@cryptotaxi247 / CoPilot / commits / 37199dbe

mimecast integration deployment

Taylor committed Jan 29, 2024 at 16:01 UTC 37199dbe458f617aff79433976a533f623886988
6 files changed +6052 -1
backend/app/connectors/grafana/dashboards/Mimecast/summary.json new
+5692
@@ -0,0 +1,5692 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "EDR"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "collapsed": true,
46 + "gridPos": {
47 + "h": 1,
48 + "w": 24,
49 + "x": 0,
50 + "y": 0
51 + },
52 + "id": 75,
53 + "panels": [
54 + {
55 + "datasource": {
56 + "type": "elasticsearch",
57 + "uid": "replace_datasource_uid"
58 + },
59 + "fieldConfig": {
60 + "defaults": {
61 + "mappings": [
62 + {
63 + "options": {
64 + "match": "null",
65 + "result": {
66 + "text": "N/A"
67 + }
68 + },
69 + "type": "special"
70 + }
71 + ],
72 + "thresholds": {
73 + "mode": "absolute",
74 + "steps": [
75 + {
76 + "color": "blue"
77 + }
78 + ]
79 + },
80 + "unit": "short"
81 + },
82 + "overrides": []
83 + },
84 + "gridPos": {
85 + "h": 7,
86 + "w": 4,
87 + "x": 0,
88 + "y": 1
89 + },
90 + "id": 43,
91 + "links": [],
92 + "options": {
93 + "colorMode": "value",
94 + "graphMode": "area",
95 + "justifyMode": "auto",
96 + "orientation": "horizontal",
97 + "reduceOptions": {
98 + "calcs": [
99 + "sum"
100 + ],
101 + "fields": "",
102 + "values": false
103 + },
104 + "text": {},
105 + "textMode": "auto",
106 + "wideLayout": true
107 + },
108 + "pluginVersion": "10.2.3",
109 + "targets": [
110 + {
111 + "bucketAggs": [
112 + {
113 + "$$hashKey": "object:135",
114 + "field": "timestamp",
115 + "id": "2",
116 + "settings": {
117 + "interval": "auto",
118 + "min_doc_count": 0,
119 + "trimEdges": 0
120 + },
121 + "type": "date_histogram"
122 + }
123 + ],
124 + "datasource": {
125 + "type": "elasticsearch",
126 + "uid": "replace_datasource_uid"
127 + },
128 + "metrics": [
129 + {
130 + "$$hashKey": "object:133",
131 + "field": "select field",
132 + "id": "1",
133 + "type": "count"
134 + }
135 + ],
136 + "query": "",
137 + "refId": "A",
138 + "timeField": "datetime"
139 + }
140 + ],
141 + "title": "EVENTS",
142 + "type": "stat"
143 + },
144 + {
145 + "datasource": {
146 + "type": "elasticsearch",
147 + "uid": "replace_datasource_uid"
148 + },
149 + "fieldConfig": {
150 + "defaults": {
151 + "color": {
152 + "mode": "thresholds"
153 + },
154 + "custom": {
155 + "align": "auto",
156 + "cellOptions": {
157 + "type": "auto"
158 + },
159 + "inspect": false
160 + },
161 + "mappings": [],
162 + "thresholds": {
163 + "mode": "absolute",
164 + "steps": [
165 + {
166 + "color": "green"
167 + },
168 + {
169 + "color": "red",
170 + "value": 80
171 + }
172 + ]
173 + }
174 + },
175 + "overrides": [
176 + {
177 + "matcher": {
178 + "id": "byName",
179 + "options": "Time"
180 + },
181 + "properties": [
182 + {
183 + "id": "displayName",
184 + "value": "Time"
185 + },
186 + {
187 + "id": "unit",
188 + "value": "time: YYYY-MM-DD HH:mm:ss"
189 + },
190 + {
191 + "id": "custom.align"
192 + }
193 + ]
194 + },
195 + {
196 + "matcher": {
197 + "id": "byName",
198 + "options": ""
199 + },
200 + "properties": [
201 + {
202 + "id": "unit",
203 + "value": "short"
204 + },
205 + {
206 + "id": "decimals",
207 + "value": 2
208 + },
209 + {
210 + "id": "custom.align"
211 + }
212 + ]
213 + },
214 + {
215 + "matcher": {
216 + "id": "byName",
217 + "options": "agent_name"
218 + },
219 + "properties": [
220 + {
221 + "id": "displayName",
222 + "value": "AGENT"
223 + },
224 + {
225 + "id": "unit",
226 + "value": "short"
227 + },
228 + {
229 + "id": "decimals",
230 + "value": 2
231 + },
232 + {
233 + "id": "custom.align"
234 + }
235 + ]
236 + },
237 + {
238 + "matcher": {
239 + "id": "byName",
240 + "options": "AGENT"
241 + },
242 + "properties": [
243 + {
244 + "id": "custom.width",
245 + "value": 299
246 + }
247 + ]
248 + }
249 + ]
250 + },
251 + "gridPos": {
252 + "h": 7,
253 + "w": 8,
254 + "x": 4,
255 + "y": 1
256 + },
257 + "id": 31,
258 + "options": {
259 + "cellHeight": "sm",
260 + "footer": {
261 + "countRows": false,
262 + "fields": "",
263 + "reducer": [
264 + "sum"
265 + ],
266 + "show": false
267 + },
268 + "showHeader": true,
269 + "sortBy": []
270 + },
271 + "pluginVersion": "10.2.3",
272 + "targets": [
273 + {
274 + "bucketAggs": [
275 + {
276 + "$$hashKey": "object:89",
277 + "fake": true,
278 + "field": "Sender",
279 + "id": "4",
280 + "settings": {
281 + "min_doc_count": 1,
282 + "order": "desc",
283 + "orderBy": "_count",
284 + "size": "10"
285 + },
286 + "type": "terms"
287 + }
288 + ],
289 + "datasource": {
290 + "type": "elasticsearch",
291 + "uid": "replace_datasource_uid"
292 + },
293 + "metrics": [
294 + {
295 + "$$hashKey": "object:87",
296 + "field": "select field",
297 + "id": "1",
298 + "type": "count"
299 + }
300 + ],
301 + "query": "",
302 + "refId": "A",
303 + "timeField": "datetime"
304 + }
305 + ],
306 + "title": "TOP 10 SENDERS",
307 + "transformations": [
308 + {
309 + "id": "merge",
310 + "options": {
311 + "reducers": []
312 + }
313 + }
314 + ],
315 + "type": "table"
316 + },
317 + {
318 + "datasource": {
319 + "type": "elasticsearch",
320 + "uid": "replace_datasource_uid"
321 + },
322 + "fieldConfig": {
323 + "defaults": {
324 + "color": {
325 + "mode": "palette-classic"
326 + },
327 + "custom": {
328 + "hideFrom": {
329 + "legend": false,
330 + "tooltip": false,
331 + "viz": false
332 + }
333 + },
334 + "decimals": 0,
335 + "mappings": [],
336 + "unit": "short"
337 + },
338 + "overrides": []
339 + },
340 + "gridPos": {
341 + "h": 7,
342 + "w": 5,
343 + "x": 12,
344 + "y": 1
345 + },
346 + "id": 59,
347 + "links": [],
348 + "options": {
349 + "displayLabels": [],
350 + "legend": {
351 + "calcs": [],
352 + "displayMode": "list",
353 + "placement": "bottom",
354 + "showLegend": false,
355 + "values": [
356 + "value"
357 + ]
358 + },
359 + "pieType": "pie",
360 + "reduceOptions": {
361 + "calcs": [
362 + "sum"
363 + ],
364 + "fields": "",
365 + "values": false
366 + },
367 + "text": {},
368 + "tooltip": {
369 + "mode": "single",
370 + "sort": "none"
371 + }
372 + },
373 + "pluginVersion": "7.3.4",
374 + "targets": [
375 + {
376 + "bucketAggs": [
377 + {
378 + "$$hashKey": "object:211",
379 + "fake": true,
380 + "field": "Rcpt",
381 + "id": "3",
382 + "settings": {
383 + "min_doc_count": "1",
384 + "missing": "Unknown",
385 + "order": "desc",
386 + "orderBy": "_count",
387 + "size": "10"
388 + },
389 + "type": "terms"
390 + },
391 + {
392 + "$$hashKey": "object:117",
393 + "field": "timestamp",
394 + "id": "2",
395 + "settings": {
396 + "interval": "auto",
397 + "min_doc_count": 0,
398 + "trimEdges": 0
399 + },
400 + "type": "date_histogram"
401 + }
402 + ],
403 + "datasource": {
404 + "type": "elasticsearch",
405 + "uid": "replace_datasource_uid"
406 + },
407 + "metrics": [
408 + {
409 + "$$hashKey": "object:115",
410 + "field": "select field",
411 + "id": "1",
412 + "type": "count"
413 + }
414 + ],
415 + "query": "",
416 + "queryType": "randomWalk",
417 + "refId": "A",
418 + "timeField": "datetime"
419 + }
420 + ],
421 + "title": "TOP 10 RECEIVERS",
422 + "type": "piechart"
423 + },
424 + {
425 + "datasource": {
426 + "type": "elasticsearch",
427 + "uid": "replace_datasource_uid"
428 + },
429 + "fieldConfig": {
430 + "defaults": {
431 + "custom": {
432 + "align": "auto",
433 + "cellOptions": {
434 + "type": "auto"
435 + },
436 + "filterable": false,
437 + "inspect": false
438 + },
439 + "mappings": [],
440 + "thresholds": {
441 + "mode": "absolute",
442 + "steps": [
443 + {
444 + "color": "green"
445 + },
446 + {
447 + "color": "red",
448 + "value": 80
449 + }
450 + ]
451 + }
452 + },
453 + "overrides": []
454 + },
455 + "gridPos": {
456 + "h": 7,
457 + "w": 7,
458 + "x": 17,
459 + "y": 1
460 + },
461 + "id": 61,
462 + "links": [],
463 + "options": {
464 + "cellHeight": "sm",
465 + "footer": {
466 + "countRows": false,
467 + "fields": "",
468 + "reducer": [
469 + "sum"
470 + ],
471 + "show": false
472 + },
473 + "showHeader": true
474 + },
475 + "pluginVersion": "10.2.3",
476 + "targets": [
477 + {
478 + "bucketAggs": [
479 + {
480 + "$$hashKey": "object:211",
481 + "fake": true,
482 + "field": "Rcpt",
483 + "id": "3",
484 + "settings": {
485 + "min_doc_count": "1",
486 + "missing": "Unknown",
487 + "order": "desc",
488 + "orderBy": "_count",
489 + "size": "10"
490 + },
491 + "type": "terms"
492 + }
493 + ],
494 + "datasource": {
495 + "type": "elasticsearch",
496 + "uid": "replace_datasource_uid"
497 + },
498 + "metrics": [
499 + {
500 + "$$hashKey": "object:115",
501 + "field": "select field",
502 + "id": "1",
503 + "type": "count"
504 + }
505 + ],
506 + "query": "",
507 + "queryType": "randomWalk",
508 + "refId": "A",
509 + "timeField": "datetime"
510 + }
511 + ],
512 + "title": "TOP 10 RECEIVERS",
513 + "transformations": [
514 + {
515 + "id": "organize",
516 + "options": {
517 + "excludeByName": {},
518 + "indexByName": {},
519 + "renameByName": {
520 + "software_vendor": "SOFTWARE VENDOR"
521 + }
522 + }
523 + }
524 + ],
525 + "type": "table"
526 + },
527 + {
528 + "datasource": {
529 + "type": "elasticsearch",
530 + "uid": "replace_datasource_uid"
531 + },
532 + "fieldConfig": {
533 + "defaults": {
534 + "mappings": [],
535 + "thresholds": {
536 + "mode": "absolute",
537 + "steps": [
538 + {
539 + "color": "green"
540 + },
541 + {
542 + "color": "red",
543 + "value": 80
544 + }
545 + ]
546 + }
547 + },
548 + "overrides": []
549 + },
550 + "gridPos": {
551 + "h": 19,
552 + "w": 24,
553 + "x": 0,
554 + "y": 8
555 + },
556 + "id": 66,
557 + "options": {
558 + "color": "blue",
559 + "iteration": 20,
560 + "monochrome": false,
561 + "nodeColor": "super-light-purple",
562 + "nodePadding": 20,
563 + "nodeWidth": 30
564 + },
565 + "targets": [
566 + {
567 + "alias": "",
568 + "bucketAggs": [
569 + {
570 + "field": "Sender",
571 + "id": "2",
572 + "settings": {
573 + "min_doc_count": "1",
574 + "order": "desc",
575 + "orderBy": "_term",
576 + "size": "10"
577 + },
578 + "type": "terms"
579 + },
580 + {
581 + "field": "Rcpt",
582 + "id": "3",
583 + "settings": {
584 + "min_doc_count": "1",
585 + "order": "desc",
586 + "orderBy": "_term",
587 + "size": "1"
588 + },
589 + "type": "terms"
590 + }
591 + ],
592 + "datasource": {
593 + "type": "elasticsearch",
594 + "uid": "replace_datasource_uid"
595 + },
596 + "metrics": [
597 + {
598 + "id": "1",
599 + "type": "count"
600 + }
601 + ],
602 + "query": "",
603 + "refId": "A",
604 + "timeField": "datetime"
605 + }
606 + ],
607 + "title": "MAIL FLOWS",
608 + "transformations": [
609 + {
610 + "id": "organize",
611 + "options": {
612 + "excludeByName": {},
613 + "indexByName": {},
614 + "renameByName": {
615 + "Count": "Count",
616 + "parent_process_image": "PARENT PROCESS",
617 + "process_image": "PROCESS"
618 + }
619 + }
620 + }
621 + ],
622 + "transparent": true,
623 + "type": "netsage-sankey-panel"
624 + },
625 + {
626 + "datasource": {
627 + "type": "elasticsearch",
628 + "uid": "replace_datasource_uid"
629 + },
630 + "fieldConfig": {
631 + "defaults": {
632 + "color": {
633 + "mode": "thresholds"
634 + },
635 + "custom": {
636 + "align": "auto",
637 + "cellOptions": {
638 + "type": "auto"
639 + },
640 + "inspect": false
641 + },
642 + "mappings": [],
643 + "thresholds": {
644 + "mode": "absolute",
645 + "steps": [
646 + {
647 + "color": "green"
648 + },
649 + {
650 + "color": "red",
651 + "value": 80
652 + }
653 + ]
654 + }
655 + },
656 + "overrides": [
657 + {
658 + "matcher": {
659 + "id": "byName",
660 + "options": "Time"
661 + },
662 + "properties": [
663 + {
664 + "id": "displayName",
665 + "value": "Time"
666 + },
667 + {
668 + "id": "unit",
669 + "value": "time: YYYY-MM-DD HH:mm:ss"
670 + },
671 + {
672 + "id": "custom.align"
673 + }
674 + ]
675 + },
676 + {
677 + "matcher": {
678 + "id": "byName",
679 + "options": ""
680 + },
681 + "properties": [
682 + {
683 + "id": "unit",
684 + "value": "short"
685 + },
686 + {
687 + "id": "decimals",
688 + "value": 2
689 + },
690 + {
691 + "id": "custom.align"
692 + }
693 + ]
694 + },
695 + {
696 + "matcher": {
697 + "id": "byName",
698 + "options": "agent_name"
699 + },
700 + "properties": [
701 + {
702 + "id": "displayName",
703 + "value": "AGENT"
704 + },
705 + {
706 + "id": "unit",
707 + "value": "short"
708 + },
709 + {
710 + "id": "decimals",
711 + "value": 2
712 + },
713 + {
714 + "id": "custom.align"
715 + }
716 + ]
717 + },
718 + {
719 + "matcher": {
720 + "id": "byName",
721 + "options": "AGENT"
722 + },
723 + "properties": [
724 + {
725 + "id": "custom.width",
726 + "value": 299
727 + }
728 + ]
729 + }
730 + ]
731 + },
732 + "gridPos": {
733 + "h": 10,
734 + "w": 8,
735 + "x": 0,
736 + "y": 27
737 + },
738 + "id": 71,
739 + "options": {
740 + "cellHeight": "sm",
741 + "footer": {
742 + "countRows": false,
743 + "fields": "",
744 + "reducer": [
745 + "sum"
746 + ],
747 + "show": false
748 + },
749 + "showHeader": true,
750 + "sortBy": []
751 + },
752 + "pluginVersion": "10.2.3",
753 + "targets": [
754 + {
755 + "bucketAggs": [
756 + {
757 + "$$hashKey": "object:89",
758 + "fake": true,
759 + "field": "IP",
760 + "id": "4",
761 + "settings": {
762 + "min_doc_count": 1,
763 + "order": "desc",
764 + "orderBy": "_count",
765 + "size": "10"
766 + },
767 + "type": "terms"
768 + },
769 + {
770 + "field": "IP_country_code",
771 + "id": "5",
772 + "settings": {
773 + "min_doc_count": "1",
774 + "order": "desc",
775 + "orderBy": "_count",
776 + "size": "10"
777 + },
778 + "type": "terms"
779 + }
780 + ],
781 + "datasource": {
782 + "type": "elasticsearch",
783 + "uid": "replace_datasource_uid"
784 + },
785 + "metrics": [
786 + {
787 + "$$hashKey": "object:87",
788 + "field": "select field",
789 + "id": "1",
790 + "type": "count"
791 + }
792 + ],
793 + "query": "",
794 + "refId": "A",
795 + "timeField": "datetime"
796 + }
797 + ],
798 + "title": "TOP 10 IPs",
799 + "transformations": [
800 + {
801 + "id": "merge",
802 + "options": {
803 + "reducers": []
804 + }
805 + }
806 + ],
807 + "type": "table"
808 + },
809 + {
810 + "circleMaxSize": 30,
811 + "circleMinSize": 2,
812 + "colors": [
813 + "rgba(245, 54, 54, 0.9)",
814 + "rgba(237, 129, 40, 0.89)",
815 + "rgba(50, 172, 45, 0.97)"
816 + ],
817 + "datasource": {
818 + "type": "elasticsearch",
819 + "uid": "replace_datasource_uid"
820 + },
821 + "decimals": 0,
822 + "esMetric": "Count",
823 + "gridPos": {
824 + "h": 10,
825 + "w": 7,
826 + "x": 8,
827 + "y": 27
828 + },
829 + "hideEmpty": false,
830 + "hideZero": false,
831 + "id": 70,
832 + "initialZoom": 1,
833 + "locationData": "countries",
834 + "mapCenter": "(0°, 0°)",
835 + "mapCenterLatitude": 0,
836 + "mapCenterLongitude": 0,
837 + "maxDataPoints": 1,
838 + "mouseWheelZoom": false,
839 + "showLegend": true,
840 + "stickyLabels": false,
841 + "tableQueryOptions": {
842 + "geohashField": "geohash",
843 + "latitudeField": "latitude",
844 + "longitudeField": "longitude",
845 + "metricField": "metric",
846 + "queryType": "geohash"
847 + },
848 + "targets": [
849 + {
850 + "alias": "",
851 + "bucketAggs": [
852 + {
853 + "field": "IP_country_code",
854 + "id": "3",
855 + "settings": {
856 + "min_doc_count": "1",
857 + "order": "desc",
858 + "orderBy": "_term",
859 + "size": "10"
860 + },
861 + "type": "terms"
862 + },
863 + {
864 + "field": "timestamp",
865 + "id": "2",
866 + "settings": {
867 + "interval": "auto"
868 + },
869 + "type": "date_histogram"
870 + }
871 + ],
872 + "datasource": {
873 + "type": "elasticsearch",
874 + "uid": "replace_datasource_uid"
875 + },
876 + "metrics": [
877 + {
878 + "id": "1",
879 + "type": "count"
880 + }
881 + ],
882 + "query": "",
883 + "refId": "A",
884 + "timeField": "datetime"
885 + }
886 + ],
887 + "thresholds": "0,10",
888 + "title": "TOP 10 GEO IPs",
889 + "type": "grafana-worldmap-panel",
890 + "unitPlural": "",
891 + "unitSingle": "",
892 + "valueName": "total"
893 + },
894 + {
895 + "datasource": {
896 + "type": "elasticsearch",
897 + "uid": "replace_datasource_uid"
898 + },
899 + "fieldConfig": {
900 + "defaults": {
901 + "color": {
902 + "mode": "thresholds"
903 + },
904 + "custom": {
905 + "align": "auto",
906 + "cellOptions": {
907 + "type": "auto"
908 + },
909 + "inspect": false
910 + },
911 + "mappings": [],
912 + "thresholds": {
913 + "mode": "absolute",
914 + "steps": [
915 + {
916 + "color": "green"
917 + },
918 + {
919 + "color": "red",
920 + "value": 80
921 + }
922 + ]
923 + }
924 + },
925 + "overrides": [
926 + {
927 + "matcher": {
928 + "id": "byName",
929 + "options": "Time"
930 + },
931 + "properties": [
932 + {
933 + "id": "displayName",
934 + "value": "Time"
935 + },
936 + {
937 + "id": "unit",
938 + "value": "time: YYYY-MM-DD HH:mm:ss"
939 + },
940 + {
941 + "id": "custom.align"
942 + }
943 + ]
944 + },
945 + {
946 + "matcher": {
947 + "id": "byName",
948 + "options": ""
949 + },
950 + "properties": [
951 + {
952 + "id": "unit",
953 + "value": "short"
954 + },
955 + {
956 + "id": "decimals",
957 + "value": 2
958 + },
959 + {
960 + "id": "custom.align"
961 + }
962 + ]
963 + },
964 + {
965 + "matcher": {
966 + "id": "byName",
967 + "options": "agent_name"
968 + },
969 + "properties": [
970 + {
971 + "id": "displayName",
972 + "value": "AGENT"
973 + },
974 + {
975 + "id": "unit",
976 + "value": "short"
977 + },
978 + {
979 + "id": "decimals",
980 + "value": 2
981 + },
982 + {
983 + "id": "custom.align"
984 + }
985 + ]
986 + },
987 + {
988 + "matcher": {
989 + "id": "byName",
990 + "options": "AGENT"
991 + },
992 + "properties": [
993 + {
994 + "id": "custom.width",
995 + "value": 299
996 + }
997 + ]
998 + }
999 + ]
1000 + },
1001 + "gridPos": {
1002 + "h": 10,
1003 + "w": 9,
1004 + "x": 15,
1005 + "y": 27
1006 + },
1007 + "id": 72,
1008 + "options": {
1009 + "cellHeight": "sm",
1010 + "footer": {
1011 + "countRows": false,
1012 + "fields": "",
1013 + "reducer": [
1014 + "sum"
1015 + ],
1016 + "show": false
1017 + },
1018 + "showHeader": true,
1019 + "sortBy": []
1020 + },
1021 + "pluginVersion": "10.2.3",
1022 + "targets": [
1023 + {
1024 + "bucketAggs": [
1025 + {
1026 + "$$hashKey": "object:89",
1027 + "fake": true,
1028 + "field": "SpamScore",
1029 + "id": "4",
1030 + "settings": {
1031 + "min_doc_count": 1,
1032 + "order": "desc",
1033 + "orderBy": "_count",
1034 + "size": "10"
1035 + },
1036 + "type": "terms"
1037 + }
1038 + ],
1039 + "datasource": {
1040 + "type": "elasticsearch",
1041 + "uid": "replace_datasource_uid"
1042 + },
1043 + "metrics": [
1044 + {
1045 + "$$hashKey": "object:87",
1046 + "field": "select field",
1047 + "id": "1",
1048 + "type": "count"
1049 + }
1050 + ],
1051 + "query": "",
1052 + "refId": "A",
1053 + "timeField": "datetime"
1054 + }
1055 + ],
1056 + "title": "TOP 10 SPAM SCORES",
1057 + "transformations": [
1058 + {
1059 + "id": "merge",
1060 + "options": {
1061 + "reducers": []
1062 + }
1063 + }
1064 + ],
1065 + "type": "table"
1066 + },
1067 + {
1068 + "datasource": {
1069 + "type": "elasticsearch",
1070 + "uid": "replace_datasource_uid"
1071 + },
1072 + "fieldConfig": {
1073 + "defaults": {
1074 + "mappings": [],
1075 + "thresholds": {
1076 + "mode": "absolute",
1077 + "steps": [
1078 + {
1079 + "color": "green"
1080 + },
1081 + {
1082 + "color": "red",
1083 + "value": 80
1084 + }
1085 + ]
1086 + }
1087 + },
1088 + "overrides": []
1089 + },
1090 + "gridPos": {
1091 + "h": 8,
1092 + "w": 12,
1093 + "x": 0,
1094 + "y": 37
1095 + },
1096 + "id": 37,
1097 + "options": {
1098 + "displayMode": "gradient",
1099 + "maxVizHeight": 300,
1100 + "minVizHeight": 10,
1101 + "minVizWidth": 0,
1102 + "namePlacement": "auto",
1103 + "orientation": "horizontal",
1104 + "reduceOptions": {
1105 + "calcs": [
1106 + "sum"
1107 + ],
1108 + "fields": "",
1109 + "values": false
1110 + },
1111 + "showUnfilled": true,
1112 + "sizing": "auto",
1113 + "text": {},
1114 + "valueMode": "color"
1115 + },
1116 + "pluginVersion": "10.2.3",
1117 + "targets": [
1118 + {
1119 + "bucketAggs": [
1120 + {
1121 + "fake": true,
1122 + "field": "Dir",
1123 + "id": "6",
1124 + "settings": {
1125 + "min_doc_count": 1,
1126 + "order": "desc",
1127 + "orderBy": "_count",
1128 + "size": "10"
1129 + },
1130 + "type": "terms"
1131 + },
1132 + {
1133 + "fake": true,
1134 + "field": "timestamp",
1135 + "id": "5",
1136 + "settings": {
1137 + "interval": "auto",
1138 + "min_doc_count": 0,
1139 + "trimEdges": 0
1140 + },
1141 + "type": "date_histogram"
1142 + }
1143 + ],
1144 + "datasource": {
1145 + "type": "elasticsearch",
1146 + "uid": "replace_datasource_uid"
1147 + },
1148 + "metrics": [
1149 + {
1150 + "field": "type",
1151 + "id": "1",
1152 + "meta": {},
1153 + "settings": {},
1154 + "type": "count"
1155 + }
1156 + ],
1157 + "query": "",
1158 + "refId": "A",
1159 + "timeField": "datetime"
1160 + }
1161 + ],
1162 + "title": "MAIL DIRECTION",
1163 + "type": "bargauge"
1164 + },
1165 + {
1166 + "datasource": {
1167 + "type": "elasticsearch",
1168 + "uid": "replace_datasource_uid"
1169 + },
1170 + "fieldConfig": {
1171 + "defaults": {
1172 + "mappings": [],
1173 + "thresholds": {
1174 + "mode": "absolute",
1175 + "steps": [
1176 + {
1177 + "color": "green"
1178 + },
1179 + {
1180 + "color": "red",
1181 + "value": 80
1182 + }
1183 + ]
1184 + }
1185 + },
1186 + "overrides": []
1187 + },
1188 + "gridPos": {
1189 + "h": 8,
1190 + "w": 12,
1191 + "x": 12,
1192 + "y": 37
1193 + },
1194 + "id": 73,
1195 + "options": {
1196 + "displayMode": "gradient",
1197 + "maxVizHeight": 300,
1198 + "minVizHeight": 10,
1199 + "minVizWidth": 0,
1200 + "namePlacement": "auto",
1201 + "orientation": "horizontal",
1202 + "reduceOptions": {
1203 + "calcs": [
1204 + "sum"
1205 + ],
1206 + "fields": "",
1207 + "values": false
1208 + },
1209 + "showUnfilled": true,
1210 + "sizing": "auto",
1211 + "text": {},
1212 + "valueMode": "color"
1213 + },
1214 + "pluginVersion": "10.2.3",
1215 + "targets": [
1216 + {
1217 + "bucketAggs": [
1218 + {
1219 + "fake": true,
1220 + "field": "SpamProcessingDetail",
1221 + "id": "6",
1222 + "settings": {
1223 + "min_doc_count": 1,
1224 + "order": "desc",
1225 + "orderBy": "_count",
1226 + "size": "10"
1227 + },
1228 + "type": "terms"
1229 + },
1230 + {
1231 + "fake": true,
1232 + "field": "timestamp",
1233 + "id": "5",
1234 + "settings": {
1235 + "interval": "auto",
1236 + "min_doc_count": 0,
1237 + "trimEdges": 0
1238 + },
1239 + "type": "date_histogram"
1240 + }
1241 + ],
1242 + "datasource": {
1243 + "type": "elasticsearch",
1244 + "uid": "replace_datasource_uid"
1245 + },
1246 + "metrics": [
1247 + {
1248 + "field": "type",
1249 + "id": "1",
1250 + "meta": {},
1251 + "settings": {},
1252 + "type": "count"
1253 + }
1254 + ],
1255 + "query": "",
1256 + "refId": "A",
1257 + "timeField": "datetime"
1258 + }
1259 + ],
1260 + "title": "SPAM PROC INFO",
1261 + "type": "bargauge"
1262 + },
1263 + {
1264 + "datasource": {
1265 + "type": "elasticsearch",
1266 + "uid": "replace_datasource_uid"
1267 + },
1268 + "fieldConfig": {
1269 + "defaults": {
1270 + "color": {
1271 + "mode": "thresholds"
1272 + },
1273 + "custom": {
1274 + "align": "auto",
1275 + "cellOptions": {
1276 + "type": "auto"
1277 + },
1278 + "filterable": true,
1279 + "inspect": false
1280 + },
1281 + "mappings": [],
1282 + "thresholds": {
1283 + "mode": "absolute",
1284 + "steps": [
1285 + {
1286 + "color": "green"
1287 + },
1288 + {
1289 + "color": "red",
1290 + "value": 80
1291 + }
1292 + ]
1293 + }
1294 + },
1295 + "overrides": [
1296 + {
1297 + "matcher": {
1298 + "id": "byName",
1299 + "options": "timestamp"
1300 + },
1301 + "properties": [
1302 + {
1303 + "id": "displayName",
1304 + "value": "DATE/TIME"
1305 + },
1306 + {
1307 + "id": "unit",
1308 + "value": "time: YYYY-MM-DD HH:mm:ss"
1309 + },
1310 + {
1311 + "id": "custom.align"
1312 + }
1313 + ]
1314 + },
1315 + {
1316 + "matcher": {
1317 + "id": "byName",
1318 + "options": "process_name"
1319 + },
1320 + "properties": [
1321 + {
1322 + "id": "displayName",
1323 + "value": "PROCESS"
1324 + },
1325 + {
1326 + "id": "unit",
1327 + "value": "short"
1328 + },
1329 + {
1330 + "id": "decimals",
1331 + "value": -1
1332 + },
1333 + {
1334 + "id": "custom.align"
1335 + }
1336 + ]
1337 + },
1338 + {
1339 + "matcher": {
1340 + "id": "byName",
1341 + "options": "process_id"
1342 + },
1343 + "properties": [
1344 + {
1345 + "id": "displayName",
1346 + "value": "PID"
1347 + },
1348 + {
1349 + "id": "unit",
1350 + "value": "none"
1351 + },
1352 + {
1353 + "id": "decimals",
1354 + "value": -2
1355 + },
1356 + {
1357 + "id": "custom.align"
1358 + }
1359 + ]
1360 + },
1361 + {
1362 + "matcher": {
1363 + "id": "byName",
1364 + "options": "process_image"
1365 + },
1366 + "properties": [
1367 + {
1368 + "id": "displayName",
1369 + "value": "PROCESS IMAGE"
1370 + },
1371 + {
1372 + "id": "unit",
1373 + "value": "short"
1374 + },
1375 + {
1376 + "id": "decimals",
1377 + "value": 2
1378 + },
1379 + {
1380 + "id": "custom.align"
1381 + }
1382 + ]
1383 + },
1384 + {
1385 + "matcher": {
1386 + "id": "byName",
1387 + "options": "user_name"
1388 + },
1389 + "properties": [
1390 + {
1391 + "id": "displayName",
1392 + "value": "USER/ACCOUNT"
1393 + },
1394 + {
1395 + "id": "unit",
1396 + "value": "short"
1397 + },
1398 + {
1399 + "id": "decimals",
1400 + "value": 2
1401 + },
1402 + {
1403 + "id": "custom.align"
1404 + }
1405 + ]
1406 + },
1407 + {
1408 + "matcher": {
1409 + "id": "byName",
1410 + "options": "agent_name"
1411 + },
1412 + "properties": [
1413 + {
1414 + "id": "displayName",
1415 + "value": "AGENT"
1416 + },
1417 + {
1418 + "id": "unit",
1419 + "value": "short"
1420 + },
1421 + {
1422 + "id": "decimals",
1423 + "value": 2
1424 + },
1425 + {
1426 + "id": "custom.align"
1427 + }
1428 + ]
1429 + },
1430 + {
1431 + "matcher": {
1432 + "id": "byName",
1433 + "options": "parent_process_image"
1434 + },
1435 + "properties": [
1436 + {
1437 + "id": "displayName",
1438 + "value": "PARENT PROCESS"
1439 + },
1440 + {
1441 + "id": "unit",
1442 + "value": "short"
1443 + },
1444 + {
1445 + "id": "decimals",
1446 + "value": 2
1447 + },
1448 + {
1449 + "id": "custom.align"
1450 + }
1451 + ]
1452 + },
1453 + {
1454 + "matcher": {
1455 + "id": "byName",
1456 + "options": "process_cmd_line"
1457 + },
1458 + "properties": [
1459 + {
1460 + "id": "displayName",
1461 + "value": "PROCESS CMD LINE"
1462 + },
1463 + {
1464 + "id": "unit",
1465 + "value": "short"
1466 + },
1467 + {
1468 + "id": "decimals",
1469 + "value": 2
1470 + },
1471 + {
1472 + "id": "custom.align"
1473 + }
1474 + ]
1475 + },
1476 + {
1477 + "matcher": {
1478 + "id": "byName",
1479 + "options": "EVENT ID"
1480 + },
1481 + "properties": [
1482 + {
1483 + "id": "links",
1484 + "value": [
1485 + {
1486 + "targetBlank": true,
1487 + "title": "VIEW EVENT DETAILS",
1488 + "url": "https://dashboard.dnsoverwatch.com/explore?left=%5B%22now-6h%22,%22now%22,%22WF_Mimecast%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
1489 + }
1490 + ]
1491 + }
1492 + ]
1493 + }
1494 + ]
1495 + },
1496 + "gridPos": {
1497 + "h": 18,
1498 + "w": 24,
1499 + "x": 0,
1500 + "y": 45
1501 + },
1502 + "id": 51,
1503 + "options": {
1504 + "cellHeight": "sm",
1505 + "footer": {
1506 + "countRows": false,
1507 + "enablePagination": true,
1508 + "fields": "",
1509 + "reducer": [
1510 + "sum"
1511 + ],
1512 + "show": false
1513 + },
1514 + "showHeader": true
1515 + },
1516 + "pluginVersion": "10.2.3",
1517 + "targets": [
1518 + {
1519 + "bucketAggs": [],
1520 + "datasource": {
1521 + "type": "elasticsearch",
1522 + "uid": "replace_datasource_uid"
1523 + },
1524 + "metrics": [
1525 + {
1526 + "id": "1",
1527 + "settings": {
1528 + "size": "250"
1529 + },
1530 + "type": "raw_data"
1531 + }
1532 + ],
1533 + "query": "",
1534 + "refId": "A",
1535 + "timeField": "datetime"
1536 + }
1537 + ],
1538 + "title": "MIMECAST LOGS",
1539 + "transformations": [
1540 + {
1541 + "id": "filterFieldsByName",
1542 + "options": {
1543 + "include": {
1544 + "names": [
1545 + "Dir",
1546 + "IP",
1547 + "IP_country_code",
1548 + "Sender",
1549 + "SourceIP",
1550 + "SourceIP_country_code",
1551 + "Subject",
1552 + "_id",
1553 + "timestamp",
1554 + "SpamScore",
1555 + "Rcpt"
1556 + ]
1557 + }
1558 + }
1559 + },
1560 + {
1561 + "id": "organize",
1562 + "options": {
1563 + "excludeByName": {},
1564 + "indexByName": {
1565 + "Dir": 5,
1566 + "IP": 7,
1567 + "IP_country_code": 8,
1568 + "Rcpt": 6,
1569 + "Sender": 2,
1570 + "SourceIP": 3,
1571 + "SourceIP_country_code": 4,
1572 + "SpamScore": 10,
1573 + "Subject": 9,
1574 + "_id": 1,
1575 + "timestamp": 0
1576 + },
1577 + "renameByName": {
1578 + "Dir": "",
1579 + "IP_country_code": "COUNTRY",
1580 + "SourceIP": "SRC IP",
1581 + "SourceIP_country_code": "SRC COUNTRY",
1582 + "SpamScore": "",
1583 + "Subject": "",
1584 + "_id": "EVENT ID",
1585 + "agent_name": "",
1586 + "parent_cmd_line": "PARENT CMD",
1587 + "parent_process_id": "PARENT PID",
1588 + "parent_process_user": "PARENT USER",
1589 + "syslog_level": "LEVEL"
1590 + }
1591 + }
1592 + }
1593 + ],
1594 + "transparent": true,
1595 + "type": "table"
1596 + }
1597 + ],
1598 + "title": "SUMMARY",
1599 + "type": "row"
1600 + },
1601 + {
1602 + "collapsed": true,
1603 + "gridPos": {
1604 + "h": 1,
1605 + "w": 24,
1606 + "x": 0,
1607 + "y": 1
1608 + },
1609 + "id": 77,
1610 + "panels": [
1611 + {
1612 + "datasource": {
1613 + "type": "elasticsearch",
1614 + "uid": "replace_datasource_uid"
1615 + },
1616 + "fieldConfig": {
1617 + "defaults": {
1618 + "mappings": [
1619 + {
1620 + "options": {
1621 + "match": "null",
1622 + "result": {
1623 + "text": "N/A"
1624 + }
1625 + },
1626 + "type": "special"
1627 + }
1628 + ],
1629 + "thresholds": {
1630 + "mode": "absolute",
1631 + "steps": [
1632 + {
1633 + "color": "blue"
1634 + }
1635 + ]
1636 + },
1637 + "unit": "short"
1638 + },
1639 + "overrides": []
1640 + },
1641 + "gridPos": {
1642 + "h": 7,
1643 + "w": 4,
1644 + "x": 0,
1645 + "y": 2
1646 + },
1647 + "id": 78,
1648 + "links": [],
1649 + "options": {
1650 + "colorMode": "value",
1651 + "graphMode": "area",
1652 + "justifyMode": "auto",
1653 + "orientation": "horizontal",
1654 + "reduceOptions": {
1655 + "calcs": [
1656 + "sum"
1657 + ],
1658 + "fields": "",
1659 + "values": false
1660 + },
1661 + "text": {},
1662 + "textMode": "auto",
1663 + "wideLayout": true
1664 + },
1665 + "pluginVersion": "10.2.3",
1666 + "targets": [
1667 + {
1668 + "bucketAggs": [
1669 + {
1670 + "$$hashKey": "object:135",
1671 + "field": "timestamp",
1672 + "id": "2",
1673 + "settings": {
1674 + "interval": "auto",
1675 + "min_doc_count": 0,
1676 + "trimEdges": 0
1677 + },
1678 + "type": "date_histogram"
1679 + }
1680 + ],
1681 + "datasource": {
1682 + "type": "elasticsearch",
1683 + "uid": "replace_datasource_uid"
1684 + },
1685 + "metrics": [
1686 + {
1687 + "$$hashKey": "object:133",
1688 + "field": "select field",
1689 + "id": "1",
1690 + "type": "count"
1691 + }
1692 + ],
1693 + "query": "Virus:*",
1694 + "refId": "A",
1695 + "timeField": "datetime"
1696 + }
1697 + ],
1698 + "title": "VIRUS EVENTS",
1699 + "type": "stat"
1700 + },
1701 + {
1702 + "datasource": {
1703 + "type": "elasticsearch",
1704 + "uid": "replace_datasource_uid"
1705 + },
1706 + "fieldConfig": {
1707 + "defaults": {
1708 + "color": {
1709 + "mode": "thresholds"
1710 + },
1711 + "custom": {
1712 + "align": "auto",
1713 + "cellOptions": {
1714 + "type": "auto"
1715 + },
1716 + "inspect": false
1717 + },
1718 + "mappings": [],
1719 + "thresholds": {
1720 + "mode": "absolute",
1721 + "steps": [
1722 + {
1723 + "color": "green"
1724 + },
1725 + {
1726 + "color": "red",
1727 + "value": 80
1728 + }
1729 + ]
1730 + }
1731 + },
1732 + "overrides": [
1733 + {
1734 + "matcher": {
1735 + "id": "byName",
1736 + "options": "Time"
1737 + },
1738 + "properties": [
1739 + {
1740 + "id": "displayName",
1741 + "value": "Time"
1742 + },
1743 + {
1744 + "id": "unit",
1745 + "value": "time: YYYY-MM-DD HH:mm:ss"
1746 + },
1747 + {
1748 + "id": "custom.align"
1749 + }
1750 + ]
1751 + },
1752 + {
1753 + "matcher": {
1754 + "id": "byName",
1755 + "options": ""
1756 + },
1757 + "properties": [
1758 + {
1759 + "id": "unit",
1760 + "value": "short"
1761 + },
1762 + {
1763 + "id": "decimals",
1764 + "value": 2
1765 + },
1766 + {
1767 + "id": "custom.align"
1768 + }
1769 + ]
1770 + },
1771 + {
1772 + "matcher": {
1773 + "id": "byName",
1774 + "options": "agent_name"
1775 + },
1776 + "properties": [
1777 + {
1778 + "id": "displayName",
1779 + "value": "AGENT"
1780 + },
1781 + {
1782 + "id": "unit",
1783 + "value": "short"
1784 + },
1785 + {
1786 + "id": "decimals",
1787 + "value": 2
1788 + },
1789 + {
1790 + "id": "custom.align"
1791 + }
1792 + ]
1793 + },
1794 + {
1795 + "matcher": {
1796 + "id": "byName",
1797 + "options": "AGENT"
1798 + },
1799 + "properties": [
1800 + {
1801 + "id": "custom.width",
1802 + "value": 299
1803 + }
1804 + ]
1805 + }
1806 + ]
1807 + },
1808 + "gridPos": {
1809 + "h": 7,
1810 + "w": 8,
1811 + "x": 4,
1812 + "y": 2
1813 + },
1814 + "id": 79,
1815 + "options": {
1816 + "cellHeight": "sm",
1817 + "footer": {
1818 + "countRows": false,
1819 + "fields": "",
1820 + "reducer": [
1821 + "sum"
1822 + ],
1823 + "show": false
1824 + },
1825 + "showHeader": true,
1826 + "sortBy": []
1827 + },
1828 + "pluginVersion": "10.2.3",
1829 + "targets": [
1830 + {
1831 + "bucketAggs": [
1832 + {
1833 + "$$hashKey": "object:89",
1834 + "fake": true,
1835 + "field": "Sender",
1836 + "id": "4",
1837 + "settings": {
1838 + "min_doc_count": 1,
1839 + "order": "desc",
1840 + "orderBy": "_count",
1841 + "size": "10"
1842 + },
1843 + "type": "terms"
1844 + }
1845 + ],
1846 + "datasource": {
1847 + "type": "elasticsearch",
1848 + "uid": "replace_datasource_uid"
1849 + },
1850 + "metrics": [
1851 + {
1852 + "$$hashKey": "object:87",
1853 + "field": "select field",
1854 + "id": "1",
1855 + "type": "count"
1856 + }
1857 + ],
1858 + "query": "Virus:*",
1859 + "refId": "A",
1860 + "timeField": "datetime"
1861 + }
1862 + ],
1863 + "title": "TOP 10 SENDERS",
1864 + "transformations": [
1865 + {
1866 + "id": "merge",
1867 + "options": {
1868 + "reducers": []
1869 + }
1870 + }
1871 + ],
1872 + "type": "table"
1873 + },
1874 + {
1875 + "datasource": {
1876 + "type": "elasticsearch",
1877 + "uid": "replace_datasource_uid"
1878 + },
1879 + "fieldConfig": {
1880 + "defaults": {
1881 + "color": {
1882 + "mode": "palette-classic"
1883 + },
1884 + "custom": {
1885 + "hideFrom": {
1886 + "legend": false,
1887 + "tooltip": false,
1888 + "viz": false
1889 + }
1890 + },
1891 + "decimals": 0,
1892 + "mappings": [],
1893 + "unit": "short"
1894 + },
1895 + "overrides": []
1896 + },
1897 + "gridPos": {
1898 + "h": 7,
1899 + "w": 5,
1900 + "x": 12,
1901 + "y": 2
1902 + },
1903 + "id": 80,
1904 + "links": [],
1905 + "options": {
1906 + "displayLabels": [],
1907 + "legend": {
1908 + "calcs": [],
1909 + "displayMode": "list",
1910 + "placement": "bottom",
1911 + "showLegend": false,
1912 + "values": [
1913 + "value"
1914 + ]
1915 + },
1916 + "pieType": "pie",
1917 + "reduceOptions": {
1918 + "calcs": [
1919 + "sum"
1920 + ],
1921 + "fields": "",
1922 + "values": false
1923 + },
1924 + "text": {},
1925 + "tooltip": {
1926 + "mode": "single",
1927 + "sort": "none"
1928 + }
1929 + },
1930 + "pluginVersion": "7.3.4",
1931 + "targets": [
1932 + {
1933 + "bucketAggs": [
1934 + {
1935 + "$$hashKey": "object:211",
1936 + "fake": true,
1937 + "field": "Rcpt",
1938 + "id": "3",
1939 + "settings": {
1940 + "min_doc_count": "1",
1941 + "missing": "Unknown",
1942 + "order": "desc",
1943 + "orderBy": "_count",
1944 + "size": "10"
1945 + },
1946 + "type": "terms"
1947 + },
1948 + {
1949 + "$$hashKey": "object:117",
1950 + "field": "timestamp",
1951 + "id": "2",
1952 + "settings": {
1953 + "interval": "auto",
1954 + "min_doc_count": 0,
1955 + "trimEdges": 0
1956 + },
1957 + "type": "date_histogram"
1958 + }
1959 + ],
1960 + "datasource": {
1961 + "type": "elasticsearch",
1962 + "uid": "replace_datasource_uid"
1963 + },
1964 + "metrics": [
1965 + {
1966 + "$$hashKey": "object:115",
1967 + "field": "select field",
1968 + "id": "1",
1969 + "type": "count"
1970 + }
1971 + ],
1972 + "query": "",
1973 + "queryType": "randomWalk",
1974 + "refId": "A",
1975 + "timeField": "datetime"
1976 + }
1977 + ],
1978 + "title": "TOP 10 RECEIVERS",
1979 + "type": "piechart"
1980 + },
1981 + {
1982 + "datasource": {
1983 + "type": "elasticsearch",
1984 + "uid": "replace_datasource_uid"
1985 + },
1986 + "fieldConfig": {
1987 + "defaults": {
1988 + "custom": {
1989 + "align": "auto",
1990 + "cellOptions": {
1991 + "type": "auto"
1992 + },
1993 + "filterable": false,
1994 + "inspect": false
1995 + },
1996 + "mappings": [],
1997 + "thresholds": {
1998 + "mode": "absolute",
1999 + "steps": [
2000 + {
2001 + "color": "green"
2002 + },
2003 + {
2004 + "color": "red",
2005 + "value": 80
2006 + }
2007 + ]
2008 + }
2009 + },
2010 + "overrides": []
2011 + },
2012 + "gridPos": {
2013 + "h": 7,
2014 + "w": 7,
2015 + "x": 17,
2016 + "y": 2
2017 + },
2018 + "id": 81,
2019 + "links": [],
2020 + "options": {
2021 + "cellHeight": "sm",
2022 + "footer": {
2023 + "countRows": false,
2024 + "fields": "",
2025 + "reducer": [
2026 + "sum"
2027 + ],
2028 + "show": false
2029 + },
2030 + "showHeader": true
2031 + },
2032 + "pluginVersion": "10.2.3",
2033 + "targets": [
2034 + {
2035 + "bucketAggs": [
2036 + {
2037 + "$$hashKey": "object:211",
2038 + "fake": true,
2039 + "field": "Recipient",
2040 + "id": "3",
2041 + "settings": {
2042 + "min_doc_count": "1",
2043 + "missing": "Unknown",
2044 + "order": "desc",
2045 + "orderBy": "_count",
2046 + "size": "10"
2047 + },
2048 + "type": "terms"
2049 + }
2050 + ],
2051 + "datasource": {
2052 + "type": "elasticsearch",
2053 + "uid": "replace_datasource_uid"
2054 + },
2055 + "metrics": [
2056 + {
2057 + "$$hashKey": "object:115",
2058 + "field": "select field",
2059 + "id": "1",
2060 + "type": "count"
2061 + }
2062 + ],
2063 + "query": "Virus:*",
2064 + "queryType": "randomWalk",
2065 + "refId": "A",
2066 + "timeField": "datetime"
2067 + }
2068 + ],
2069 + "title": "TOP 10 RECEIVERS",
2070 + "transformations": [
2071 + {
2072 + "id": "organize",
2073 + "options": {
2074 + "excludeByName": {},
2075 + "indexByName": {},
2076 + "renameByName": {
2077 + "software_vendor": "SOFTWARE VENDOR"
2078 + }
2079 + }
2080 + }
2081 + ],
2082 + "type": "table"
2083 + },
2084 + {
2085 + "datasource": {
2086 + "type": "elasticsearch",
2087 + "uid": "replace_datasource_uid"
2088 + },
2089 + "fieldConfig": {
2090 + "defaults": {
2091 + "color": {
2092 + "mode": "thresholds"
2093 + },
2094 + "custom": {
2095 + "align": "auto",
2096 + "cellOptions": {
2097 + "type": "auto"
2098 + },
2099 + "inspect": false
2100 + },
2101 + "mappings": [],
2102 + "thresholds": {
2103 + "mode": "absolute",
2104 + "steps": [
2105 + {
2106 + "color": "green"
2107 + },
2108 + {
2109 + "color": "red",
2110 + "value": 80
2111 + }
2112 + ]
2113 + }
2114 + },
2115 + "overrides": [
2116 + {
2117 + "matcher": {
2118 + "id": "byName",
2119 + "options": "Time"
2120 + },
2121 + "properties": [
2122 + {
2123 + "id": "displayName",
2124 + "value": "Time"
2125 + },
2126 + {
2127 + "id": "unit",
2128 + "value": "time: YYYY-MM-DD HH:mm:ss"
2129 + },
2130 + {
2131 + "id": "custom.align"
2132 + }
2133 + ]
2134 + },
2135 + {
2136 + "matcher": {
2137 + "id": "byName",
2138 + "options": ""
2139 + },
2140 + "properties": [
2141 + {
2142 + "id": "unit",
2143 + "value": "short"
2144 + },
2145 + {
2146 + "id": "decimals",
2147 + "value": 2
2148 + },
2149 + {
2150 + "id": "custom.align"
2151 + }
2152 + ]
2153 + },
2154 + {
2155 + "matcher": {
2156 + "id": "byName",
2157 + "options": "agent_name"
2158 + },
2159 + "properties": [
2160 + {
2161 + "id": "displayName",
2162 + "value": "AGENT"
2163 + },
2164 + {
2165 + "id": "unit",
2166 + "value": "short"
2167 + },
2168 + {
2169 + "id": "decimals",
2170 + "value": 2
2171 + },
2172 + {
2173 + "id": "custom.align"
2174 + }
2175 + ]
2176 + },
2177 + {
2178 + "matcher": {
2179 + "id": "byName",
2180 + "options": "AGENT"
2181 + },
2182 + "properties": [
2183 + {
2184 + "id": "custom.width",
2185 + "value": 299
2186 + }
2187 + ]
2188 + }
2189 + ]
2190 + },
2191 + "gridPos": {
2192 + "h": 10,
2193 + "w": 8,
2194 + "x": 0,
2195 + "y": 9
2196 + },
2197 + "id": 82,
2198 + "options": {
2199 + "cellHeight": "sm",
2200 + "footer": {
2201 + "countRows": false,
2202 + "fields": "",
2203 + "reducer": [
2204 + "sum"
2205 + ],
2206 + "show": false
2207 + },
2208 + "showHeader": true,
2209 + "sortBy": []
2210 + },
2211 + "pluginVersion": "10.2.3",
2212 + "targets": [
2213 + {
2214 + "bucketAggs": [
2215 + {
2216 + "$$hashKey": "object:89",
2217 + "fake": true,
2218 + "field": "SenderDomain",
2219 + "id": "4",
2220 + "settings": {
2221 + "min_doc_count": 1,
2222 + "order": "desc",
2223 + "orderBy": "_count",
2224 + "size": "10"
2225 + },
2226 + "type": "terms"
2227 + }
2228 + ],
2229 + "datasource": {
2230 + "type": "elasticsearch",
2231 + "uid": "replace_datasource_uid"
2232 + },
2233 + "metrics": [
2234 + {
2235 + "$$hashKey": "object:87",
2236 + "field": "select field",
2237 + "id": "1",
2238 + "type": "count"
2239 + }
2240 + ],
2241 + "query": "Virus:*",
2242 + "refId": "A",
2243 + "timeField": "datetime"
2244 + }
2245 + ],
2246 + "title": "TOP 10 DOMAIN SENDERS",
2247 + "transformations": [
2248 + {
2249 + "id": "merge",
2250 + "options": {
2251 + "reducers": []
2252 + }
2253 + }
2254 + ],
2255 + "type": "table"
2256 + },
2257 + {
2258 + "datasource": {
2259 + "type": "elasticsearch",
2260 + "uid": "replace_datasource_uid"
2261 + },
2262 + "fieldConfig": {
2263 + "defaults": {
2264 + "color": {
2265 + "mode": "thresholds"
2266 + },
2267 + "custom": {
2268 + "align": "auto",
2269 + "cellOptions": {
2270 + "type": "auto"
2271 + },
2272 + "inspect": false
2273 + },
2274 + "mappings": [],
2275 + "thresholds": {
2276 + "mode": "absolute",
2277 + "steps": [
2278 + {
2279 + "color": "green"
2280 + },
2281 + {
2282 + "color": "red",
2283 + "value": 80
2284 + }
2285 + ]
2286 + }
2287 + },
2288 + "overrides": [
2289 + {
2290 + "matcher": {
2291 + "id": "byName",
2292 + "options": "Time"
2293 + },
2294 + "properties": [
2295 + {
2296 + "id": "displayName",
2297 + "value": "Time"
2298 + },
2299 + {
2300 + "id": "unit",
2301 + "value": "time: YYYY-MM-DD HH:mm:ss"
2302 + },
2303 + {
2304 + "id": "custom.align"
2305 + }
2306 + ]
2307 + },
2308 + {
2309 + "matcher": {
2310 + "id": "byName",
2311 + "options": ""
2312 + },
2313 + "properties": [
2314 + {
2315 + "id": "unit",
2316 + "value": "short"
2317 + },
2318 + {
2319 + "id": "decimals",
2320 + "value": 2
2321 + },
2322 + {
2323 + "id": "custom.align"
2324 + }
2325 + ]
2326 + },
2327 + {
2328 + "matcher": {
2329 + "id": "byName",
2330 + "options": "agent_name"
2331 + },
2332 + "properties": [
2333 + {
2334 + "id": "displayName",
2335 + "value": "AGENT"
2336 + },
2337 + {
2338 + "id": "unit",
2339 + "value": "short"
2340 + },
2341 + {
2342 + "id": "decimals",
2343 + "value": 2
2344 + },
2345 + {
2346 + "id": "custom.align"
2347 + }
2348 + ]
2349 + },
2350 + {
2351 + "matcher": {
2352 + "id": "byName",
2353 + "options": "AGENT"
2354 + },
2355 + "properties": [
2356 + {
2357 + "id": "custom.width",
2358 + "value": 299
2359 + }
2360 + ]
2361 + }
2362 + ]
2363 + },
2364 + "gridPos": {
2365 + "h": 10,
2366 + "w": 8,
2367 + "x": 8,
2368 + "y": 9
2369 + },
2370 + "id": 83,
2371 + "options": {
2372 + "cellHeight": "sm",
2373 + "footer": {
2374 + "countRows": false,
2375 + "fields": "",
2376 + "reducer": [
2377 + "sum"
2378 + ],
2379 + "show": false
2380 + },
2381 + "showHeader": true,
2382 + "sortBy": []
2383 + },
2384 + "pluginVersion": "10.2.3",
2385 + "targets": [
2386 + {
2387 + "bucketAggs": [
2388 + {
2389 + "$$hashKey": "object:89",
2390 + "fake": true,
2391 + "field": "IP",
2392 + "id": "4",
2393 + "settings": {
2394 + "min_doc_count": 1,
2395 + "order": "desc",
2396 + "orderBy": "_count",
2397 + "size": "10"
2398 + },
2399 + "type": "terms"
2400 + },
2401 + {
2402 + "field": "IP_country_code",
2403 + "id": "5",
2404 + "settings": {
2405 + "min_doc_count": "1",
2406 + "order": "desc",
2407 + "orderBy": "_count",
2408 + "size": "10"
2409 + },
2410 + "type": "terms"
2411 + }
2412 + ],
2413 + "datasource": {
2414 + "type": "elasticsearch",
2415 + "uid": "replace_datasource_uid"
2416 + },
2417 + "metrics": [
2418 + {
2419 + "$$hashKey": "object:87",
2420 + "field": "select field",
2421 + "id": "1",
2422 + "type": "count"
2423 + }
2424 + ],
2425 + "query": "Virus:*",
2426 + "refId": "A",
2427 + "timeField": "datetime"
2428 + }
2429 + ],
2430 + "title": "TOP 10 IPs",
2431 + "transformations": [
2432 + {
2433 + "id": "merge",
2434 + "options": {
2435 + "reducers": []
2436 + }
2437 + }
2438 + ],
2439 + "type": "table"
2440 + },
2441 + {
2442 + "circleMaxSize": 30,
2443 + "circleMinSize": 2,
2444 + "colors": [
2445 + "rgba(245, 54, 54, 0.9)",
2446 + "rgba(237, 129, 40, 0.89)",
2447 + "rgba(50, 172, 45, 0.97)"
2448 + ],
2449 + "datasource": {
2450 + "type": "elasticsearch",
2451 + "uid": "replace_datasource_uid"
2452 + },
2453 + "decimals": 0,
2454 + "esMetric": "Count",
2455 + "gridPos": {
2456 + "h": 10,
2457 + "w": 8,
2458 + "x": 16,
2459 + "y": 9
2460 + },
2461 + "hideEmpty": false,
2462 + "hideZero": false,
2463 + "id": 84,
2464 + "initialZoom": 1,
2465 + "locationData": "countries",
2466 + "mapCenter": "(0°, 0°)",
2467 + "mapCenterLatitude": 0,
2468 + "mapCenterLongitude": 0,
2469 + "maxDataPoints": 1,
2470 + "mouseWheelZoom": false,
2471 + "showLegend": true,
2472 + "stickyLabels": false,
2473 + "tableQueryOptions": {
2474 + "geohashField": "geohash",
2475 + "latitudeField": "latitude",
2476 + "longitudeField": "longitude",
2477 + "metricField": "metric",
2478 + "queryType": "geohash"
2479 + },
2480 + "targets": [
2481 + {
2482 + "alias": "",
2483 + "bucketAggs": [
2484 + {
2485 + "field": "IP_country_code",
2486 + "id": "3",
2487 + "settings": {
2488 + "min_doc_count": "1",
2489 + "order": "desc",
2490 + "orderBy": "_term",
2491 + "size": "10"
2492 + },
2493 + "type": "terms"
2494 + },
2495 + {
2496 + "field": "timestamp",
2497 + "id": "2",
2498 + "settings": {
2499 + "interval": "auto"
2500 + },
2501 + "type": "date_histogram"
2502 + }
2503 + ],
2504 + "datasource": {
2505 + "type": "elasticsearch",
2506 + "uid": "replace_datasource_uid"
2507 + },
2508 + "metrics": [
2509 + {
2510 + "id": "1",
2511 + "type": "count"
2512 + }
2513 + ],
2514 + "query": "Virus:*",
2515 + "refId": "A",
2516 + "timeField": "datetime"
2517 + }
2518 + ],
2519 + "thresholds": "0,10",
2520 + "title": "TOP 10 GEO IPs",
2521 + "type": "grafana-worldmap-panel",
2522 + "unitPlural": "",
2523 + "unitSingle": "",
2524 + "valueName": "total"
2525 + },
2526 + {
2527 + "datasource": {
2528 + "type": "grafana-opensearch-datasource",
2529 + "uid": "replace_datasource_uid"
2530 + },
2531 + "fieldConfig": {
2532 + "defaults": {
2533 + "mappings": [],
2534 + "thresholds": {
2535 + "mode": "absolute",
2536 + "steps": [
2537 + {
2538 + "color": "green"
2539 + },
2540 + {
2541 + "color": "red",
2542 + "value": 80
2543 + }
2544 + ]
2545 + }
2546 + },
2547 + "overrides": []
2548 + },
2549 + "gridPos": {
2550 + "h": 19,
2551 + "w": 24,
2552 + "x": 0,
2553 + "y": 19
2554 + },
2555 + "id": 85,
2556 + "options": {
2557 + "color": "blue",
2558 + "iteration": 20,
2559 + "monochrome": false,
2560 + "nodeColor": "super-light-purple",
2561 + "nodePadding": 20,
2562 + "nodeWidth": 30
2563 + },
2564 + "targets": [
2565 + {
2566 + "alias": "",
2567 + "bucketAggs": [
2568 + {
2569 + "field": "Virus",
2570 + "id": "2",
2571 + "settings": {
2572 + "min_doc_count": "1",
2573 + "order": "desc",
2574 + "orderBy": "_term",
2575 + "size": "10"
2576 + },
2577 + "type": "terms"
2578 + },
2579 + {
2580 + "field": "Sender",
2581 + "id": "3",
2582 + "settings": {
2583 + "min_doc_count": "1",
2584 + "order": "desc",
2585 + "orderBy": "_term",
2586 + "size": "1"
2587 + },
2588 + "type": "terms"
2589 + }
2590 + ],
2591 + "datasource": {
2592 + "type": "elasticsearch",
2593 + "uid": "replace_datasource_uid"
2594 + },
2595 + "metrics": [
2596 + {
2597 + "id": "1",
2598 + "type": "count"
2599 + }
2600 + ],
2601 + "query": "Virus:*",
2602 + "refId": "A",
2603 + "timeField": "timestamp"
2604 + }
2605 + ],
2606 + "title": "VIRUS FILE NAMES",
2607 + "transformations": [
2608 + {
2609 + "id": "organize",
2610 + "options": {
2611 + "excludeByName": {},
2612 + "indexByName": {},
2613 + "renameByName": {
2614 + "Count": "Count",
2615 + "parent_process_image": "PARENT PROCESS",
2616 + "process_image": "PROCESS"
2617 + }
2618 + }
2619 + }
2620 + ],
2621 + "transparent": true,
2622 + "type": "netsage-sankey-panel"
2623 + },
2624 + {
2625 + "datasource": {
2626 + "type": "elasticsearch",
2627 + "uid": "replace_datasource_uid"
2628 + },
2629 + "fieldConfig": {
2630 + "defaults": {
2631 + "color": {
2632 + "mode": "thresholds"
2633 + },
2634 + "custom": {
2635 + "align": "auto",
2636 + "cellOptions": {
2637 + "type": "auto"
2638 + },
2639 + "filterable": true,
2640 + "inspect": false
2641 + },
2642 + "mappings": [],
2643 + "thresholds": {
2644 + "mode": "absolute",
2645 + "steps": [
2646 + {
2647 + "color": "green"
2648 + },
2649 + {
2650 + "color": "red",
2651 + "value": 80
2652 + }
2653 + ]
2654 + }
2655 + },
2656 + "overrides": [
2657 + {
2658 + "matcher": {
2659 + "id": "byName",
2660 + "options": "timestamp"
2661 + },
2662 + "properties": [
2663 + {
2664 + "id": "displayName",
2665 + "value": "DATE/TIME"
2666 + },
2667 + {
2668 + "id": "unit",
2669 + "value": "time: YYYY-MM-DD HH:mm:ss"
2670 + },
2671 + {
2672 + "id": "custom.align"
2673 + }
2674 + ]
2675 + },
2676 + {
2677 + "matcher": {
2678 + "id": "byName",
2679 + "options": "process_name"
2680 + },
2681 + "properties": [
2682 + {
2683 + "id": "displayName",
2684 + "value": "PROCESS"
2685 + },
2686 + {
2687 + "id": "unit",
2688 + "value": "short"
2689 + },
2690 + {
2691 + "id": "decimals",
2692 + "value": -1
2693 + },
2694 + {
2695 + "id": "custom.align"
2696 + }
2697 + ]
2698 + },
2699 + {
2700 + "matcher": {
2701 + "id": "byName",
2702 + "options": "process_id"
2703 + },
2704 + "properties": [
2705 + {
2706 + "id": "displayName",
2707 + "value": "PID"
2708 + },
2709 + {
2710 + "id": "unit",
2711 + "value": "none"
2712 + },
2713 + {
2714 + "id": "decimals",
2715 + "value": -2
2716 + },
2717 + {
2718 + "id": "custom.align"
2719 + }
2720 + ]
2721 + },
2722 + {
2723 + "matcher": {
2724 + "id": "byName",
2725 + "options": "process_image"
2726 + },
2727 + "properties": [
2728 + {
2729 + "id": "displayName",
2730 + "value": "PROCESS IMAGE"
2731 + },
2732 + {
2733 + "id": "unit",
2734 + "value": "short"
2735 + },
2736 + {
2737 + "id": "decimals",
2738 + "value": 2
2739 + },
2740 + {
2741 + "id": "custom.align"
2742 + }
2743 + ]
2744 + },
2745 + {
2746 + "matcher": {
2747 + "id": "byName",
2748 + "options": "user_name"
2749 + },
2750 + "properties": [
2751 + {
2752 + "id": "displayName",
2753 + "value": "USER/ACCOUNT"
2754 + },
2755 + {
2756 + "id": "unit",
2757 + "value": "short"
2758 + },
2759 + {
2760 + "id": "decimals",
2761 + "value": 2
2762 + },
2763 + {
2764 + "id": "custom.align"
2765 + }
2766 + ]
2767 + },
2768 + {
2769 + "matcher": {
2770 + "id": "byName",
2771 + "options": "agent_name"
2772 + },
2773 + "properties": [
2774 + {
2775 + "id": "displayName",
2776 + "value": "AGENT"
2777 + },
2778 + {
2779 + "id": "unit",
2780 + "value": "short"
2781 + },
2782 + {
2783 + "id": "decimals",
2784 + "value": 2
2785 + },
2786 + {
2787 + "id": "custom.align"
2788 + }
2789 + ]
2790 + },
2791 + {
2792 + "matcher": {
2793 + "id": "byName",
2794 + "options": "parent_process_image"
2795 + },
2796 + "properties": [
2797 + {
2798 + "id": "displayName",
2799 + "value": "PARENT PROCESS"
2800 + },
2801 + {
2802 + "id": "unit",
2803 + "value": "short"
2804 + },
2805 + {
2806 + "id": "decimals",
2807 + "value": 2
2808 + },
2809 + {
2810 + "id": "custom.align"
2811 + }
2812 + ]
2813 + },
2814 + {
2815 + "matcher": {
2816 + "id": "byName",
2817 + "options": "process_cmd_line"
2818 + },
2819 + "properties": [
2820 + {
2821 + "id": "displayName",
2822 + "value": "PROCESS CMD LINE"
2823 + },
2824 + {
2825 + "id": "unit",
2826 + "value": "short"
2827 + },
2828 + {
2829 + "id": "decimals",
2830 + "value": 2
2831 + },
2832 + {
2833 + "id": "custom.align"
2834 + }
2835 + ]
2836 + },
2837 + {
2838 + "matcher": {
2839 + "id": "byName",
2840 + "options": "EVENT ID"
2841 + },
2842 + "properties": [
2843 + {
2844 + "id": "links",
2845 + "value": [
2846 + {
2847 + "targetBlank": true,
2848 + "title": "VIEW EVENT DETAILS",
2849 + "url": "https://dashboard.dnsoverwatch.com/explore?left=%5B%22now-6h%22,%22now%22,%22WF_Mimecast%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
2850 + }
2851 + ]
2852 + }
2853 + ]
2854 + }
2855 + ]
2856 + },
2857 + "gridPos": {
2858 + "h": 18,
2859 + "w": 24,
2860 + "x": 0,
2861 + "y": 38
2862 + },
2863 + "id": 86,
2864 + "options": {
2865 + "cellHeight": "sm",
2866 + "footer": {
2867 + "countRows": false,
2868 + "enablePagination": true,
2869 + "fields": "",
2870 + "reducer": [
2871 + "sum"
2872 + ],
2873 + "show": false
2874 + },
2875 + "showHeader": true
2876 + },
2877 + "pluginVersion": "10.2.3",
2878 + "targets": [
2879 + {
2880 + "bucketAggs": [],
2881 + "datasource": {
2882 + "type": "elasticsearch",
2883 + "uid": "replace_datasource_uid"
2884 + },
2885 + "metrics": [
2886 + {
2887 + "id": "1",
2888 + "settings": {
2889 + "size": "250"
2890 + },
2891 + "type": "raw_data"
2892 + }
2893 + ],
2894 + "query": "Virus:*",
2895 + "refId": "A",
2896 + "timeField": "datetime"
2897 + }
2898 + ],
2899 + "title": "VIRUS LOGS",
2900 + "transformations": [
2901 + {
2902 + "id": "filterFieldsByName",
2903 + "options": {
2904 + "include": {
2905 + "names": [
2906 + "Dir",
2907 + "IP",
2908 + "IP_country_code",
2909 + "Sender",
2910 + "SourceIP",
2911 + "SourceIP_country_code",
2912 + "Subject",
2913 + "_id",
2914 + "timestamp",
2915 + "SpamScore",
2916 + "Rcpt"
2917 + ]
2918 + }
2919 + }
2920 + },
2921 + {
2922 + "id": "organize",
2923 + "options": {
2924 + "excludeByName": {},
2925 + "indexByName": {
2926 + "Dir": 5,
2927 + "IP": 7,
2928 + "IP_country_code": 8,
2929 + "Rcpt": 6,
2930 + "Sender": 2,
2931 + "SourceIP": 3,
2932 + "SourceIP_country_code": 4,
2933 + "SpamScore": 10,
2934 + "Subject": 9,
2935 + "_id": 1,
2936 + "timestamp": 0
2937 + },
2938 + "renameByName": {
2939 + "Dir": "",
2940 + "IP_country_code": "COUNTRY",
2941 + "SourceIP": "SRC IP",
2942 + "SourceIP_country_code": "SRC COUNTRY",
2943 + "SpamScore": "",
2944 + "Subject": "",
2945 + "_id": "EVENT ID",
2946 + "agent_name": "",
2947 + "parent_cmd_line": "PARENT CMD",
2948 + "parent_process_id": "PARENT PID",
2949 + "parent_process_user": "PARENT USER",
2950 + "syslog_level": "LEVEL"
2951 + }
2952 + }
2953 + }
2954 + ],
2955 + "transparent": true,
2956 + "type": "table"
2957 + }
2958 + ],
2959 + "title": "VIRUS",
2960 + "type": "row"
2961 + },
2962 + {
2963 + "collapsed": true,
2964 + "gridPos": {
2965 + "h": 1,
2966 + "w": 24,
2967 + "x": 0,
2968 + "y": 2
2969 + },
2970 + "id": 88,
2971 + "panels": [
2972 + {
2973 + "datasource": {
2974 + "type": "elasticsearch",
2975 + "uid": "replace_datasource_uid"
2976 + },
2977 + "fieldConfig": {
2978 + "defaults": {
2979 + "mappings": [
2980 + {
2981 + "options": {
2982 + "match": "null",
2983 + "result": {
2984 + "text": "N/A"
2985 + }
2986 + },
2987 + "type": "special"
2988 + }
2989 + ],
2990 + "thresholds": {
2991 + "mode": "absolute",
2992 + "steps": [
2993 + {
2994 + "color": "blue",
2995 + "value": null
2996 + }
2997 + ]
2998 + },
2999 + "unit": "short"
3000 + },
3001 + "overrides": []
3002 + },
3003 + "gridPos": {
3004 + "h": 7,
3005 + "w": 4,
3006 + "x": 0,
3007 + "y": 3
3008 + },
3009 + "id": 89,
3010 + "links": [],
3011 + "options": {
3012 + "colorMode": "value",
3013 + "graphMode": "area",
3014 + "justifyMode": "auto",
3015 + "orientation": "horizontal",
3016 + "reduceOptions": {
3017 + "calcs": [
3018 + "sum"
3019 + ],
3020 + "fields": "",
3021 + "values": false
3022 + },
3023 + "text": {},
3024 + "textMode": "auto",
3025 + "wideLayout": true
3026 + },
3027 + "pluginVersion": "10.2.3",
3028 + "targets": [
3029 + {
3030 + "bucketAggs": [
3031 + {
3032 + "$$hashKey": "object:135",
3033 + "field": "timestamp",
3034 + "id": "2",
3035 + "settings": {
3036 + "interval": "auto",
3037 + "min_doc_count": 0,
3038 + "trimEdges": 0
3039 + },
3040 + "type": "date_histogram"
3041 + }
3042 + ],
3043 + "datasource": {
3044 + "type": "elasticsearch",
3045 + "uid": "replace_datasource_uid"
3046 + },
3047 + "metrics": [
3048 + {
3049 + "$$hashKey": "object:133",
3050 + "field": "select field",
3051 + "id": "1",
3052 + "type": "count"
3053 + }
3054 + ],
3055 + "query": "SpamScore:*",
3056 + "refId": "A",
3057 + "timeField": "datetime"
3058 + }
3059 + ],
3060 + "title": "SPAM EVENTS",
3061 + "type": "stat"
3062 + },
3063 + {
3064 + "datasource": {
3065 + "type": "elasticsearch",
3066 + "uid": "replace_datasource_uid"
3067 + },
3068 + "fieldConfig": {
3069 + "defaults": {
3070 + "color": {
3071 + "mode": "thresholds"
3072 + },
3073 + "custom": {
3074 + "align": "auto",
3075 + "cellOptions": {
3076 + "type": "auto"
3077 + },
3078 + "inspect": false
3079 + },
3080 + "mappings": [],
3081 + "thresholds": {
3082 + "mode": "absolute",
3083 + "steps": [
3084 + {
3085 + "color": "green",
3086 + "value": null
3087 + },
3088 + {
3089 + "color": "red",
3090 + "value": 80
3091 + }
3092 + ]
3093 + }
3094 + },
3095 + "overrides": [
3096 + {
3097 + "matcher": {
3098 + "id": "byName",
3099 + "options": "Time"
3100 + },
3101 + "properties": [
3102 + {
3103 + "id": "displayName",
3104 + "value": "Time"
3105 + },
3106 + {
3107 + "id": "unit",
3108 + "value": "time: YYYY-MM-DD HH:mm:ss"
3109 + },
3110 + {
3111 + "id": "custom.align"
3112 + }
3113 + ]
3114 + },
3115 + {
3116 + "matcher": {
3117 + "id": "byName",
3118 + "options": ""
3119 + },
3120 + "properties": [
3121 + {
3122 + "id": "unit",
3123 + "value": "short"
3124 + },
3125 + {
3126 + "id": "decimals",
3127 + "value": 2
3128 + },
3129 + {
3130 + "id": "custom.align"
3131 + }
3132 + ]
3133 + },
3134 + {
3135 + "matcher": {
3136 + "id": "byName",
3137 + "options": "agent_name"
3138 + },
3139 + "properties": [
3140 + {
3141 + "id": "displayName",
3142 + "value": "AGENT"
3143 + },
3144 + {
3145 + "id": "unit",
3146 + "value": "short"
3147 + },
3148 + {
3149 + "id": "decimals",
3150 + "value": 2
3151 + },
3152 + {
3153 + "id": "custom.align"
3154 + }
3155 + ]
3156 + },
3157 + {
3158 + "matcher": {
3159 + "id": "byName",
3160 + "options": "AGENT"
3161 + },
3162 + "properties": [
3163 + {
3164 + "id": "custom.width",
3165 + "value": 299
3166 + }
3167 + ]
3168 + }
3169 + ]
3170 + },
3171 + "gridPos": {
3172 + "h": 7,
3173 + "w": 8,
3174 + "x": 4,
3175 + "y": 3
3176 + },
3177 + "id": 90,
3178 + "options": {
3179 + "cellHeight": "sm",
3180 + "footer": {
3181 + "countRows": false,
3182 + "fields": "",
3183 + "reducer": [
3184 + "sum"
3185 + ],
3186 + "show": false
3187 + },
3188 + "showHeader": true,
3189 + "sortBy": []
3190 + },
3191 + "pluginVersion": "10.2.3",
3192 + "targets": [
3193 + {
3194 + "bucketAggs": [
3195 + {
3196 + "$$hashKey": "object:89",
3197 + "fake": true,
3198 + "field": "Sender",
3199 + "id": "4",
3200 + "settings": {
3201 + "min_doc_count": 1,
3202 + "order": "desc",
3203 + "orderBy": "_count",
3204 + "size": "10"
3205 + },
3206 + "type": "terms"
3207 + }
3208 + ],
3209 + "datasource": {
3210 + "type": "elasticsearch",
3211 + "uid": "replace_datasource_uid"
3212 + },
3213 + "metrics": [
3214 + {
3215 + "$$hashKey": "object:87",
3216 + "field": "select field",
3217 + "id": "1",
3218 + "type": "count"
3219 + }
3220 + ],
3221 + "query": "SpamScore:*",
3222 + "refId": "A",
3223 + "timeField": "datetime"
3224 + }
3225 + ],
3226 + "title": "TOP 10 SENDERS",
3227 + "transformations": [
3228 + {
3229 + "id": "merge",
3230 + "options": {
3231 + "reducers": []
3232 + }
3233 + }
3234 + ],
3235 + "type": "table"
3236 + },
3237 + {
3238 + "datasource": {
3239 + "type": "elasticsearch",
3240 + "uid": "replace_datasource_uid"
3241 + },
3242 + "fieldConfig": {
3243 + "defaults": {
3244 + "color": {
3245 + "mode": "palette-classic"
3246 + },
3247 + "custom": {
3248 + "hideFrom": {
3249 + "legend": false,
3250 + "tooltip": false,
3251 + "viz": false
3252 + }
3253 + },
3254 + "decimals": 0,
3255 + "mappings": [],
3256 + "unit": "short"
3257 + },
3258 + "overrides": []
3259 + },
3260 + "gridPos": {
3261 + "h": 7,
3262 + "w": 5,
3263 + "x": 12,
3264 + "y": 3
3265 + },
3266 + "id": 91,
3267 + "links": [],
3268 + "options": {
3269 + "displayLabels": [],
3270 + "legend": {
3271 + "calcs": [],
3272 + "displayMode": "list",
3273 + "placement": "bottom",
3274 + "showLegend": false,
3275 + "values": [
3276 + "value"
3277 + ]
3278 + },
3279 + "pieType": "pie",
3280 + "reduceOptions": {
3281 + "calcs": [
3282 + "sum"
3283 + ],
3284 + "fields": "",
3285 + "values": false
3286 + },
3287 + "text": {},
3288 + "tooltip": {
3289 + "mode": "single",
3290 + "sort": "none"
3291 + }
3292 + },
3293 + "pluginVersion": "7.3.4",
3294 + "targets": [
3295 + {
3296 + "bucketAggs": [
3297 + {
3298 + "$$hashKey": "object:211",
3299 + "fake": true,
3300 + "field": "Rcpt",
3301 + "id": "3",
3302 + "settings": {
3303 + "min_doc_count": "1",
3304 + "missing": "Unknown",
3305 + "order": "desc",
3306 + "orderBy": "_count",
3307 + "size": "10"
3308 + },
3309 + "type": "terms"
3310 + },
3311 + {
3312 + "$$hashKey": "object:117",
3313 + "field": "timestamp",
3314 + "id": "2",
3315 + "settings": {
3316 + "interval": "auto",
3317 + "min_doc_count": 0,
3318 + "trimEdges": 0
3319 + },
3320 + "type": "date_histogram"
3321 + }
3322 + ],
3323 + "datasource": {
3324 + "type": "elasticsearch",
3325 + "uid": "replace_datasource_uid"
3326 + },
3327 + "metrics": [
3328 + {
3329 + "$$hashKey": "object:115",
3330 + "field": "select field",
3331 + "id": "1",
3332 + "type": "count"
3333 + }
3334 + ],
3335 + "query": "SpamScore:*",
3336 + "queryType": "randomWalk",
3337 + "refId": "A",
3338 + "timeField": "datetime"
3339 + }
3340 + ],
3341 + "title": "TOP 10 RECEIVERS",
3342 + "type": "piechart"
3343 + },
3344 + {
3345 + "datasource": {
3346 + "type": "elasticsearch",
3347 + "uid": "replace_datasource_uid"
3348 + },
3349 + "fieldConfig": {
3350 + "defaults": {
3351 + "custom": {
3352 + "align": "auto",
3353 + "cellOptions": {
3354 + "type": "auto"
3355 + },
3356 + "filterable": false,
3357 + "inspect": false
3358 + },
3359 + "mappings": [],
3360 + "thresholds": {
3361 + "mode": "absolute",
3362 + "steps": [
3363 + {
3364 + "color": "green",
3365 + "value": null
3366 + },
3367 + {
3368 + "color": "red",
3369 + "value": 80
3370 + }
3371 + ]
3372 + }
3373 + },
3374 + "overrides": []
3375 + },
3376 + "gridPos": {
3377 + "h": 7,
3378 + "w": 7,
3379 + "x": 17,
3380 + "y": 3
3381 + },
3382 + "id": 92,
3383 + "links": [],
3384 + "options": {
3385 + "cellHeight": "sm",
3386 + "footer": {
3387 + "countRows": false,
3388 + "fields": "",
3389 + "reducer": [
3390 + "sum"
3391 + ],
3392 + "show": false
3393 + },
3394 + "showHeader": true
3395 + },
3396 + "pluginVersion": "10.2.3",
3397 + "targets": [
3398 + {
3399 + "bucketAggs": [
3400 + {
3401 + "$$hashKey": "object:211",
3402 + "fake": true,
3403 + "field": "Rcpt",
3404 + "id": "3",
3405 + "settings": {
3406 + "min_doc_count": "1",
3407 + "missing": "Unknown",
3408 + "order": "desc",
3409 + "orderBy": "_count",
3410 + "size": "10"
3411 + },
3412 + "type": "terms"
3413 + }
3414 + ],
3415 + "datasource": {
3416 + "type": "elasticsearch",
3417 + "uid": "replace_datasource_uid"
3418 + },
3419 + "metrics": [
3420 + {
3421 + "$$hashKey": "object:115",
3422 + "field": "select field",
3423 + "id": "1",
3424 + "type": "count"
3425 + }
3426 + ],
3427 + "query": "SpamScore:*",
3428 + "queryType": "randomWalk",
3429 + "refId": "A",
3430 + "timeField": "datetime"
3431 + }
3432 + ],
3433 + "title": "TOP 10 RECEIVERS",
3434 + "transformations": [
3435 + {
3436 + "id": "organize",
3437 + "options": {
3438 + "excludeByName": {},
3439 + "indexByName": {},
3440 + "renameByName": {
3441 + "software_vendor": "SOFTWARE VENDOR"
3442 + }
3443 + }
3444 + }
3445 + ],
3446 + "type": "table"
3447 + },
3448 + {
3449 + "datasource": {
3450 + "type": "elasticsearch",
3451 + "uid": "replace_datasource_uid"
3452 + },
3453 + "fieldConfig": {
3454 + "defaults": {
3455 + "color": {
3456 + "mode": "thresholds"
3457 + },
3458 + "custom": {
3459 + "align": "auto",
3460 + "cellOptions": {
3461 + "type": "auto"
3462 + },
3463 + "inspect": false
3464 + },
3465 + "mappings": [],
3466 + "thresholds": {
3467 + "mode": "absolute",
3468 + "steps": [
3469 + {
3470 + "color": "green",
3471 + "value": null
3472 + },
3473 + {
3474 + "color": "red",
3475 + "value": 80
3476 + }
3477 + ]
3478 + }
3479 + },
3480 + "overrides": [
3481 + {
3482 + "matcher": {
3483 + "id": "byName",
3484 + "options": "Time"
3485 + },
3486 + "properties": [
3487 + {
3488 + "id": "displayName",
3489 + "value": "Time"
3490 + },
3491 + {
3492 + "id": "unit",
3493 + "value": "time: YYYY-MM-DD HH:mm:ss"
3494 + },
3495 + {
3496 + "id": "custom.align"
3497 + }
3498 + ]
3499 + },
3500 + {
3501 + "matcher": {
3502 + "id": "byName",
3503 + "options": ""
3504 + },
3505 + "properties": [
3506 + {
3507 + "id": "unit",
3508 + "value": "short"
3509 + },
3510 + {
3511 + "id": "decimals",
3512 + "value": 2
3513 + },
3514 + {
3515 + "id": "custom.align"
3516 + }
3517 + ]
3518 + },
3519 + {
3520 + "matcher": {
3521 + "id": "byName",
3522 + "options": "agent_name"
3523 + },
3524 + "properties": [
3525 + {
3526 + "id": "displayName",
3527 + "value": "AGENT"
3528 + },
3529 + {
3530 + "id": "unit",
3531 + "value": "short"
3532 + },
3533 + {
3534 + "id": "decimals",
3535 + "value": 2
3536 + },
3537 + {
3538 + "id": "custom.align"
3539 + }
3540 + ]
3541 + },
3542 + {
3543 + "matcher": {
3544 + "id": "byName",
3545 + "options": "AGENT"
3546 + },
3547 + "properties": [
3548 + {
3549 + "id": "custom.width",
3550 + "value": 299
3551 + }
3552 + ]
3553 + }
3554 + ]
3555 + },
3556 + "gridPos": {
3557 + "h": 10,
3558 + "w": 8,
3559 + "x": 0,
3560 + "y": 10
3561 + },
3562 + "id": 93,
3563 + "options": {
3564 + "cellHeight": "sm",
3565 + "footer": {
3566 + "countRows": false,
3567 + "fields": "",
3568 + "reducer": [
3569 + "sum"
3570 + ],
3571 + "show": false
3572 + },
3573 + "showHeader": true,
3574 + "sortBy": []
3575 + },
3576 + "pluginVersion": "10.2.3",
3577 + "targets": [
3578 + {
3579 + "bucketAggs": [
3580 + {
3581 + "$$hashKey": "object:89",
3582 + "fake": true,
3583 + "field": "Subject",
3584 + "id": "4",
3585 + "settings": {
3586 + "min_doc_count": 1,
3587 + "order": "desc",
3588 + "orderBy": "_count",
3589 + "size": "10"
3590 + },
3591 + "type": "terms"
3592 + }
3593 + ],
3594 + "datasource": {
3595 + "type": "elasticsearch",
3596 + "uid": "replace_datasource_uid"
3597 + },
3598 + "metrics": [
3599 + {
3600 + "$$hashKey": "object:87",
3601 + "field": "select field",
3602 + "id": "1",
3603 + "type": "count"
3604 + }
3605 + ],
3606 + "query": "SpamScore:*",
3607 + "refId": "A",
3608 + "timeField": "datetime"
3609 + }
3610 + ],
3611 + "title": "TOP 10 SUBJECTS",
3612 + "transformations": [
3613 + {
3614 + "id": "merge",
3615 + "options": {
3616 + "reducers": []
3617 + }
3618 + }
3619 + ],
3620 + "type": "table"
3621 + },
3622 + {
3623 + "datasource": {
3624 + "type": "elasticsearch",
3625 + "uid": "replace_datasource_uid"
3626 + },
3627 + "fieldConfig": {
3628 + "defaults": {
3629 + "color": {
3630 + "mode": "thresholds"
3631 + },
3632 + "custom": {
3633 + "align": "auto",
3634 + "cellOptions": {
3635 + "type": "auto"
3636 + },
3637 + "inspect": false
3638 + },
3639 + "mappings": [],
3640 + "thresholds": {
3641 + "mode": "absolute",
3642 + "steps": [
3643 + {
3644 + "color": "green",
3645 + "value": null
3646 + },
3647 + {
3648 + "color": "red",
3649 + "value": 80
3650 + }
3651 + ]
3652 + }
3653 + },
3654 + "overrides": [
3655 + {
3656 + "matcher": {
3657 + "id": "byName",
3658 + "options": "Time"
3659 + },
3660 + "properties": [
3661 + {
3662 + "id": "displayName",
3663 + "value": "Time"
3664 + },
3665 + {
3666 + "id": "unit",
3667 + "value": "time: YYYY-MM-DD HH:mm:ss"
3668 + },
3669 + {
3670 + "id": "custom.align"
3671 + }
3672 + ]
3673 + },
3674 + {
3675 + "matcher": {
3676 + "id": "byName",
3677 + "options": ""
3678 + },
3679 + "properties": [
3680 + {
3681 + "id": "unit",
3682 + "value": "short"
3683 + },
3684 + {
3685 + "id": "decimals",
3686 + "value": 2
3687 + },
3688 + {
3689 + "id": "custom.align"
3690 + }
3691 + ]
3692 + },
3693 + {
3694 + "matcher": {
3695 + "id": "byName",
3696 + "options": "agent_name"
3697 + },
3698 + "properties": [
3699 + {
3700 + "id": "displayName",
3701 + "value": "AGENT"
3702 + },
3703 + {
3704 + "id": "unit",
3705 + "value": "short"
3706 + },
3707 + {
3708 + "id": "decimals",
3709 + "value": 2
3710 + },
3711 + {
3712 + "id": "custom.align"
3713 + }
3714 + ]
3715 + },
3716 + {
3717 + "matcher": {
3718 + "id": "byName",
3719 + "options": "AGENT"
3720 + },
3721 + "properties": [
3722 + {
3723 + "id": "custom.width",
3724 + "value": 299
3725 + }
3726 + ]
3727 + }
3728 + ]
3729 + },
3730 + "gridPos": {
3731 + "h": 10,
3732 + "w": 8,
3733 + "x": 8,
3734 + "y": 10
3735 + },
3736 + "id": 94,
3737 + "options": {
3738 + "cellHeight": "sm",
3739 + "footer": {
3740 + "countRows": false,
3741 + "fields": "",
3742 + "reducer": [
3743 + "sum"
3744 + ],
3745 + "show": false
3746 + },
3747 + "showHeader": true,
3748 + "sortBy": []
3749 + },
3750 + "pluginVersion": "10.2.3",
3751 + "targets": [
3752 + {
3753 + "bucketAggs": [
3754 + {
3755 + "$$hashKey": "object:89",
3756 + "fake": true,
3757 + "field": "IP",
3758 + "id": "4",
3759 + "settings": {
3760 + "min_doc_count": 1,
3761 + "order": "desc",
3762 + "orderBy": "_count",
3763 + "size": "10"
3764 + },
3765 + "type": "terms"
3766 + },
3767 + {
3768 + "field": "IP_country_code",
3769 + "id": "5",
3770 + "settings": {
3771 + "min_doc_count": "1",
3772 + "order": "desc",
3773 + "orderBy": "_count",
3774 + "size": "10"
3775 + },
3776 + "type": "terms"
3777 + }
3778 + ],
3779 + "datasource": {
3780 + "type": "elasticsearch",
3781 + "uid": "replace_datasource_uid"
3782 + },
3783 + "metrics": [
3784 + {
3785 + "$$hashKey": "object:87",
3786 + "field": "select field",
3787 + "id": "1",
3788 + "type": "count"
3789 + }
3790 + ],
3791 + "query": "SpamScore:*",
3792 + "refId": "A",
3793 + "timeField": "datetime"
3794 + }
3795 + ],
3796 + "title": "TOP 10 IPs",
3797 + "transformations": [
3798 + {
3799 + "id": "merge",
3800 + "options": {
3801 + "reducers": []
3802 + }
3803 + }
3804 + ],
3805 + "type": "table"
3806 + },
3807 + {
3808 + "circleMaxSize": 30,
3809 + "circleMinSize": 2,
3810 + "colors": [
3811 + "rgba(245, 54, 54, 0.9)",
3812 + "rgba(237, 129, 40, 0.89)",
3813 + "rgba(50, 172, 45, 0.97)"
3814 + ],
3815 + "datasource": {
3816 + "type": "elasticsearch",
3817 + "uid": "replace_datasource_uid"
3818 + },
3819 + "decimals": 0,
3820 + "esMetric": "Count",
3821 + "gridPos": {
3822 + "h": 10,
3823 + "w": 8,
3824 + "x": 16,
3825 + "y": 10
3826 + },
3827 + "hideEmpty": false,
3828 + "hideZero": false,
3829 + "id": 95,
3830 + "initialZoom": 1,
3831 + "locationData": "countries",
3832 + "mapCenter": "(0°, 0°)",
3833 + "mapCenterLatitude": 0,
3834 + "mapCenterLongitude": 0,
3835 + "maxDataPoints": 1,
3836 + "mouseWheelZoom": false,
3837 + "showLegend": true,
3838 + "stickyLabels": false,
3839 + "tableQueryOptions": {
3840 + "geohashField": "geohash",
3841 + "latitudeField": "latitude",
3842 + "longitudeField": "longitude",
3843 + "metricField": "metric",
3844 + "queryType": "geohash"
3845 + },
3846 + "targets": [
3847 + {
3848 + "alias": "",
3849 + "bucketAggs": [
3850 + {
3851 + "field": "IP_country_code",
3852 + "id": "3",
3853 + "settings": {
3854 + "min_doc_count": "1",
3855 + "order": "desc",
3856 + "orderBy": "_term",
3857 + "size": "10"
3858 + },
3859 + "type": "terms"
3860 + },
3861 + {
3862 + "field": "timestamp",
3863 + "id": "2",
3864 + "settings": {
3865 + "interval": "auto"
3866 + },
3867 + "type": "date_histogram"
3868 + }
3869 + ],
3870 + "datasource": {
3871 + "type": "elasticsearch",
3872 + "uid": "replace_datasource_uid"
3873 + },
3874 + "metrics": [
3875 + {
3876 + "id": "1",
3877 + "type": "count"
3878 + }
3879 + ],
3880 + "query": "SpamScore:*",
3881 + "refId": "A",
3882 + "timeField": "datetime"
3883 + }
3884 + ],
3885 + "thresholds": "0,10",
3886 + "title": "TOP 10 GEO IPs",
3887 + "type": "grafana-worldmap-panel",
3888 + "unitPlural": "",
3889 + "unitSingle": "",
3890 + "valueName": "total"
3891 + },
3892 + {
3893 + "datasource": {
3894 + "type": "elasticsearch",
3895 + "uid": "replace_datasource_uid"
3896 + },
3897 + "fieldConfig": {
3898 + "defaults": {
3899 + "mappings": [],
3900 + "thresholds": {
3901 + "mode": "absolute",
3902 + "steps": [
3903 + {
3904 + "color": "green",
3905 + "value": null
3906 + },
3907 + {
3908 + "color": "red",
3909 + "value": 80
3910 + }
3911 + ]
3912 + }
3913 + },
3914 + "overrides": []
3915 + },
3916 + "gridPos": {
3917 + "h": 19,
3918 + "w": 24,
3919 + "x": 0,
3920 + "y": 20
3921 + },
3922 + "id": 96,
3923 + "options": {
3924 + "color": "blue",
3925 + "iteration": 20,
3926 + "monochrome": false,
3927 + "nodeColor": "super-light-purple",
3928 + "nodePadding": 20,
3929 + "nodeWidth": 30
3930 + },
3931 + "targets": [
3932 + {
3933 + "alias": "",
3934 + "bucketAggs": [
3935 + {
3936 + "field": "Sender",
3937 + "id": "2",
3938 + "settings": {
3939 + "min_doc_count": "1",
3940 + "order": "desc",
3941 + "orderBy": "_term",
3942 + "size": "10"
3943 + },
3944 + "type": "terms"
3945 + },
3946 + {
3947 + "field": "Subject",
3948 + "id": "3",
3949 + "settings": {
3950 + "min_doc_count": "1",
3951 + "order": "desc",
3952 + "orderBy": "_term",
3953 + "size": "1"
3954 + },
3955 + "type": "terms"
3956 + }
3957 + ],
3958 + "datasource": {
3959 + "type": "elasticsearch",
3960 + "uid": "replace_datasource_uid"
3961 + },
3962 + "metrics": [
3963 + {
3964 + "id": "1",
3965 + "type": "count"
3966 + }
3967 + ],
3968 + "query": "SpamScore:*",
3969 + "refId": "A",
3970 + "timeField": "datetime"
3971 + }
3972 + ],
3973 + "title": "SPAM SUBJECTS",
3974 + "transformations": [
3975 + {
3976 + "id": "organize",
3977 + "options": {
3978 + "excludeByName": {},
3979 + "indexByName": {},
3980 + "renameByName": {
3981 + "Count": "Count",
3982 + "parent_process_image": "PARENT PROCESS",
3983 + "process_image": "PROCESS"
3984 + }
3985 + }
3986 + }
3987 + ],
3988 + "transparent": true,
3989 + "type": "netsage-sankey-panel"
3990 + },
3991 + {
3992 + "datasource": {
3993 + "type": "elasticsearch",
3994 + "uid": "replace_datasource_uid"
3995 + },
3996 + "fieldConfig": {
3997 + "defaults": {
3998 + "color": {
3999 + "mode": "thresholds"
4000 + },
4001 + "custom": {
4002 + "align": "auto",
4003 + "cellOptions": {
4004 + "type": "auto"
4005 + },
4006 + "filterable": true,
4007 + "inspect": false
4008 + },
4009 + "mappings": [],
4010 + "thresholds": {
4011 + "mode": "absolute",
4012 + "steps": [
4013 + {
4014 + "color": "green"
4015 + },
4016 + {
4017 + "color": "red",
4018 + "value": 80
4019 + }
4020 + ]
4021 + }
4022 + },
4023 + "overrides": [
4024 + {
4025 + "matcher": {
4026 + "id": "byName",
4027 + "options": "timestamp"
4028 + },
4029 + "properties": [
4030 + {
4031 + "id": "displayName",
4032 + "value": "DATE/TIME"
4033 + },
4034 + {
4035 + "id": "unit",
4036 + "value": "time: YYYY-MM-DD HH:mm:ss"
4037 + },
4038 + {
4039 + "id": "custom.align"
4040 + }
4041 + ]
4042 + },
4043 + {
4044 + "matcher": {
4045 + "id": "byName",
4046 + "options": "process_name"
4047 + },
4048 + "properties": [
4049 + {
4050 + "id": "displayName",
4051 + "value": "PROCESS"
4052 + },
4053 + {
4054 + "id": "unit",
4055 + "value": "short"
4056 + },
4057 + {
4058 + "id": "decimals",
4059 + "value": -1
4060 + },
4061 + {
4062 + "id": "custom.align"
4063 + }
4064 + ]
4065 + },
4066 + {
4067 + "matcher": {
4068 + "id": "byName",
4069 + "options": "process_id"
4070 + },
4071 + "properties": [
4072 + {
4073 + "id": "displayName",
4074 + "value": "PID"
4075 + },
4076 + {
4077 + "id": "unit",
4078 + "value": "none"
4079 + },
4080 + {
4081 + "id": "decimals",
4082 + "value": -2
4083 + },
4084 + {
4085 + "id": "custom.align"
4086 + }
4087 + ]
4088 + },
4089 + {
4090 + "matcher": {
4091 + "id": "byName",
4092 + "options": "process_image"
4093 + },
4094 + "properties": [
4095 + {
4096 + "id": "displayName",
4097 + "value": "PROCESS IMAGE"
4098 + },
4099 + {
4100 + "id": "unit",
4101 + "value": "short"
4102 + },
4103 + {
4104 + "id": "decimals",
4105 + "value": 2
4106 + },
4107 + {
4108 + "id": "custom.align"
4109 + }
4110 + ]
4111 + },
4112 + {
4113 + "matcher": {
4114 + "id": "byName",
4115 + "options": "user_name"
4116 + },
4117 + "properties": [
4118 + {
4119 + "id": "displayName",
4120 + "value": "USER/ACCOUNT"
4121 + },
4122 + {
4123 + "id": "unit",
4124 + "value": "short"
4125 + },
4126 + {
4127 + "id": "decimals",
4128 + "value": 2
4129 + },
4130 + {
4131 + "id": "custom.align"
4132 + }
4133 + ]
4134 + },
4135 + {
4136 + "matcher": {
4137 + "id": "byName",
4138 + "options": "agent_name"
4139 + },
4140 + "properties": [
4141 + {
4142 + "id": "displayName",
4143 + "value": "AGENT"
4144 + },
4145 + {
4146 + "id": "unit",
4147 + "value": "short"
4148 + },
4149 + {
4150 + "id": "decimals",
4151 + "value": 2
4152 + },
4153 + {
4154 + "id": "custom.align"
4155 + }
4156 + ]
4157 + },
4158 + {
4159 + "matcher": {
4160 + "id": "byName",
4161 + "options": "parent_process_image"
4162 + },
4163 + "properties": [
4164 + {
4165 + "id": "displayName",
4166 + "value": "PARENT PROCESS"
4167 + },
4168 + {
4169 + "id": "unit",
4170 + "value": "short"
4171 + },
4172 + {
4173 + "id": "decimals",
4174 + "value": 2
4175 + },
4176 + {
4177 + "id": "custom.align"
4178 + }
4179 + ]
4180 + },
4181 + {
4182 + "matcher": {
4183 + "id": "byName",
4184 + "options": "process_cmd_line"
4185 + },
4186 + "properties": [
4187 + {
4188 + "id": "displayName",
4189 + "value": "PROCESS CMD LINE"
4190 + },
4191 + {
4192 + "id": "unit",
4193 + "value": "short"
4194 + },
4195 + {
4196 + "id": "decimals",
4197 + "value": 2
4198 + },
4199 + {
4200 + "id": "custom.align"
4201 + }
4202 + ]
4203 + },
4204 + {
4205 + "matcher": {
4206 + "id": "byName",
4207 + "options": "EVENT ID"
4208 + },
4209 + "properties": [
4210 + {
4211 + "id": "links",
4212 + "value": [
4213 + {
4214 + "targetBlank": true,
4215 + "title": "VIEW EVENT DETAILS",
4216 + "url": "https://dashboard.dnsoverwatch.com/explore?left=%5B%22now-6h%22,%22now%22,%22WF_Mimecast%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
4217 + }
4218 + ]
4219 + }
4220 + ]
4221 + }
4222 + ]
4223 + },
4224 + "gridPos": {
4225 + "h": 18,
4226 + "w": 24,
4227 + "x": 0,
4228 + "y": 39
4229 + },
4230 + "id": 97,
4231 + "options": {
4232 + "cellHeight": "sm",
4233 + "footer": {
4234 + "countRows": false,
4235 + "enablePagination": true,
4236 + "fields": "",
4237 + "reducer": [
4238 + "sum"
4239 + ],
4240 + "show": false
4241 + },
4242 + "showHeader": true
4243 + },
4244 + "pluginVersion": "10.2.3",
4245 + "targets": [
4246 + {
4247 + "bucketAggs": [],
4248 + "datasource": {
4249 + "type": "elasticsearch",
4250 + "uid": "replace_datasource_uid"
4251 + },
4252 + "metrics": [
4253 + {
4254 + "id": "1",
4255 + "settings": {
4256 + "size": "250"
4257 + },
4258 + "type": "raw_data"
4259 + }
4260 + ],
4261 + "query": "SpamScore:*",
4262 + "refId": "A",
4263 + "timeField": "datetime"
4264 + }
4265 + ],
4266 + "title": "SPAM LOGS",
4267 + "transformations": [
4268 + {
4269 + "id": "filterFieldsByName",
4270 + "options": {
4271 + "include": {
4272 + "names": [
4273 + "Dir",
4274 + "IP",
4275 + "IP_country_code",
4276 + "Sender",
4277 + "SourceIP",
4278 + "SourceIP_country_code",
4279 + "Subject",
4280 + "_id",
4281 + "timestamp",
4282 + "SpamScore",
4283 + "Rcpt"
4284 + ]
4285 + }
4286 + }
4287 + },
4288 + {
4289 + "id": "organize",
4290 + "options": {
4291 + "excludeByName": {},
4292 + "indexByName": {
4293 + "Dir": 5,
4294 + "IP": 7,
4295 + "IP_country_code": 8,
4296 + "Rcpt": 6,
4297 + "Sender": 2,
4298 + "SourceIP": 3,
4299 + "SourceIP_country_code": 4,
4300 + "SpamScore": 10,
4301 + "Subject": 9,
4302 + "_id": 1,
4303 + "timestamp": 0
4304 + },
4305 + "renameByName": {
4306 + "Dir": "",
4307 + "IP_country_code": "COUNTRY",
4308 + "SourceIP": "SRC IP",
4309 + "SourceIP_country_code": "SRC COUNTRY",
4310 + "SpamScore": "",
4311 + "Subject": "",
4312 + "_id": "EVENT ID",
4313 + "agent_name": "",
4314 + "parent_cmd_line": "PARENT CMD",
4315 + "parent_process_id": "PARENT PID",
4316 + "parent_process_user": "PARENT USER",
4317 + "syslog_level": "LEVEL"
4318 + }
4319 + }
4320 + }
4321 + ],
4322 + "transparent": true,
4323 + "type": "table"
4324 + }
4325 + ],
4326 + "title": "SPAM",
4327 + "type": "row"
4328 + },
4329 + {
4330 + "collapsed": false,
4331 + "gridPos": {
4332 + "h": 1,
4333 + "w": 24,
4334 + "x": 0,
4335 + "y": 3
4336 + },
4337 + "id": 99,
4338 + "panels": [],
4339 + "title": "URL SCANNING",
4340 + "type": "row"
4341 + },
4342 + {
4343 + "datasource": {
4344 + "type": "grafana-opensearch-datasource",
4345 + "uid": "replace_datasource_uid"
4346 + },
4347 + "fieldConfig": {
4348 + "defaults": {
4349 + "mappings": [
4350 + {
4351 + "options": {
4352 + "match": "null",
4353 + "result": {
4354 + "text": "N/A"
4355 + }
4356 + },
4357 + "type": "special"
4358 + }
4359 + ],
4360 + "thresholds": {
4361 + "mode": "absolute",
4362 + "steps": [
4363 + {
4364 + "color": "blue",
4365 + "value": null
4366 + }
4367 + ]
4368 + },
4369 + "unit": "short"
4370 + },
4371 + "overrides": []
4372 + },
4373 + "gridPos": {
4374 + "h": 7,
4375 + "w": 4,
4376 + "x": 0,
4377 + "y": 4
4378 + },
4379 + "id": 100,
4380 + "links": [],
4381 + "options": {
4382 + "colorMode": "value",
4383 + "graphMode": "area",
4384 + "justifyMode": "auto",
4385 + "orientation": "horizontal",
4386 + "reduceOptions": {
4387 + "calcs": [
4388 + "sum"
4389 + ],
4390 + "fields": "",
4391 + "values": false
4392 + },
4393 + "text": {},
4394 + "textMode": "auto",
4395 + "wideLayout": true
4396 + },
4397 + "pluginVersion": "10.2.3",
4398 + "targets": [
4399 + {
4400 + "bucketAggs": [
4401 + {
4402 + "$$hashKey": "object:135",
4403 + "field": "timestamp",
4404 + "id": "2",
4405 + "settings": {
4406 + "interval": "auto",
4407 + "min_doc_count": 0,
4408 + "trimEdges": 0
4409 + },
4410 + "type": "date_histogram"
4411 + }
4412 + ],
4413 + "datasource": {
4414 + "type": "grafana-opensearch-datasource",
4415 + "uid": "replace_datasource_uid"
4416 + },
4417 + "metrics": [
4418 + {
4419 + "$$hashKey": "object:133",
4420 + "field": "select field",
4421 + "id": "1",
4422 + "type": "count"
4423 + }
4424 + ],
4425 + "query": "scanResult:*",
4426 + "refId": "A",
4427 + "timeField": "timestamp"
4428 + }
4429 + ],
4430 + "title": "URL SCAN EVENTS",
4431 + "type": "stat"
4432 + },
4433 + {
4434 + "datasource": {
4435 + "type": "grafana-opensearch-datasource",
4436 + "uid": "replace_datasource_uid"
4437 + },
4438 + "fieldConfig": {
4439 + "defaults": {
4440 + "color": {
4441 + "mode": "thresholds"
4442 + },
4443 + "custom": {
4444 + "align": "auto",
4445 + "cellOptions": {
4446 + "type": "auto"
4447 + },
4448 + "inspect": false
4449 + },
4450 + "mappings": [],
4451 + "thresholds": {
4452 + "mode": "absolute",
4453 + "steps": [
4454 + {
4455 + "color": "green",
4456 + "value": null
4457 + },
4458 + {
4459 + "color": "red",
4460 + "value": 80
4461 + }
4462 + ]
4463 + }
4464 + },
4465 + "overrides": [
4466 + {
4467 + "matcher": {
4468 + "id": "byName",
4469 + "options": "Time"
4470 + },
4471 + "properties": [
4472 + {
4473 + "id": "displayName",
4474 + "value": "Time"
4475 + },
4476 + {
4477 + "id": "unit",
4478 + "value": "time: YYYY-MM-DD HH:mm:ss"
4479 + },
4480 + {
4481 + "id": "custom.align"
4482 + }
4483 + ]
4484 + },
4485 + {
4486 + "matcher": {
4487 + "id": "byName",
4488 + "options": ""
4489 + },
4490 + "properties": [
4491 + {
4492 + "id": "unit",
4493 + "value": "short"
4494 + },
4495 + {
4496 + "id": "decimals",
4497 + "value": 2
4498 + },
4499 + {
4500 + "id": "custom.align"
4501 + }
4502 + ]
4503 + },
4504 + {
4505 + "matcher": {
4506 + "id": "byName",
4507 + "options": "data_fromUserEmailAddress"
4508 + },
4509 + "properties": [
4510 + {
4511 + "id": "displayName",
4512 + "value": "SENDER"
4513 + },
4514 + {
4515 + "id": "unit",
4516 + "value": "short"
4517 + },
4518 + {
4519 + "id": "decimals",
4520 + "value": 2
4521 + },
4522 + {
4523 + "id": "custom.align"
4524 + }
4525 + ]
4526 + },
4527 + {
4528 + "matcher": {
4529 + "id": "byName",
4530 + "options": "AGENT"
4531 + },
4532 + "properties": [
4533 + {
4534 + "id": "custom.width",
4535 + "value": 299
4536 + }
4537 + ]
4538 + }
4539 + ]
4540 + },
4541 + "gridPos": {
4542 + "h": 7,
4543 + "w": 8,
4544 + "x": 4,
4545 + "y": 4
4546 + },
4547 + "id": 101,
4548 + "options": {
4549 + "cellHeight": "sm",
4550 + "footer": {
4551 + "countRows": false,
4552 + "fields": "",
4553 + "reducer": [
4554 + "sum"
4555 + ],
4556 + "show": false
4557 + },
4558 + "showHeader": true,
4559 + "sortBy": []
4560 + },
4561 + "pluginVersion": "10.2.3",
4562 + "targets": [
4563 + {
4564 + "bucketAggs": [
4565 + {
4566 + "$$hashKey": "object:89",
4567 + "fake": true,
4568 + "field": "fromUserEmailAddress",
4569 + "id": "4",
4570 + "settings": {
4571 + "min_doc_count": 1,
4572 + "order": "desc",
4573 + "orderBy": "_count",
4574 + "size": "10"
4575 + },
4576 + "type": "terms"
4577 + }
4578 + ],
4579 + "datasource": {
4580 + "type": "grafana-opensearch-datasource",
4581 + "uid": "replace_datasource_uid"
4582 + },
4583 + "metrics": [
4584 + {
4585 + "$$hashKey": "object:87",
4586 + "field": "select field",
4587 + "id": "1",
4588 + "type": "count"
4589 + }
4590 + ],
4591 + "query": "fromUserEmailAddress:*",
4592 + "refId": "A",
4593 + "timeField": "timestamp"
4594 + }
4595 + ],
4596 + "title": "TOP 10 SENDERS",
4597 + "transformations": [
4598 + {
4599 + "id": "merge",
4600 + "options": {
4601 + "reducers": []
4602 + }
4603 + }
4604 + ],
4605 + "type": "table"
4606 + },
4607 + {
4608 + "datasource": {
4609 + "type": "grafana-opensearch-datasource",
4610 + "uid": "replace_datasource_uid"
4611 + },
4612 + "fieldConfig": {
4613 + "defaults": {
4614 + "color": {
4615 + "mode": "palette-classic"
4616 + },
4617 + "custom": {
4618 + "hideFrom": {
4619 + "legend": false,
4620 + "tooltip": false,
4621 + "viz": false
4622 + }
4623 + },
4624 + "decimals": 0,
4625 + "mappings": [],
4626 + "unit": "short"
4627 + },
4628 + "overrides": []
4629 + },
4630 + "gridPos": {
4631 + "h": 7,
4632 + "w": 5,
4633 + "x": 12,
4634 + "y": 4
4635 + },
4636 + "id": 102,
4637 + "links": [],
4638 + "options": {
4639 + "displayLabels": [],
4640 + "legend": {
4641 + "calcs": [],
4642 + "displayMode": "list",
4643 + "placement": "bottom",
4644 + "showLegend": false,
4645 + "values": [
4646 + "value"
4647 + ]
4648 + },
4649 + "pieType": "pie",
4650 + "reduceOptions": {
4651 + "calcs": [
4652 + "sum"
4653 + ],
4654 + "fields": "",
4655 + "values": false
4656 + },
4657 + "text": {},
4658 + "tooltip": {
4659 + "mode": "single",
4660 + "sort": "none"
4661 + }
4662 + },
4663 + "pluginVersion": "7.3.4",
4664 + "targets": [
4665 + {
4666 + "bucketAggs": [
4667 + {
4668 + "$$hashKey": "object:211",
4669 + "fake": true,
4670 + "field": "userEmailAddress",
4671 + "id": "3",
4672 + "settings": {
4673 + "min_doc_count": "1",
4674 + "missing": "Unknown",
4675 + "order": "desc",
4676 + "orderBy": "_count",
4677 + "size": "10"
4678 + },
4679 + "type": "terms"
4680 + },
4681 + {
4682 + "$$hashKey": "object:117",
4683 + "field": "timestamp",
4684 + "id": "2",
4685 + "settings": {
4686 + "interval": "auto",
4687 + "min_doc_count": 0,
4688 + "trimEdges": 0
4689 + },
4690 + "type": "date_histogram"
4691 + }
4692 + ],
4693 + "datasource": {
4694 + "type": "grafana-opensearch-datasource",
4695 + "uid": "replace_datasource_uid"
4696 + },
4697 + "metrics": [
4698 + {
4699 + "$$hashKey": "object:115",
4700 + "field": "select field",
4701 + "id": "1",
4702 + "type": "count"
4703 + }
4704 + ],
4705 + "query": "scanResult:*",
4706 + "queryType": "randomWalk",
4707 + "refId": "A",
4708 + "timeField": "timestamp"
4709 + }
4710 + ],
4711 + "title": "TOP 10 RECEIVERS",
4712 + "type": "piechart"
4713 + },
4714 + {
4715 + "datasource": {
4716 + "type": "grafana-opensearch-datasource",
4717 + "uid": "replace_datasource_uid"
4718 + },
4719 + "fieldConfig": {
4720 + "defaults": {
4721 + "custom": {
4722 + "align": "auto",
4723 + "cellOptions": {
4724 + "type": "auto"
4725 + },
4726 + "filterable": false,
4727 + "inspect": false
4728 + },
4729 + "mappings": [],
4730 + "thresholds": {
4731 + "mode": "absolute",
4732 + "steps": [
4733 + {
4734 + "color": "green",
4735 + "value": null
4736 + },
4737 + {
4738 + "color": "red",
4739 + "value": 80
4740 + }
4741 + ]
4742 + }
4743 + },
4744 + "overrides": []
4745 + },
4746 + "gridPos": {
4747 + "h": 7,
4748 + "w": 7,
4749 + "x": 17,
4750 + "y": 4
4751 + },
4752 + "id": 103,
4753 + "links": [],
4754 + "options": {
4755 + "cellHeight": "sm",
4756 + "footer": {
4757 + "countRows": false,
4758 + "fields": "",
4759 + "reducer": [
4760 + "sum"
4761 + ],
4762 + "show": false
4763 + },
4764 + "showHeader": true
4765 + },
4766 + "pluginVersion": "10.2.3",
4767 + "targets": [
4768 + {
4769 + "bucketAggs": [
4770 + {
4771 + "$$hashKey": "object:211",
4772 + "fake": true,
4773 + "field": "userEmailAddress",
4774 + "id": "3",
4775 + "settings": {
4776 + "min_doc_count": "1",
4777 + "missing": "Unknown",
4778 + "order": "desc",
4779 + "orderBy": "_count",
4780 + "size": "10"
4781 + },
4782 + "type": "terms"
4783 + }
4784 + ],
4785 + "datasource": {
4786 + "type": "grafana-opensearch-datasource",
4787 + "uid": "replace_datasource_uid"
4788 + },
4789 + "metrics": [
4790 + {
4791 + "$$hashKey": "object:115",
4792 + "field": "select field",
4793 + "id": "1",
4794 + "type": "count"
4795 + }
4796 + ],
4797 + "query": "scanResult:*",
4798 + "queryType": "randomWalk",
4799 + "refId": "A",
4800 + "timeField": "timestamp"
4801 + }
4802 + ],
4803 + "title": "TOP 10 RECEIVERS",
4804 + "transformations": [
4805 + {
4806 + "id": "organize",
4807 + "options": {
4808 + "excludeByName": {},
4809 + "indexByName": {},
4810 + "renameByName": {
4811 + "data_userEmailAddress": "RECEIVER",
4812 + "software_vendor": "SOFTWARE VENDOR"
4813 + }
4814 + }
4815 + }
4816 + ],
4817 + "type": "table"
4818 + },
4819 + {
4820 + "datasource": {
4821 + "type": "grafana-opensearch-datasource",
4822 + "uid": "replace_datasource_uid"
4823 + },
4824 + "fieldConfig": {
4825 + "defaults": {
4826 + "color": {
4827 + "mode": "thresholds"
4828 + },
4829 + "custom": {
4830 + "align": "auto",
4831 + "cellOptions": {
4832 + "type": "auto"
4833 + },
4834 + "inspect": false
4835 + },
4836 + "mappings": [
4837 + {
4838 + "options": {
4839 + "clean": {
4840 + "color": "green",
4841 + "index": 0,
4842 + "text": "clean"
4843 + },
4844 + "malicious": {
4845 + "color": "red",
4846 + "index": 1
4847 + }
4848 + },
4849 + "type": "value"
4850 + }
4851 + ],
4852 + "thresholds": {
4853 + "mode": "absolute",
4854 + "steps": [
4855 + {
4856 + "color": "green",
4857 + "value": null
4858 + },
4859 + {
4860 + "color": "red",
4861 + "value": 80
4862 + }
4863 + ]
4864 + }
4865 + },
4866 + "overrides": [
4867 + {
4868 + "matcher": {
4869 + "id": "byName",
4870 + "options": "data_scanResult"
4871 + },
4872 + "properties": [
4873 + {
4874 + "id": "displayName",
4875 + "value": "SCAN RESULT"
4876 + },
4877 + {
4878 + "id": "unit",
4879 + "value": "short"
4880 + },
4881 + {
4882 + "id": "decimals",
4883 + "value": 2
4884 + },
4885 + {
4886 + "id": "custom.align"
4887 + },
4888 + {
4889 + "id": "custom.cellOptions",
4890 + "value": {
4891 + "mode": "gradient",
4892 + "type": "color-background"
4893 + }
4894 + }
4895 + ]
4896 + },
4897 + {
4898 + "matcher": {
4899 + "id": "byName",
4900 + "options": "data_subject"
4901 + },
4902 + "properties": [
4903 + {
4904 + "id": "displayName",
4905 + "value": "SUBJECT"
4906 + }
4907 + ]
4908 + }
4909 + ]
4910 + },
4911 + "gridPos": {
4912 + "h": 10,
4913 + "w": 8,
4914 + "x": 0,
4915 + "y": 11
4916 + },
4917 + "id": 104,
4918 + "options": {
4919 + "cellHeight": "sm",
4920 + "footer": {
4921 + "countRows": false,
4922 + "fields": "",
4923 + "reducer": [
4924 + "sum"
4925 + ],
4926 + "show": false
4927 + },
4928 + "showHeader": true,
4929 + "sortBy": []
4930 + },
4931 + "pluginVersion": "10.2.3",
4932 + "targets": [
4933 + {
4934 + "bucketAggs": [
4935 + {
4936 + "$$hashKey": "object:89",
4937 + "fake": true,
4938 + "field": "subject",
4939 + "id": "4",
4940 + "settings": {
4941 + "min_doc_count": 1,
4942 + "order": "desc",
4943 + "orderBy": "_count",
4944 + "size": "10"
4945 + },
4946 + "type": "terms"
4947 + },
4948 + {
4949 + "field": "scanResult",
4950 + "id": "5",
4951 + "settings": {
4952 + "min_doc_count": "1",
4953 + "order": "desc",
4954 + "orderBy": "_term",
4955 + "size": "10"
4956 + },
4957 + "type": "terms"
4958 + }
4959 + ],
4960 + "datasource": {
4961 + "type": "grafana-opensearch-datasource",
4962 + "uid": "replace_datasource_uid"
4963 + },
4964 + "metrics": [
4965 + {
4966 + "$$hashKey": "object:87",
4967 + "field": "select field",
4968 + "id": "1",
4969 + "type": "count"
4970 + }
4971 + ],
4972 + "query": "scanResult:*",
4973 + "refId": "A",
4974 + "timeField": "timestamp"
4975 + }
4976 + ],
4977 + "title": "TOP 10 SUBJECTS",
4978 + "transformations": [
4979 + {
4980 + "id": "merge",
4981 + "options": {
4982 + "reducers": []
4983 + }
4984 + }
4985 + ],
4986 + "type": "table"
4987 + },
4988 + {
4989 + "datasource": {
4990 + "type": "grafana-opensearch-datasource",
4991 + "uid": "replace_datasource_uid"
4992 + },
4993 + "fieldConfig": {
4994 + "defaults": {
4995 + "color": {
4996 + "mode": "thresholds"
4997 + },
4998 + "custom": {
4999 + "align": "auto",

This file is too large to show in full.

backend/app/connectors/grafana/schema/dashboards.py
+3
@@ -61,6 +61,9 @@ class Office365Dashboard(Enum):
61 TEAMS = ("Office365", "teams.json")
62 THREAT_INTELLIGENCE = ("Office365", "threat_intelligence.json")
63
64 +class MimecastDashboard(Enum):
65 + SUMMARY = ("Mimecast", "summary.json")
66 +
67
68 class DashboardProvisionRequest(BaseModel):
69 dashboards: List[str] = Field(..., description="List of dashboard identifiers to provision")
backend/app/connectors/grafana/services/dashboards.py
+2 -1
@@ -8,6 +8,7 @@ from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
8 from app.connectors.grafana.schema.dashboards import GrafanaDashboard
9 from app.connectors.grafana.schema.dashboards import GrafanaDashboardResponse
10 from app.connectors.grafana.schema.dashboards import Office365Dashboard
11 +from app.connectors.grafana.schema.dashboards import MimecastDashboard
12 from app.connectors.grafana.schema.dashboards import WazuhDashboard
13 from app.connectors.grafana.utils.universal import create_grafana_client
14
@@ -124,7 +125,7 @@ async def provision_dashboards(dashboard_request: DashboardProvisionRequest) ->
125 provisioned_dashboards = []
126 errors = []
127
127 - valid_dashboards = {item.name: item for item in list(WazuhDashboard) + list(Office365Dashboard)}
128 + valid_dashboards = {item.name: item for item in list(WazuhDashboard) + list(Office365Dashboard) + list(MimecastDashboard)}
129
130 for dashboard_name in dashboard_request.dashboards:
131 dashboard_enum = valid_dashboards[dashboard_name]
backend/app/integrations/mimecast/routes/provision.py
+26
@@ -2,10 +2,36 @@ from fastapi import APIRouter
2
3 from app.integrations.mimecast.schema.mimecast import MimecastScheduledResponse
4 from app.schedulers.models.scheduler import CreateSchedulerRequest
5 +from app.integrations.mimecast.schema.provision import ProvisionMimecastRequest
6 +from app.integrations.mimecast.schema.provision import ProvisionMimecastResponse
7 from app.schedulers.scheduler import add_scheduler_jobs
8 +from app.db.db_session import get_db
9 +from sqlalchemy.ext.asyncio import AsyncSession
10 +from fastapi import Depends
11 +from app.integrations.mimecast.services.provision import provision_mimecast
12
13 integration_mimecast_scheduler_router = APIRouter()
14
15 +@integration_mimecast_scheduler_router.post(
16 + "/provision",
17 + response_model=ProvisionMimecastResponse,
18 + description="Provision a mimecast integration.",
19 +)
20 +async def provision_mimecast_route(provision_mimecast_request: ProvisionMimecastRequest, session: AsyncSession = Depends(get_db)) -> ProvisionMimecastResponse:
21 + """
22 + Provisions Office365 integration for a customer.
23 +
24 + Args:
25 + provision_office365_request (ProvisionOffice365Request): The request object containing the necessary information for provisioning.
26 + session (AsyncSession, optional): The database session. Defaults to Depends(get_db).
27 +
28 + Returns:
29 + ProvisionOffice365Response: The response object containing the result of the provisioning.
30 + """
31 + return await provision_mimecast(provision_mimecast_request, session)
32 +
33 +
34 +
35
36 @integration_mimecast_scheduler_router.post(
37 "/invoke/scheduler",
backend/app/integrations/mimecast/schema/provision.py new
+64
@@ -0,0 +1,64 @@
1 +from enum import Enum
2 +from typing import Any
3 +from typing import Dict
4 +
5 +from pydantic import BaseModel
6 +from pydantic import Field
7 +from pydantic import root_validator
8 +from typing import List, Optional
9 +
10 +
11 +class ProvisionMimecastRequest(BaseModel):
12 + customer_code: str = Field(
13 + ...,
14 + description="The customer code.",
15 + examples=["00002"],
16 + )
17 + integration_name: str = Field(
18 + "Mimecast",
19 + description="The integration name.",
20 + examples=["Mimecast"],
21 + )
22 +
23 + # ensure the `integration_name` is always set to "Mimecast"
24 + @root_validator(pre=True)
25 + def set_integration_name(cls, values: Dict[str, Any]) -> Dict[str, Any]:
26 + values["integration_name"] = "Mimecast"
27 + return values
28 +
29 +
30 +class ProvisionMimecastResponse(BaseModel):
31 + success: bool
32 + message: str
33 +
34 +# ! STREAMS ! #
35 +class StreamRule(BaseModel):
36 + field: str
37 + type: int
38 + inverted: bool
39 + value: str
40 +
41 +class MimecastEventStream(BaseModel):
42 + title: str = Field(..., description="Title of the stream")
43 + description: str = Field(..., description="Description of the stream")
44 + index_set_id: str = Field(..., description="ID of the associated index set")
45 + rules: List[StreamRule] = Field(..., description="List of rules for the stream")
46 + matching_type: str = Field(..., description="Matching type for the rules")
47 + remove_matches_from_default_stream: bool = Field(..., description="Whether to remove matches from the default stream")
48 + content_pack: Optional[str] = Field(None, description="Associated content pack, if any")
49 +
50 + class Config:
51 + schema_extra = {
52 + "example": {
53 + "title": "Mimecast EVENTS - Example Company",
54 + "description": "Mimecast EVENTS - Example Company",
55 + "index_set_id": "12345",
56 + "rules": [
57 + {"field": "agent_labels_customer", "type": 1, "inverted": False, "value": "ExampleCode"},
58 + {"field": "agent_labels_integration", "type": 1, "inverted": False, "value": "Office365"},
59 + ],
60 + "matching_type": "AND",
61 + "remove_matches_from_default_stream": True,
62 + "content_pack": None,
63 + },
64 + }
backend/app/integrations/mimecast/services/provision.py new
+265
@@ -0,0 +1,265 @@
1 +from app.integrations.mimecast.schema.provision import ProvisionMimecastRequest
2 +from app.integrations.mimecast.schema.provision import ProvisionMimecastResponse, MimecastEventStream
3 +from app.schedulers.scheduler import add_scheduler_jobs
4 +import json
5 +import os
6 +from datetime import datetime
7 +from typing import List
8 +from sqlalchemy.ext.asyncio import AsyncSession
9 +from app.connectors.grafana.services.dashboards import provision_dashboards
10 +from app.connectors.grafana.utils.universal import create_grafana_client
11 +from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineRequest
12 +from app.utils import get_connector_attribute
13 +from app.connectors.grafana.schema.dashboards import MimecastDashboard
14 +from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
15 +from app.customer_provisioning.schema.graylog import StreamCreationResponse
16 +from app.customer_provisioning.services.grafana import create_grafana_folder
17 +from app.customer_provisioning.services.grafana import get_opensearch_version
18 +from app.customer_provisioning.schema.graylog import TimeBasedIndexSet
19 +from app.customers.routes.customers import get_customer
20 +from app.customer_provisioning.schema.grafana import GrafanaDatasource
21 +from app.customer_provisioning.schema.grafana import GrafanaDataSourceCreationResponse
22 +from app.connectors.graylog.services.management import start_stream
23 +from app.customers.routes.customers import get_customer_meta
24 +from app.connectors.graylog.utils.universal import send_post_request
25 +from app.connectors.wazuh_manager.utils.universal import send_get_request
26 +from app.connectors.wazuh_manager.utils.universal import send_put_request
27 +from app.customer_provisioning.schema.graylog import GraylogIndexSetCreationResponse
28 +from loguru import logger
29 +
30 +################## ! GRAYLOG ! ##################
31 +async def build_index_set_config(customer_code: str, session: AsyncSession) -> TimeBasedIndexSet:
32 + """
33 + Build the configuration for a time-based index set.
34 +
35 + Args:
36 + request (ProvisionNewCustomer): The request object containing customer information.
37 +
38 + Returns:
39 + TimeBasedIndexSet: The configured time-based index set.
40 + """
41 + return TimeBasedIndexSet(
42 + title=f"Mimecast - {(await get_customer(customer_code, session)).customer.customer_name}",
43 + description=f"Mimecast - {customer_code}",
44 + index_prefix=f"mimecast_{customer_code}",
45 + rotation_strategy_class="org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategy",
46 + rotation_strategy={
47 + "type": "org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategyConfig",
48 + "rotation_period": "P1D",
49 + "rotate_empty_index_set": False,
50 + "max_rotation_period": None,
51 + },
52 + retention_strategy_class="org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy",
53 + retention_strategy={
54 + "type": "org.graylog2.indexer.retention.strategies.DeletionRetentionStrategyConfig",
55 + "max_number_of_indices": 30,
56 + },
57 + creation_date=datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
58 + index_analyzer="standard",
59 + shards=1,
60 + replicas=0,
61 + index_optimization_max_num_segments=1,
62 + index_optimization_disabled=False,
63 + writable=True,
64 + field_type_refresh_interval=5000,
65 + )
66 +
67 +# Function to send the POST request and handle the response
68 +async def send_index_set_creation_request(index_set: TimeBasedIndexSet) -> GraylogIndexSetCreationResponse:
69 + """
70 + Sends a request to create an index set in Graylog.
71 +
72 + Args:
73 + index_set (TimeBasedIndexSet): The index set to be created.
74 +
75 + Returns:
76 + GraylogIndexSetCreationResponse: The response from Graylog after creating the index set.
77 + """
78 + json_index_set = json.dumps(index_set.dict())
79 + logger.info(f"json_index_set set: {json_index_set}")
80 + response_json = await send_post_request(endpoint="/api/system/indices/index_sets", data=index_set.dict())
81 + return GraylogIndexSetCreationResponse(**response_json)
82 +
83 +async def create_index_set(customer_code: str, session: AsyncSession) -> GraylogIndexSetCreationResponse:
84 + """
85 + Creates an index set for a new customer.
86 +
87 + Args:
88 + request (ProvisionNewCustomer): The request object containing the customer information.
89 +
90 + Returns:
91 + GraylogIndexSetCreationResponse: The response object containing the result of the index set creation.
92 + """
93 + logger.info(f"Creating index set for customer {customer_code}")
94 + index_set_config = await build_index_set_config(customer_code, session)
95 + return await send_index_set_creation_request(index_set_config)
96 +
97 +# ! Event STREAMS ! #
98 +# Function to create event stream configuration
99 +async def build_event_stream_config(
100 + customer_code: str,
101 + index_set_id: str,
102 + session: AsyncSession,
103 +) -> MimecastEventStream:
104 + """
105 + Build the configuration for a Wazuh event stream.
106 +
107 + Args:
108 + request (ProvisionNewCustomer): The request object containing customer information.
109 + index_set_id (str): The ID of the index set.
110 +
111 + Returns:
112 + Office365EventStream: The configured Wazuh event stream.
113 + """
114 + return MimecastEventStream(
115 + title=f"Mimecast EVENTS - {(await get_customer(customer_code, session)).customer.customer_name}",
116 + description=f"Mimecast EVENTS - {(await get_customer(customer_code, session)).customer.customer_name}",
117 + index_set_id=index_set_id,
118 + rules=[
119 + {
120 + "field": "integration",
121 + "type": 1,
122 + "inverted": False,
123 + "value": "mimecast",
124 + },
125 + {
126 + "field": "customer_code",
127 + "type": 1,
128 + "inverted": False,
129 + "value": f"{customer_code}",
130 + },
131 + ],
132 + matching_type="AND",
133 + remove_matches_from_default_stream=True,
134 + content_pack=None,
135 + )
136 +
137 +
138 +async def send_event_stream_creation_request(event_stream: MimecastEventStream) -> StreamCreationResponse:
139 + """
140 + Sends a request to create an event stream.
141 +
142 + Args:
143 + event_stream (WazuhEventStream): The event stream to be created.
144 +
145 + Returns:
146 + StreamCreationResponse: The response containing the created event stream.
147 + """
148 + json_event_stream = json.dumps(event_stream.dict())
149 + logger.info(f"json_event_stream set: {json_event_stream}")
150 + response_json = await send_post_request(endpoint="/api/streams", data=event_stream.dict())
151 + return StreamCreationResponse(**response_json)
152 +
153 +async def create_event_stream(
154 + customer_code: str,
155 + index_set_id: str,
156 + session: AsyncSession,
157 +) -> StreamCreationResponse:
158 + """
159 + Creates an event stream for a customer.
160 +
161 + Args:
162 + request (ProvisionNewCustomer): The request object containing customer information.
163 + index_set_id (str): The ID of the index set.
164 +
165 + Returns:
166 + The result of the event stream creation request.
167 + """
168 + event_stream_config = await build_event_stream_config(customer_code, index_set_id, session)
169 + return await send_event_stream_creation_request(event_stream_config)
170 +
171 +#### ! GRAFANA ! ####
172 +async def create_grafana_datasource(
173 + customer_code: str,
174 + session: AsyncSession,
175 +) -> GrafanaDataSourceCreationResponse:
176 + """
177 + Creates a Grafana Wazuh datasource for a new customer using the OpenSearch Data Source.
178 +
179 + Args:
180 + request (ProvisionNewCustomer): The request object containing customer information.
181 + organization_id (int): The ID of the organization to create the datasource for.
182 + session (AsyncSession): The database session.
183 +
184 + Returns:
185 + GrafanaDataSourceCreationResponse: The response object containing the result of the datasource creation.
186 + """
187 + logger.info("Creating Grafana datasource")
188 + grafana_client = await create_grafana_client("Grafana")
189 + # Switch to the newly created organization
190 + grafana_client.user.switch_actual_user_organisation(
191 + (await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id,
192 + )
193 + datasource_payload = GrafanaDatasource(
194 + name="MIMECAST",
195 + type="grafana-opensearch-datasource",
196 + typeName="OpenSearch",
197 + access="proxy",
198 + url=await get_connector_attribute(connector_id=1, column_name="connector_url", session=session),
199 + database=f"mimecast_{customer_code}*",
200 + basicAuth=True,
201 + basicAuthUser=await get_connector_attribute(connector_id=1, column_name="connector_username", session=session),
202 + secureJsonData={
203 + "basicAuthPassword": await get_connector_attribute(connector_id=1, column_name="connector_password", session=session),
204 + },
205 + isDefault=False,
206 + jsonData={
207 + "database": f"mimecast_{customer_code}*",
208 + "flavor": "opensearch",
209 + "includeFrozen": False,
210 + "logLevelField": "syslog_level",
211 + "logMessageField": "rule_description",
212 + "maxConcurrentShardRequests": 5,
213 + "pplEnabled": True,
214 + "timeField": "timestamp",
215 + "tlsSkipVerify": True,
216 + "version": await get_opensearch_version(),
217 + },
218 + readOnly=True,
219 + )
220 + results = grafana_client.datasource.create_datasource(
221 + datasource=datasource_payload.dict(),
222 + )
223 + return GrafanaDataSourceCreationResponse(**results)
224 +
225 +async def provision_mimecast(provision_mimecast_request: ProvisionMimecastRequest, session: AsyncSession) -> ProvisionMimecastResponse:
226 + """
227 + Provisions Mimecast integration for a customer.
228 +
229 + Args:
230 + provision_mimecast_request (ProvisionMimecastRequest): The request object containing the necessary information for provisioning.
231 + session (AsyncSession, optional): The database session. Defaults to Depends(get_db).
232 +
233 + Returns:
234 + ProvisionMimecastResponse: The response object containing the result of the provisioning.
235 + """
236 + logger.info(f"Provisioning Mimecast integration for customer {provision_mimecast_request.customer_code}.")
237 +
238 + # Create Index Set
239 + index_set_id = (await create_index_set(customer_code=provision_mimecast_request.customer_code, session=session)).data.id
240 + logger.info(f"Index set: {index_set_id}")
241 + # Create event stream
242 + stream_id = (await create_event_stream(provision_mimecast_request.customer_code, index_set_id, session)).data.stream_id
243 + # Start stream
244 + await start_stream(stream_id=stream_id)
245 +
246 + # Grafana Deployment
247 + office365_datasource_uid = (await create_grafana_datasource(customer_code=provision_mimecast_request.customer_code, session=session)).datasource.uid
248 + grafana_o365_folder_id = (
249 + await create_grafana_folder(
250 + organization_id=(await get_customer_meta(provision_mimecast_request.customer_code, session)).customer_meta.customer_meta_grafana_org_id,
251 + folder_title="MIMECAST",
252 + )
253 + ).id
254 + await provision_dashboards(
255 + DashboardProvisionRequest(
256 + dashboards=[dashboard.name for dashboard in MimecastDashboard],
257 + organizationId=(await get_customer_meta(provision_mimecast_request.customer_code, session)).customer_meta.customer_meta_grafana_org_id,
258 + folderId=grafana_o365_folder_id,
259 + datasourceUid=office365_datasource_uid,
260 + ),
261 + )
262 +
263 +
264 + return ProvisionMimecastResponse(success=True, message="Mimecast integration provisioned.")
265 +