@cryptotaxi247 / CoPilot / commits / 3fa404c6

Integrations (#117)

* add security to routes * Add integration details to available integrations * Add endpoint to update available integrations * Add available integrations auth keys functionality * Refactor integration settings retrieval to include auth keys * Add markdown support for integrations * Update image paths in Office365 integration documentation * Adjust integration metadata to integration auth keys * Add update_integration endpoint to routes.py * Add find_customer_integration and get_subscription_id functions * Add office365 router and update send_get_request function * Add Office365 integration to Wazuh configuration * Add office365_template_with_api_type function and update_wazuh_configuration to handle API type errors * Add check for existing Office365 integration * Add error handling for failed Wazuh configuration update * Remove commented code and update update_wazuh_configuration function * Add restart_wazuh_manager function to provision Office365 integration * Add integration response retrieval and authentication key extraction functions docs Add provision_office365_route function docs Add get_wazuh_configuration function docs * Add Wazuh Manager and Graylog sections to provision.py * Add Office365EventStream to Graylog schema * added integrations api * added integrations type * updated dependencies * added integrations page * added integrations list/item component * create pipeline rules * Update Office365 integration documentation * Update Office 365 integration documentation * Add pipeline rules for WAZUH syslog levels * Add Office365 pipeline creation * Fix pipeline title typo and add pipeline connection * Add success message to provision_office365 function * Update error message for missing auth keys in Office365 integration * Moved some functions to graylog services * add office365 dashboard templates * Update Office365Dashboard enum with new dashboard files and add grafana deployment * updated integration markdown viewer * improved auth routing * Update office365.md with code snippets * updated intergration apis * added CustomerIntegrationsList component * Add Alert Creation Provisioning connector * Add Office365 alert provisioning in Praeco * Refactor provision_alert_in_praeco function to use PraecoAlertConfig and update logging messages * Add ALERT_CREATION_PROVISIONING_URL to .env.example * Removed comments * add office365 threat intel to praeco * mimecast markdown * Add Office365 integration handling and update organization ID in alert_creation_settings table * Add Office365 alert creation routes and related functions * Add Azure Active Directory workload to ValidOffice365Workloads enum * updated dependencies * updated customer integrations * Add create_threat_intel_alert service and update create_office365_threat_intel_alert function * updated customer integrations * updated customer integrations * return integration_service_id * updated unavailable integrations check * Add integration_service_name field to CustomerIntegrations model and related functions * updated customer integrations * added deployed status * Add update_customer_integration_table function to provision Office365 integration * updated customer integrations * updated customer integrations * Mimecast integration siem log collection * Add validation for customer meta existence * Add checkpoint file to .gitignore and process log files in mimecast.py * mimecast integration done * Add MimecastScheduledResponse model and include Mimecast scheduler route * Update Mimecast checkpoint file --------- Co-authored-by: Davide Di Modica <webmaster.ddm@gmail.com>

taylor_socfortress committed Jan 23, 2024 at 17:28 UTC 3fa404c6afec3a9d41d66598fdd7cecc52690b84
86 files changed +41451 -2193
.env.example
+2
@@ -57,3 +57,5 @@ WAZUH_WORKER_PROVISIONING_URL=http://example.com
57
58 EVENT_SHIPPER_URL=graylog_host
59 GELF_INPUT_PORT=gelf_port
60 +
61 +ALERT_CREATION_PROVISIONING_URL=http://example.com
.gitignore
+1
@@ -46,3 +46,4 @@ site/
46 backend/file-store/api.config.yaml
47 unplugin.components.d.ts
48 package-lock.json
49 +*.checkpoint
backend/app/connectors/grafana/dashboards/Office365/active_directory.json new
+4256
@@ -0,0 +1,4256 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "9.3.6",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "displayMode": "auto",
261 + "inspect": false
262 + },
263 + "mappings": [],
264 + "thresholds": {
265 + "mode": "absolute",
266 + "steps": [
267 + {
268 + "color": "red",
269 + "value": null
270 + }
271 + ]
272 + }
273 + },
274 + "overrides": [
275 + {
276 + "matcher": {
277 + "id": "byName",
278 + "options": "Count"
279 + },
280 + "properties": [
281 + {
282 + "id": "displayName",
283 + "value": "EVENTS"
284 + },
285 + {
286 + "id": "unit",
287 + "value": "short"
288 + },
289 + {
290 + "id": "decimals",
291 + "value": -1
292 + },
293 + {
294 + "id": "custom.align"
295 + },
296 + {
297 + "id": "thresholds",
298 + "value": {
299 + "mode": "absolute",
300 + "steps": [
301 + {
302 + "color": "red",
303 + "value": null
304 + }
305 + ]
306 + }
307 + }
308 + ]
309 + }
310 + ]
311 + },
312 + "gridPos": {
313 + "h": 7,
314 + "w": 6,
315 + "x": 8,
316 + "y": 0
317 + },
318 + "id": 54,
319 + "options": {
320 + "footer": {
321 + "fields": "",
322 + "reducer": [
323 + "sum"
324 + ],
325 + "show": false
326 + },
327 + "showHeader": true
328 + },
329 + "pluginVersion": "9.3.6",
330 + "targets": [
331 + {
332 + "bucketAggs": [
333 + {
334 + "fake": true,
335 + "field": "data_office365_Operation",
336 + "id": "4",
337 + "settings": {
338 + "min_doc_count": 1,
339 + "order": "desc",
340 + "orderBy": "_count",
341 + "size": "0"
342 + },
343 + "type": "terms"
344 + }
345 + ],
346 + "datasource": {
347 + "type": "elasticsearch",
348 + "uid": "replace_datasource_uid"
349 + },
350 + "metrics": [
351 + {
352 + "field": "select field",
353 + "id": "1",
354 + "type": "count"
355 + }
356 + ],
357 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
358 + "refId": "A",
359 + "timeField": "timestamp"
360 + }
361 + ],
362 + "title": "EVENTS BY OPERATION",
363 + "transformations": [
364 + {
365 + "id": "merge",
366 + "options": {
367 + "reducers": []
368 + }
369 + },
370 + {
371 + "id": "organize",
372 + "options": {
373 + "excludeByName": {},
374 + "indexByName": {},
375 + "renameByName": {
376 + "Count": "EVENTS",
377 + "data_office365_Operation": "OPERATION"
378 + }
379 + }
380 + }
381 + ],
382 + "type": "table"
383 + },
384 + {
385 + "datasource": {
386 + "type": "elasticsearch",
387 + "uid": "replace_datasource_uid"
388 + },
389 + "fieldConfig": {
390 + "defaults": {
391 + "mappings": [
392 + {
393 + "options": {
394 + "match": "null",
395 + "result": {
396 + "text": "N/A"
397 + }
398 + },
399 + "type": "special"
400 + }
401 + ],
402 + "thresholds": {
403 + "mode": "absolute",
404 + "steps": [
405 + {
406 + "color": "blue",
407 + "value": null
408 + }
409 + ]
410 + },
411 + "unit": "locale"
412 + },
413 + "overrides": []
414 + },
415 + "gridPos": {
416 + "h": 7,
417 + "w": 4,
418 + "x": 14,
419 + "y": 0
420 + },
421 + "id": 59,
422 + "links": [],
423 + "options": {
424 + "colorMode": "value",
425 + "graphMode": "area",
426 + "justifyMode": "auto",
427 + "orientation": "horizontal",
428 + "reduceOptions": {
429 + "calcs": [
430 + "sum"
431 + ],
432 + "fields": "",
433 + "values": false
434 + },
435 + "text": {},
436 + "textMode": "auto"
437 + },
438 + "pluginVersion": "9.3.6",
439 + "targets": [
440 + {
441 + "bucketAggs": [
442 + {
443 + "$$hashKey": "object:331",
444 + "field": "timestamp",
445 + "id": "2",
446 + "settings": {
447 + "interval": "auto",
448 + "min_doc_count": 0,
449 + "trimEdges": 0
450 + },
451 + "type": "date_histogram"
452 + }
453 + ],
454 + "datasource": {
455 + "type": "elasticsearch",
456 + "uid": "replace_datasource_uid"
457 + },
458 + "metrics": [
459 + {
460 + "$$hashKey": "object:329",
461 + "field": "select field",
462 + "id": "1",
463 + "type": "count"
464 + }
465 + ],
466 + "query": "data_office365_Operation:\"Add device.\" OR data_office365_Operation:\"Add registered owner to device.\" OR data_office365_Operation:\"Add registered users to device.\"",
467 + "refId": "A",
468 + "timeField": "timestamp"
469 + }
470 + ],
471 + "title": "DEVICE EVENTS (Total)",
472 + "type": "stat"
473 + },
474 + {
475 + "datasource": {
476 + "type": "elasticsearch",
477 + "uid": "replace_datasource_uid"
478 + },
479 + "fieldConfig": {
480 + "defaults": {
481 + "color": {
482 + "mode": "thresholds"
483 + },
484 + "custom": {
485 + "align": "auto",
486 + "displayMode": "auto",
487 + "inspect": false
488 + },
489 + "mappings": [],
490 + "thresholds": {
491 + "mode": "absolute",
492 + "steps": [
493 + {
494 + "color": "red",
495 + "value": null
496 + }
497 + ]
498 + }
499 + },
500 + "overrides": [
501 + {
502 + "matcher": {
503 + "id": "byName",
504 + "options": "Count"
505 + },
506 + "properties": [
507 + {
508 + "id": "displayName",
509 + "value": "EVENTS"
510 + },
511 + {
512 + "id": "unit",
513 + "value": "short"
514 + },
515 + {
516 + "id": "decimals",
517 + "value": -1
518 + },
519 + {
520 + "id": "custom.align"
521 + },
522 + {
523 + "id": "thresholds",
524 + "value": {
525 + "mode": "absolute",
526 + "steps": [
527 + {
528 + "color": "red",
529 + "value": null
530 + }
531 + ]
532 + }
533 + }
534 + ]
535 + }
536 + ]
537 + },
538 + "gridPos": {
539 + "h": 7,
540 + "w": 6,
541 + "x": 18,
542 + "y": 0
543 + },
544 + "id": 60,
545 + "options": {
546 + "footer": {
547 + "fields": "",
548 + "reducer": [
549 + "sum"
550 + ],
551 + "show": false
552 + },
553 + "showHeader": true
554 + },
555 + "pluginVersion": "9.3.6",
556 + "targets": [
557 + {
558 + "bucketAggs": [
559 + {
560 + "fake": true,
561 + "field": "data_office365_Operation",
562 + "id": "4",
563 + "settings": {
564 + "min_doc_count": 1,
565 + "order": "desc",
566 + "orderBy": "_count",
567 + "size": "0"
568 + },
569 + "type": "terms"
570 + }
571 + ],
572 + "datasource": {
573 + "type": "elasticsearch",
574 + "uid": "replace_datasource_uid"
575 + },
576 + "metrics": [
577 + {
578 + "field": "select field",
579 + "id": "1",
580 + "type": "count"
581 + }
582 + ],
583 + "query": "data_office365_Operation:\"Add device.\" OR data_office365_Operation:\"Add registered owner to device.\" OR data_office365_Operation:\"Add registered users to device.\"",
584 + "refId": "A",
585 + "timeField": "timestamp"
586 + }
587 + ],
588 + "title": "DEVICE EVENTS BY OPERATION",
589 + "transformations": [
590 + {
591 + "id": "merge",
592 + "options": {
593 + "reducers": []
594 + }
595 + },
596 + {
597 + "id": "organize",
598 + "options": {
599 + "excludeByName": {},
600 + "indexByName": {},
601 + "renameByName": {
602 + "Count": "EVENTS",
603 + "data_office365_Operation": "OPERATION"
604 + }
605 + }
606 + }
607 + ],
608 + "type": "table"
609 + },
610 + {
611 + "datasource": {
612 + "type": "elasticsearch",
613 + "uid": "replace_datasource_uid"
614 + },
615 + "fieldConfig": {
616 + "defaults": {
617 + "mappings": [
618 + {
619 + "options": {
620 + "match": "null",
621 + "result": {
622 + "text": "N/A"
623 + }
624 + },
625 + "type": "special"
626 + }
627 + ],
628 + "thresholds": {
629 + "mode": "absolute",
630 + "steps": [
631 + {
632 + "color": "blue",
633 + "value": null
634 + }
635 + ]
636 + },
637 + "unit": "locale"
638 + },
639 + "overrides": []
640 + },
641 + "gridPos": {
642 + "h": 7,
643 + "w": 4,
644 + "x": 0,
645 + "y": 7
646 + },
647 + "id": 65,
648 + "links": [],
649 + "options": {
650 + "colorMode": "value",
651 + "graphMode": "area",
652 + "justifyMode": "auto",
653 + "orientation": "horizontal",
654 + "reduceOptions": {
655 + "calcs": [
656 + "sum"
657 + ],
658 + "fields": "",
659 + "values": false
660 + },
661 + "text": {},
662 + "textMode": "auto"
663 + },
664 + "pluginVersion": "9.3.6",
665 + "targets": [
666 + {
667 + "bucketAggs": [
668 + {
669 + "$$hashKey": "object:331",
670 + "field": "timestamp",
671 + "id": "2",
672 + "settings": {
673 + "interval": "auto",
674 + "min_doc_count": 0,
675 + "trimEdges": 0
676 + },
677 + "type": "date_histogram"
678 + }
679 + ],
680 + "datasource": {
681 + "type": "elasticsearch",
682 + "uid": "replace_datasource_uid"
683 + },
684 + "metrics": [
685 + {
686 + "$$hashKey": "object:329",
687 + "field": "select field",
688 + "id": "1",
689 + "type": "count"
690 + }
691 + ],
692 + "query": "data_office365_Operation:\"Add user.\"",
693 + "refId": "A",
694 + "timeField": "timestamp"
695 + }
696 + ],
697 + "title": "USERS ADDED EVENTS (Total)",
698 + "type": "stat"
699 + },
700 + {
701 + "datasource": {
702 + "type": "elasticsearch",
703 + "uid": "replace_datasource_uid"
704 + },
705 + "fieldConfig": {
706 + "defaults": {
707 + "color": {
708 + "mode": "palette-classic"
709 + },
710 + "custom": {
711 + "hideFrom": {
712 + "legend": false,
713 + "tooltip": false,
714 + "viz": false
715 + }
716 + },
717 + "mappings": []
718 + },
719 + "overrides": [
720 + {
721 + "matcher": {
722 + "id": "byName",
723 + "options": "Count"
724 + },
725 + "properties": [
726 + {
727 + "id": "displayName",
728 + "value": "EVENTS"
729 + },
730 + {
731 + "id": "unit",
732 + "value": "short"
733 + },
734 + {
735 + "id": "decimals",
736 + "value": -1
737 + }
738 + ]
739 + },
740 + {
741 + "matcher": {
742 + "id": "byName",
743 + "options": "Failure"
744 + },
745 + "properties": [
746 + {
747 + "id": "color",
748 + "value": {
749 + "fixedColor": "orange",
750 + "mode": "fixed"
751 + }
752 + }
753 + ]
754 + }
755 + ]
756 + },
757 + "gridPos": {
758 + "h": 7,
759 + "w": 4,
760 + "x": 4,
761 + "y": 7
762 + },
763 + "id": 66,
764 + "options": {
765 + "legend": {
766 + "displayMode": "table",
767 + "placement": "bottom",
768 + "showLegend": true
769 + },
770 + "pieType": "donut",
771 + "reduceOptions": {
772 + "calcs": [
773 + "sum"
774 + ],
775 + "fields": "",
776 + "values": false
777 + },
778 + "tooltip": {
779 + "mode": "single",
780 + "sort": "none"
781 + }
782 + },
783 + "pluginVersion": "8.5.1",
784 + "targets": [
785 + {
786 + "bucketAggs": [
787 + {
788 + "fake": true,
789 + "field": "data_office365_ResultStatus",
790 + "id": "4",
791 + "settings": {
792 + "min_doc_count": 1,
793 + "order": "desc",
794 + "orderBy": "_count",
795 + "size": "10"
796 + },
797 + "type": "terms"
798 + },
799 + {
800 + "field": "data_office365_CreationTime",
801 + "id": "5",
802 + "settings": {
803 + "interval": "auto",
804 + "min_doc_count": "0",
805 + "timeZone": "utc",
806 + "trimEdges": "0"
807 + },
808 + "type": "date_histogram"
809 + }
810 + ],
811 + "datasource": {
812 + "type": "elasticsearch",
813 + "uid": "replace_datasource_uid"
814 + },
815 + "metrics": [
816 + {
817 + "field": "select field",
818 + "id": "1",
819 + "type": "count"
820 + }
821 + ],
822 + "query": "data_office365_Operation:\"Add user.\" AND rule_level:$rule_level",
823 + "refId": "A",
824 + "timeField": "timestamp"
825 + }
826 + ],
827 + "title": "USERS ADDED EVENTS (Results)",
828 + "transformations": [],
829 + "type": "piechart"
830 + },
831 + {
832 + "datasource": {
833 + "type": "elasticsearch",
834 + "uid": "replace_datasource_uid"
835 + },
836 + "fieldConfig": {
837 + "defaults": {
838 + "color": {
839 + "mode": "thresholds"
840 + },
841 + "custom": {
842 + "align": "auto",
843 + "displayMode": "auto",
844 + "inspect": false
845 + },
846 + "mappings": [],
847 + "thresholds": {
848 + "mode": "absolute",
849 + "steps": [
850 + {
851 + "color": "red",
852 + "value": null
853 + }
854 + ]
855 + }
856 + },
857 + "overrides": [
858 + {
859 + "matcher": {
860 + "id": "byName",
861 + "options": "Count"
862 + },
863 + "properties": [
864 + {
865 + "id": "displayName",
866 + "value": "EVENTS"
867 + },
868 + {
869 + "id": "unit",
870 + "value": "short"
871 + },
872 + {
873 + "id": "decimals",
874 + "value": -1
875 + },
876 + {
877 + "id": "custom.align"
878 + },
879 + {
880 + "id": "thresholds",
881 + "value": {
882 + "mode": "absolute",
883 + "steps": [
884 + {
885 + "color": "red",
886 + "value": null
887 + }
888 + ]
889 + }
890 + }
891 + ]
892 + },
893 + {
894 + "matcher": {
895 + "id": "byName",
896 + "options": "data_office365_ResultStatus"
897 + },
898 + "properties": [
899 + {
900 + "id": "custom.displayMode",
901 + "value": "color-text"
902 + },
903 + {
904 + "id": "mappings",
905 + "value": [
906 + {
907 + "options": {
908 + "Failure": {
909 + "color": "orange",
910 + "index": 0
911 + },
912 + "Success": {
913 + "color": "green",
914 + "index": 1
915 + }
916 + },
917 + "type": "value"
918 + }
919 + ]
920 + }
921 + ]
922 + }
923 + ]
924 + },
925 + "gridPos": {
926 + "h": 7,
927 + "w": 6,
928 + "x": 8,
929 + "y": 7
930 + },
931 + "id": 67,
932 + "options": {
933 + "footer": {
934 + "fields": "",
935 + "reducer": [
936 + "sum"
937 + ],
938 + "show": false
939 + },
940 + "showHeader": true
941 + },
942 + "pluginVersion": "9.3.6",
943 + "targets": [
944 + {
945 + "bucketAggs": [
946 + {
947 + "fake": true,
948 + "field": "data_office365_ResultStatus",
949 + "id": "4",
950 + "settings": {
951 + "min_doc_count": 1,
952 + "order": "desc",
953 + "orderBy": "_count",
954 + "size": "0"
955 + },
956 + "type": "terms"
957 + }
958 + ],
959 + "datasource": {
960 + "type": "elasticsearch",
961 + "uid": "replace_datasource_uid"
962 + },
963 + "metrics": [
964 + {
965 + "field": "select field",
966 + "id": "1",
967 + "type": "count"
968 + }
969 + ],
970 + "query": "data_office365_Operation:\"Add user.\" AND rule_level:$rule_level",
971 + "refId": "A",
972 + "timeField": "timestamp"
973 + }
974 + ],
975 + "title": "USERS ADDED EVENTS (Results)",
976 + "transformations": [
977 + {
978 + "id": "merge",
979 + "options": {
980 + "reducers": []
981 + }
982 + },
983 + {
984 + "id": "organize",
985 + "options": {
986 + "excludeByName": {},
987 + "indexByName": {},
988 + "renameByName": {
989 + "Count": "EVENTS",
990 + "data_office365_Operation": "OPERATION",
991 + "data_office365_ResultStatus": "RESULT"
992 + }
993 + }
994 + }
995 + ],
996 + "type": "table"
997 + },
998 + {
999 + "datasource": {
1000 + "type": "elasticsearch",
1001 + "uid": "replace_datasource_uid"
1002 + },
1003 + "fieldConfig": {
1004 + "defaults": {
1005 + "color": {
1006 + "mode": "thresholds"
1007 + },
1008 + "custom": {
1009 + "align": "auto",
1010 + "displayMode": "auto",
1011 + "inspect": false
1012 + },
1013 + "mappings": [],
1014 + "thresholds": {
1015 + "mode": "absolute",
1016 + "steps": [
1017 + {
1018 + "color": "red",
1019 + "value": null
1020 + }
1021 + ]
1022 + }
1023 + },
1024 + "overrides": [
1025 + {
1026 + "matcher": {
1027 + "id": "byName",
1028 + "options": "Count"
1029 + },
1030 + "properties": [
1031 + {
1032 + "id": "displayName",
1033 + "value": "EVENTS"
1034 + },
1035 + {
1036 + "id": "unit",
1037 + "value": "short"
1038 + },
1039 + {
1040 + "id": "decimals",
1041 + "value": -1
1042 + },
1043 + {
1044 + "id": "custom.align"
1045 + },
1046 + {
1047 + "id": "thresholds",
1048 + "value": {
1049 + "mode": "absolute",
1050 + "steps": [
1051 + {
1052 + "color": "red",
1053 + "value": null
1054 + }
1055 + ]
1056 + }
1057 + }
1058 + ]
1059 + },
1060 + {
1061 + "matcher": {
1062 + "id": "byName",
1063 + "options": "RESULT"
1064 + },
1065 + "properties": [
1066 + {
1067 + "id": "custom.displayMode",
1068 + "value": "color-text"
1069 + },
1070 + {
1071 + "id": "mappings",
1072 + "value": [
1073 + {
1074 + "options": {
1075 + "Failure": {
1076 + "color": "orange",
1077 + "index": 0
1078 + },
1079 + "Success": {
1080 + "color": "green",
1081 + "index": 1
1082 + }
1083 + },
1084 + "type": "value"
1085 + }
1086 + ]
1087 + }
1088 + ]
1089 + }
1090 + ]
1091 + },
1092 + "gridPos": {
1093 + "h": 7,
1094 + "w": 10,
1095 + "x": 14,
1096 + "y": 7
1097 + },
1098 + "id": 68,
1099 + "options": {
1100 + "footer": {
1101 + "fields": "",
1102 + "reducer": [
1103 + "sum"
1104 + ],
1105 + "show": false
1106 + },
1107 + "showHeader": true
1108 + },
1109 + "pluginVersion": "9.3.6",
1110 + "targets": [
1111 + {
1112 + "bucketAggs": [
1113 + {
1114 + "fake": true,
1115 + "field": "data_office365_ObjectId",
1116 + "id": "4",
1117 + "settings": {
1118 + "min_doc_count": 1,
1119 + "order": "desc",
1120 + "orderBy": "_count",
1121 + "size": "0"
1122 + },
1123 + "type": "terms"
1124 + },
1125 + {
1126 + "field": "data_office365_ResultStatus",
1127 + "id": "5",
1128 + "settings": {
1129 + "min_doc_count": "1",
1130 + "order": "desc",
1131 + "orderBy": "_count",
1132 + "size": "10"
1133 + },
1134 + "type": "terms"
1135 + }
1136 + ],
1137 + "datasource": {
1138 + "type": "elasticsearch",
1139 + "uid": "replace_datasource_uid"
1140 + },
1141 + "metrics": [
1142 + {
1143 + "field": "select field",
1144 + "id": "1",
1145 + "type": "count"
1146 + }
1147 + ],
1148 + "query": "data_office365_Operation:\"Add user.\" AND rule_level:$rule_level",
1149 + "refId": "A",
1150 + "timeField": "timestamp"
1151 + }
1152 + ],
1153 + "title": "USERS ADDED EVENTS (Accounts)",
1154 + "transformations": [
1155 + {
1156 + "id": "merge",
1157 + "options": {
1158 + "reducers": []
1159 + }
1160 + },
1161 + {
1162 + "id": "organize",
1163 + "options": {
1164 + "excludeByName": {},
1165 + "indexByName": {},
1166 + "renameByName": {
1167 + "Count": "EVENTS",
1168 + "data_office365_ObjectId": "ACCOUNT",
1169 + "data_office365_Operation": "OPERATION",
1170 + "data_office365_ResultStatus": "RESULT"
1171 + }
1172 + }
1173 + }
1174 + ],
1175 + "type": "table"
1176 + },
1177 + {
1178 + "datasource": {
1179 + "type": "elasticsearch",
1180 + "uid": "replace_datasource_uid"
1181 + },
1182 + "fieldConfig": {
1183 + "defaults": {
1184 + "mappings": [
1185 + {
1186 + "options": {
1187 + "match": "null",
1188 + "result": {
1189 + "text": "N/A"
1190 + }
1191 + },
1192 + "type": "special"
1193 + }
1194 + ],
1195 + "thresholds": {
1196 + "mode": "absolute",
1197 + "steps": [
1198 + {
1199 + "color": "orange",
1200 + "value": null
1201 + }
1202 + ]
1203 + },
1204 + "unit": "locale"
1205 + },
1206 + "overrides": []
1207 + },
1208 + "gridPos": {
1209 + "h": 7,
1210 + "w": 4,
1211 + "x": 0,
1212 + "y": 14
1213 + },
1214 + "id": 69,
1215 + "links": [],
1216 + "options": {
1217 + "colorMode": "value",
1218 + "graphMode": "area",
1219 + "justifyMode": "auto",
1220 + "orientation": "horizontal",
1221 + "reduceOptions": {
1222 + "calcs": [
1223 + "sum"
1224 + ],
1225 + "fields": "",
1226 + "values": false
1227 + },
1228 + "text": {},
1229 + "textMode": "auto"
1230 + },
1231 + "pluginVersion": "9.3.6",
1232 + "targets": [
1233 + {
1234 + "bucketAggs": [
1235 + {
1236 + "$$hashKey": "object:331",
1237 + "field": "timestamp",
1238 + "id": "2",
1239 + "settings": {
1240 + "interval": "auto",
1241 + "min_doc_count": 0,
1242 + "trimEdges": 0
1243 + },
1244 + "type": "date_histogram"
1245 + }
1246 + ],
1247 + "datasource": {
1248 + "type": "elasticsearch",
1249 + "uid": "replace_datasource_uid"
1250 + },
1251 + "metrics": [
1252 + {
1253 + "$$hashKey": "object:329",
1254 + "field": "select field",
1255 + "id": "1",
1256 + "type": "count"
1257 + }
1258 + ],
1259 + "query": "data_office365_Operation:UserLoggedIn AND (data_office365_UserId:*#EXT# OR data_office365_UserId:*gmail.com)",
1260 + "refId": "A",
1261 + "timeField": "timestamp"
1262 + }
1263 + ],
1264 + "title": "EXTERNAL USERS LOGIN (Total)",
1265 + "type": "stat"
1266 + },
1267 + {
1268 + "datasource": {
1269 + "type": "elasticsearch",
1270 + "uid": "replace_datasource_uid"
1271 + },
1272 + "fieldConfig": {
1273 + "defaults": {
1274 + "color": {
1275 + "mode": "thresholds"
1276 + },
1277 + "custom": {
1278 + "align": "auto",
1279 + "displayMode": "auto",
1280 + "inspect": false
1281 + },
1282 + "mappings": [],
1283 + "thresholds": {
1284 + "mode": "absolute",
1285 + "steps": [
1286 + {
1287 + "color": "red",
1288 + "value": null
1289 + }
1290 + ]
1291 + }
1292 + },
1293 + "overrides": [
1294 + {
1295 + "matcher": {
1296 + "id": "byName",
1297 + "options": "Count"
1298 + },
1299 + "properties": [
1300 + {
1301 + "id": "displayName",
1302 + "value": "EVENTS"
1303 + },
1304 + {
1305 + "id": "unit",
1306 + "value": "short"
1307 + },
1308 + {
1309 + "id": "decimals",
1310 + "value": -1
1311 + },
1312 + {
1313 + "id": "custom.align"
1314 + },
1315 + {
1316 + "id": "thresholds",
1317 + "value": {
1318 + "mode": "absolute",
1319 + "steps": [
1320 + {
1321 + "color": "red",
1322 + "value": null
1323 + }
1324 + ]
1325 + }
1326 + }
1327 + ]
1328 + },
1329 + {
1330 + "matcher": {
1331 + "id": "byName",
1332 + "options": "data_office365_ResultStatus"
1333 + },
1334 + "properties": [
1335 + {
1336 + "id": "custom.displayMode",
1337 + "value": "color-text"
1338 + },
1339 + {
1340 + "id": "mappings",
1341 + "value": [
1342 + {
1343 + "options": {
1344 + "Failure": {
1345 + "color": "orange",
1346 + "index": 0
1347 + }
1348 + },
1349 + "type": "value"
1350 + }
1351 + ]
1352 + }
1353 + ]
1354 + }
1355 + ]
1356 + },
1357 + "gridPos": {
1358 + "h": 7,
1359 + "w": 5,
1360 + "x": 4,
1361 + "y": 14
1362 + },
1363 + "id": 70,
1364 + "options": {
1365 + "footer": {
1366 + "fields": "",
1367 + "reducer": [
1368 + "sum"
1369 + ],
1370 + "show": false
1371 + },
1372 + "showHeader": true
1373 + },
1374 + "pluginVersion": "9.3.6",
1375 + "targets": [
1376 + {
1377 + "bucketAggs": [
1378 + {
1379 + "fake": true,
1380 + "field": "data_office365_ResultStatus",
1381 + "id": "4",
1382 + "settings": {
1383 + "min_doc_count": 1,
1384 + "order": "desc",
1385 + "orderBy": "_count",
1386 + "size": "0"
1387 + },
1388 + "type": "terms"
1389 + }
1390 + ],
1391 + "datasource": {
1392 + "type": "elasticsearch",
1393 + "uid": "replace_datasource_uid"
1394 + },
1395 + "metrics": [
1396 + {
1397 + "field": "select field",
1398 + "id": "1",
1399 + "type": "count"
1400 + }
1401 + ],
1402 + "query": "data_office365_Operation:UserLoggedIn AND (data_office365_UserId:*#EXT# OR data_office365_UserId:*gmail.com) AND rule_level:$rule_level",
1403 + "refId": "A",
1404 + "timeField": "timestamp"
1405 + }
1406 + ],
1407 + "title": "EXTERNAL USERS LOGIN (Results)",
1408 + "transformations": [
1409 + {
1410 + "id": "merge",
1411 + "options": {
1412 + "reducers": []
1413 + }
1414 + },
1415 + {
1416 + "id": "organize",
1417 + "options": {
1418 + "excludeByName": {},
1419 + "indexByName": {},
1420 + "renameByName": {
1421 + "Count": "EVENTS",
1422 + "data_office365_Operation": "OPERATION",
1423 + "data_office365_ResultStatus": "RESULT"
1424 + }
1425 + }
1426 + }
1427 + ],
1428 + "type": "table"
1429 + },
1430 + {
1431 + "datasource": {
1432 + "type": "elasticsearch",
1433 + "uid": "replace_datasource_uid"
1434 + },
1435 + "fieldConfig": {
1436 + "defaults": {
1437 + "color": {
1438 + "mode": "thresholds"
1439 + },
1440 + "custom": {
1441 + "align": "auto",
1442 + "displayMode": "auto",
1443 + "inspect": false
1444 + },
1445 + "mappings": [],
1446 + "thresholds": {
1447 + "mode": "absolute",
1448 + "steps": [
1449 + {
1450 + "color": "red",
1451 + "value": null
1452 + }
1453 + ]
1454 + }
1455 + },
1456 + "overrides": [
1457 + {
1458 + "matcher": {
1459 + "id": "byName",
1460 + "options": "Count"
1461 + },
1462 + "properties": [
1463 + {
1464 + "id": "displayName",
1465 + "value": "EVENTS"
1466 + },
1467 + {
1468 + "id": "unit",
1469 + "value": "short"
1470 + },
1471 + {
1472 + "id": "decimals",
1473 + "value": -1
1474 + },
1475 + {
1476 + "id": "custom.align"
1477 + },
1478 + {
1479 + "id": "thresholds",
1480 + "value": {
1481 + "mode": "absolute",
1482 + "steps": [
1483 + {
1484 + "color": "red",
1485 + "value": null
1486 + }
1487 + ]
1488 + }
1489 + }
1490 + ]
1491 + },
1492 + {
1493 + "matcher": {
1494 + "id": "byName",
1495 + "options": "RESULT"
1496 + },
1497 + "properties": [
1498 + {
1499 + "id": "custom.displayMode",
1500 + "value": "color-text"
1501 + },
1502 + {
1503 + "id": "mappings",
1504 + "value": [
1505 + {
1506 + "options": {
1507 + "Failure": {
1508 + "color": "orange",
1509 + "index": 0
1510 + }
1511 + },
1512 + "type": "value"
1513 + }
1514 + ]
1515 + }
1516 + ]
1517 + }
1518 + ]
1519 + },
1520 + "gridPos": {
1521 + "h": 7,
1522 + "w": 6,
1523 + "x": 9,
1524 + "y": 14
1525 + },
1526 + "id": 71,
1527 + "options": {
1528 + "footer": {
1529 + "fields": "",
1530 + "reducer": [
1531 + "sum"
1532 + ],
1533 + "show": false
1534 + },
1535 + "showHeader": true
1536 + },
1537 + "pluginVersion": "9.3.6",
1538 + "targets": [
1539 + {
1540 + "bucketAggs": [
1541 + {
1542 + "fake": true,
1543 + "field": "data_office365_UserId",
1544 + "id": "4",
1545 + "settings": {
1546 + "min_doc_count": 1,
1547 + "order": "desc",
1548 + "orderBy": "_count",
1549 + "size": "0"
1550 + },
1551 + "type": "terms"
1552 + },
1553 + {
1554 + "field": "data_office365_ResultStatus",
1555 + "id": "5",
1556 + "settings": {
1557 + "min_doc_count": "1",
1558 + "order": "desc",
1559 + "orderBy": "_count",
1560 + "size": "10"
1561 + },
1562 + "type": "terms"
1563 + }
1564 + ],
1565 + "datasource": {
1566 + "type": "elasticsearch",
1567 + "uid": "replace_datasource_uid"
1568 + },
1569 + "metrics": [
1570 + {
1571 + "field": "select field",
1572 + "id": "1",
1573 + "type": "count"
1574 + }
1575 + ],
1576 + "query": "data_office365_Operation:UserLoggedIn AND (data_office365_UserId:*#EXT# OR data_office365_UserId:*gmail.com) AND rule_level:$rule_level",
1577 + "refId": "A",
1578 + "timeField": "timestamp"
1579 + }
1580 + ],
1581 + "title": "EXTERNAL USERS LOGIN (Accounts)",
1582 + "transformations": [
1583 + {
1584 + "id": "merge",
1585 + "options": {
1586 + "reducers": []
1587 + }
1588 + },
1589 + {
1590 + "id": "organize",
1591 + "options": {
1592 + "excludeByName": {},
1593 + "indexByName": {},
1594 + "renameByName": {
1595 + "Count": "EVENTS",
1596 + "data_office365_ObjectId": "ACCOUNT",
1597 + "data_office365_Operation": "OPERATION",
1598 + "data_office365_ResultStatus": "RESULT",
1599 + "data_office365_UserId": "ACCOUNT"
1600 + }
1601 + }
1602 + }
1603 + ],
1604 + "type": "table"
1605 + },
1606 + {
1607 + "datasource": {
1608 + "type": "elasticsearch",
1609 + "uid": "replace_datasource_uid"
1610 + },
1611 + "fieldConfig": {
1612 + "defaults": {
1613 + "mappings": [
1614 + {
1615 + "options": {
1616 + "match": "null",
1617 + "result": {
1618 + "text": "N/A"
1619 + }
1620 + },
1621 + "type": "special"
1622 + }
1623 + ],
1624 + "thresholds": {
1625 + "mode": "absolute",
1626 + "steps": [
1627 + {
1628 + "color": "orange",
1629 + "value": null
1630 + }
1631 + ]
1632 + },
1633 + "unit": "locale"
1634 + },
1635 + "overrides": []
1636 + },
1637 + "gridPos": {
1638 + "h": 7,
1639 + "w": 4,
1640 + "x": 15,
1641 + "y": 14
1642 + },
1643 + "id": 73,
1644 + "links": [],
1645 + "options": {
1646 + "colorMode": "value",
1647 + "graphMode": "area",
1648 + "justifyMode": "auto",
1649 + "orientation": "horizontal",
1650 + "reduceOptions": {
1651 + "calcs": [
1652 + "sum"
1653 + ],
1654 + "fields": "",
1655 + "values": false
1656 + },
1657 + "text": {},
1658 + "textMode": "auto"
1659 + },
1660 + "pluginVersion": "9.3.6",
1661 + "targets": [
1662 + {
1663 + "bucketAggs": [
1664 + {
1665 + "$$hashKey": "object:331",
1666 + "field": "timestamp",
1667 + "id": "2",
1668 + "settings": {
1669 + "interval": "auto",
1670 + "min_doc_count": 0,
1671 + "trimEdges": 0
1672 + },
1673 + "type": "date_histogram"
1674 + }
1675 + ],
1676 + "datasource": {
1677 + "type": "elasticsearch",
1678 + "uid": "replace_datasource_uid"
1679 + },
1680 + "metrics": [
1681 + {
1682 + "$$hashKey": "object:329",
1683 + "field": "select field",
1684 + "id": "1",
1685 + "type": "count"
1686 + }
1687 + ],
1688 + "query": "data_office365_Operation:UserLoggedIn AND data_office365_ResultStatus:Success AND data_office365_ExtendedProperties_UserAuthenticationMethod:1",
1689 + "refId": "A",
1690 + "timeField": "timestamp"
1691 + }
1692 + ],
1693 + "title": "USERS LOGGEDIN NON MFA (Total)",
1694 + "type": "stat"
1695 + },
1696 + {
1697 + "datasource": {
1698 + "type": "elasticsearch",
1699 + "uid": "replace_datasource_uid"
1700 + },
1701 + "fieldConfig": {
1702 + "defaults": {
1703 + "color": {
1704 + "mode": "thresholds"
1705 + },
1706 + "custom": {
1707 + "align": "auto",
1708 + "displayMode": "auto",
1709 + "inspect": false
1710 + },
1711 + "mappings": [],
1712 + "thresholds": {
1713 + "mode": "absolute",
1714 + "steps": [
1715 + {
1716 + "color": "red",
1717 + "value": null
1718 + }
1719 + ]
1720 + }
1721 + },
1722 + "overrides": [
1723 + {
1724 + "matcher": {
1725 + "id": "byName",
1726 + "options": "Count"
1727 + },
1728 + "properties": [
1729 + {
1730 + "id": "displayName",
1731 + "value": "EVENTS"
1732 + },
1733 + {
1734 + "id": "unit",
1735 + "value": "short"
1736 + },
1737 + {
1738 + "id": "decimals",
1739 + "value": -1
1740 + },
1741 + {
1742 + "id": "custom.align"
1743 + },
1744 + {
1745 + "id": "thresholds",
1746 + "value": {
1747 + "mode": "absolute",
1748 + "steps": [
1749 + {
1750 + "color": "red",
1751 + "value": null
1752 + }
1753 + ]
1754 + }
1755 + }
1756 + ]
1757 + },
1758 + {
1759 + "matcher": {
1760 + "id": "byName",
1761 + "options": "RESULT"
1762 + },
1763 + "properties": [
1764 + {
1765 + "id": "custom.displayMode",
1766 + "value": "color-text"
1767 + },
1768 + {
1769 + "id": "mappings",
1770 + "value": [
1771 + {
1772 + "options": {
1773 + "Success": {
1774 + "color": "orange",
1775 + "index": 0
1776 + }
1777 + },
1778 + "type": "value"
1779 + }
1780 + ]
1781 + }
1782 + ]
1783 + }
1784 + ]
1785 + },
1786 + "gridPos": {
1787 + "h": 7,
1788 + "w": 5,
1789 + "x": 19,
1790 + "y": 14
1791 + },
1792 + "id": 74,
1793 + "options": {
1794 + "footer": {
1795 + "fields": "",
1796 + "reducer": [
1797 + "sum"
1798 + ],
1799 + "show": false
1800 + },
1801 + "showHeader": true
1802 + },
1803 + "pluginVersion": "9.3.6",
1804 + "targets": [
1805 + {
1806 + "bucketAggs": [
1807 + {
1808 + "fake": true,
1809 + "field": "data_office365_UserId",
1810 + "id": "4",
1811 + "settings": {
1812 + "min_doc_count": 1,
1813 + "order": "desc",
1814 + "orderBy": "_count",
1815 + "size": "0"
1816 + },
1817 + "type": "terms"
1818 + },
1819 + {
1820 + "field": "data_office365_ResultStatus",
1821 + "id": "5",
1822 + "settings": {
1823 + "min_doc_count": "1",
1824 + "order": "desc",
1825 + "orderBy": "_count",
1826 + "size": "10"
1827 + },
1828 + "type": "terms"
1829 + }
1830 + ],
1831 + "datasource": {
1832 + "type": "elasticsearch",
1833 + "uid": "replace_datasource_uid"
1834 + },
1835 + "metrics": [
1836 + {
1837 + "field": "select field",
1838 + "id": "1",
1839 + "type": "count"
1840 + }
1841 + ],
1842 + "query": "data_office365_Operation:UserLoggedIn AND data_office365_ResultStatus:Success AND data_office365_ExtendedProperties_UserAuthenticationMethod:1",
1843 + "refId": "A",
1844 + "timeField": "timestamp"
1845 + }
1846 + ],
1847 + "title": "USERS LOGGEDIN NON MFA (Accounts)",
1848 + "transformations": [
1849 + {
1850 + "id": "merge",
1851 + "options": {
1852 + "reducers": []
1853 + }
1854 + },
1855 + {
1856 + "id": "organize",
1857 + "options": {
1858 + "excludeByName": {},
1859 + "indexByName": {},
1860 + "renameByName": {
1861 + "Count": "EVENTS",
1862 + "data_office365_ObjectId": "ACCOUNT",
1863 + "data_office365_Operation": "OPERATION",
1864 + "data_office365_ResultStatus": "RESULT",
1865 + "data_office365_UserId": "ACCOUNT"
1866 + }
1867 + }
1868 + }
1869 + ],
1870 + "type": "table"
1871 + },
1872 + {
1873 + "datasource": {
1874 + "type": "elasticsearch",
1875 + "uid": "replace_datasource_uid"
1876 + },
1877 + "fieldConfig": {
1878 + "defaults": {
1879 + "mappings": [
1880 + {
1881 + "options": {
1882 + "match": "null",
1883 + "result": {
1884 + "text": "N/A"
1885 + }
1886 + },
1887 + "type": "special"
1888 + }
1889 + ],
1890 + "thresholds": {
1891 + "mode": "absolute",
1892 + "steps": [
1893 + {
1894 + "color": "orange",
1895 + "value": null
1896 + }
1897 + ]
1898 + },
1899 + "unit": "locale"
1900 + },
1901 + "overrides": []
1902 + },
1903 + "gridPos": {
1904 + "h": 7,
1905 + "w": 4,
1906 + "x": 0,
1907 + "y": 21
1908 + },
1909 + "id": 61,
1910 + "links": [],
1911 + "options": {
1912 + "colorMode": "value",
1913 + "graphMode": "area",
1914 + "justifyMode": "auto",
1915 + "orientation": "horizontal",
1916 + "reduceOptions": {
1917 + "calcs": [
1918 + "sum"
1919 + ],
1920 + "fields": "",
1921 + "values": false
1922 + },
1923 + "text": {},
1924 + "textMode": "auto"
1925 + },
1926 + "pluginVersion": "9.3.6",
1927 + "targets": [
1928 + {
1929 + "bucketAggs": [
1930 + {
1931 + "field": "timestamp",
1932 + "id": "2",
1933 + "settings": {
1934 + "interval": "auto",
1935 + "min_doc_count": 0,
1936 + "trimEdges": 0
1937 + },
1938 + "type": "date_histogram"
1939 + }
1940 + ],
1941 + "datasource": {
1942 + "type": "elasticsearch",
1943 + "uid": "replace_datasource_uid"
1944 + },
1945 + "metrics": [
1946 + {
1947 + "field": "select field",
1948 + "id": "1",
1949 + "type": "count"
1950 + }
1951 + ],
1952 + "query": "data_office365_Operation:UserLoggedIn AND !data_office365_ActorIpAddress_country_code:COMPANY_COUNTRY_CODE",
1953 + "refId": "A",
1954 + "timeField": "timestamp"
1955 + }
1956 + ],
1957 + "title": "AUTHS NON TRUSTED SOURCE",
1958 + "type": "stat"
1959 + },
1960 + {
1961 + "circleMaxSize": 30,
1962 + "circleMinSize": 2,
1963 + "colors": [
1964 + "rgba(245, 54, 54, 0.9)",
1965 + "rgba(237, 129, 40, 0.89)",
1966 + "rgba(50, 172, 45, 0.97)"
1967 + ],
1968 + "datasource": {
1969 + "type": "elasticsearch",
1970 + "uid": "replace_datasource_uid"
1971 + },
1972 + "decimals": 0,
1973 + "esMetric": "Count",
1974 + "gridPos": {
1975 + "h": 14,
1976 + "w": 10,
1977 + "x": 4,
1978 + "y": 21
1979 + },
1980 + "hideEmpty": false,
1981 + "hideZero": false,
1982 + "id": 62,
1983 + "initialZoom": 1,
1984 + "locationData": "countries",
1985 + "mapCenter": "(0°, 0°)",
1986 + "mapCenterLatitude": 0,
1987 + "mapCenterLongitude": 0,
1988 + "maxDataPoints": 1,
1989 + "mouseWheelZoom": false,
1990 + "showLegend": true,
1991 + "stickyLabels": false,
1992 + "tableQueryOptions": {
1993 + "geohashField": "geohash",
1994 + "latitudeField": "latitude",
1995 + "longitudeField": "longitude",
1996 + "metricField": "metric",
1997 + "queryType": "geohash"
1998 + },
1999 + "targets": [
2000 + {
2001 + "bucketAggs": [
2002 + {
2003 + "fake": true,
2004 + "field": "data_office365_ActorIpAddress_country_code",
2005 + "id": "3",
2006 + "settings": {
2007 + "min_doc_count": 1,
2008 + "order": "desc",
2009 + "orderBy": "_term",
2010 + "size": "0"
2011 + },
2012 + "type": "terms"
2013 + },
2014 + {
2015 + "field": "timestamp",
2016 + "id": "2",
2017 + "settings": {
2018 + "interval": "auto",
2019 + "min_doc_count": 0,
2020 + "trimEdges": 0
2021 + },
2022 + "type": "date_histogram"
2023 + }
2024 + ],
2025 + "datasource": {
2026 + "type": "elasticsearch",
2027 + "uid": "replace_datasource_uid"
2028 + },
2029 + "metrics": [
2030 + {
2031 + "field": "select field",
2032 + "id": "1",
2033 + "type": "count"
2034 + }
2035 + ],
2036 + "query": "data_office365_Operation:UserLoggedIn AND !data_office365_ActorIpAddress_country_code:COMPANY_COUNTRY_CODE",
2037 + "refId": "A",
2038 + "timeField": "timestamp"
2039 + }
2040 + ],
2041 + "thresholds": "0,10",
2042 + "title": "AUTHS NON TRUSTED SOURCE BY COUNTRY",
2043 + "type": "grafana-worldmap-panel",
2044 + "unitPlural": "",
2045 + "unitSingle": "",
2046 + "valueName": "total"
2047 + },
2048 + {
2049 + "datasource": {
2050 + "type": "elasticsearch",
2051 + "uid": "replace_datasource_uid"
2052 + },
2053 + "fieldConfig": {
2054 + "defaults": {
2055 + "color": {
2056 + "mode": "thresholds"
2057 + },
2058 + "custom": {
2059 + "align": "auto",
2060 + "displayMode": "auto",
2061 + "inspect": false
2062 + },
2063 + "mappings": [],
2064 + "thresholds": {
2065 + "mode": "absolute",
2066 + "steps": [
2067 + {
2068 + "color": "orange",
2069 + "value": null
2070 + }
2071 + ]
2072 + }
2073 + },
2074 + "overrides": [
2075 + {
2076 + "matcher": {
2077 + "id": "byName",
2078 + "options": "Count"
2079 + },
2080 + "properties": [
2081 + {
2082 + "id": "displayName",
2083 + "value": "EVENTS"
2084 + },
2085 + {
2086 + "id": "unit",
2087 + "value": "short"
2088 + },
2089 + {
2090 + "id": "decimals",
2091 + "value": -1
2092 + },
2093 + {
2094 + "id": "custom.align"
2095 + },
2096 + {
2097 + "id": "custom.displayMode",
2098 + "value": "color-text"
2099 + }
2100 + ]
2101 + },
2102 + {
2103 + "matcher": {
2104 + "id": "byName",
2105 + "options": "AD ACCOUNT"
2106 + },
2107 + "properties": [
2108 + {
2109 + "id": "custom.width",
2110 + "value": 377
2111 + },
2112 + {
2113 + "id": "custom.displayMode",
2114 + "value": "color-text"
2115 + }
2116 + ]
2117 + },
2118 + {
2119 + "matcher": {
2120 + "id": "byName",
2121 + "options": "SRC IP"
2122 + },
2123 + "properties": [
2124 + {
2125 + "id": "custom.width",
2126 + "value": 166
2127 + },
2128 + {
2129 + "id": "custom.displayMode",
2130 + "value": "color-text"
2131 + }
2132 + ]
2133 + },
2134 + {
2135 + "matcher": {
2136 + "id": "byName",
2137 + "options": "COUNTRY"
2138 + },
2139 + "properties": [
2140 + {
2141 + "id": "custom.displayMode",
2142 + "value": "color-text"
2143 + }
2144 + ]
2145 + }
2146 + ]
2147 + },
2148 + "gridPos": {
2149 + "h": 14,
2150 + "w": 10,
2151 + "x": 14,
2152 + "y": 21
2153 + },
2154 + "id": 63,
2155 + "options": {
2156 + "footer": {
2157 + "fields": "",
2158 + "reducer": [
2159 + "sum"
2160 + ],
2161 + "show": false
2162 + },
2163 + "showHeader": true,
2164 + "sortBy": []
2165 + },
2166 + "pluginVersion": "9.3.6",
2167 + "targets": [
2168 + {
2169 + "bucketAggs": [
2170 + {
2171 + "fake": true,
2172 + "field": "data_office365_UserId",
2173 + "id": "4",
2174 + "settings": {
2175 + "min_doc_count": 1,
2176 + "order": "desc",
2177 + "orderBy": "_count",
2178 + "size": "0"
2179 + },
2180 + "type": "terms"
2181 + },
2182 + {
2183 + "field": "data_office365_ActorIpAddress",
2184 + "id": "5",
2185 + "settings": {
2186 + "min_doc_count": "1",
2187 + "order": "desc",
2188 + "orderBy": "_term",
2189 + "size": "10"
2190 + },
2191 + "type": "terms"
2192 + },
2193 + {
2194 + "field": "data_office365_ActorIpAddress_country_code",
2195 + "id": "6",
2196 + "settings": {
2197 + "min_doc_count": "1",
2198 + "order": "desc",
2199 + "orderBy": "_term",
2200 + "size": "10"
2201 + },
2202 + "type": "terms"
2203 + }
2204 + ],
2205 + "datasource": {
2206 + "type": "elasticsearch",
2207 + "uid": "replace_datasource_uid"
2208 + },
2209 + "metrics": [
2210 + {
2211 + "field": "select field",
2212 + "id": "1",
2213 + "type": "count"
2214 + }
2215 + ],
2216 + "query": "data_office365_Operation:UserLoggedIn AND !data_office365_ActorIpAddress_country_code:COMPANY_COUNTRY_CODE",
2217 + "refId": "A",
2218 + "timeField": "timestamp"
2219 + }
2220 + ],
2221 + "title": "AUTHS NON TRUSTED SOURCE BY ACCOUNT",
2222 + "transformations": [
2223 + {
2224 + "id": "merge",
2225 + "options": {
2226 + "reducers": []
2227 + }
2228 + },
2229 + {
2230 + "id": "organize",
2231 + "options": {
2232 + "excludeByName": {},
2233 + "indexByName": {},
2234 + "renameByName": {
2235 + "Count": "AUTH EVENTS",
2236 + "data_office365_ActorIpAddress": "SRC IP",
2237 + "data_office365_ActorIpAddress_country_code": "COUNTRY",
2238 + "data_office365_LogonError": "ERROR",
2239 + "data_office365_Operation": "WORKLOAD",
2240 + "data_office365_UserId": "AD ACCOUNT"
2241 + }
2242 + }
2243 + }
2244 + ],
2245 + "type": "table"
2246 + },
2247 + {
2248 + "datasource": {
2249 + "type": "elasticsearch",
2250 + "uid": "replace_datasource_uid"
2251 + },
2252 + "fieldConfig": {
2253 + "defaults": {
2254 + "mappings": [
2255 + {
2256 + "options": {
2257 + "match": "null",
2258 + "result": {
2259 + "text": "N/A"
2260 + }
2261 + },
2262 + "type": "special"
2263 + }
2264 + ],
2265 + "thresholds": {
2266 + "mode": "absolute",
2267 + "steps": [
2268 + {
2269 + "color": "orange",
2270 + "value": null
2271 + }
2272 + ]
2273 + },
2274 + "unit": "locale"
2275 + },
2276 + "overrides": []
2277 + },
2278 + "gridPos": {
2279 + "h": 7,
2280 + "w": 4,
2281 + "x": 0,
2282 + "y": 28
2283 + },
2284 + "id": 64,
2285 + "links": [],
2286 + "options": {
2287 + "colorMode": "value",
2288 + "graphMode": "area",
2289 + "justifyMode": "auto",
2290 + "orientation": "horizontal",
2291 + "reduceOptions": {
2292 + "calcs": [
2293 + "sum"
2294 + ],
2295 + "fields": "",
2296 + "values": false
2297 + },
2298 + "text": {},
2299 + "textMode": "auto"
2300 + },
2301 + "pluginVersion": "9.3.6",
2302 + "targets": [
2303 + {
2304 + "bucketAggs": [
2305 + {
2306 + "field": "timestamp",
2307 + "id": "2",
2308 + "settings": {
2309 + "interval": "365d",
2310 + "min_doc_count": 0,
2311 + "trimEdges": 0
2312 + },
2313 + "type": "date_histogram"
2314 + }
2315 + ],
2316 + "datasource": {
2317 + "type": "elasticsearch",
2318 + "uid": "replace_datasource_uid"
2319 + },
2320 + "metrics": [
2321 + {
2322 + "field": "data_office365_UserId",
2323 + "id": "1",
2324 + "type": "cardinality"
2325 + }
2326 + ],
2327 + "query": "data_office365_Operation:UserLoggedIn AND !data_office365_ActorIpAddress_country_code:COMPANY_COUNTRY_CODE",
2328 + "refId": "A",
2329 + "timeField": "timestamp"
2330 + }
2331 + ],
2332 + "title": "AUTHS NON TRUSTED - ACCOUNTS",
2333 + "type": "stat"
2334 + },
2335 + {
2336 + "datasource": {
2337 + "type": "elasticsearch",
2338 + "uid": "replace_datasource_uid"
2339 + },
2340 + "fieldConfig": {
2341 + "defaults": {
2342 + "color": {
2343 + "mode": "thresholds"
2344 + },
2345 + "mappings": [
2346 + {
2347 + "options": {
2348 + "match": "null",
2349 + "result": {
2350 + "text": "N/A"
2351 + }
2352 + },
2353 + "type": "special"
2354 + }
2355 + ],
2356 + "max": 15,
2357 + "min": 0,
2358 + "thresholds": {
2359 + "mode": "absolute",
2360 + "steps": [
2361 + {
2362 + "color": "#299c46",
2363 + "value": null
2364 + },
2365 + {
2366 + "color": "rgba(237, 129, 40, 0.89)",
2367 + "value": 8
2368 + },
2369 + {
2370 + "color": "#d44a3a",
2371 + "value": 12
2372 + }
2373 + ]
2374 + },
2375 + "unit": "none"
2376 + },
2377 + "overrides": []
2378 + },
2379 + "gridPos": {
2380 + "h": 7,
2381 + "w": 4,
2382 + "x": 0,
2383 + "y": 35
2384 + },
2385 + "id": 16,
2386 + "links": [],
2387 + "options": {
2388 + "orientation": "horizontal",
2389 + "reduceOptions": {
2390 + "calcs": [
2391 + "max"
2392 + ],
2393 + "fields": "",
2394 + "values": false
2395 + },
2396 + "showThresholdLabels": false,
2397 + "showThresholdMarkers": true,
2398 + "text": {}
2399 + },
2400 + "pluginVersion": "9.3.6",
2401 + "targets": [
2402 + {
2403 + "bucketAggs": [
2404 + {
2405 + "field": "timestamp",
2406 + "id": "2",
2407 + "settings": {
2408 + "interval": "auto",
2409 + "min_doc_count": 0,
2410 + "trimEdges": 0
2411 + },
2412 + "type": "date_histogram"
2413 + }
2414 + ],
2415 + "datasource": {
2416 + "type": "elasticsearch",
2417 + "uid": "replace_datasource_uid"
2418 + },
2419 + "metrics": [
2420 + {
2421 + "field": "rule_level",
2422 + "id": "1",
2423 + "meta": {},
2424 + "settings": {},
2425 + "type": "max"
2426 + }
2427 + ],
2428 + "query": "data_office365_Operation:$operation",
2429 + "refId": "A",
2430 + "timeField": "timestamp"
2431 + }
2432 + ],
2433 + "title": "MAX SEVERITY (0 - 15)",
2434 + "type": "gauge"
2435 + },
2436 + {
2437 + "datasource": {
2438 + "type": "elasticsearch",
2439 + "uid": "replace_datasource_uid"
2440 + },
2441 + "fieldConfig": {
2442 + "defaults": {
2443 + "color": {
2444 + "mode": "palette-classic"
2445 + },
2446 + "custom": {
2447 + "axisCenteredZero": false,
2448 + "axisColorMode": "text",
2449 + "axisLabel": "",
2450 + "axisPlacement": "auto",
2451 + "barAlignment": 0,
2452 + "drawStyle": "bars",
2453 + "fillOpacity": 0,
2454 + "gradientMode": "none",
2455 + "hideFrom": {
2456 + "legend": false,
2457 + "tooltip": false,
2458 + "viz": false
2459 + },
2460 + "lineInterpolation": "linear",
2461 + "lineWidth": 1,
2462 + "pointSize": 5,
2463 + "scaleDistribution": {
2464 + "type": "linear"
2465 + },
2466 + "showPoints": "auto",
2467 + "spanNulls": false,
2468 + "stacking": {
2469 + "group": "A",
2470 + "mode": "none"
2471 + },
2472 + "thresholdsStyle": {
2473 + "mode": "off"
2474 + }
2475 + },
2476 + "mappings": [],
2477 + "thresholds": {
2478 + "mode": "absolute",
2479 + "steps": [
2480 + {
2481 + "color": "green",
2482 + "value": null
2483 + },
2484 + {
2485 + "color": "red",
2486 + "value": 80
2487 + }
2488 + ]
2489 + }
2490 + },
2491 + "overrides": []
2492 + },
2493 + "gridPos": {
2494 + "h": 13,
2495 + "w": 20,
2496 + "x": 4,
2497 + "y": 35
2498 + },
2499 + "id": 76,
2500 + "options": {
2501 + "legend": {
2502 + "calcs": [],
2503 + "displayMode": "table",
2504 + "placement": "right",
2505 + "showLegend": true
2506 + },
2507 + "tooltip": {
2508 + "mode": "single",
2509 + "sort": "none"
2510 + }
2511 + },
2512 + "targets": [
2513 + {
2514 + "alias": "",
2515 + "bucketAggs": [
2516 + {
2517 + "field": "data_office365_Operation",
2518 + "id": "3",
2519 + "settings": {
2520 + "min_doc_count": "1",
2521 + "order": "desc",
2522 + "orderBy": "_count",
2523 + "size": "10"
2524 + },
2525 + "type": "terms"
2526 + },
2527 + {
2528 + "field": "data_office365_CreationTime",
2529 + "id": "2",
2530 + "settings": {
2531 + "interval": "5m"
2532 + },
2533 + "type": "date_histogram"
2534 + }
2535 + ],
2536 + "datasource": {
2537 + "type": "elasticsearch",
2538 + "uid": "replace_datasource_uid"
2539 + },
2540 + "metrics": [
2541 + {
2542 + "id": "1",
2543 + "type": "count"
2544 + }
2545 + ],
2546 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
2547 + "refId": "A",
2548 + "timeField": "timestamp"
2549 + }
2550 + ],
2551 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
2552 + "transparent": true,
2553 + "type": "timeseries"
2554 + },
2555 + {
2556 + "datasource": {
2557 + "type": "elasticsearch",
2558 + "uid": "replace_datasource_uid"
2559 + },
2560 + "fieldConfig": {
2561 + "defaults": {
2562 + "mappings": [
2563 + {
2564 + "options": {
2565 + "match": "null",
2566 + "result": {
2567 + "text": "N/A"
2568 + }
2569 + },
2570 + "type": "special"
2571 + }
2572 + ],
2573 + "thresholds": {
2574 + "mode": "absolute",
2575 + "steps": [
2576 + {
2577 + "color": "blue",
2578 + "value": null
2579 + }
2580 + ]
2581 + },
2582 + "unit": "locale"
2583 + },
2584 + "overrides": []
2585 + },
2586 + "gridPos": {
2587 + "h": 6,
2588 + "w": 4,
2589 + "x": 0,
2590 + "y": 42
2591 + },
2592 + "id": 51,
2593 + "links": [],
2594 + "options": {
2595 + "colorMode": "value",
2596 + "graphMode": "area",
2597 + "justifyMode": "auto",
2598 + "orientation": "horizontal",
2599 + "reduceOptions": {
2600 + "calcs": [
2601 + "sum"
2602 + ],
2603 + "fields": "",
2604 + "values": false
2605 + },
2606 + "text": {},
2607 + "textMode": "auto"
2608 + },
2609 + "pluginVersion": "9.3.6",
2610 + "targets": [
2611 + {
2612 + "bucketAggs": [
2613 + {
2614 + "$$hashKey": "object:331",
2615 + "field": "timestamp",
2616 + "id": "2",
2617 + "settings": {
2618 + "interval": "auto",
2619 + "min_doc_count": 0,
2620 + "trimEdges": 0
2621 + },
2622 + "type": "date_histogram"
2623 + }
2624 + ],
2625 + "datasource": {
2626 + "type": "elasticsearch",
2627 + "uid": "replace_datasource_uid"
2628 + },
2629 + "metrics": [
2630 + {
2631 + "$$hashKey": "object:329",
2632 + "field": "select field",
2633 + "id": "1",
2634 + "type": "count"
2635 + }
2636 + ],
2637 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
2638 + "refId": "A",
2639 + "timeField": "timestamp"
2640 + }
2641 + ],
2642 + "title": "EVENTS (Total)",
2643 + "type": "stat"
2644 + },
2645 + {
2646 + "datasource": {
2647 + "type": "elasticsearch",
2648 + "uid": "replace_datasource_uid"
2649 + },
2650 + "fieldConfig": {
2651 + "defaults": {
2652 + "mappings": [
2653 + {
2654 + "options": {
2655 + "match": "null",
2656 + "result": {
2657 + "text": "N/A"
2658 + }
2659 + },
2660 + "type": "special"
2661 + }
2662 + ],
2663 + "thresholds": {
2664 + "mode": "absolute",
2665 + "steps": [
2666 + {
2667 + "color": "red",
2668 + "value": null
2669 + }
2670 + ]
2671 + },
2672 + "unit": "locale"
2673 + },
2674 + "overrides": []
2675 + },
2676 + "gridPos": {
2677 + "h": 6,
2678 + "w": 4,
2679 + "x": 0,
2680 + "y": 48
2681 + },
2682 + "id": 52,
2683 + "links": [],
2684 + "options": {
2685 + "colorMode": "value",
2686 + "graphMode": "area",
2687 + "justifyMode": "auto",
2688 + "orientation": "horizontal",
2689 + "reduceOptions": {
2690 + "calcs": [
2691 + "sum"
2692 + ],
2693 + "fields": "",
2694 + "values": false
2695 + },
2696 + "text": {},
2697 + "textMode": "auto"
2698 + },
2699 + "pluginVersion": "9.3.6",
2700 + "targets": [
2701 + {
2702 + "bucketAggs": [
2703 + {
2704 + "$$hashKey": "object:331",
2705 + "field": "timestamp",
2706 + "id": "2",
2707 + "settings": {
2708 + "interval": "auto",
2709 + "min_doc_count": 0,
2710 + "trimEdges": 0
2711 + },
2712 + "type": "date_histogram"
2713 + }
2714 + ],
2715 + "datasource": {
2716 + "type": "elasticsearch",
2717 + "uid": "replace_datasource_uid"
2718 + },
2719 + "metrics": [
2720 + {
2721 + "$$hashKey": "object:329",
2722 + "field": "select field",
2723 + "id": "1",
2724 + "type": "count"
2725 + }
2726 + ],
2727 + "query": "data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
2728 + "refId": "A",
2729 + "timeField": "timestamp"
2730 + }
2731 + ],
2732 + "title": "AZURE AD - FAILED AUTHS",
2733 + "type": "stat"
2734 + },
2735 + {
2736 + "circleMaxSize": 30,
2737 + "circleMinSize": 2,
2738 + "colors": [
2739 + "rgba(245, 54, 54, 0.9)",
2740 + "rgba(237, 129, 40, 0.89)",
2741 + "rgba(50, 172, 45, 0.97)"
2742 + ],
2743 + "datasource": {
2744 + "type": "elasticsearch",
2745 + "uid": "replace_datasource_uid"
2746 + },
2747 + "decimals": 0,
2748 + "esMetric": "Count",
2749 + "gridPos": {
2750 + "h": 12,
2751 + "w": 10,
2752 + "x": 4,
2753 + "y": 48
2754 + },
2755 + "hideEmpty": false,
2756 + "hideZero": false,
2757 + "id": 50,
2758 + "initialZoom": 1,
2759 + "locationData": "countries",
2760 + "mapCenter": "(0°, 0°)",
2761 + "mapCenterLatitude": 0,
2762 + "mapCenterLongitude": 0,
2763 + "maxDataPoints": 1,
2764 + "mouseWheelZoom": false,
2765 + "showLegend": true,
2766 + "stickyLabels": false,
2767 + "tableQueryOptions": {
2768 + "geohashField": "geohash",
2769 + "latitudeField": "latitude",
2770 + "longitudeField": "longitude",
2771 + "metricField": "metric",
2772 + "queryType": "geohash"
2773 + },
2774 + "targets": [
2775 + {
2776 + "bucketAggs": [
2777 + {
2778 + "fake": true,
2779 + "field": "data_office365_ActorIpAddress_country_code",
2780 + "id": "3",
2781 + "settings": {
2782 + "min_doc_count": 1,
2783 + "order": "desc",
2784 + "orderBy": "_term",
2785 + "size": "0"
2786 + },
2787 + "type": "terms"
2788 + },
2789 + {
2790 + "field": "timestamp",
2791 + "id": "2",
2792 + "settings": {
2793 + "interval": "auto",
2794 + "min_doc_count": 0,
2795 + "trimEdges": 0
2796 + },
2797 + "type": "date_histogram"
2798 + }
2799 + ],
2800 + "datasource": {
2801 + "type": "elasticsearch",
2802 + "uid": "replace_datasource_uid"
2803 + },
2804 + "metrics": [
2805 + {
2806 + "field": "select field",
2807 + "id": "1",
2808 + "type": "count"
2809 + }
2810 + ],
2811 + "query": "data_office365_Workload:AzureActiveDirectory AND rule_level:$rule_level",
2812 + "refId": "A",
2813 + "timeField": "timestamp"
2814 + }
2815 + ],
2816 + "thresholds": "0,10",
2817 + "title": "AZURE AD - ALL AUTH EVENTS BY COUNTRY",
2818 + "type": "grafana-worldmap-panel",
2819 + "unitPlural": "",
2820 + "unitSingle": "",
2821 + "valueName": "total"
2822 + },
2823 + {
2824 + "datasource": {
2825 + "type": "elasticsearch",
2826 + "uid": "replace_datasource_uid"
2827 + },
2828 + "fieldConfig": {
2829 + "defaults": {
2830 + "color": {
2831 + "mode": "thresholds"
2832 + },
2833 + "custom": {
2834 + "align": "auto",
2835 + "displayMode": "auto",
2836 + "filterable": true,
2837 + "inspect": false
2838 + },
2839 + "mappings": [],
2840 + "thresholds": {
2841 + "mode": "absolute",
2842 + "steps": [
2843 + {
2844 + "color": "orange",
2845 + "value": null
2846 + }
2847 + ]
2848 + }
2849 + },
2850 + "overrides": [
2851 + {
2852 + "matcher": {
2853 + "id": "byName",
2854 + "options": "Count"
2855 + },
2856 + "properties": [
2857 + {
2858 + "id": "displayName",
2859 + "value": "EVENTS"
2860 + },
2861 + {
2862 + "id": "unit",
2863 + "value": "short"
2864 + },
2865 + {
2866 + "id": "decimals",
2867 + "value": -1
2868 + },
2869 + {
2870 + "id": "custom.align"
2871 + },
2872 + {
2873 + "id": "custom.displayMode",
2874 + "value": "color-text"
2875 + }
2876 + ]
2877 + },
2878 + {
2879 + "matcher": {
2880 + "id": "byName",
2881 + "options": "AD ACCOUNT"
2882 + },
2883 + "properties": [
2884 + {
2885 + "id": "custom.width",
2886 + "value": 377
2887 + },
2888 + {
2889 + "id": "custom.displayMode",
2890 + "value": "color-text"
2891 + }
2892 + ]
2893 + },
2894 + {
2895 + "matcher": {
2896 + "id": "byName",
2897 + "options": "data_office365_LogonError"
2898 + },
2899 + "properties": [
2900 + {
2901 + "id": "custom.width",
2902 + "value": 326
2903 + },
2904 + {
2905 + "id": "custom.displayMode",
2906 + "value": "color-text"
2907 + },
2908 + {
2909 + "id": "links",
2910 + "value": [
2911 + {
2912 + "targetBlank": true,
2913 + "title": "MICROSOFT LOGON ERROR",
2914 + "url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-aadsts-error-codes"
2915 + }
2916 + ]
2917 + }
2918 + ]
2919 + }
2920 + ]
2921 + },
2922 + "gridPos": {
2923 + "h": 32,
2924 + "w": 10,
2925 + "x": 14,
2926 + "y": 48
2927 + },
2928 + "id": 58,
2929 + "options": {
2930 + "footer": {
2931 + "fields": "",
2932 + "reducer": [
2933 + "sum"
2934 + ],
2935 + "show": false
2936 + },
2937 + "showHeader": true,
2938 + "sortBy": []
2939 + },
2940 + "pluginVersion": "9.3.6",
2941 + "targets": [
2942 + {
2943 + "bucketAggs": [
2944 + {
2945 + "fake": true,
2946 + "field": "data_office365_UserId",
2947 + "id": "4",
2948 + "settings": {
2949 + "min_doc_count": 1,
2950 + "order": "desc",
2951 + "orderBy": "_count",
2952 + "size": "0"
2953 + },
2954 + "type": "terms"
2955 + },
2956 + {
2957 + "field": "data_office365_LogonError",
2958 + "id": "5",
2959 + "settings": {
2960 + "min_doc_count": "1",
2961 + "order": "desc",
2962 + "orderBy": "_term",
2963 + "size": "10"
2964 + },
2965 + "type": "terms"
2966 + },
2967 + {
2968 + "field": "data_office365_ActorIpAddress_country_code",
2969 + "id": "6",
2970 + "settings": {
2971 + "min_doc_count": "1",
2972 + "order": "desc",
2973 + "orderBy": "1",
2974 + "size": "0"
2975 + },
2976 + "type": "terms"
2977 + }
2978 + ],
2979 + "datasource": {
2980 + "type": "elasticsearch",
2981 + "uid": "replace_datasource_uid"
2982 + },
2983 + "metrics": [
2984 + {
2985 + "field": "select field",
2986 + "id": "1",
2987 + "type": "count"
2988 + }
2989 + ],
2990 + "query": "data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
2991 + "refId": "A",
2992 + "timeField": "timestamp"
2993 + }
2994 + ],
2995 + "title": "FAILED AUTHS BY ACCOUNT AND ERROR",
2996 + "transformations": [
2997 + {
2998 + "id": "merge",
2999 + "options": {
3000 + "reducers": []
3001 + }
3002 + },
3003 + {
3004 + "id": "organize",
3005 + "options": {
3006 + "excludeByName": {},
3007 + "indexByName": {},
3008 + "renameByName": {
3009 + "Count": "EVENTS",
3010 + "data_office365_ActorIpAddress_country_code": "COUNTRY",
3011 + "data_office365_LogonError": "ERROR",
3012 + "data_office365_Operation": "WORKLOAD",
3013 + "data_office365_UserId": "AD ACCOUNT"
3014 + }
3015 + }
3016 + }
3017 + ],
3018 + "type": "table"
3019 + },
3020 + {
3021 + "datasource": {
3022 + "type": "elasticsearch",
3023 + "uid": "replace_datasource_uid"
3024 + },
3025 + "fieldConfig": {
3026 + "defaults": {
3027 + "mappings": [
3028 + {
3029 + "options": {
3030 + "match": "null",
3031 + "result": {
3032 + "text": "N/A"
3033 + }
3034 + },
3035 + "type": "special"
3036 + }
3037 + ],
3038 + "thresholds": {
3039 + "mode": "absolute",
3040 + "steps": [
3041 + {
3042 + "color": "blue",
3043 + "value": null
3044 + }
3045 + ]
3046 + },
3047 + "unit": "locale"
3048 + },
3049 + "overrides": []
3050 + },
3051 + "gridPos": {
3052 + "h": 6,
3053 + "w": 4,
3054 + "x": 0,
3055 + "y": 54
3056 + },
3057 + "id": 18,
3058 + "links": [],
3059 + "options": {
3060 + "colorMode": "value",
3061 + "graphMode": "area",
3062 + "justifyMode": "auto",
3063 + "orientation": "horizontal",
3064 + "reduceOptions": {
3065 + "calcs": [
3066 + "sum"
3067 + ],
3068 + "fields": "",
3069 + "values": false
3070 + },
3071 + "text": {},
3072 + "textMode": "auto"
3073 + },
3074 + "pluginVersion": "9.3.6",
3075 + "targets": [
3076 + {
3077 + "bucketAggs": [
3078 + {
3079 + "$$hashKey": "object:331",
3080 + "field": "timestamp",
3081 + "id": "2",
3082 + "settings": {
3083 + "interval": "auto",
3084 + "min_doc_count": 0,
3085 + "trimEdges": 0
3086 + },
3087 + "type": "date_histogram"
3088 + }
3089 + ],
3090 + "datasource": {
3091 + "type": "elasticsearch",
3092 + "uid": "replace_datasource_uid"
3093 + },
3094 + "metrics": [
3095 + {
3096 + "$$hashKey": "object:329",
3097 + "field": "select field",
3098 + "id": "1",
3099 + "type": "count"
3100 + }
3101 + ],
3102 + "query": "data_office365_Operation:UserLoggedIn AND rule_level:$rule_level",
3103 + "refId": "A",
3104 + "timeField": "timestamp"
3105 + }
3106 + ],
3107 + "title": "AZURE AD - TOTAL AUTHS",
3108 + "type": "stat"
3109 + },
3110 + {
3111 + "datasource": {
3112 + "type": "elasticsearch",
3113 + "uid": "replace_datasource_uid"
3114 + },
3115 + "fieldConfig": {
3116 + "defaults": {
3117 + "color": {
3118 + "mode": "thresholds"
3119 + },
3120 + "mappings": [],
3121 + "thresholds": {
3122 + "mode": "absolute",
3123 + "steps": [
3124 + {
3125 + "color": "green",
3126 + "value": null
3127 + },
3128 + {
3129 + "color": "red",
3130 + "value": 80
3131 + }
3132 + ]
3133 + }
3134 + },
3135 + "overrides": []
3136 + },
3137 + "gridPos": {
3138 + "h": 10,
3139 + "w": 14,
3140 + "x": 0,
3141 + "y": 60
3142 + },
3143 + "id": 57,
3144 + "options": {
3145 + "displayMode": "gradient",
3146 + "minVizHeight": 10,
3147 + "minVizWidth": 0,
3148 + "orientation": "horizontal",
3149 + "reduceOptions": {
3150 + "calcs": [
3151 + "sum"
3152 + ],
3153 + "fields": "",
3154 + "values": false
3155 + },
3156 + "showUnfilled": true
3157 + },
3158 + "pluginVersion": "9.3.6",
3159 + "targets": [
3160 + {
3161 + "alias": "",
3162 + "bucketAggs": [
3163 + {
3164 + "field": "data_office365_LogonError",
3165 + "id": "2",
3166 + "settings": {
3167 + "min_doc_count": "1",
3168 + "order": "desc",
3169 + "orderBy": "_count",
3170 + "size": "15"
3171 + },
3172 + "type": "terms"
3173 + },
3174 + {
3175 + "field": "timestamp",
3176 + "id": "3",
3177 + "settings": {
3178 + "interval": "auto",
3179 + "min_doc_count": "1",
3180 + "timeZone": "utc",
3181 + "trimEdges": "0"
3182 + },
3183 + "type": "date_histogram"
3184 + }
3185 + ],
3186 + "datasource": {
3187 + "type": "elasticsearch",
3188 + "uid": "replace_datasource_uid"
3189 + },
3190 + "metrics": [
3191 + {
3192 + "id": "1",
3193 + "type": "count"
3194 + }
3195 + ],
3196 + "query": "",
3197 + "refId": "A",
3198 + "timeField": "timestamp"
3199 + }
3200 + ],
3201 + "title": "FAILED AUTHS BY ERROR (Top 15)",
3202 + "type": "bargauge"
3203 + },
3204 + {
3205 + "datasource": {
3206 + "type": "elasticsearch",
3207 + "uid": "replace_datasource_uid"
3208 + },
3209 + "fieldConfig": {
3210 + "defaults": {
3211 + "color": {
3212 + "mode": "thresholds"
3213 + },
3214 + "mappings": [],
3215 + "thresholds": {
3216 + "mode": "absolute",
3217 + "steps": [
3218 + {
3219 + "color": "green",
3220 + "value": null
3221 + },
3222 + {
3223 + "color": "red",
3224 + "value": 80
3225 + }
3226 + ]
3227 + }
3228 + },
3229 + "overrides": []
3230 + },
3231 + "gridPos": {
3232 + "h": 10,
3233 + "w": 14,
3234 + "x": 0,
3235 + "y": 70
3236 + },
3237 + "id": 72,
3238 + "options": {
3239 + "displayMode": "gradient",
3240 + "minVizHeight": 10,
3241 + "minVizWidth": 0,
3242 + "orientation": "horizontal",
3243 + "reduceOptions": {
3244 + "calcs": [
3245 + "sum"
3246 + ],
3247 + "fields": "",
3248 + "values": false
3249 + },
3250 + "showUnfilled": true
3251 + },
3252 + "pluginVersion": "9.3.6",
3253 + "targets": [
3254 + {
3255 + "alias": "",
3256 + "bucketAggs": [
3257 + {
3258 + "field": "data_office365_ExtendedProperties_UserAgent",
3259 + "id": "2",
3260 + "settings": {
3261 + "min_doc_count": "1",
3262 + "order": "desc",
3263 + "orderBy": "_count",
3264 + "size": "15"
3265 + },
3266 + "type": "terms"
3267 + },
3268 + {
3269 + "field": "timestamp",
3270 + "id": "3",
3271 + "settings": {
3272 + "interval": "auto",
3273 + "min_doc_count": "1",
3274 + "timeZone": "utc",
3275 + "trimEdges": "0"
3276 + },
3277 + "type": "date_histogram"
3278 + }
3279 + ],
3280 + "datasource": {
3281 + "type": "elasticsearch",
3282 + "uid": "replace_datasource_uid"
3283 + },
3284 + "metrics": [
3285 + {
3286 + "id": "1",
3287 + "type": "count"
3288 + }
3289 + ],
3290 + "query": "data_office365_Operation:UserLoggedIn AND data_office365_ResultStatus:Success",
3291 + "refId": "A",
3292 + "timeField": "timestamp"
3293 + }
3294 + ],
3295 + "title": "SUCCESSFUL AUTHS BY USER AGENT (Top 15)",
3296 + "type": "bargauge"
3297 + },
3298 + {
3299 + "datasource": {
3300 + "type": "elasticsearch",
3301 + "uid": "replace_datasource_uid"
3302 + },
3303 + "fieldConfig": {
3304 + "defaults": {
3305 + "color": {
3306 + "mode": "thresholds"
3307 + },
3308 + "custom": {
3309 + "align": "auto",
3310 + "displayMode": "auto",
3311 + "filterable": true,
3312 + "inspect": false
3313 + },
3314 + "mappings": [],
3315 + "thresholds": {
3316 + "mode": "absolute",
3317 + "steps": [
3318 + {
3319 + "color": "green",
3320 + "value": null
3321 + },
3322 + {
3323 + "color": "red",
3324 + "value": 80
3325 + }
3326 + ]
3327 + }
3328 + },
3329 + "overrides": [
3330 + {
3331 + "matcher": {
3332 + "id": "byName",
3333 + "options": "rule_level"
3334 + },
3335 + "properties": [
3336 + {
3337 + "id": "displayName",
3338 + "value": "RULE LEVEL"
3339 + },
3340 + {
3341 + "id": "unit",
3342 + "value": "short"
3343 + },
3344 + {
3345 + "id": "decimals",
3346 + "value": -1
3347 + },
3348 + {
3349 + "id": "custom.displayMode",
3350 + "value": "color-background"
3351 + },
3352 + {
3353 + "id": "custom.align"
3354 + },
3355 + {
3356 + "id": "thresholds",
3357 + "value": {
3358 + "mode": "absolute",
3359 + "steps": [
3360 + {
3361 + "color": "#37872D",
3362 + "value": null
3363 + },
3364 + {
3365 + "color": "rgba(237, 129, 40, 0.89)",
3366 + "value": 7
3367 + },
3368 + {
3369 + "color": "rgba(245, 54, 54, 0.9)",
3370 + "value": 12
3371 + }
3372 + ]
3373 + }
3374 + }
3375 + ]
3376 + },
3377 + {
3378 + "matcher": {
3379 + "id": "byName",
3380 + "options": "Date/Time"
3381 + },
3382 + "properties": [
3383 + {
3384 + "id": "custom.width",
3385 + "value": 242
3386 + }
3387 + ]
3388 + },
3389 + {
3390 + "matcher": {
3391 + "id": "byName",
3392 + "options": "MITRE TACTIC"
3393 + },
3394 + "properties": [
3395 + {
3396 + "id": "custom.width",
3397 + "value": 332
3398 + }
3399 + ]
3400 + },
3401 + {
3402 + "matcher": {
3403 + "id": "byName",
3404 + "options": "IP ADDRESS"
3405 + },
3406 + "properties": [
3407 + {
3408 + "id": "custom.width",
3409 + "value": 163
3410 + }
3411 + ]
3412 + },
3413 + {
3414 + "matcher": {
3415 + "id": "byName",
3416 + "options": "MITRE TECHNIQUE"
3417 + },
3418 + "properties": [
3419 + {
3420 + "id": "custom.width",
3421 + "value": 312
3422 + }
3423 + ]
3424 + },
3425 + {
3426 + "matcher": {
3427 + "id": "byName",
3428 + "options": "EVENT ID"
3429 + },
3430 + "properties": [
3431 + {
3432 + "id": "links",
3433 + "value": [
3434 + {
3435 + "targetBlank": true,
3436 + "title": "VIEW EVENT DETAILS",
3437 + "url": "https://grafana.company.local/explore?left=%5B%22now-6h%22,%22now%22,%22O365%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
3438 + }
3439 + ]
3440 + },
3441 + {
3442 + "id": "custom.width",
3443 + "value": 336
3444 + }
3445 + ]
3446 + },
3447 + {
3448 + "matcher": {
3449 + "id": "byName",
3450 + "options": "RESULT"
3451 + },
3452 + "properties": [
3453 + {
3454 + "id": "custom.width",
3455 + "value": 118
3456 + },
3457 + {
3458 + "id": "mappings",
3459 + "value": [
3460 + {
3461 + "options": {
3462 + "Failed": {
3463 + "color": "orange",
3464 + "index": 1
3465 + },
3466 + "Success": {
3467 + "color": "green",
3468 + "index": 0
3469 + }
3470 + },
3471 + "type": "value"
3472 + }
3473 + ]
3474 + },
3475 + {
3476 + "id": "custom.displayMode",
3477 + "value": "color-text"
3478 + }
3479 + ]
3480 + },
3481 + {
3482 + "matcher": {
3483 + "id": "byName",
3484 + "options": "SRC IP"
3485 + },
3486 + "properties": [
3487 + {
3488 + "id": "custom.width",
3489 + "value": 265
3490 + }
3491 + ]
3492 + },
3493 + {
3494 + "matcher": {
3495 + "id": "byName",
3496 + "options": "ACCOUNT"
3497 + },
3498 + "properties": [
3499 + {
3500 + "id": "custom.width",
3501 + "value": 343
3502 + }
3503 + ]
3504 + },
3505 + {
3506 + "matcher": {
3507 + "id": "byName",
3508 + "options": "EVENT TIME"
3509 + },
3510 + "properties": [
3511 + {
3512 + "id": "custom.width",
3513 + "value": 195
3514 + }
3515 + ]
3516 + }
3517 + ]
3518 + },
3519 + "gridPos": {
3520 + "h": 16,
3521 + "w": 24,
3522 + "x": 0,
3523 + "y": 80
3524 + },
3525 + "id": 27,
3526 + "options": {
3527 + "footer": {
3528 + "enablePagination": true,
3529 + "fields": "",
3530 + "reducer": [
3531 + "sum"
3532 + ],
3533 + "show": false
3534 + },
3535 + "showHeader": true,
3536 + "sortBy": []
3537 + },
3538 + "pluginVersion": "9.3.6",
3539 + "targets": [
3540 + {
3541 + "bucketAggs": [],
3542 + "datasource": {
3543 + "type": "elasticsearch",
3544 + "uid": "replace_datasource_uid"
3545 + },
3546 + "metrics": [
3547 + {
3548 + "id": "1",
3549 + "settings": {
3550 + "size": "250"
3551 + },
3552 + "type": "raw_data"
3553 + }
3554 + ],
3555 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
3556 + "refId": "A",
3557 + "timeField": "timestamp"
3558 + }
3559 + ],
3560 + "title": "EVENTS",
3561 + "transformations": [
3562 + {
3563 + "id": "organize",
3564 + "options": {
3565 + "excludeByName": {
3566 + "@metadata_beat": true,
3567 + "@metadata_type": true,
3568 + "@metadata_version": true,
3569 + "IMPHASH": true,
3570 + "MD5": true,
3571 + "SHA1": true,
3572 + "SHA256": true,
3573 + "_id": false,
3574 + "_index": true,
3575 + "_type": true,
3576 + "agent_ephemeral_id": true,
3577 + "agent_hostname": true,
3578 + "agent_id": true,
3579 + "agent_ip_city_name": true,
3580 + "agent_ip_country_code": true,
3581 + "agent_ip_geolocation": true,
3582 + "agent_name": true,
3583 + "agent_type": true,
3584 + "agent_version": true,
3585 + "beats_type": true,
3586 + "cluster_name": true,
3587 + "cluster_node": true,
3588 + "collector_node_id": true,
3589 + "data_alert_action": true,
3590 + "data_alert_category": true,
3591 + "data_alert_gid": true,
3592 + "data_alert_rev": true,
3593 + "data_alert_severity": true,
3594 + "data_alert_signature": true,
3595 + "data_alert_signature_id": true,
3596 + "data_app_proto": true,
3597 + "data_audit_auid": true,
3598 + "data_audit_command": true,
3599 + "data_audit_euid": true,
3600 + "data_audit_exe": true,
3601 + "data_audit_gid": true,
3602 + "data_audit_id": true,
3603 + "data_audit_pid": true,
3604 + "data_audit_res": true,
3605 + "data_audit_session": true,
3606 + "data_audit_type": true,
3607 + "data_audit_uid": true,
3608 + "data_dest_ip": true,
3609 + "data_dest_port": true,
3610 + "data_dstuser": true,
3611 + "data_event_type": true,
3612 + "data_extra_data": true,
3613 + "data_file": true,
3614 + "data_flow_bytes_toclient": true,
3615 + "data_flow_bytes_toserver": true,
3616 + "data_flow_id": true,
3617 + "data_flow_pkts_toclient": true,
3618 + "data_flow_pkts_toserver": true,
3619 + "data_flow_start": true,
3620 + "data_http_http_content_type": true,
3621 + "data_http_http_port": true,
3622 + "data_http_length": true,
3623 + "data_http_status": true,
3624 + "data_http_url": true,
3625 + "data_id": true,
3626 + "data_in_iface": true,
3627 + "data_integration": true,
3628 + "data_label": true,
3629 + "data_metadata_flowbits": true,
3630 + "data_metadata_flowints_http_anomaly_count": true,
3631 + "data_metadata_flowints_tcp_retransmission_count": true,
3632 + "data_office365_Actor": true,
3633 + "data_office365_ActorContextId": true,
3634 + "data_office365_ActorIpAddress": false,
3635 + "data_office365_ActorIpAddress_city_name": true,
3636 + "data_office365_ActorIpAddress_country_code": true,
3637 + "data_office365_ActorIpAddress_geolocation": true,
3638 + "data_office365_ApplicationId": true,
3639 + "data_office365_AzureActiveDirectoryEventType": true,
3640 + "data_office365_ClientIP": true,
3641 + "data_office365_ClientIP_city_name": true,
3642 + "data_office365_ClientIP_country_code": true,
3643 + "data_office365_ClientIP_geolocation": true,
3644 + "data_office365_CreationTime": false,
3645 + "data_office365_DeviceProperties": true,
3646 + "data_office365_ErrorNumber": true,
3647 + "data_office365_ExtendedProperties": true,
3648 + "data_office365_Id": true,
3649 + "data_office365_InterSystemsId": true,
3650 + "data_office365_IntraSystemId": true,
3651 + "data_office365_LogonError": true,
3652 + "data_office365_ModifiedProperties": true,
3653 + "data_office365_ObjectId": true,
3654 + "data_office365_Operation": true,
3655 + "data_office365_OrganizationId": true,
3656 + "data_office365_RecordType": true,
3657 + "data_office365_ResultStatus": false,
3658 + "data_office365_Subscription": true,
3659 + "data_office365_Target": true,
3660 + "data_office365_TargetContextId": true,
3661 + "data_office365_UserId": false,
3662 + "data_office365_UserKey": true,
3663 + "data_office365_UserType": true,
3664 + "data_office365_Version": true,
3665 + "data_office365_Workload": true,
3666 + "data_osquery_action": true,
3667 + "data_osquery_calendarTime": true,
3668 + "data_osquery_columns_address": true,
3669 + "data_osquery_columns_address_city_name": true,
3670 + "data_osquery_columns_address_country_code": true,
3671 + "data_osquery_columns_address_geolocation": true,
3672 + "data_osquery_columns_cmdline": true,
3673 + "data_osquery_columns_cwd": true,
3674 + "data_osquery_columns_description": true,
3675 + "data_osquery_columns_directory": true,
3676 + "data_osquery_columns_disk_bytes_read": true,
3677 + "data_osquery_columns_disk_bytes_written": true,
3678 + "data_osquery_columns_egid": true,
3679 + "data_osquery_columns_euid": true,
3680 + "data_osquery_columns_family": true,
3681 + "data_osquery_columns_fd": true,
3682 + "data_osquery_columns_gid": true,
3683 + "data_osquery_columns_gid_signed": true,
3684 + "data_osquery_columns_host": true,
3685 + "data_osquery_columns_interface": true,
3686 + "data_osquery_columns_local_address": true,
3687 + "data_osquery_columns_local_address_city_name": true,
3688 + "data_osquery_columns_local_address_country_code": true,
3689 + "data_osquery_columns_local_address_geolocation": true,
3690 + "data_osquery_columns_local_port": true,
3691 + "data_osquery_columns_mac": true,
3692 + "data_osquery_columns_name": true,
3693 + "data_osquery_columns_net_namespace": true,
3694 + "data_osquery_columns_nice": true,
3695 + "data_osquery_columns_on_disk": true,
3696 + "data_osquery_columns_parent": true,
3697 + "data_osquery_columns_path": true,
3698 + "data_osquery_columns_pgroup": true,
3699 + "data_osquery_columns_pid": true,
3700 + "data_osquery_columns_port": true,
3701 + "data_osquery_columns_protocol": true,
3702 + "data_osquery_columns_remote_address": true,
3703 + "data_osquery_columns_remote_address_city_name": true,
3704 + "data_osquery_columns_remote_address_country_code": true,
3705 + "data_osquery_columns_remote_address_geolocation": true,
3706 + "data_osquery_columns_remote_port": true,
3707 + "data_osquery_columns_resident_size": true,
3708 + "data_osquery_columns_root": true,
3709 + "data_osquery_columns_sgid": true,
3710 + "data_osquery_columns_shell": true,
3711 + "data_osquery_columns_socket": true,
3712 + "data_osquery_columns_start_time": true,
3713 + "data_osquery_columns_state": true,
3714 + "data_osquery_columns_suid": true,
3715 + "data_osquery_columns_system_time": true,
3716 + "data_osquery_columns_threads": true,
3717 + "data_osquery_columns_time_utc": true,
3718 + "data_osquery_columns_total_size": true,
3719 + "data_osquery_columns_tty": true,
3720 + "data_osquery_columns_type": true,
3721 + "data_osquery_columns_uid": true,
3722 + "data_osquery_columns_uid_signed": true,
3723 + "data_osquery_columns_user": true,
3724 + "data_osquery_columns_user_time": true,
3725 + "data_osquery_columns_username": true,
3726 + "data_osquery_columns_wired_size": true,
3727 + "data_osquery_counter": true,
3728 + "data_osquery_decorations_host_uuid": true,
3729 + "data_osquery_decorations_hostname": true,
3730 + "data_osquery_epoch": true,
3731 + "data_osquery_hostIdentifier": true,
3732 + "data_osquery_name": true,
3733 + "data_osquery_numerics": true,
3734 + "data_osquery_unixTime": true,
3735 + "data_proto": true,
3736 + "data_sca_check_command": true,
3737 + "data_sca_check_compliance_cis": true,
3738 + "data_sca_check_compliance_cis_csc": true,
3739 + "data_sca_check_compliance_gdpr_IV": true,
3740 + "data_sca_check_compliance_gpg_13": true,
3741 + "data_sca_check_compliance_hipaa": true,
3742 + "data_sca_check_compliance_nist_800_53": true,
3743 + "data_sca_check_compliance_pci_dss": true,
3744 + "data_sca_check_compliance_tsc": true,
3745 + "data_sca_check_description": true,
3746 + "data_sca_check_id": true,
3747 + "data_sca_check_previous_result": true,
3748 + "data_sca_check_rationale": true,
3749 + "data_sca_check_remediation": true,
3750 + "data_sca_check_result": true,
3751 + "data_sca_check_title": true,
3752 + "data_sca_description": true,
3753 + "data_sca_failed": true,
3754 + "data_sca_file": true,
3755 + "data_sca_invalid": true,
3756 + "data_sca_passed": true,
3757 + "data_sca_policy": true,
3758 + "data_sca_policy_id": true,
3759 + "data_sca_scan_id": true,
3760 + "data_sca_score": true,
3761 + "data_sca_total_checks": true,
3762 + "data_sca_type": true,
3763 + "data_script": true,
3764 + "data_src_ip": true,
3765 + "data_src_ip_city_name": true,
3766 + "data_src_ip_country_code": true,
3767 + "data_src_ip_geolocation": true,
3768 + "data_src_port": true,
3769 + "data_srcip": true,
3770 + "data_srcip_city_name": true,
3771 + "data_srcip_country_code": true,
3772 + "data_srcip_geolocation": true,
3773 + "data_srcuser": true,
3774 + "data_timestamp": true,
3775 + "data_title": true,
3776 + "data_tls_session_resumed": true,
3777 + "data_tls_version": true,
3778 + "data_tx_id": true,
3779 + "data_type": true,
3780 + "data_win_eventXML_binaryData": true,
3781 + "data_win_eventXML_binaryDataSize": true,
3782 + "data_win_eventXML_param1": true,
3783 + "data_win_eventdata_authenticationPackageName": true,
3784 + "data_win_eventdata_callTrace": true,
3785 + "data_win_eventdata_commandLine": true,
3786 + "data_win_eventdata_company": true,
3787 + "data_win_eventdata_creationUtcTime": true,
3788 + "data_win_eventdata_currentDirectory": true,
3789 + "data_win_eventdata_description": true,
3790 + "data_win_eventdata_destinationHostname": true,
3791 + "data_win_eventdata_destinationIp": true,
3792 + "data_win_eventdata_destinationIp_city_name": true,
3793 + "data_win_eventdata_destinationIp_country_code": true,
3794 + "data_win_eventdata_destinationIp_geolocation": true,
3795 + "data_win_eventdata_destinationIsIpv6": true,
3796 + "data_win_eventdata_destinationPort": true,
3797 + "data_win_eventdata_destinationPortName": true,
3798 + "data_win_eventdata_details": true,
3799 + "data_win_eventdata_elevatedToken": true,
3800 + "data_win_eventdata_eventType": true,
3801 + "data_win_eventdata_fileVersion": true,
3802 + "data_win_eventdata_fileVersion_city_name": true,
3803 + "data_win_eventdata_fileVersion_country_code": true,
3804 + "data_win_eventdata_fileVersion_geolocation": true,
3805 + "data_win_eventdata_grantedAccess": true,
3806 + "data_win_eventdata_hashes": true,
3807 + "data_win_eventdata_image": true,
3808 + "data_win_eventdata_imageLoaded": true,
3809 + "data_win_eventdata_impersonationLevel": true,
3810 + "data_win_eventdata_initiated": true,
3811 + "data_win_eventdata_integrityLevel": true,
3812 + "data_win_eventdata_ipAddress": true,
3813 + "data_win_eventdata_ipPort": true,
3814 + "data_win_eventdata_keyLength": true,
3815 + "data_win_eventdata_logonGuid": true,
3816 + "data_win_eventdata_logonId": true,
3817 + "data_win_eventdata_logonProcessName": true,
3818 + "data_win_eventdata_logonType": true,
3819 + "data_win_eventdata_originalFileName": true,
3820 + "data_win_eventdata_param1": true,
3821 + "data_win_eventdata_param2": true,
3822 + "data_win_eventdata_param3": true,
3823 + "data_win_eventdata_param4": true,
3824 + "data_win_eventdata_parentCommandLine": true,
3825 + "data_win_eventdata_parentImage": true,
3826 + "data_win_eventdata_parentProcessGuid": true,
3827 + "data_win_eventdata_parentProcessId": true,
3828 + "data_win_eventdata_processGuid": true,
3829 + "data_win_eventdata_processId": true,
3830 + "data_win_eventdata_processName": true,
3831 + "data_win_eventdata_product": true,
3832 + "data_win_eventdata_protocol": true,
3833 + "data_win_eventdata_queryName": true,
3834 + "data_win_eventdata_queryResults": true,
3835 + "data_win_eventdata_queryStatus": true,
3836 + "data_win_eventdata_ruleName": true,
3837 + "data_win_eventdata_serviceName": true,
3838 + "data_win_eventdata_serviceSid": true,
3839 + "data_win_eventdata_signature": true,
3840 + "data_win_eventdata_signatureStatus": true,
3841 + "data_win_eventdata_signed": true,
3842 + "data_win_eventdata_sourceHostname": true,
3843 + "data_win_eventdata_sourceImage": true,
3844 + "data_win_eventdata_sourceIp": true,
3845 + "data_win_eventdata_sourceIp_city_name": true,
3846 + "data_win_eventdata_sourceIp_country_code": true,
3847 + "data_win_eventdata_sourceIp_geolocation": true,
3848 + "data_win_eventdata_sourceIsIpv6": true,
3849 + "data_win_eventdata_sourcePort": true,
3850 + "data_win_eventdata_sourceProcessGUID": true,
3851 + "data_win_eventdata_sourceProcessId": true,
3852 + "data_win_eventdata_sourceThreadId": true,
3853 + "data_win_eventdata_status": true,
3854 + "data_win_eventdata_subjectDomainName": true,
3855 + "data_win_eventdata_subjectLogonId": true,
3856 + "data_win_eventdata_subjectUserName": true,
3857 + "data_win_eventdata_subjectUserSid": true,
3858 + "data_win_eventdata_targetDomainName": true,
3859 + "data_win_eventdata_targetFilename": true,
3860 + "data_win_eventdata_targetImage": true,
3861 + "data_win_eventdata_targetLinkedLogonId": true,
3862 + "data_win_eventdata_targetLogonId": true,
3863 + "data_win_eventdata_targetObject": true,
3864 + "data_win_eventdata_targetProcessGUID": true,
3865 + "data_win_eventdata_targetProcessId": true,
3866 + "data_win_eventdata_targetUserName": true,
3867 + "data_win_eventdata_targetUserSid": true,
3868 + "data_win_eventdata_terminalSessionId": true,
3869 + "data_win_eventdata_ticketEncryptionType": true,
3870 + "data_win_eventdata_ticketOptions": true,
3871 + "data_win_eventdata_user": true,
3872 + "data_win_eventdata_utcTime": true,
3873 + "data_win_eventdata_virtualAccount": true,
3874 + "data_win_system_channel": true,
3875 + "data_win_system_computer": true,
3876 + "data_win_system_eventID": true,
3877 + "data_win_system_eventRecordID": true,
3878 + "data_win_system_eventSourceName": true,
3879 + "data_win_system_keywords": true,
3880 + "data_win_system_level": true,
3881 + "data_win_system_message": true,
3882 + "data_win_system_opcode": true,
3883 + "data_win_system_processID": true,
3884 + "data_win_system_providerGuid": true,
3885 + "data_win_system_providerName": true,
3886 + "data_win_system_severityValue": true,
3887 + "data_win_system_systemTime": true,
3888 + "data_win_system_task": true,
3889 + "data_win_system_threadID": true,
3890 + "data_win_system_version": true,
3891 + "decoder_name": true,
3892 + "decoder_parent": true,
3893 + "dns_query": true,
3894 + "dns_query_threat_indicated": true,
3895 + "dst_ip": true,
3896 + "dst_ip_city_name": true,
3897 + "dst_ip_country_code": true,
3898 + "dst_ip_geolocation": true,
3899 + "dst_ip_threat_indicated": true,
3900 + "dst_port": true,
3901 + "ecs_version": true,
3902 + "error": true,
3903 + "event_hash": true,
3904 + "file_path": true,
3905 + "firewall_rule_name": true,
3906 + "full_log": false,
3907 + "gl2_accounted_message_size": true,
3908 + "gl2_message_id": true,
3909 + "gl2_processing_error": true,
3910 + "gl2_remote_ip": true,
3911 + "gl2_remote_port": true,
3912 + "gl2_source_collector": true,
3913 + "gl2_source_input": true,
3914 + "gl2_source_node": true,
3915 + "hash_md5": true,
3916 + "hash_sha1": true,
3917 + "hash_sha256": true,
3918 + "highlight": true,
3919 + "host_architecture": true,
3920 + "host_containerized": true,
3921 + "host_hostname": true,
3922 + "host_id": true,
3923 + "host_ip": true,
3924 + "host_mac": true,
3925 + "host_name": true,
3926 + "host_os_codename": true,
3927 + "host_os_kernel": true,
3928 + "host_os_name": true,
3929 + "host_os_platform": true,
3930 + "host_os_version": true,
3931 + "hostname": true,
3932 + "id": true,
3933 + "input_type": true,
3934 + "level": true,
3935 + "location": true,
3936 + "log_file_path": true,
3937 + "log_offset": true,
3938 + "manager_name": true,
3939 + "message": true,
3940 + "module": true,
3941 + "parent_process_cmd_line": true,
3942 + "parent_process_id": true,
3943 + "parent_process_image": true,
3944 + "pid": true,
3945 + "predecoder_hostname": true,
3946 + "predecoder_program_name": true,
3947 + "predecoder_timestamp": true,
3948 + "previous_log": true,
3949 + "previous_output": true,
3950 + "process_cmd_line": true,
3951 + "process_id": true,
3952 + "process_image": true,
3953 + "process_name": true,
3954 + "protocol": true,
3955 + "rule_cis": true,
3956 + "rule_cis_csc": true,
3957 + "rule_firedtimes": true,
3958 + "rule_gdpr": true,
3959 + "rule_gdpr_IV": true,
3960 + "rule_gpg13": true,
3961 + "rule_gpg_13": true,
3962 + "rule_group1": true,
3963 + "rule_group2": true,
3964 + "rule_groups": true,
3965 + "rule_hipaa": true,
3966 + "rule_id": true,
3967 + "rule_info": true,
3968 + "rule_mail": true,
3969 + "rule_mitre_id": true,
3970 + "rule_mitre_tactic": false,
3971 + "rule_nist_800_53": true,
3972 + "rule_pci_dss": true,
3973 + "rule_tsc": true,
3974 + "scanid": true,
3975 + "service": true,
3976 + "software_package": true,
3977 + "software_vendor": true,
3978 + "sort": true,
3979 + "source": true,
3980 + "source_reserved_ip": true,
3981 + "src_ip": true,
3982 + "src_ip_city_name": true,
3983 + "src_ip_country_code": true,
3984 + "src_ip_geolocation": true,
3985 + "src_port": true,
3986 + "streams": true,
3987 + "syscheck_attrs_after": true,
3988 + "syscheck_audit_effective_user_id": true,
3989 + "syscheck_audit_effective_user_name": true,
3990 + "syscheck_audit_group_id": true,
3991 + "syscheck_audit_group_name": true,
3992 + "syscheck_audit_login_user_id": true,
3993 + "syscheck_audit_login_user_name": true,
3994 + "syscheck_audit_process_cwd": true,
3995 + "syscheck_audit_process_id": true,
3996 + "syscheck_audit_process_name": true,
3997 + "syscheck_audit_process_parent_cwd": true,
3998 + "syscheck_audit_process_parent_name": true,
3999 + "syscheck_audit_process_ppid": true,
4000 + "syscheck_audit_user_id": true,
4001 + "syscheck_audit_user_name": true,
4002 + "syscheck_changed_attributes": true,
4003 + "syscheck_event": true,
4004 + "syscheck_gid_after": true,
4005 + "syscheck_gname_after": true,
4006 + "syscheck_hard_links": true,
4007 + "syscheck_inode_after": true,
4008 + "syscheck_inode_before": true,
4009 + "syscheck_md5_after": true,
4010 + "syscheck_md5_before": true,
4011 + "syscheck_mode": true,
4012 + "syscheck_mtime_after": true,
4013 + "syscheck_mtime_before": true,
4014 + "syscheck_path": true,
4015 + "syscheck_perm_after": true,
4016 + "syscheck_perm_before": true,
4017 + "syscheck_sha1_after": true,
4018 + "syscheck_sha1_before": true,
4019 + "syscheck_sha256_after": true,
4020 + "syscheck_sha256_before": true,
4021 + "syscheck_size_after": true,
4022 + "syscheck_size_before": true,
4023 + "syscheck_uid_after": true,
4024 + "syscheck_uname_after": true,
4025 + "syscheck_win_perm_after": true,
4026 + "syscheck_win_perm_after_0_allowed": true,
4027 + "syscheck_win_perm_after_0_name": true,
4028 + "syscheck_win_perm_after_1_allowed": true,
4029 + "syscheck_win_perm_after_1_name": true,
4030 + "syscheck_win_perm_after_2_allowed": true,
4031 + "syscheck_win_perm_after_2_name": true,
4032 + "syscheck_win_perm_after_3_allowed": true,
4033 + "syscheck_win_perm_after_3_name": true,
4034 + "syslog_customer": true,
4035 + "syslog_level": true,
4036 + "syslog_tag": true,
4037 + "syslog_type": true,
4038 + "sysmon_event_description": true,
4039 + "threat_ids": true,
4040 + "threat_indicated": true,
4041 + "threat_names": true,
4042 + "time": true,
4043 + "timestamp": true,
4044 + "true": true,
4045 + "user_name": true,
4046 + "win_registry_key": true,
4047 + "win_system_eventID": true,
4048 + "windows_auth_package": true,
4049 + "windows_domain": true,
4050 + "windows_event_id": true,
4051 + "windows_event_severity": true,
4052 + "windows_logon_type": true
4053 + },
4054 + "indexByName": {
4055 + "_id": 2,
4056 + "_index": 10,
4057 + "_type": 11,
4058 + "agent_id": 12,
4059 + "agent_name": 5,
4060 + "cluster_name": 13,
4061 + "cluster_node": 14,
4062 + "data_office365_Actor": 15,
4063 + "data_office365_ActorContextId": 16,
4064 + "data_office365_ActorIpAddress": 4,
4065 + "data_office365_ActorIpAddress_city_name": 17,
4066 + "data_office365_ActorIpAddress_country_code": 18,
4067 + "data_office365_ActorIpAddress_geolocation": 19,
4068 + "data_office365_ApplicationId": 20,
4069 + "data_office365_AzureActiveDirectoryEventType": 21,
4070 + "data_office365_ClientIP": 22,
4071 + "data_office365_ClientIP_city_name": 23,
4072 + "data_office365_ClientIP_country_code": 24,
4073 + "data_office365_ClientIP_geolocation": 25,
4074 + "data_office365_CreationTime": 0,
4075 + "data_office365_DeviceProperties": 26,
4076 + "data_office365_ErrorNumber": 27,
4077 + "data_office365_ExtendedProperties": 28,
4078 + "data_office365_Id": 29,
4079 + "data_office365_InterSystemsId": 30,
4080 + "data_office365_IntraSystemId": 31,
4081 + "data_office365_LogonError": 32,
4082 + "data_office365_ModifiedProperties": 33,
4083 + "data_office365_ObjectId": 34,
4084 + "data_office365_Operation": 42,
4085 + "data_office365_OrganizationId": 35,
4086 + "data_office365_RecordType": 36,
4087 + "data_office365_ResultStatus": 6,
4088 + "data_office365_Target": 37,
4089 + "data_office365_TargetContextId": 38,
4090 + "data_office365_UserId": 3,
4091 + "data_office365_UserKey": 39,
4092 + "data_office365_UserType": 40,
4093 + "data_office365_Version": 41,
4094 + "data_office365_Workload": 66,
4095 + "decoder_name": 43,
4096 + "gl2_accounted_message_size": 44,
4097 + "gl2_message_id": 45,
4098 + "gl2_processing_error": 46,
4099 + "gl2_remote_ip": 47,
4100 + "gl2_remote_port": 48,
4101 + "gl2_source_input": 49,
4102 + "gl2_source_node": 50,
4103 + "highlight": 51,
4104 + "id": 52,
4105 + "location": 53,
4106 + "manager_name": 54,
4107 + "message": 55,
4108 + "rule_description": 7,
4109 + "rule_firedtimes": 56,
4110 + "rule_group1": 57,
4111 + "rule_groups": 58,
4112 + "rule_id": 9,
4113 + "rule_level": 8,
4114 + "rule_mail": 59,
4115 + "sort": 60,
4116 + "source": 61,
4117 + "streams": 62,
4118 + "syslog_level": 63,
4119 + "syslog_type": 64,
4120 + "timestamp": 1,
4121 + "true": 65
4122 + },
4123 + "renameByName": {
4124 + "_id": "EVENT ID",
4125 + "agent_name": "",
4126 + "data_office365_ActorIpAddress": "SRC IP",
4127 + "data_office365_CreationTime": "EVENT TIME",
4128 + "data_office365_DeviceProperties_BrowserType": "BROWSER",
4129 + "data_office365_DeviceProperties_DisplayName": "HOSTNAME",
4130 + "data_office365_DeviceProperties_OS": "OS",
4131 + "data_office365_ExtendedProperties_RequestType": "REQ TYPE",
4132 + "data_office365_ExtendedProperties_ResultStatusDetail": "RESULT",
4133 + "data_office365_ExtendedProperties_UserAgent": "AGENT",
4134 + "data_office365_ExtendedProperties_UserAuthenticationMethod": "AUTH METHOD",
4135 + "data_office365_ResultStatus": "RESULT",
4136 + "data_office365_UserId": "ACCOUNT",
4137 + "rule_description": "DESCRIPTION",
4138 + "rule_id": "RULE ID",
4139 + "rule_level": "LEVEL",
4140 + "rule_mitre_tactic": "MITRE TACTIC",
4141 + "rule_mitre_technique": "MITRE TECHNIQUE",
4142 + "timestamp": "Date/Time"
4143 + }
4144 + }
4145 + }
4146 + ],
4147 + "transparent": true,
4148 + "type": "table"
4149 + }
4150 + ],
4151 + "refresh": false,
4152 + "schemaVersion": 37,
4153 + "style": "dark",
4154 + "tags": [
4155 + "O365"
4156 + ],
4157 + "templating": {
4158 + "list": [
4159 + {
4160 + "datasource": {
4161 + "type": "elasticsearch",
4162 + "uid": "replace_datasource_uid"
4163 + },
4164 + "filters": [],
4165 + "hide": 0,
4166 + "label": "",
4167 + "name": "Filters",
4168 + "skipUrlSync": false,
4169 + "type": "adhoc"
4170 + },
4171 + {
4172 + "current": {
4173 + "selected": false,
4174 + "text": "All",
4175 + "value": "$__all"
4176 + },
4177 + "datasource": {
4178 + "type": "elasticsearch",
4179 + "uid": "replace_datasource_uid"
4180 + },
4181 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:AzureActiveDirectory\"}",
4182 + "hide": 0,
4183 + "includeAll": true,
4184 + "label": "Operation",
4185 + "multi": false,
4186 + "name": "operation",
4187 + "options": [],
4188 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:AzureActiveDirectory\"}",
4189 + "refresh": 2,
4190 + "regex": "",
4191 + "skipUrlSync": false,
4192 + "sort": 1,
4193 + "tagValuesQuery": "",
4194 + "tagsQuery": "",
4195 + "type": "query",
4196 + "useTags": false
4197 + },
4198 + {
4199 + "current": {
4200 + "selected": false,
4201 + "text": "All",
4202 + "value": "$__all"
4203 + },
4204 + "datasource": {
4205 + "type": "elasticsearch",
4206 + "uid": "replace_datasource_uid"
4207 + },
4208 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
4209 + "hide": 0,
4210 + "includeAll": true,
4211 + "label": "Rule Level",
4212 + "multi": false,
4213 + "name": "rule_level",
4214 + "options": [],
4215 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
4216 + "refresh": 2,
4217 + "regex": "",
4218 + "skipUrlSync": false,
4219 + "sort": 0,
4220 + "type": "query"
4221 + }
4222 + ]
4223 + },
4224 + "time": {
4225 + "from": "now-24h",
4226 + "to": "now"
4227 + },
4228 + "timepicker": {
4229 + "refresh_intervals": [
4230 + "5s",
4231 + "10s",
4232 + "30s",
4233 + "1m",
4234 + "5m",
4235 + "15m",
4236 + "30m",
4237 + "1h",
4238 + "2h",
4239 + "1d"
4240 + ],
4241 + "time_options": [
4242 + "5m",
4243 + "15m",
4244 + "1h",
4245 + "6h",
4246 + "12h",
4247 + "24h",
4248 + "2d",
4249 + "7d",
4250 + "30d"
4251 + ]
4252 + },
4253 + "timezone": "",
4254 + "title": "O365 - ACTIVE DIRECTORY",
4255 + "weekStart": ""
4256 +}
backend/app/connectors/grafana/dashboards/Office365/applications.json new
+2409
@@ -0,0 +1,2409 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "10.0.3",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Workload:$workload",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "pie",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Workload",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY WORKLOAD (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "cellOptions": {
261 + "type": "auto"
262 + },
263 + "inspect": false
264 + },
265 + "mappings": [],
266 + "thresholds": {
267 + "mode": "absolute",
268 + "steps": [
269 + {
270 + "color": "red",
271 + "value": null
272 + }
273 + ]
274 + }
275 + },
276 + "overrides": [
277 + {
278 + "matcher": {
279 + "id": "byName",
280 + "options": "Count"
281 + },
282 + "properties": [
283 + {
284 + "id": "displayName",
285 + "value": "EVENTS"
286 + },
287 + {
288 + "id": "unit",
289 + "value": "short"
290 + },
291 + {
292 + "id": "decimals",
293 + "value": -1
294 + },
295 + {
296 + "id": "custom.align"
297 + },
298 + {
299 + "id": "thresholds",
300 + "value": {
301 + "mode": "absolute",
302 + "steps": [
303 + {
304 + "color": "red",
305 + "value": null
306 + }
307 + ]
308 + }
309 + }
310 + ]
311 + }
312 + ]
313 + },
314 + "gridPos": {
315 + "h": 7,
316 + "w": 6,
317 + "x": 8,
318 + "y": 0
319 + },
320 + "id": 54,
321 + "options": {
322 + "cellHeight": "sm",
323 + "footer": {
324 + "countRows": false,
325 + "fields": "",
326 + "reducer": [
327 + "sum"
328 + ],
329 + "show": false
330 + },
331 + "showHeader": true
332 + },
333 + "pluginVersion": "10.0.3",
334 + "targets": [
335 + {
336 + "bucketAggs": [
337 + {
338 + "fake": true,
339 + "field": "data_office365_Workload",
340 + "id": "4",
341 + "settings": {
342 + "min_doc_count": 1,
343 + "order": "desc",
344 + "orderBy": "_count",
345 + "size": "0"
346 + },
347 + "type": "terms"
348 + }
349 + ],
350 + "datasource": {
351 + "type": "elasticsearch",
352 + "uid": "replace_datasource_uid"
353 + },
354 + "metrics": [
355 + {
356 + "field": "select field",
357 + "id": "1",
358 + "type": "count"
359 + }
360 + ],
361 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
362 + "refId": "A",
363 + "timeField": "timestamp"
364 + }
365 + ],
366 + "title": "EVENTS BY WORKLOAD",
367 + "transformations": [
368 + {
369 + "id": "merge",
370 + "options": {
371 + "reducers": []
372 + }
373 + },
374 + {
375 + "id": "organize",
376 + "options": {
377 + "excludeByName": {},
378 + "indexByName": {},
379 + "renameByName": {
380 + "Count": "EVENTS",
381 + "data_office365_Operation": "OPERATION",
382 + "data_office365_Workload": "WORKLOAD"
383 + }
384 + }
385 + }
386 + ],
387 + "type": "table"
388 + },
389 + {
390 + "datasource": {
391 + "type": "elasticsearch",
392 + "uid": "replace_datasource_uid"
393 + },
394 + "fieldConfig": {
395 + "defaults": {
396 + "color": {
397 + "mode": "palette-classic"
398 + },
399 + "custom": {
400 + "hideFrom": {
401 + "legend": false,
402 + "tooltip": false,
403 + "viz": false
404 + }
405 + },
406 + "mappings": []
407 + },
408 + "overrides": [
409 + {
410 + "matcher": {
411 + "id": "byName",
412 + "options": "Count"
413 + },
414 + "properties": [
415 + {
416 + "id": "displayName",
417 + "value": "EVENTS"
418 + },
419 + {
420 + "id": "unit",
421 + "value": "short"
422 + },
423 + {
424 + "id": "decimals",
425 + "value": -1
426 + }
427 + ]
428 + }
429 + ]
430 + },
431 + "gridPos": {
432 + "h": 7,
433 + "w": 4,
434 + "x": 14,
435 + "y": 0
436 + },
437 + "id": 61,
438 + "options": {
439 + "legend": {
440 + "displayMode": "list",
441 + "placement": "bottom",
442 + "showLegend": false
443 + },
444 + "pieType": "donut",
445 + "reduceOptions": {
446 + "calcs": [
447 + "sum"
448 + ],
449 + "fields": "",
450 + "values": false
451 + },
452 + "tooltip": {
453 + "mode": "single",
454 + "sort": "none"
455 + }
456 + },
457 + "pluginVersion": "8.5.1",
458 + "targets": [
459 + {
460 + "bucketAggs": [
461 + {
462 + "fake": true,
463 + "field": "data_office365_Operation",
464 + "id": "4",
465 + "settings": {
466 + "min_doc_count": 1,
467 + "order": "desc",
468 + "orderBy": "_count",
469 + "size": "10"
470 + },
471 + "type": "terms"
472 + },
473 + {
474 + "field": "data_office365_CreationTime",
475 + "id": "5",
476 + "settings": {
477 + "interval": "auto",
478 + "min_doc_count": "0",
479 + "timeZone": "utc",
480 + "trimEdges": "0"
481 + },
482 + "type": "date_histogram"
483 + }
484 + ],
485 + "datasource": {
486 + "type": "elasticsearch",
487 + "uid": "replace_datasource_uid"
488 + },
489 + "metrics": [
490 + {
491 + "field": "select field",
492 + "id": "1",
493 + "type": "count"
494 + }
495 + ],
496 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
497 + "refId": "A",
498 + "timeField": "timestamp"
499 + }
500 + ],
501 + "title": "EVENTS BY OPERATION (Top 10)",
502 + "transformations": [],
503 + "type": "piechart"
504 + },
505 + {
506 + "datasource": {
507 + "type": "elasticsearch",
508 + "uid": "replace_datasource_uid"
509 + },
510 + "fieldConfig": {
511 + "defaults": {
512 + "color": {
513 + "mode": "thresholds"
514 + },
515 + "custom": {
516 + "align": "auto",
517 + "cellOptions": {
518 + "type": "auto"
519 + },
520 + "inspect": false
521 + },
522 + "mappings": [],
523 + "thresholds": {
524 + "mode": "absolute",
525 + "steps": [
526 + {
527 + "color": "red",
528 + "value": null
529 + }
530 + ]
531 + }
532 + },
533 + "overrides": [
534 + {
535 + "matcher": {
536 + "id": "byName",
537 + "options": "Count"
538 + },
539 + "properties": [
540 + {
541 + "id": "displayName",
542 + "value": "EVENTS"
543 + },
544 + {
545 + "id": "unit",
546 + "value": "short"
547 + },
548 + {
549 + "id": "decimals",
550 + "value": -1
551 + },
552 + {
553 + "id": "custom.align"
554 + },
555 + {
556 + "id": "thresholds",
557 + "value": {
558 + "mode": "absolute",
559 + "steps": [
560 + {
561 + "color": "red",
562 + "value": null
563 + }
564 + ]
565 + }
566 + }
567 + ]
568 + }
569 + ]
570 + },
571 + "gridPos": {
572 + "h": 7,
573 + "w": 6,
574 + "x": 18,
575 + "y": 0
576 + },
577 + "id": 62,
578 + "options": {
579 + "cellHeight": "sm",
580 + "footer": {
581 + "countRows": false,
582 + "fields": "",
583 + "reducer": [
584 + "sum"
585 + ],
586 + "show": false
587 + },
588 + "showHeader": true
589 + },
590 + "pluginVersion": "10.0.3",
591 + "targets": [
592 + {
593 + "bucketAggs": [
594 + {
595 + "fake": true,
596 + "field": "data_office365_Operation",
597 + "id": "4",
598 + "settings": {
599 + "min_doc_count": 1,
600 + "order": "desc",
601 + "orderBy": "_count",
602 + "size": "0"
603 + },
604 + "type": "terms"
605 + }
606 + ],
607 + "datasource": {
608 + "type": "elasticsearch",
609 + "uid": "replace_datasource_uid"
610 + },
611 + "metrics": [
612 + {
613 + "field": "select field",
614 + "id": "1",
615 + "type": "count"
616 + }
617 + ],
618 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
619 + "refId": "A",
620 + "timeField": "timestamp"
621 + }
622 + ],
623 + "title": "EVENTS BY OPERATION",
624 + "transformations": [
625 + {
626 + "id": "merge",
627 + "options": {
628 + "reducers": []
629 + }
630 + },
631 + {
632 + "id": "organize",
633 + "options": {
634 + "excludeByName": {},
635 + "indexByName": {},
636 + "renameByName": {
637 + "Count": "EVENTS",
638 + "data_office365_Operation": "OPERATION",
639 + "data_office365_Workload": "WORKLOAD"
640 + }
641 + }
642 + }
643 + ],
644 + "type": "table"
645 + },
646 + {
647 + "datasource": {
648 + "type": "elasticsearch",
649 + "uid": "replace_datasource_uid"
650 + },
651 + "fieldConfig": {
652 + "defaults": {
653 + "color": {
654 + "mode": "thresholds"
655 + },
656 + "mappings": [
657 + {
658 + "options": {
659 + "match": "null",
660 + "result": {
661 + "text": "N/A"
662 + }
663 + },
664 + "type": "special"
665 + }
666 + ],
667 + "max": 15,
668 + "min": 0,
669 + "thresholds": {
670 + "mode": "absolute",
671 + "steps": [
672 + {
673 + "color": "#299c46",
674 + "value": null
675 + },
676 + {
677 + "color": "rgba(237, 129, 40, 0.89)",
678 + "value": 8
679 + },
680 + {
681 + "color": "#d44a3a",
682 + "value": 12
683 + }
684 + ]
685 + },
686 + "unit": "none"
687 + },
688 + "overrides": []
689 + },
690 + "gridPos": {
691 + "h": 7,
692 + "w": 4,
693 + "x": 0,
694 + "y": 7
695 + },
696 + "id": 16,
697 + "links": [],
698 + "options": {
699 + "orientation": "horizontal",
700 + "reduceOptions": {
701 + "calcs": [
702 + "max"
703 + ],
704 + "fields": "",
705 + "values": false
706 + },
707 + "showThresholdLabels": false,
708 + "showThresholdMarkers": true,
709 + "text": {}
710 + },
711 + "pluginVersion": "10.0.3",
712 + "targets": [
713 + {
714 + "bucketAggs": [
715 + {
716 + "field": "timestamp",
717 + "id": "2",
718 + "settings": {
719 + "interval": "auto",
720 + "min_doc_count": 0,
721 + "trimEdges": 0
722 + },
723 + "type": "date_histogram"
724 + }
725 + ],
726 + "datasource": {
727 + "type": "elasticsearch",
728 + "uid": "replace_datasource_uid"
729 + },
730 + "metrics": [
731 + {
732 + "field": "rule_level",
733 + "id": "1",
734 + "meta": {},
735 + "settings": {},
736 + "type": "max"
737 + }
738 + ],
739 + "query": "data_office365_Workload:$workload",
740 + "refId": "A",
741 + "timeField": "timestamp"
742 + }
743 + ],
744 + "title": "MAX SEVERITY (0 - 15)",
745 + "type": "gauge"
746 + },
747 + {
748 + "datasource": {
749 + "type": "elasticsearch",
750 + "uid": "replace_datasource_uid"
751 + },
752 + "fieldConfig": {
753 + "defaults": {
754 + "color": {
755 + "mode": "palette-classic"
756 + },
757 + "custom": {
758 + "axisCenteredZero": false,
759 + "axisColorMode": "text",
760 + "axisLabel": "",
761 + "axisPlacement": "auto",
762 + "barAlignment": 0,
763 + "drawStyle": "bars",
764 + "fillOpacity": 0,
765 + "gradientMode": "none",
766 + "hideFrom": {
767 + "legend": false,
768 + "tooltip": false,
769 + "viz": false
770 + },
771 + "lineInterpolation": "linear",
772 + "lineWidth": 1,
773 + "pointSize": 5,
774 + "scaleDistribution": {
775 + "type": "linear"
776 + },
777 + "showPoints": "auto",
778 + "spanNulls": false,
779 + "stacking": {
780 + "group": "A",
781 + "mode": "normal"
782 + },
783 + "thresholdsStyle": {
784 + "mode": "off"
785 + }
786 + },
787 + "mappings": [],
788 + "thresholds": {
789 + "mode": "absolute",
790 + "steps": [
791 + {
792 + "color": "green",
793 + "value": null
794 + },
795 + {
796 + "color": "red",
797 + "value": 80
798 + }
799 + ]
800 + }
801 + },
802 + "overrides": []
803 + },
804 + "gridPos": {
805 + "h": 13,
806 + "w": 20,
807 + "x": 4,
808 + "y": 7
809 + },
810 + "id": 68,
811 + "options": {
812 + "legend": {
813 + "calcs": [],
814 + "displayMode": "table",
815 + "placement": "right",
816 + "showLegend": true
817 + },
818 + "tooltip": {
819 + "mode": "single",
820 + "sort": "none"
821 + }
822 + },
823 + "targets": [
824 + {
825 + "alias": "",
826 + "bucketAggs": [
827 + {
828 + "field": "data_office365_Operation",
829 + "id": "3",
830 + "settings": {
831 + "min_doc_count": "1",
832 + "order": "desc",
833 + "orderBy": "_count",
834 + "size": "10"
835 + },
836 + "type": "terms"
837 + },
838 + {
839 + "field": "timestamp",
840 + "id": "2",
841 + "settings": {
842 + "interval": "auto"
843 + },
844 + "type": "date_histogram"
845 + }
846 + ],
847 + "datasource": {
848 + "type": "elasticsearch",
849 + "uid": "replace_datasource_uid"
850 + },
851 + "metrics": [
852 + {
853 + "id": "1",
854 + "type": "count"
855 + }
856 + ],
857 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
858 + "refId": "A",
859 + "timeField": "timestamp"
860 + }
861 + ],
862 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
863 + "transparent": true,
864 + "type": "timeseries"
865 + },
866 + {
867 + "datasource": {
868 + "type": "elasticsearch",
869 + "uid": "replace_datasource_uid"
870 + },
871 + "fieldConfig": {
872 + "defaults": {
873 + "mappings": [
874 + {
875 + "options": {
876 + "match": "null",
877 + "result": {
878 + "text": "N/A"
879 + }
880 + },
881 + "type": "special"
882 + }
883 + ],
884 + "thresholds": {
885 + "mode": "absolute",
886 + "steps": [
887 + {
888 + "color": "blue",
889 + "value": null
890 + }
891 + ]
892 + },
893 + "unit": "locale"
894 + },
895 + "overrides": []
896 + },
897 + "gridPos": {
898 + "h": 6,
899 + "w": 4,
900 + "x": 0,
901 + "y": 14
902 + },
903 + "id": 51,
904 + "links": [],
905 + "options": {
906 + "colorMode": "value",
907 + "graphMode": "area",
908 + "justifyMode": "auto",
909 + "orientation": "horizontal",
910 + "reduceOptions": {
911 + "calcs": [
912 + "sum"
913 + ],
914 + "fields": "",
915 + "values": false
916 + },
917 + "text": {},
918 + "textMode": "auto"
919 + },
920 + "pluginVersion": "10.0.3",
921 + "targets": [
922 + {
923 + "bucketAggs": [
924 + {
925 + "$$hashKey": "object:331",
926 + "field": "timestamp",
927 + "id": "2",
928 + "settings": {
929 + "interval": "auto",
930 + "min_doc_count": 0,
931 + "trimEdges": 0
932 + },
933 + "type": "date_histogram"
934 + }
935 + ],
936 + "datasource": {
937 + "type": "elasticsearch",
938 + "uid": "replace_datasource_uid"
939 + },
940 + "metrics": [
941 + {
942 + "$$hashKey": "object:329",
943 + "field": "select field",
944 + "id": "1",
945 + "type": "count"
946 + }
947 + ],
948 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
949 + "refId": "A",
950 + "timeField": "timestamp"
951 + }
952 + ],
953 + "title": "EVENTS (Total)",
954 + "type": "stat"
955 + },
956 + {
957 + "circleMaxSize": 30,
958 + "circleMinSize": 2,
959 + "colors": [
960 + "rgba(245, 54, 54, 0.9)",
961 + "rgba(237, 129, 40, 0.89)",
962 + "rgba(50, 172, 45, 0.97)"
963 + ],
964 + "datasource": {
965 + "type": "elasticsearch",
966 + "uid": "replace_datasource_uid"
967 + },
968 + "decimals": 0,
969 + "esMetric": "Count",
970 + "gridPos": {
971 + "h": 12,
972 + "w": 10,
973 + "x": 0,
974 + "y": 20
975 + },
976 + "hideEmpty": false,
977 + "hideZero": false,
978 + "id": 64,
979 + "initialZoom": 1,
980 + "locationData": "countries",
981 + "mapCenter": "(0°, 0°)",
982 + "mapCenterLatitude": 0,
983 + "mapCenterLongitude": 0,
984 + "maxDataPoints": 1,
985 + "mouseWheelZoom": false,
986 + "showLegend": true,
987 + "stickyLabels": false,
988 + "tableQueryOptions": {
989 + "geohashField": "geohash",
990 + "latitudeField": "latitude",
991 + "longitudeField": "longitude",
992 + "metricField": "metric",
993 + "queryType": "geohash"
994 + },
995 + "targets": [
996 + {
997 + "bucketAggs": [
998 + {
999 + "fake": true,
1000 + "field": "data_office365_ClientIP_country_code",
1001 + "id": "3",
1002 + "settings": {
1003 + "min_doc_count": 1,
1004 + "order": "desc",
1005 + "orderBy": "_term",
1006 + "size": "0"
1007 + },
1008 + "type": "terms"
1009 + },
1010 + {
1011 + "field": "timestamp",
1012 + "id": "2",
1013 + "settings": {
1014 + "interval": "auto",
1015 + "min_doc_count": 0,
1016 + "trimEdges": 0
1017 + },
1018 + "type": "date_histogram"
1019 + }
1020 + ],
1021 + "datasource": {
1022 + "type": "elasticsearch",
1023 + "uid": "replace_datasource_uid"
1024 + },
1025 + "metrics": [
1026 + {
1027 + "field": "select field",
1028 + "id": "1",
1029 + "type": "count"
1030 + }
1031 + ],
1032 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1033 + "refId": "A",
1034 + "timeField": "timestamp"
1035 + }
1036 + ],
1037 + "thresholds": "0,10",
1038 + "title": "APPLICATIONS ACCESS BY SRC COUNTRY",
1039 + "type": "grafana-worldmap-panel",
1040 + "unitPlural": "",
1041 + "unitSingle": "",
1042 + "valueName": "total"
1043 + },
1044 + {
1045 + "datasource": {
1046 + "type": "elasticsearch",
1047 + "uid": "replace_datasource_uid"
1048 + },
1049 + "fieldConfig": {
1050 + "defaults": {
1051 + "color": {
1052 + "mode": "thresholds"
1053 + },
1054 + "custom": {
1055 + "align": "auto",
1056 + "cellOptions": {
1057 + "type": "auto"
1058 + },
1059 + "inspect": false
1060 + },
1061 + "mappings": [],
1062 + "thresholds": {
1063 + "mode": "absolute",
1064 + "steps": [
1065 + {
1066 + "color": "orange",
1067 + "value": null
1068 + }
1069 + ]
1070 + }
1071 + },
1072 + "overrides": [
1073 + {
1074 + "matcher": {
1075 + "id": "byName",
1076 + "options": "Count"
1077 + },
1078 + "properties": [
1079 + {
1080 + "id": "displayName",
1081 + "value": "EVENTS"
1082 + },
1083 + {
1084 + "id": "unit",
1085 + "value": "short"
1086 + },
1087 + {
1088 + "id": "decimals",
1089 + "value": -1
1090 + },
1091 + {
1092 + "id": "custom.align"
1093 + }
1094 + ]
1095 + },
1096 + {
1097 + "matcher": {
1098 + "id": "byName",
1099 + "options": "AD ACCOUNT"
1100 + },
1101 + "properties": [
1102 + {
1103 + "id": "custom.width",
1104 + "value": 377
1105 + }
1106 + ]
1107 + },
1108 + {
1109 + "matcher": {
1110 + "id": "byName",
1111 + "options": "data_office365_LogonError"
1112 + },
1113 + "properties": [
1114 + {
1115 + "id": "custom.width",
1116 + "value": 326
1117 + },
1118 + {
1119 + "id": "custom.cellOptions",
1120 + "value": {
1121 + "type": "color-text"
1122 + }
1123 + }
1124 + ]
1125 + },
1126 + {
1127 + "matcher": {
1128 + "id": "byName",
1129 + "options": "COUNTRY"
1130 + },
1131 + "properties": [
1132 + {
1133 + "id": "custom.width",
1134 + "value": 207
1135 + }
1136 + ]
1137 + }
1138 + ]
1139 + },
1140 + "gridPos": {
1141 + "h": 12,
1142 + "w": 14,
1143 + "x": 10,
1144 + "y": 20
1145 + },
1146 + "id": 66,
1147 + "options": {
1148 + "cellHeight": "sm",
1149 + "footer": {
1150 + "countRows": false,
1151 + "fields": "",
1152 + "reducer": [
1153 + "sum"
1154 + ],
1155 + "show": false
1156 + },
1157 + "showHeader": true,
1158 + "sortBy": []
1159 + },
1160 + "pluginVersion": "10.0.3",
1161 + "targets": [
1162 + {
1163 + "bucketAggs": [
1164 + {
1165 + "fake": true,
1166 + "field": "data_office365_UserId",
1167 + "id": "4",
1168 + "settings": {
1169 + "min_doc_count": 1,
1170 + "order": "desc",
1171 + "orderBy": "_count",
1172 + "size": "0"
1173 + },
1174 + "type": "terms"
1175 + },
1176 + {
1177 + "field": "data_office365_Workload",
1178 + "id": "5",
1179 + "settings": {
1180 + "min_doc_count": "1",
1181 + "order": "desc",
1182 + "orderBy": "_term",
1183 + "size": "10"
1184 + },
1185 + "type": "terms"
1186 + },
1187 + {
1188 + "field": "data_office365_ClientIP_country_code",
1189 + "id": "6",
1190 + "settings": {
1191 + "min_doc_count": "1",
1192 + "order": "desc",
1193 + "orderBy": "_term",
1194 + "size": "10"
1195 + },
1196 + "type": "terms"
1197 + }
1198 + ],
1199 + "datasource": {
1200 + "type": "elasticsearch",
1201 + "uid": "replace_datasource_uid"
1202 + },
1203 + "metrics": [
1204 + {
1205 + "field": "select field",
1206 + "id": "1",
1207 + "type": "count"
1208 + }
1209 + ],
1210 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1211 + "refId": "A",
1212 + "timeField": "timestamp"
1213 + }
1214 + ],
1215 + "title": "APPS ACCESS BY ACCOUNT AND APP",
1216 + "transformations": [
1217 + {
1218 + "id": "merge",
1219 + "options": {
1220 + "reducers": []
1221 + }
1222 + },
1223 + {
1224 + "id": "organize",
1225 + "options": {
1226 + "excludeByName": {},
1227 + "indexByName": {},
1228 + "renameByName": {
1229 + "Count": "EVENTS",
1230 + "data_office365_ClientIP_country_code": "COUNTRY",
1231 + "data_office365_LogonError": "ERROR",
1232 + "data_office365_Operation": "WORKLOAD",
1233 + "data_office365_UserId": "AD ACCOUNT",
1234 + "data_office365_Workload": "WORKLOAD"
1235 + }
1236 + }
1237 + }
1238 + ],
1239 + "type": "table"
1240 + },
1241 + {
1242 + "datasource": {
1243 + "type": "elasticsearch",
1244 + "uid": "replace_datasource_uid"
1245 + },
1246 + "fieldConfig": {
1247 + "defaults": {
1248 + "color": {
1249 + "mode": "thresholds"
1250 + },
1251 + "custom": {
1252 + "align": "auto",
1253 + "cellOptions": {
1254 + "type": "auto"
1255 + },
1256 + "filterable": true,
1257 + "inspect": false
1258 + },
1259 + "mappings": [],
1260 + "thresholds": {
1261 + "mode": "absolute",
1262 + "steps": [
1263 + {
1264 + "color": "green"
1265 + },
1266 + {
1267 + "color": "red",
1268 + "value": 80
1269 + }
1270 + ]
1271 + }
1272 + },
1273 + "overrides": [
1274 + {
1275 + "matcher": {
1276 + "id": "byName",
1277 + "options": "rule_level"
1278 + },
1279 + "properties": [
1280 + {
1281 + "id": "displayName",
1282 + "value": "RULE LEVEL"
1283 + },
1284 + {
1285 + "id": "unit",
1286 + "value": "short"
1287 + },
1288 + {
1289 + "id": "decimals",
1290 + "value": -1
1291 + },
1292 + {
1293 + "id": "custom.cellOptions",
1294 + "value": {
1295 + "mode": "gradient",
1296 + "type": "color-background"
1297 + }
1298 + },
1299 + {
1300 + "id": "custom.align"
1301 + },
1302 + {
1303 + "id": "thresholds",
1304 + "value": {
1305 + "mode": "absolute",
1306 + "steps": [
1307 + {
1308 + "color": "#37872D"
1309 + },
1310 + {
1311 + "color": "rgba(237, 129, 40, 0.89)",
1312 + "value": 7
1313 + },
1314 + {
1315 + "color": "rgba(245, 54, 54, 0.9)",
1316 + "value": 12
1317 + }
1318 + ]
1319 + }
1320 + }
1321 + ]
1322 + },
1323 + {
1324 + "matcher": {
1325 + "id": "byName",
1326 + "options": "Date/Time"
1327 + },
1328 + "properties": [
1329 + {
1330 + "id": "custom.width",
1331 + "value": 242
1332 + }
1333 + ]
1334 + },
1335 + {
1336 + "matcher": {
1337 + "id": "byName",
1338 + "options": "MITRE TACTIC"
1339 + },
1340 + "properties": [
1341 + {
1342 + "id": "custom.width",
1343 + "value": 145
1344 + }
1345 + ]
1346 + },
1347 + {
1348 + "matcher": {
1349 + "id": "byName",
1350 + "options": "IP ADDRESS"
1351 + },
1352 + "properties": [
1353 + {
1354 + "id": "custom.width",
1355 + "value": 163
1356 + }
1357 + ]
1358 + },
1359 + {
1360 + "matcher": {
1361 + "id": "byName",
1362 + "options": "MITRE TECHNIQUE"
1363 + },
1364 + "properties": [
1365 + {
1366 + "id": "custom.width",
1367 + "value": 312
1368 + }
1369 + ]
1370 + },
1371 + {
1372 + "matcher": {
1373 + "id": "byName",
1374 + "options": "EVENT ID"
1375 + },
1376 + "properties": [
1377 + {
1378 + "id": "links",
1379 + "value": [
1380 + {
1381 + "targetBlank": true,
1382 + "title": "VIEW EVENT DETAILS",
1383 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1384 + }
1385 + ]
1386 + },
1387 + {
1388 + "id": "custom.width",
1389 + "value": 336
1390 + }
1391 + ]
1392 + },
1393 + {
1394 + "matcher": {
1395 + "id": "byName",
1396 + "options": "RESULT"
1397 + },
1398 + "properties": [
1399 + {
1400 + "id": "custom.width",
1401 + "value": 118
1402 + },
1403 + {
1404 + "id": "mappings",
1405 + "value": [
1406 + {
1407 + "options": {
1408 + "Failed": {
1409 + "color": "orange",
1410 + "index": 1
1411 + },
1412 + "Success": {
1413 + "color": "green",
1414 + "index": 0
1415 + }
1416 + },
1417 + "type": "value"
1418 + }
1419 + ]
1420 + },
1421 + {
1422 + "id": "custom.cellOptions",
1423 + "value": {
1424 + "type": "color-text"
1425 + }
1426 + }
1427 + ]
1428 + },
1429 + {
1430 + "matcher": {
1431 + "id": "byName",
1432 + "options": "SRC IP"
1433 + },
1434 + "properties": [
1435 + {
1436 + "id": "custom.width",
1437 + "value": 125
1438 + }
1439 + ]
1440 + },
1441 + {
1442 + "matcher": {
1443 + "id": "byName",
1444 + "options": "ACCOUNT"
1445 + },
1446 + "properties": [
1447 + {
1448 + "id": "custom.width",
1449 + "value": 343
1450 + }
1451 + ]
1452 + },
1453 + {
1454 + "matcher": {
1455 + "id": "byName",
1456 + "options": "EVENT TIME"
1457 + },
1458 + "properties": [
1459 + {
1460 + "id": "custom.width",
1461 + "value": 195
1462 + }
1463 + ]
1464 + }
1465 + ]
1466 + },
1467 + "gridPos": {
1468 + "h": 16,
1469 + "w": 24,
1470 + "x": 0,
1471 + "y": 32
1472 + },
1473 + "id": 27,
1474 + "options": {
1475 + "cellHeight": "sm",
1476 + "footer": {
1477 + "countRows": false,
1478 + "fields": "",
1479 + "reducer": [
1480 + "sum"
1481 + ],
1482 + "show": false
1483 + },
1484 + "showHeader": true,
1485 + "sortBy": []
1486 + },
1487 + "pluginVersion": "10.0.3",
1488 + "targets": [
1489 + {
1490 + "bucketAggs": [],
1491 + "datasource": {
1492 + "type": "elasticsearch",
1493 + "uid": "replace_datasource_uid"
1494 + },
1495 + "metrics": [
1496 + {
1497 + "id": "1",
1498 + "settings": {
1499 + "size": "250"
1500 + },
1501 + "type": "raw_data"
1502 + }
1503 + ],
1504 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1505 + "refId": "A",
1506 + "timeField": "timestamp"
1507 + }
1508 + ],
1509 + "title": "EVENTS",
1510 + "transformations": [
1511 + {
1512 + "id": "organize",
1513 + "options": {
1514 + "excludeByName": {
1515 + "@metadata_beat": true,
1516 + "@metadata_type": true,
1517 + "@metadata_version": true,
1518 + "IMPHASH": true,
1519 + "MD5": true,
1520 + "SHA1": true,
1521 + "SHA256": true,
1522 + "_id": false,
1523 + "_index": true,
1524 + "_type": true,
1525 + "agent_ephemeral_id": true,
1526 + "agent_hostname": true,
1527 + "agent_id": true,
1528 + "agent_ip_city_name": true,
1529 + "agent_ip_country_code": true,
1530 + "agent_ip_geolocation": true,
1531 + "agent_name": true,
1532 + "agent_type": true,
1533 + "agent_version": true,
1534 + "beats_type": true,
1535 + "cluster_name": true,
1536 + "cluster_node": true,
1537 + "collector_node_id": true,
1538 + "data_alert_action": true,
1539 + "data_alert_category": true,
1540 + "data_alert_gid": true,
1541 + "data_alert_rev": true,
1542 + "data_alert_severity": true,
1543 + "data_alert_signature": true,
1544 + "data_alert_signature_id": true,
1545 + "data_app_proto": true,
1546 + "data_audit_auid": true,
1547 + "data_audit_command": true,
1548 + "data_audit_euid": true,
1549 + "data_audit_exe": true,
1550 + "data_audit_gid": true,
1551 + "data_audit_id": true,
1552 + "data_audit_pid": true,
1553 + "data_audit_res": true,
1554 + "data_audit_session": true,
1555 + "data_audit_type": true,
1556 + "data_audit_uid": true,
1557 + "data_dest_ip": true,
1558 + "data_dest_port": true,
1559 + "data_dstuser": true,
1560 + "data_event_type": true,
1561 + "data_extra_data": true,
1562 + "data_file": true,
1563 + "data_flow_bytes_toclient": true,
1564 + "data_flow_bytes_toserver": true,
1565 + "data_flow_id": true,
1566 + "data_flow_pkts_toclient": true,
1567 + "data_flow_pkts_toserver": true,
1568 + "data_flow_start": true,
1569 + "data_http_http_content_type": true,
1570 + "data_http_http_port": true,
1571 + "data_http_length": true,
1572 + "data_http_status": true,
1573 + "data_http_url": true,
1574 + "data_id": true,
1575 + "data_in_iface": true,
1576 + "data_integration": true,
1577 + "data_metadata_flowbits": true,
1578 + "data_metadata_flowints_http_anomaly_count": true,
1579 + "data_metadata_flowints_tcp_retransmission_count": true,
1580 + "data_office365_Activity": true,
1581 + "data_office365_ActivityId": true,
1582 + "data_office365_ActivityParameters": true,
1583 + "data_office365_Actor": true,
1584 + "data_office365_ActorContextId": true,
1585 + "data_office365_ActorIpAddress": false,
1586 + "data_office365_ActorIpAddress_city_name": true,
1587 + "data_office365_ActorIpAddress_country_code": true,
1588 + "data_office365_ActorIpAddress_geolocation": true,
1589 + "data_office365_ActorUserId": true,
1590 + "data_office365_ActorYammerUserId": true,
1591 + "data_office365_AdditionalInfo": true,
1592 + "data_office365_AffectedItems": true,
1593 + "data_office365_AppAccessContext_AADSessionId": true,
1594 + "data_office365_AppAccessContext_APIId": true,
1595 + "data_office365_AppAccessContext_ClientAppId": true,
1596 + "data_office365_AppAccessContext_ClientAppName": true,
1597 + "data_office365_AppAccessContext_CorrelationId": true,
1598 + "data_office365_AppAccessContext_IssuedAtTime": true,
1599 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1600 + "data_office365_AppAccessContext_UniqueTokenId": true,
1601 + "data_office365_AppId": true,
1602 + "data_office365_AppName": true,
1603 + "data_office365_AppReportId": true,
1604 + "data_office365_Application": true,
1605 + "data_office365_ApplicationDisplayName": true,
1606 + "data_office365_ApplicationId": true,
1607 + "data_office365_ArtifactId": true,
1608 + "data_office365_ArtifactName": true,
1609 + "data_office365_AssertingApplicationId": true,
1610 + "data_office365_AuthenticationType": true,
1611 + "data_office365_AzureActiveDirectoryEventType": true,
1612 + "data_office365_BrowserName": true,
1613 + "data_office365_BrowserVersion": true,
1614 + "data_office365_BrowserVersion_city_name": true,
1615 + "data_office365_BrowserVersion_country_code": true,
1616 + "data_office365_BrowserVersion_geolocation": true,
1617 + "data_office365_CapacityId": true,
1618 + "data_office365_CapacityName": true,
1619 + "data_office365_ChatThreadId": true,
1620 + "data_office365_ClientAppId": true,
1621 + "data_office365_ClientIP": false,
1622 + "data_office365_ClientIPAddress": true,
1623 + "data_office365_ClientIPAddress_city_name": true,
1624 + "data_office365_ClientIPAddress_country_code": true,
1625 + "data_office365_ClientIPAddress_geolocation": true,
1626 + "data_office365_ClientIP_city_name": true,
1627 + "data_office365_ClientIP_country_code": true,
1628 + "data_office365_ClientIP_geolocation": true,
1629 + "data_office365_ClientIP_reserved_ip": true,
1630 + "data_office365_ClientInfoString": true,
1631 + "data_office365_ClientRequestId": true,
1632 + "data_office365_CmdletVersion": true,
1633 + "data_office365_CommunicationType": true,
1634 + "data_office365_ConsumptionMethod": true,
1635 + "data_office365_CorrelationId": true,
1636 + "data_office365_CreationTime": false,
1637 + "data_office365_CrossMailboxOperation": true,
1638 + "data_office365_CustomUniqueId": true,
1639 + "data_office365_CustomizedDoclib": true,
1640 + "data_office365_DashboardId": true,
1641 + "data_office365_DashboardName": true,
1642 + "data_office365_DataConnectivityMode": true,
1643 + "data_office365_DataflowAccessTokenRequestParameters_entityName": true,
1644 + "data_office365_DataflowAccessTokenRequestParameters_partitionUri": true,
1645 + "data_office365_DataflowAccessTokenRequestParameters_permissions": true,
1646 + "data_office365_DataflowAccessTokenRequestParameters_tokenLifetimeInMinutes": true,
1647 + "data_office365_DataflowId": true,
1648 + "data_office365_DataflowName": true,
1649 + "data_office365_DataflowType": true,
1650 + "data_office365_DatasetId": true,
1651 + "data_office365_DatasetName": true,
1652 + "data_office365_Datasets": true,
1653 + "data_office365_DatasourceId": true,
1654 + "data_office365_DestFolder_Id": true,
1655 + "data_office365_DestFolder_Path": true,
1656 + "data_office365_DestinationLocationType": true,
1657 + "data_office365_DeviceDisplayName": true,
1658 + "data_office365_DeviceDisplayName_city_name": true,
1659 + "data_office365_DeviceDisplayName_country_code": true,
1660 + "data_office365_DeviceDisplayName_geolocation": true,
1661 + "data_office365_DeviceName": true,
1662 + "data_office365_DeviceProperties": true,
1663 + "data_office365_DistributionMethod": true,
1664 + "data_office365_DoNotDistributeEvent": true,
1665 + "data_office365_EnforcementMode": true,
1666 + "data_office365_Entity": true,
1667 + "data_office365_ErrorNumber": true,
1668 + "data_office365_EventData": true,
1669 + "data_office365_EventSource": true,
1670 + "data_office365_ExtendedProperties": true,
1671 + "data_office365_ExternalAccess": true,
1672 + "data_office365_ExtraProperties": true,
1673 + "data_office365_FileExtension": true,
1674 + "data_office365_FileId": true,
1675 + "data_office365_FileName": true,
1676 + "data_office365_FileSize": true,
1677 + "data_office365_FileSizeBytes": true,
1678 + "data_office365_FileType": true,
1679 + "data_office365_Folder_Id": true,
1680 + "data_office365_Folder_Path": true,
1681 + "data_office365_FormId": true,
1682 + "data_office365_FormName": true,
1683 + "data_office365_FormsUserType": true,
1684 + "data_office365_FromApp": true,
1685 + "data_office365_GatewayId": true,
1686 + "data_office365_Hidden": true,
1687 + "data_office365_HighPriorityMediaProcessing": true,
1688 + "data_office365_Id": true,
1689 + "data_office365_ImplicitShare": true,
1690 + "data_office365_ImportDisplayName": true,
1691 + "data_office365_ImportId": true,
1692 + "data_office365_ImportSource": true,
1693 + "data_office365_ImportType": true,
1694 + "data_office365_InterSystemsId": true,
1695 + "data_office365_InternalLogonType": true,
1696 + "data_office365_IntraSystemId": true,
1697 + "data_office365_IsManagedDevice": true,
1698 + "data_office365_IsPolicyHit": true,
1699 + "data_office365_IsSuccess": true,
1700 + "data_office365_ItemCount": true,
1701 + "data_office365_ItemName": true,
1702 + "data_office365_ItemType": true,
1703 + "data_office365_Item_Id": true,
1704 + "data_office365_Item_InternetMessageId": true,
1705 + "data_office365_Item_IsRecord": true,
1706 + "data_office365_Item_ParentFolder_Id": true,
1707 + "data_office365_Item_ParentFolder_Path": true,
1708 + "data_office365_Item_SizeInBytes": true,
1709 + "data_office365_Item_Subject": true,
1710 + "data_office365_JitTriggered": true,
1711 + "data_office365_LastRefreshTime": true,
1712 + "data_office365_ListBaseTemplateType": true,
1713 + "data_office365_ListBaseType": true,
1714 + "data_office365_ListId": true,
1715 + "data_office365_ListItemUniqueId": true,
1716 + "data_office365_ListServerTemplate": true,
1717 + "data_office365_ListTitle": true,
1718 + "data_office365_LogonError": true,
1719 + "data_office365_LogonType": true,
1720 + "data_office365_LogonUserSid": true,
1721 + "data_office365_MDATPDeviceId": true,
1722 + "data_office365_MailboxGuid": true,
1723 + "data_office365_MailboxOwnerSid": true,
1724 + "data_office365_MailboxOwnerUPN": true,
1725 + "data_office365_MessageId": true,
1726 + "data_office365_MessageReactionType": true,
1727 + "data_office365_MessageVersion": true,
1728 + "data_office365_ModelsSnapshots": true,
1729 + "data_office365_ModifiedProperties": true,
1730 + "data_office365_ObjectId": true,
1731 + "data_office365_ObjectName": true,
1732 + "data_office365_Operation": false,
1733 + "data_office365_OrganizationId": true,
1734 + "data_office365_OrganizationName": true,
1735 + "data_office365_OriginatingServer": true,
1736 + "data_office365_Parameters": true,
1737 + "data_office365_ParticipantInfo_HasForeignTenantUsers": true,
1738 + "data_office365_ParticipantInfo_HasGuestUsers": true,
1739 + "data_office365_ParticipantInfo_HasOtherGuestUsers": true,
1740 + "data_office365_ParticipantInfo_HasUnauthenticatedUsers": true,
1741 + "data_office365_ParticipantInfo_ParticipatingTenantIds": true,
1742 + "data_office365_Platform": true,
1743 + "data_office365_RMSEncrypted": true,
1744 + "data_office365_RecordType": true,
1745 + "data_office365_RefreshType": true,
1746 + "data_office365_ReportId": true,
1747 + "data_office365_ReportName": true,
1748 + "data_office365_ReportType": true,
1749 + "data_office365_RequestId": true,
1750 + "data_office365_ResourceTenantId": true,
1751 + "data_office365_ResultDescription": true,
1752 + "data_office365_ResultStatus": false,
1753 + "data_office365_SRPolicyMatchDetails_SRPolicyId": true,
1754 + "data_office365_SRPolicyMatchDetails_SRPolicyName": true,
1755 + "data_office365_Schedules_Days": true,
1756 + "data_office365_Schedules_RefreshFrequency": true,
1757 + "data_office365_Schedules_Time": true,
1758 + "data_office365_Schedules_TimeZone": true,
1759 + "data_office365_Scope": true,
1760 + "data_office365_SearchQueryText": true,
1761 + "data_office365_SessionId": true,
1762 + "data_office365_Sha1": true,
1763 + "data_office365_Sha256": true,
1764 + "data_office365_ShareLinkId": true,
1765 + "data_office365_SharingAction": true,
1766 + "data_office365_Site": true,
1767 + "data_office365_SiteUrl": true,
1768 + "data_office365_SkypeForBusinessEventType": true,
1769 + "data_office365_Source": true,
1770 + "data_office365_SourceApp": true,
1771 + "data_office365_SourceFileExtension": true,
1772 + "data_office365_SourceFileName": true,
1773 + "data_office365_SourceLocationType": true,
1774 + "data_office365_SourceRelativeUrl": true,
1775 + "data_office365_Subscription": true,
1776 + "data_office365_TableName": true,
1777 + "data_office365_Target": true,
1778 + "data_office365_TargetContextId": true,
1779 + "data_office365_TargetFilePath": true,
1780 + "data_office365_TenantName": true,
1781 + "data_office365_ThreadID": true,
1782 + "data_office365_UserAgent": true,
1783 + "data_office365_UserId": false,
1784 + "data_office365_UserKey": true,
1785 + "data_office365_UserType": true,
1786 + "data_office365_Version": true,
1787 + "data_office365_VersionId": true,
1788 + "data_office365_WebId": true,
1789 + "data_office365_WorkSpaceName": true,
1790 + "data_office365_Workload": false,
1791 + "data_office365_WorkspaceId": true,
1792 + "data_office365_YammerNetworkId": true,
1793 + "data_osquery_action": true,
1794 + "data_osquery_calendarTime": true,
1795 + "data_osquery_columns_address": true,
1796 + "data_osquery_columns_address_city_name": true,
1797 + "data_osquery_columns_address_country_code": true,
1798 + "data_osquery_columns_address_geolocation": true,
1799 + "data_osquery_columns_cmdline": true,
1800 + "data_osquery_columns_cwd": true,
1801 + "data_osquery_columns_description": true,
1802 + "data_osquery_columns_directory": true,
1803 + "data_osquery_columns_disk_bytes_read": true,
1804 + "data_osquery_columns_disk_bytes_written": true,
1805 + "data_osquery_columns_egid": true,
1806 + "data_osquery_columns_euid": true,
1807 + "data_osquery_columns_family": true,
1808 + "data_osquery_columns_fd": true,
1809 + "data_osquery_columns_gid": true,
1810 + "data_osquery_columns_gid_signed": true,
1811 + "data_osquery_columns_host": true,
1812 + "data_osquery_columns_interface": true,
1813 + "data_osquery_columns_local_address": true,
1814 + "data_osquery_columns_local_address_city_name": true,
1815 + "data_osquery_columns_local_address_country_code": true,
1816 + "data_osquery_columns_local_address_geolocation": true,
1817 + "data_osquery_columns_local_port": true,
1818 + "data_osquery_columns_mac": true,
1819 + "data_osquery_columns_name": true,
1820 + "data_osquery_columns_net_namespace": true,
1821 + "data_osquery_columns_nice": true,
1822 + "data_osquery_columns_on_disk": true,
1823 + "data_osquery_columns_parent": true,
1824 + "data_osquery_columns_path": true,
1825 + "data_osquery_columns_pgroup": true,
1826 + "data_osquery_columns_pid": true,
1827 + "data_osquery_columns_port": true,
1828 + "data_osquery_columns_protocol": true,
1829 + "data_osquery_columns_remote_address": true,
1830 + "data_osquery_columns_remote_address_city_name": true,
1831 + "data_osquery_columns_remote_address_country_code": true,
1832 + "data_osquery_columns_remote_address_geolocation": true,
1833 + "data_osquery_columns_remote_port": true,
1834 + "data_osquery_columns_resident_size": true,
1835 + "data_osquery_columns_root": true,
1836 + "data_osquery_columns_sgid": true,
1837 + "data_osquery_columns_shell": true,
1838 + "data_osquery_columns_socket": true,
1839 + "data_osquery_columns_start_time": true,
1840 + "data_osquery_columns_state": true,
1841 + "data_osquery_columns_suid": true,
1842 + "data_osquery_columns_system_time": true,
1843 + "data_osquery_columns_threads": true,
1844 + "data_osquery_columns_time_utc": true,
1845 + "data_osquery_columns_total_size": true,
1846 + "data_osquery_columns_tty": true,
1847 + "data_osquery_columns_type": true,
1848 + "data_osquery_columns_uid": true,
1849 + "data_osquery_columns_uid_signed": true,
1850 + "data_osquery_columns_user": true,
1851 + "data_osquery_columns_user_time": true,
1852 + "data_osquery_columns_username": true,
1853 + "data_osquery_columns_wired_size": true,
1854 + "data_osquery_counter": true,
1855 + "data_osquery_decorations_host_uuid": true,
1856 + "data_osquery_decorations_hostname": true,
1857 + "data_osquery_epoch": true,
1858 + "data_osquery_hostIdentifier": true,
1859 + "data_osquery_name": true,
1860 + "data_osquery_numerics": true,
1861 + "data_osquery_unixTime": true,
1862 + "data_proto": true,
1863 + "data_sca_check_command": true,
1864 + "data_sca_check_compliance_cis": true,
1865 + "data_sca_check_compliance_cis_csc": true,
1866 + "data_sca_check_compliance_gdpr_IV": true,
1867 + "data_sca_check_compliance_gpg_13": true,
1868 + "data_sca_check_compliance_hipaa": true,
1869 + "data_sca_check_compliance_nist_800_53": true,
1870 + "data_sca_check_compliance_pci_dss": true,
1871 + "data_sca_check_compliance_tsc": true,
1872 + "data_sca_check_description": true,
1873 + "data_sca_check_id": true,
1874 + "data_sca_check_previous_result": true,
1875 + "data_sca_check_rationale": true,
1876 + "data_sca_check_remediation": true,
1877 + "data_sca_check_result": true,
1878 + "data_sca_check_title": true,
1879 + "data_sca_description": true,
1880 + "data_sca_failed": true,
1881 + "data_sca_file": true,
1882 + "data_sca_invalid": true,
1883 + "data_sca_passed": true,
1884 + "data_sca_policy": true,
1885 + "data_sca_policy_id": true,
1886 + "data_sca_scan_id": true,
1887 + "data_sca_score": true,
1888 + "data_sca_total_checks": true,
1889 + "data_sca_type": true,
1890 + "data_script": true,
1891 + "data_src_ip": true,
1892 + "data_src_ip_city_name": true,
1893 + "data_src_ip_country_code": true,
1894 + "data_src_ip_geolocation": true,
1895 + "data_src_port": true,
1896 + "data_srcip": true,
1897 + "data_srcip_city_name": true,
1898 + "data_srcip_country_code": true,
1899 + "data_srcip_geolocation": true,
1900 + "data_srcuser": true,
1901 + "data_timestamp": true,
1902 + "data_title": true,
1903 + "data_tls_session_resumed": true,
1904 + "data_tls_version": true,
1905 + "data_tx_id": true,
1906 + "data_type": true,
1907 + "data_win_eventXML_binaryData": true,
1908 + "data_win_eventXML_binaryDataSize": true,
1909 + "data_win_eventXML_param1": true,
1910 + "data_win_eventdata_authenticationPackageName": true,
1911 + "data_win_eventdata_callTrace": true,
1912 + "data_win_eventdata_commandLine": true,
1913 + "data_win_eventdata_company": true,
1914 + "data_win_eventdata_creationUtcTime": true,
1915 + "data_win_eventdata_currentDirectory": true,
1916 + "data_win_eventdata_description": true,
1917 + "data_win_eventdata_destinationHostname": true,
1918 + "data_win_eventdata_destinationIp": true,
1919 + "data_win_eventdata_destinationIp_city_name": true,
1920 + "data_win_eventdata_destinationIp_country_code": true,
1921 + "data_win_eventdata_destinationIp_geolocation": true,
1922 + "data_win_eventdata_destinationIsIpv6": true,
1923 + "data_win_eventdata_destinationPort": true,
1924 + "data_win_eventdata_destinationPortName": true,
1925 + "data_win_eventdata_details": true,
1926 + "data_win_eventdata_elevatedToken": true,
1927 + "data_win_eventdata_eventType": true,
1928 + "data_win_eventdata_fileVersion": true,
1929 + "data_win_eventdata_fileVersion_city_name": true,
1930 + "data_win_eventdata_fileVersion_country_code": true,
1931 + "data_win_eventdata_fileVersion_geolocation": true,
1932 + "data_win_eventdata_grantedAccess": true,
1933 + "data_win_eventdata_hashes": true,
1934 + "data_win_eventdata_image": true,
1935 + "data_win_eventdata_imageLoaded": true,
1936 + "data_win_eventdata_impersonationLevel": true,
1937 + "data_win_eventdata_initiated": true,
1938 + "data_win_eventdata_integrityLevel": true,
1939 + "data_win_eventdata_ipAddress": true,
1940 + "data_win_eventdata_ipPort": true,
1941 + "data_win_eventdata_keyLength": true,
1942 + "data_win_eventdata_logonGuid": true,
1943 + "data_win_eventdata_logonId": true,
1944 + "data_win_eventdata_logonProcessName": true,
1945 + "data_win_eventdata_logonType": true,
1946 + "data_win_eventdata_originalFileName": true,
1947 + "data_win_eventdata_param1": true,
1948 + "data_win_eventdata_param2": true,
1949 + "data_win_eventdata_param3": true,
1950 + "data_win_eventdata_param4": true,
1951 + "data_win_eventdata_parentCommandLine": true,
1952 + "data_win_eventdata_parentImage": true,
1953 + "data_win_eventdata_parentProcessGuid": true,
1954 + "data_win_eventdata_parentProcessId": true,
1955 + "data_win_eventdata_processGuid": true,
1956 + "data_win_eventdata_processId": true,
1957 + "data_win_eventdata_processName": true,
1958 + "data_win_eventdata_product": true,
1959 + "data_win_eventdata_protocol": true,
1960 + "data_win_eventdata_queryName": true,
1961 + "data_win_eventdata_queryResults": true,
1962 + "data_win_eventdata_queryStatus": true,
1963 + "data_win_eventdata_ruleName": true,
1964 + "data_win_eventdata_serviceName": true,
1965 + "data_win_eventdata_serviceSid": true,
1966 + "data_win_eventdata_signature": true,
1967 + "data_win_eventdata_signatureStatus": true,
1968 + "data_win_eventdata_signed": true,
1969 + "data_win_eventdata_sourceHostname": true,
1970 + "data_win_eventdata_sourceImage": true,
1971 + "data_win_eventdata_sourceIp": true,
1972 + "data_win_eventdata_sourceIp_city_name": true,
1973 + "data_win_eventdata_sourceIp_country_code": true,
1974 + "data_win_eventdata_sourceIp_geolocation": true,
1975 + "data_win_eventdata_sourceIsIpv6": true,
1976 + "data_win_eventdata_sourcePort": true,
1977 + "data_win_eventdata_sourceProcessGUID": true,
1978 + "data_win_eventdata_sourceProcessId": true,
1979 + "data_win_eventdata_sourceThreadId": true,
1980 + "data_win_eventdata_status": true,
1981 + "data_win_eventdata_subjectDomainName": true,
1982 + "data_win_eventdata_subjectLogonId": true,
1983 + "data_win_eventdata_subjectUserName": true,
1984 + "data_win_eventdata_subjectUserSid": true,
1985 + "data_win_eventdata_targetDomainName": true,
1986 + "data_win_eventdata_targetFilename": true,
1987 + "data_win_eventdata_targetImage": true,
1988 + "data_win_eventdata_targetLinkedLogonId": true,
1989 + "data_win_eventdata_targetLogonId": true,
1990 + "data_win_eventdata_targetObject": true,
1991 + "data_win_eventdata_targetProcessGUID": true,
1992 + "data_win_eventdata_targetProcessId": true,
1993 + "data_win_eventdata_targetUserName": true,
1994 + "data_win_eventdata_targetUserSid": true,
1995 + "data_win_eventdata_terminalSessionId": true,
1996 + "data_win_eventdata_ticketEncryptionType": true,
1997 + "data_win_eventdata_ticketOptions": true,
1998 + "data_win_eventdata_user": true,
1999 + "data_win_eventdata_utcTime": true,
2000 + "data_win_eventdata_virtualAccount": true,
2001 + "data_win_system_channel": true,
2002 + "data_win_system_computer": true,
2003 + "data_win_system_eventID": true,
2004 + "data_win_system_eventRecordID": true,
2005 + "data_win_system_eventSourceName": true,
2006 + "data_win_system_keywords": true,
2007 + "data_win_system_level": true,
2008 + "data_win_system_message": true,
2009 + "data_win_system_opcode": true,
2010 + "data_win_system_processID": true,
2011 + "data_win_system_providerGuid": true,
2012 + "data_win_system_providerName": true,
2013 + "data_win_system_severityValue": true,
2014 + "data_win_system_systemTime": true,
2015 + "data_win_system_task": true,
2016 + "data_win_system_threadID": true,
2017 + "data_win_system_version": true,
2018 + "decoder_name": true,
2019 + "decoder_parent": true,
2020 + "dns_query": true,
2021 + "dns_query_threat_indicated": true,
2022 + "dst_ip": true,
2023 + "dst_ip_city_name": true,
2024 + "dst_ip_country_code": true,
2025 + "dst_ip_geolocation": true,
2026 + "dst_ip_threat_indicated": true,
2027 + "dst_port": true,
2028 + "ecs_version": true,
2029 + "error": true,
2030 + "event_hash": true,
2031 + "file_path": true,
2032 + "firewall_rule_name": true,
2033 + "full_log": false,
2034 + "gl2_accounted_message_size": true,
2035 + "gl2_message_id": true,
2036 + "gl2_processing_error": true,
2037 + "gl2_remote_ip": true,
2038 + "gl2_remote_port": true,
2039 + "gl2_source_collector": true,
2040 + "gl2_source_input": true,
2041 + "gl2_source_node": true,
2042 + "hash_md5": true,
2043 + "hash_sha1": true,
2044 + "hash_sha256": true,
2045 + "highlight": true,
2046 + "host_architecture": true,
2047 + "host_containerized": true,
2048 + "host_hostname": true,
2049 + "host_id": true,
2050 + "host_ip": true,
2051 + "host_mac": true,
2052 + "host_name": true,
2053 + "host_os_codename": true,
2054 + "host_os_kernel": true,
2055 + "host_os_name": true,
2056 + "host_os_platform": true,
2057 + "host_os_version": true,
2058 + "hostname": true,
2059 + "id": true,
2060 + "input_type": true,
2061 + "level": true,
2062 + "location": true,
2063 + "log_file_path": true,
2064 + "log_offset": true,
2065 + "manager_name": true,
2066 + "message": true,
2067 + "module": true,
2068 + "msg_timestamp": true,
2069 + "parent_process_cmd_line": true,
2070 + "parent_process_id": true,
2071 + "parent_process_image": true,
2072 + "pid": true,
2073 + "predecoder_hostname": true,
2074 + "predecoder_program_name": true,
2075 + "predecoder_timestamp": true,
2076 + "previous_log": true,
2077 + "previous_output": true,
2078 + "process_cmd_line": true,
2079 + "process_id": true,
2080 + "process_image": true,
2081 + "process_name": true,
2082 + "protocol": true,
2083 + "rule_cis": true,
2084 + "rule_cis_csc": true,
2085 + "rule_description": true,
2086 + "rule_firedtimes": true,
2087 + "rule_gdpr": true,
2088 + "rule_gdpr_IV": true,
2089 + "rule_gpg13": true,
2090 + "rule_gpg_13": true,
2091 + "rule_group1": true,
2092 + "rule_group2": true,
2093 + "rule_group3": true,
2094 + "rule_groups": true,
2095 + "rule_hipaa": true,
2096 + "rule_id": true,
2097 + "rule_info": true,
2098 + "rule_mail": true,
2099 + "rule_mitre_id": true,
2100 + "rule_mitre_tactic": false,
2101 + "rule_nist_800_53": true,
2102 + "rule_pci_dss": true,
2103 + "rule_tsc": true,
2104 + "scanid": true,
2105 + "service": true,
2106 + "software_package": true,
2107 + "software_vendor": true,
2108 + "sort": true,
2109 + "source": true,
2110 + "source_reserved_ip": true,
2111 + "src_ip": true,
2112 + "src_ip_city_name": true,
2113 + "src_ip_country_code": true,
2114 + "src_ip_geolocation": true,
2115 + "src_port": true,
2116 + "streams": true,
2117 + "syscheck_attrs_after": true,
2118 + "syscheck_audit_effective_user_id": true,
2119 + "syscheck_audit_effective_user_name": true,
2120 + "syscheck_audit_group_id": true,
2121 + "syscheck_audit_group_name": true,
2122 + "syscheck_audit_login_user_id": true,
2123 + "syscheck_audit_login_user_name": true,
2124 + "syscheck_audit_process_cwd": true,
2125 + "syscheck_audit_process_id": true,
2126 + "syscheck_audit_process_name": true,
2127 + "syscheck_audit_process_parent_cwd": true,
2128 + "syscheck_audit_process_parent_name": true,
2129 + "syscheck_audit_process_ppid": true,
2130 + "syscheck_audit_user_id": true,
2131 + "syscheck_audit_user_name": true,
2132 + "syscheck_changed_attributes": true,
2133 + "syscheck_event": true,
2134 + "syscheck_gid_after": true,
2135 + "syscheck_gname_after": true,
2136 + "syscheck_hard_links": true,
2137 + "syscheck_inode_after": true,
2138 + "syscheck_inode_before": true,
2139 + "syscheck_md5_after": true,
2140 + "syscheck_md5_before": true,
2141 + "syscheck_mode": true,
2142 + "syscheck_mtime_after": true,
2143 + "syscheck_mtime_before": true,
2144 + "syscheck_path": true,
2145 + "syscheck_perm_after": true,
2146 + "syscheck_perm_before": true,
2147 + "syscheck_sha1_after": true,
2148 + "syscheck_sha1_before": true,
2149 + "syscheck_sha256_after": true,
2150 + "syscheck_sha256_before": true,
2151 + "syscheck_size_after": true,
2152 + "syscheck_size_before": true,
2153 + "syscheck_uid_after": true,
2154 + "syscheck_uname_after": true,
2155 + "syscheck_win_perm_after": true,
2156 + "syscheck_win_perm_after_0_allowed": true,
2157 + "syscheck_win_perm_after_0_name": true,
2158 + "syscheck_win_perm_after_1_allowed": true,
2159 + "syscheck_win_perm_after_1_name": true,
2160 + "syscheck_win_perm_after_2_allowed": true,
2161 + "syscheck_win_perm_after_2_name": true,
2162 + "syscheck_win_perm_after_3_allowed": true,
2163 + "syscheck_win_perm_after_3_name": true,
2164 + "syslog_customer": true,
2165 + "syslog_level": true,
2166 + "syslog_tag": true,
2167 + "syslog_type": true,
2168 + "sysmon_event_description": true,
2169 + "threat_ids": true,
2170 + "threat_indicated": true,
2171 + "threat_names": true,
2172 + "time": true,
2173 + "timestamp": true,
2174 + "true": true,
2175 + "user_name": true,
2176 + "win_registry_key": true,
2177 + "win_system_eventID": true,
2178 + "windows_auth_package": true,
2179 + "windows_domain": true,
2180 + "windows_event_id": true,
2181 + "windows_event_severity": true,
2182 + "windows_logon_type": true
2183 + },
2184 + "indexByName": {
2185 + "_id": 2,
2186 + "_index": 12,
2187 + "_type": 13,
2188 + "agent_id": 14,
2189 + "agent_name": 7,
2190 + "cluster_name": 15,
2191 + "cluster_node": 16,
2192 + "data_office365_Activity": 50,
2193 + "data_office365_ActivityId": 51,
2194 + "data_office365_ActivityParameters": 52,
2195 + "data_office365_ActorUserId": 53,
2196 + "data_office365_ActorYammerUserId": 54,
2197 + "data_office365_AdditionalInfo": 55,
2198 + "data_office365_AppAccessContext_AADSessionId": 56,
2199 + "data_office365_AppAccessContext_CorrelationId": 57,
2200 + "data_office365_AppAccessContext_UniqueTokenId": 58,
2201 + "data_office365_AppName": 59,
2202 + "data_office365_CapacityId": 60,
2203 + "data_office365_CapacityName": 61,
2204 + "data_office365_ClientIP": 4,
2205 + "data_office365_ClientIP_city_name": 17,
2206 + "data_office365_ClientIP_country_code": 18,
2207 + "data_office365_ClientIP_geolocation": 19,
2208 + "data_office365_ConsumptionMethod": 62,
2209 + "data_office365_CorrelationId": 63,
2210 + "data_office365_CreationTime": 0,
2211 + "data_office365_DashboardId": 64,
2212 + "data_office365_DashboardName": 65,
2213 + "data_office365_DatasetId": 66,
2214 + "data_office365_DatasetName": 67,
2215 + "data_office365_Datasets": 68,
2216 + "data_office365_DistributionMethod": 69,
2217 + "data_office365_Entity": 70,
2218 + "data_office365_EventSource": 71,
2219 + "data_office365_FileId": 72,
2220 + "data_office365_FileName": 73,
2221 + "data_office365_FormId": 74,
2222 + "data_office365_FormName": 75,
2223 + "data_office365_FormsUserType": 76,
2224 + "data_office365_Id": 20,
2225 + "data_office365_IsSuccess": 77,
2226 + "data_office365_ItemName": 78,
2227 + "data_office365_ItemType": 79,
2228 + "data_office365_ModelsSnapshots": 80,
2229 + "data_office365_ObjectId": 21,
2230 + "data_office365_Operation": 6,
2231 + "data_office365_OrganizationId": 22,
2232 + "data_office365_RecordType": 23,
2233 + "data_office365_ReportId": 81,
2234 + "data_office365_ReportName": 82,
2235 + "data_office365_ReportType": 83,
2236 + "data_office365_RequestId": 84,
2237 + "data_office365_ResultStatus": 8,
2238 + "data_office365_SourceApp": 85,
2239 + "data_office365_ThreadID": 86,
2240 + "data_office365_UserAgent": 87,
2241 + "data_office365_UserId": 3,
2242 + "data_office365_UserKey": 24,
2243 + "data_office365_UserType": 25,
2244 + "data_office365_Version": 26,
2245 + "data_office365_VersionId": 88,
2246 + "data_office365_WorkSpaceName": 89,
2247 + "data_office365_Workload": 5,
2248 + "data_office365_WorkspaceId": 90,
2249 + "data_office365_YammerNetworkId": 91,
2250 + "decoder_name": 27,
2251 + "gl2_accounted_message_size": 28,
2252 + "gl2_message_id": 29,
2253 + "gl2_processing_error": 30,
2254 + "gl2_remote_ip": 31,
2255 + "gl2_remote_port": 32,
2256 + "gl2_source_input": 33,
2257 + "gl2_source_node": 34,
2258 + "highlight": 35,
2259 + "id": 36,
2260 + "location": 37,
2261 + "manager_name": 38,
2262 + "message": 39,
2263 + "rule_description": 9,
2264 + "rule_firedtimes": 40,
2265 + "rule_group1": 41,
2266 + "rule_groups": 42,
2267 + "rule_id": 11,
2268 + "rule_level": 10,
2269 + "rule_mail": 43,
2270 + "sort": 44,
2271 + "source": 45,
2272 + "streams": 46,
2273 + "syslog_level": 47,
2274 + "syslog_type": 48,
2275 + "timestamp": 1,
2276 + "true": 49
2277 + },
2278 + "renameByName": {
2279 + "_id": "EVENT ID",
2280 + "agent_name": "",
2281 + "data_office365_ActorIpAddress": "SRC IP",
2282 + "data_office365_Application": "APP",
2283 + "data_office365_ClientIP": "SRC IP",
2284 + "data_office365_CreationTime": "EVENT TIME",
2285 + "data_office365_Operation": "OPERATION",
2286 + "data_office365_ResultStatus": "RESULT",
2287 + "data_office365_UserId": "ACCOUNT",
2288 + "data_office365_Workload": "WORKLOAD",
2289 + "decoder_name": "",
2290 + "rule_description": "DESCRIPTION",
2291 + "rule_id": "RULE ID",
2292 + "rule_level": "",
2293 + "rule_mitre_tactic": "MITRE TACTIC",
2294 + "rule_mitre_technique": "MITRE TECHNIQUE",
2295 + "timestamp": "Date/Time"
2296 + }
2297 + }
2298 + }
2299 + ],
2300 + "transparent": true,
2301 + "type": "table"
2302 + }
2303 + ],
2304 + "refresh": "",
2305 + "schemaVersion": 38,
2306 + "style": "dark",
2307 + "tags": [
2308 + "O365"
2309 + ],
2310 + "templating": {
2311 + "list": [
2312 + {
2313 + "datasource": {
2314 + "type": "elasticsearch",
2315 + "uid": "replace_datasource_uid"
2316 + },
2317 + "filters": [],
2318 + "hide": 0,
2319 + "label": "",
2320 + "name": "Filters",
2321 + "skipUrlSync": false,
2322 + "type": "adhoc"
2323 + },
2324 + {
2325 + "current": {
2326 + "selected": false,
2327 + "text": "All",
2328 + "value": "$__all"
2329 + },
2330 + "datasource": {
2331 + "type": "elasticsearch",
2332 + "uid": "replace_datasource_uid"
2333 + },
2334 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2335 + "hide": 0,
2336 + "includeAll": true,
2337 + "label": "Workload",
2338 + "multi": false,
2339 + "name": "workload",
2340 + "options": [],
2341 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2342 + "refresh": 2,
2343 + "regex": "",
2344 + "skipUrlSync": false,
2345 + "sort": 1,
2346 + "tagValuesQuery": "",
2347 + "tagsQuery": "",
2348 + "type": "query",
2349 + "useTags": false
2350 + },
2351 + {
2352 + "current": {
2353 + "selected": false,
2354 + "text": "All",
2355 + "value": "$__all"
2356 + },
2357 + "datasource": {
2358 + "type": "elasticsearch",
2359 + "uid": "replace_datasource_uid"
2360 + },
2361 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2362 + "hide": 0,
2363 + "includeAll": true,
2364 + "label": "Rule Level",
2365 + "multi": false,
2366 + "name": "rule_level",
2367 + "options": [],
2368 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2369 + "refresh": 2,
2370 + "regex": "",
2371 + "skipUrlSync": false,
2372 + "sort": 0,
2373 + "type": "query"
2374 + }
2375 + ]
2376 + },
2377 + "time": {
2378 + "from": "now-6h",
2379 + "to": "now"
2380 + },
2381 + "timepicker": {
2382 + "refresh_intervals": [
2383 + "5s",
2384 + "10s",
2385 + "30s",
2386 + "1m",
2387 + "5m",
2388 + "15m",
2389 + "30m",
2390 + "1h",
2391 + "2h",
2392 + "1d"
2393 + ],
2394 + "time_options": [
2395 + "5m",
2396 + "15m",
2397 + "1h",
2398 + "6h",
2399 + "12h",
2400 + "24h",
2401 + "2d",
2402 + "7d",
2403 + "30d"
2404 + ]
2405 + },
2406 + "timezone": "",
2407 + "title": "O365 - APPLICATIONS",
2408 + "weekStart": ""
2409 +}
backend/app/connectors/grafana/dashboards/Office365/compliance_center.json new
+1646
@@ -0,0 +1,1646 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "9.2.0",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 3,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "displayMode": "auto",
261 + "inspect": false
262 + },
263 + "mappings": [],
264 + "thresholds": {
265 + "mode": "absolute",
266 + "steps": [
267 + {
268 + "color": "red",
269 + "value": null
270 + }
271 + ]
272 + }
273 + },
274 + "overrides": [
275 + {
276 + "matcher": {
277 + "id": "byName",
278 + "options": "Count"
279 + },
280 + "properties": [
281 + {
282 + "id": "displayName",
283 + "value": "EVENTS"
284 + },
285 + {
286 + "id": "unit",
287 + "value": "short"
288 + },
289 + {
290 + "id": "decimals",
291 + "value": -1
292 + },
293 + {
294 + "id": "custom.align"
295 + },
296 + {
297 + "id": "thresholds",
298 + "value": {
299 + "mode": "absolute",
300 + "steps": [
301 + {
302 + "color": "red",
303 + "value": null
304 + }
305 + ]
306 + }
307 + }
308 + ]
309 + },
310 + {
311 + "matcher": {
312 + "id": "byName",
313 + "options": "OPERATION"
314 + },
315 + "properties": [
316 + {
317 + "id": "custom.width",
318 + "value": 209
319 + }
320 + ]
321 + }
322 + ]
323 + },
324 + "gridPos": {
325 + "h": 7,
326 + "w": 5,
327 + "x": 7,
328 + "y": 0
329 + },
330 + "id": 54,
331 + "options": {
332 + "footer": {
333 + "fields": "",
334 + "reducer": [
335 + "sum"
336 + ],
337 + "show": false
338 + },
339 + "showHeader": true,
340 + "sortBy": []
341 + },
342 + "pluginVersion": "9.2.0",
343 + "targets": [
344 + {
345 + "bucketAggs": [
346 + {
347 + "fake": true,
348 + "field": "data_office365_Operation",
349 + "id": "4",
350 + "settings": {
351 + "min_doc_count": 1,
352 + "order": "desc",
353 + "orderBy": "_count",
354 + "size": "0"
355 + },
356 + "type": "terms"
357 + }
358 + ],
359 + "datasource": {
360 + "type": "elasticsearch",
361 + "uid": "replace_datasource_uid"
362 + },
363 + "metrics": [
364 + {
365 + "field": "select field",
366 + "id": "1",
367 + "type": "count"
368 + }
369 + ],
370 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
371 + "refId": "A",
372 + "timeField": "timestamp"
373 + }
374 + ],
375 + "title": "EVENTS BY OPERATION",
376 + "transformations": [
377 + {
378 + "id": "merge",
379 + "options": {
380 + "reducers": []
381 + }
382 + },
383 + {
384 + "id": "organize",
385 + "options": {
386 + "excludeByName": {},
387 + "indexByName": {},
388 + "renameByName": {
389 + "Count": "EVENTS",
390 + "data_office365_Operation": "OPERATION",
391 + "data_office365_Workload": "WORKLOAD"
392 + }
393 + }
394 + }
395 + ],
396 + "type": "table"
397 + },
398 + {
399 + "datasource": {
400 + "type": "elasticsearch",
401 + "uid": "replace_datasource_uid"
402 + },
403 + "fieldConfig": {
404 + "defaults": {
405 + "mappings": [
406 + {
407 + "options": {
408 + "match": "null",
409 + "result": {
410 + "text": "N/A"
411 + }
412 + },
413 + "type": "special"
414 + }
415 + ],
416 + "thresholds": {
417 + "mode": "absolute",
418 + "steps": [
419 + {
420 + "color": "orange",
421 + "value": null
422 + }
423 + ]
424 + },
425 + "unit": "locale"
426 + },
427 + "overrides": []
428 + },
429 + "gridPos": {
430 + "h": 7,
431 + "w": 4,
432 + "x": 12,
433 + "y": 0
434 + },
435 + "id": 55,
436 + "links": [],
437 + "options": {
438 + "colorMode": "value",
439 + "graphMode": "area",
440 + "justifyMode": "auto",
441 + "orientation": "horizontal",
442 + "reduceOptions": {
443 + "calcs": [
444 + "sum"
445 + ],
446 + "fields": "",
447 + "values": false
448 + },
449 + "text": {},
450 + "textMode": "auto"
451 + },
452 + "pluginVersion": "9.2.0",
453 + "targets": [
454 + {
455 + "bucketAggs": [
456 + {
457 + "field": "timestamp",
458 + "id": "2",
459 + "settings": {
460 + "interval": "auto",
461 + "min_doc_count": 0,
462 + "trimEdges": 0
463 + },
464 + "type": "date_histogram"
465 + }
466 + ],
467 + "datasource": {
468 + "type": "elasticsearch",
469 + "uid": "replace_datasource_uid"
470 + },
471 + "metrics": [
472 + {
473 + "field": "select field",
474 + "id": "1",
475 + "type": "count"
476 + }
477 + ],
478 + "query": "data_office365_Operation:UserSubmission",
479 + "refId": "A",
480 + "timeField": "timestamp"
481 + }
482 + ],
483 + "title": "PHISHING (USER SUBMISSIONS)",
484 + "type": "stat"
485 + },
486 + {
487 + "datasource": {
488 + "type": "elasticsearch",
489 + "uid": "replace_datasource_uid"
490 + },
491 + "fieldConfig": {
492 + "defaults": {
493 + "color": {
494 + "mode": "thresholds"
495 + },
496 + "custom": {
497 + "align": "auto",
498 + "displayMode": "auto",
499 + "inspect": false
500 + },
501 + "mappings": [],
502 + "thresholds": {
503 + "mode": "absolute",
504 + "steps": [
505 + {
506 + "color": "red",
507 + "value": null
508 + }
509 + ]
510 + }
511 + },
512 + "overrides": [
513 + {
514 + "matcher": {
515 + "id": "byName",
516 + "options": "Count"
517 + },
518 + "properties": [
519 + {
520 + "id": "displayName",
521 + "value": "EVENTS"
522 + },
523 + {
524 + "id": "unit",
525 + "value": "short"
526 + },
527 + {
528 + "id": "decimals",
529 + "value": -1
530 + },
531 + {
532 + "id": "custom.align"
533 + },
534 + {
535 + "id": "thresholds",
536 + "value": {
537 + "mode": "absolute",
538 + "steps": [
539 + {
540 + "color": "red",
541 + "value": null
542 + }
543 + ]
544 + }
545 + }
546 + ]
547 + },
548 + {
549 + "matcher": {
550 + "id": "byName",
551 + "options": "OPERATION"
552 + },
553 + "properties": [
554 + {
555 + "id": "custom.width",
556 + "value": 263
557 + }
558 + ]
559 + },
560 + {
561 + "matcher": {
562 + "id": "byName",
563 + "options": "ACCOUNT"
564 + },
565 + "properties": [
566 + {
567 + "id": "custom.width",
568 + "value": 439
569 + }
570 + ]
571 + }
572 + ]
573 + },
574 + "gridPos": {
575 + "h": 7,
576 + "w": 8,
577 + "x": 16,
578 + "y": 0
579 + },
580 + "id": 57,
581 + "options": {
582 + "footer": {
583 + "fields": "",
584 + "reducer": [
585 + "sum"
586 + ],
587 + "show": false
588 + },
589 + "showHeader": true,
590 + "sortBy": []
591 + },
592 + "pluginVersion": "9.2.0",
593 + "targets": [
594 + {
595 + "bucketAggs": [
596 + {
597 + "fake": true,
598 + "field": "data_office365_UserId",
599 + "id": "4",
600 + "settings": {
601 + "min_doc_count": 1,
602 + "order": "desc",
603 + "orderBy": "_count",
604 + "size": "0"
605 + },
606 + "type": "terms"
607 + }
608 + ],
609 + "datasource": {
610 + "type": "elasticsearch",
611 + "uid": "replace_datasource_uid"
612 + },
613 + "metrics": [
614 + {
615 + "field": "select field",
616 + "id": "1",
617 + "type": "count"
618 + }
619 + ],
620 + "query": "data_office365_Operation:UserSubmission",
621 + "refId": "A",
622 + "timeField": "timestamp"
623 + }
624 + ],
625 + "title": "PHISHING (REPORTERS)",
626 + "transformations": [
627 + {
628 + "id": "organize",
629 + "options": {
630 + "excludeByName": {},
631 + "indexByName": {},
632 + "renameByName": {
633 + "Count": "EVENTS",
634 + "data_office365_Operation": "OPERATION",
635 + "data_office365_UserId": "ACCOUNT",
636 + "data_office365_Workload": "WORKLOAD"
637 + }
638 + }
639 + }
640 + ],
641 + "type": "table"
642 + },
643 + {
644 + "datasource": {
645 + "type": "elasticsearch",
646 + "uid": "replace_datasource_uid"
647 + },
648 + "fieldConfig": {
649 + "defaults": {
650 + "color": {
651 + "mode": "thresholds"
652 + },
653 + "mappings": [
654 + {
655 + "options": {
656 + "match": "null",
657 + "result": {
658 + "text": "N/A"
659 + }
660 + },
661 + "type": "special"
662 + }
663 + ],
664 + "max": 15,
665 + "min": 0,
666 + "thresholds": {
667 + "mode": "absolute",
668 + "steps": [
669 + {
670 + "color": "#299c46",
671 + "value": null
672 + },
673 + {
674 + "color": "rgba(237, 129, 40, 0.89)",
675 + "value": 8
676 + },
677 + {
678 + "color": "#d44a3a",
679 + "value": 12
680 + }
681 + ]
682 + },
683 + "unit": "none"
684 + },
685 + "overrides": []
686 + },
687 + "gridPos": {
688 + "h": 7,
689 + "w": 4,
690 + "x": 0,
691 + "y": 7
692 + },
693 + "id": 16,
694 + "links": [],
695 + "options": {
696 + "orientation": "horizontal",
697 + "reduceOptions": {
698 + "calcs": [
699 + "max"
700 + ],
701 + "fields": "",
702 + "values": false
703 + },
704 + "showThresholdLabels": false,
705 + "showThresholdMarkers": true,
706 + "text": {}
707 + },
708 + "pluginVersion": "9.2.0",
709 + "targets": [
710 + {
711 + "bucketAggs": [
712 + {
713 + "field": "timestamp",
714 + "id": "2",
715 + "settings": {
716 + "interval": "auto",
717 + "min_doc_count": 0,
718 + "trimEdges": 0
719 + },
720 + "type": "date_histogram"
721 + }
722 + ],
723 + "datasource": {
724 + "type": "elasticsearch",
725 + "uid": "replace_datasource_uid"
726 + },
727 + "metrics": [
728 + {
729 + "field": "rule_level",
730 + "id": "1",
731 + "meta": {},
732 + "settings": {},
733 + "type": "max"
734 + }
735 + ],
736 + "query": "data_office365_Operation:$operation",
737 + "refId": "A",
738 + "timeField": "timestamp"
739 + }
740 + ],
741 + "title": "MAX SEVERITY (0 - 15)",
742 + "type": "gauge"
743 + },
744 + {
745 + "datasource": {
746 + "type": "elasticsearch",
747 + "uid": "replace_datasource_uid"
748 + },
749 + "fieldConfig": {
750 + "defaults": {
751 + "color": {
752 + "mode": "palette-classic"
753 + },
754 + "custom": {
755 + "axisCenteredZero": false,
756 + "axisColorMode": "text",
757 + "axisLabel": "",
758 + "axisPlacement": "auto",
759 + "barAlignment": 0,
760 + "drawStyle": "bars",
761 + "fillOpacity": 0,
762 + "gradientMode": "none",
763 + "hideFrom": {
764 + "legend": false,
765 + "tooltip": false,
766 + "viz": false
767 + },
768 + "lineInterpolation": "linear",
769 + "lineWidth": 1,
770 + "pointSize": 5,
771 + "scaleDistribution": {
772 + "type": "linear"
773 + },
774 + "showPoints": "auto",
775 + "spanNulls": false,
776 + "stacking": {
777 + "group": "A",
778 + "mode": "normal"
779 + },
780 + "thresholdsStyle": {
781 + "mode": "off"
782 + }
783 + },
784 + "mappings": [],
785 + "thresholds": {
786 + "mode": "absolute",
787 + "steps": [
788 + {
789 + "color": "green",
790 + "value": null
791 + },
792 + {
793 + "color": "red",
794 + "value": 80
795 + }
796 + ]
797 + }
798 + },
799 + "overrides": []
800 + },
801 + "gridPos": {
802 + "h": 13,
803 + "w": 20,
804 + "x": 4,
805 + "y": 7
806 + },
807 + "id": 59,
808 + "options": {
809 + "legend": {
810 + "calcs": [],
811 + "displayMode": "table",
812 + "placement": "right",
813 + "showLegend": true
814 + },
815 + "tooltip": {
816 + "mode": "single",
817 + "sort": "none"
818 + }
819 + },
820 + "targets": [
821 + {
822 + "alias": "",
823 + "bucketAggs": [
824 + {
825 + "field": "data_office365_Operation",
826 + "id": "3",
827 + "settings": {
828 + "min_doc_count": "1",
829 + "order": "desc",
830 + "orderBy": "_count",
831 + "size": "10"
832 + },
833 + "type": "terms"
834 + },
835 + {
836 + "field": "timestamp",
837 + "id": "2",
838 + "settings": {
839 + "interval": "auto"
840 + },
841 + "type": "date_histogram"
842 + }
843 + ],
844 + "datasource": {
845 + "type": "elasticsearch",
846 + "uid": "replace_datasource_uid"
847 + },
848 + "metrics": [
849 + {
850 + "id": "1",
851 + "type": "count"
852 + }
853 + ],
854 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
855 + "refId": "A",
856 + "timeField": "timestamp"
857 + }
858 + ],
859 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
860 + "transparent": true,
861 + "type": "timeseries"
862 + },
863 + {
864 + "datasource": {
865 + "type": "elasticsearch",
866 + "uid": "replace_datasource_uid"
867 + },
868 + "fieldConfig": {
869 + "defaults": {
870 + "mappings": [
871 + {
872 + "options": {
873 + "match": "null",
874 + "result": {
875 + "text": "N/A"
876 + }
877 + },
878 + "type": "special"
879 + }
880 + ],
881 + "thresholds": {
882 + "mode": "absolute",
883 + "steps": [
884 + {
885 + "color": "blue",
886 + "value": null
887 + }
888 + ]
889 + },
890 + "unit": "locale"
891 + },
892 + "overrides": []
893 + },
894 + "gridPos": {
895 + "h": 6,
896 + "w": 4,
897 + "x": 0,
898 + "y": 14
899 + },
900 + "id": 51,
901 + "links": [],
902 + "options": {
903 + "colorMode": "value",
904 + "graphMode": "area",
905 + "justifyMode": "auto",
906 + "orientation": "horizontal",
907 + "reduceOptions": {
908 + "calcs": [
909 + "sum"
910 + ],
911 + "fields": "",
912 + "values": false
913 + },
914 + "text": {},
915 + "textMode": "auto"
916 + },
917 + "pluginVersion": "9.2.0",
918 + "targets": [
919 + {
920 + "bucketAggs": [
921 + {
922 + "$$hashKey": "object:331",
923 + "field": "timestamp",
924 + "id": "2",
925 + "settings": {
926 + "interval": "auto",
927 + "min_doc_count": 0,
928 + "trimEdges": 0
929 + },
930 + "type": "date_histogram"
931 + }
932 + ],
933 + "datasource": {
934 + "type": "elasticsearch",
935 + "uid": "replace_datasource_uid"
936 + },
937 + "metrics": [
938 + {
939 + "$$hashKey": "object:329",
940 + "field": "select field",
941 + "id": "1",
942 + "type": "count"
943 + }
944 + ],
945 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
946 + "refId": "A",
947 + "timeField": "timestamp"
948 + }
949 + ],
950 + "title": "EVENTS (Total)",
951 + "type": "stat"
952 + },
953 + {
954 + "datasource": {
955 + "type": "elasticsearch",
956 + "uid": "replace_datasource_uid"
957 + },
958 + "fieldConfig": {
959 + "defaults": {
960 + "color": {
961 + "mode": "thresholds"
962 + },
963 + "custom": {
964 + "align": "auto",
965 + "displayMode": "auto",
966 + "filterable": true,
967 + "inspect": false
968 + },
969 + "mappings": [],
970 + "thresholds": {
971 + "mode": "absolute",
972 + "steps": [
973 + {
974 + "color": "green",
975 + "value": null
976 + },
977 + {
978 + "color": "red",
979 + "value": 80
980 + }
981 + ]
982 + }
983 + },
984 + "overrides": [
985 + {
986 + "matcher": {
987 + "id": "byName",
988 + "options": "rule_level"
989 + },
990 + "properties": [
991 + {
992 + "id": "displayName",
993 + "value": "RULE LEVEL"
994 + },
995 + {
996 + "id": "unit",
997 + "value": "short"
998 + },
999 + {
1000 + "id": "decimals",
1001 + "value": -1
1002 + },
1003 + {
1004 + "id": "custom.displayMode",
1005 + "value": "color-background"
1006 + },
1007 + {
1008 + "id": "custom.align"
1009 + },
1010 + {
1011 + "id": "thresholds",
1012 + "value": {
1013 + "mode": "absolute",
1014 + "steps": [
1015 + {
1016 + "color": "#37872D",
1017 + "value": null
1018 + },
1019 + {
1020 + "color": "rgba(237, 129, 40, 0.89)",
1021 + "value": 7
1022 + },
1023 + {
1024 + "color": "rgba(245, 54, 54, 0.9)",
1025 + "value": 12
1026 + }
1027 + ]
1028 + }
1029 + }
1030 + ]
1031 + },
1032 + {
1033 + "matcher": {
1034 + "id": "byName",
1035 + "options": "Date/Time"
1036 + },
1037 + "properties": [
1038 + {
1039 + "id": "custom.width",
1040 + "value": 242
1041 + }
1042 + ]
1043 + },
1044 + {
1045 + "matcher": {
1046 + "id": "byName",
1047 + "options": "MITRE TACTIC"
1048 + },
1049 + "properties": [
1050 + {
1051 + "id": "custom.width",
1052 + "value": 332
1053 + }
1054 + ]
1055 + },
1056 + {
1057 + "matcher": {
1058 + "id": "byName",
1059 + "options": "MITRE TECHNIQUE"
1060 + },
1061 + "properties": [
1062 + {
1063 + "id": "custom.width",
1064 + "value": 312
1065 + }
1066 + ]
1067 + },
1068 + {
1069 + "matcher": {
1070 + "id": "byName",
1071 + "options": "EVENT ID"
1072 + },
1073 + "properties": [
1074 + {
1075 + "id": "links",
1076 + "value": [
1077 + {
1078 + "targetBlank": true,
1079 + "title": "VIEW EVENT DETAILS",
1080 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1081 + }
1082 + ]
1083 + },
1084 + {
1085 + "id": "custom.width",
1086 + "value": 319
1087 + }
1088 + ]
1089 + },
1090 + {
1091 + "matcher": {
1092 + "id": "byName",
1093 + "options": "ACCOUNT"
1094 + },
1095 + "properties": [
1096 + {
1097 + "id": "custom.width",
1098 + "value": 343
1099 + }
1100 + ]
1101 + },
1102 + {
1103 + "matcher": {
1104 + "id": "byName",
1105 + "options": "EVENT TIME"
1106 + },
1107 + "properties": [
1108 + {
1109 + "id": "custom.width",
1110 + "value": 195
1111 + }
1112 + ]
1113 + },
1114 + {
1115 + "matcher": {
1116 + "id": "byName",
1117 + "options": "FILE SIZE"
1118 + },
1119 + "properties": [
1120 + {
1121 + "id": "unit",
1122 + "value": "bytes"
1123 + }
1124 + ]
1125 + },
1126 + {
1127 + "matcher": {
1128 + "id": "byName",
1129 + "options": "SENSITIVE INFO"
1130 + },
1131 + "properties": [
1132 + {
1133 + "id": "custom.width",
1134 + "value": 154
1135 + }
1136 + ]
1137 + },
1138 + {
1139 + "matcher": {
1140 + "id": "byName",
1141 + "options": "RULE LEVEL"
1142 + },
1143 + "properties": [
1144 + {
1145 + "id": "custom.width",
1146 + "value": 157
1147 + }
1148 + ]
1149 + }
1150 + ]
1151 + },
1152 + "gridPos": {
1153 + "h": 16,
1154 + "w": 24,
1155 + "x": 0,
1156 + "y": 20
1157 + },
1158 + "id": 27,
1159 + "options": {
1160 + "footer": {
1161 + "fields": "",
1162 + "reducer": [
1163 + "sum"
1164 + ],
1165 + "show": false
1166 + },
1167 + "showHeader": true,
1168 + "sortBy": []
1169 + },
1170 + "pluginVersion": "9.2.0",
1171 + "targets": [
1172 + {
1173 + "bucketAggs": [],
1174 + "datasource": {
1175 + "type": "elasticsearch",
1176 + "uid": "replace_datasource_uid"
1177 + },
1178 + "metrics": [
1179 + {
1180 + "id": "1",
1181 + "settings": {
1182 + "size": "250"
1183 + },
1184 + "type": "raw_data"
1185 + }
1186 + ],
1187 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1188 + "refId": "A",
1189 + "timeField": "timestamp"
1190 + }
1191 + ],
1192 + "title": "EVENTS",
1193 + "transformations": [
1194 + {
1195 + "id": "merge",
1196 + "options": {
1197 + "reducers": []
1198 + }
1199 + },
1200 + {
1201 + "id": "organize",
1202 + "options": {
1203 + "excludeByName": {
1204 + "@metadata_beat": true,
1205 + "@metadata_type": true,
1206 + "@metadata_version": true,
1207 + "IMPHASH": true,
1208 + "MD5": true,
1209 + "SHA1": true,
1210 + "SHA256": true,
1211 + "_id": false,
1212 + "_index": true,
1213 + "_type": true,
1214 + "agent_ephemeral_id": true,
1215 + "agent_hostname": true,
1216 + "agent_id": true,
1217 + "agent_ip_city_name": true,
1218 + "agent_ip_country_code": true,
1219 + "agent_ip_geolocation": true,
1220 + "agent_name": true,
1221 + "agent_type": true,
1222 + "agent_version": true,
1223 + "beats_type": true,
1224 + "cluster_name": true,
1225 + "cluster_node": true,
1226 + "collector_node_id": true,
1227 + "data_alert_action": true,
1228 + "data_alert_category": true,
1229 + "data_alert_gid": true,
1230 + "data_alert_rev": true,
1231 + "data_alert_severity": true,
1232 + "data_alert_signature": true,
1233 + "data_alert_signature_id": true,
1234 + "data_app_proto": true,
1235 + "data_audit_auid": true,
1236 + "data_audit_command": true,
1237 + "data_audit_euid": true,
1238 + "data_audit_exe": true,
1239 + "data_audit_gid": true,
1240 + "data_audit_id": true,
1241 + "data_audit_pid": true,
1242 + "data_audit_res": true,
1243 + "data_audit_session": true,
1244 + "data_audit_type": true,
1245 + "data_audit_uid": true,
1246 + "data_dest_ip": true,
1247 + "data_dest_port": true,
1248 + "data_dstuser": true,
1249 + "data_event_type": true,
1250 + "data_extra_data": true,
1251 + "data_file": true,
1252 + "data_flow_bytes_toclient": true,
1253 + "data_flow_bytes_toserver": true,
1254 + "data_flow_id": true,
1255 + "data_flow_pkts_toclient": true,
1256 + "data_flow_pkts_toserver": true,
1257 + "data_flow_start": true,
1258 + "data_http_http_content_type": true,
1259 + "data_http_http_port": true,
1260 + "data_http_length": true,
1261 + "data_http_status": true,
1262 + "data_http_url": true,
1263 + "data_id": true,
1264 + "data_in_iface": true,
1265 + "data_metadata_flowbits": true,
1266 + "data_metadata_flowints_http_anomaly_count": true,
1267 + "data_metadata_flowints_tcp_retransmission_count": true,
1268 + "data_office365_AadAppId": true,
1269 + "data_office365_Actor": true,
1270 + "data_office365_ActorContextId": true,
1271 + "data_office365_ActorIpAddress": false,
1272 + "data_office365_ActorIpAddress_city_name": true,
1273 + "data_office365_ActorIpAddress_country_code": true,
1274 + "data_office365_ActorIpAddress_geolocation": true,
1275 + "data_office365_AdditionalData": true,
1276 + "data_office365_AlertEntityId": true,
1277 + "data_office365_AlertId": true,
1278 + "data_office365_AlertLinks": true,
1279 + "data_office365_AlertType": true,
1280 + "data_office365_ApplicationId": true,
1281 + "data_office365_AzureActiveDirectoryEventType": true,
1282 + "data_office365_BCLValue": true,
1283 + "data_office365_Category": true,
1284 + "data_office365_ClientApplication": true,
1285 + "data_office365_ClientIP": true,
1286 + "data_office365_ClientIP_city_name": true,
1287 + "data_office365_ClientIP_country_code": true,
1288 + "data_office365_ClientIP_geolocation": true,
1289 + "data_office365_CmdletVersion": true,
1290 + "data_office365_Comments": true,
1291 + "data_office365_CreationTime": false,
1292 + "data_office365_Data": true,
1293 + "data_office365_DataType": true,
1294 + "data_office365_DatabaseType": true,
1295 + "data_office365_DeliveryMessageInfo_DIEnrichment": true,
1296 + "data_office365_DeliveryMessageInfo_DeliveryControlSource": true,
1297 + "data_office365_DeliveryMessageInfo_DeliveryControlType": true,
1298 + "data_office365_DeliveryMessageInfo_DeliveryReason": true,
1299 + "data_office365_DeliveryMessageInfo_Destination": true,
1300 + "data_office365_DeliveryMessageInfo_FinalFilterVerdict": true,
1301 + "data_office365_DeliveryMessageInfo_FinalFilterVerdictControlSource": true,
1302 + "data_office365_DeliveryMessageInfo_FinalVerdict": true,
1303 + "data_office365_DeliveryMessageInfo_FinalVerdictSource": true,
1304 + "data_office365_DeliveryMessageInfo_Id": true,
1305 + "data_office365_DeliveryMessageInfo_IsValid": true,
1306 + "data_office365_DeliveryMessageInfo_PolicyHit": true,
1307 + "data_office365_DeliveryMessageInfo_PolicyOverride": true,
1308 + "data_office365_DeliveryMessageInfo_TenantActionPolicyId": true,
1309 + "data_office365_DeliveryMessageInfo_TenantActionPolicyType": true,
1310 + "data_office365_DeliveryMessageInfo_Timestamp": true,
1311 + "data_office365_Description": true,
1312 + "data_office365_DeviceProperties": true,
1313 + "data_office365_EffectiveOrganization": true,
1314 + "data_office365_EntityType": true,
1315 + "data_office365_ErrorNumber": true,
1316 + "data_office365_ExchangeLocations": true,
1317 + "data_office365_ExchangeMetaData_CC": true,
1318 + "data_office365_ExchangeMetaData_FileSize": false,
1319 + "data_office365_ExchangeMetaData_From": true,
1320 + "data_office365_ExchangeMetaData_MessageID": true,
1321 + "data_office365_ExchangeMetaData_RecipientCount": false,
1322 + "data_office365_ExchangeMetaData_Sent": true,
1323 + "data_office365_ExchangeMetaData_Subject": false,
1324 + "data_office365_ExchangeMetaData_To": true,
1325 + "data_office365_ExchangeMetaData_UniqueID": true,
1326 + "data_office365_ExtendedProperties": true,
1327 + "data_office365_FilteringDate": true,
1328 + "data_office365_GradingResult_FirstTriagedBy": true,
1329 + "data_office365_GradingResult_Id": true,
1330 + "data_office365_GradingResult_LastUpdatedBy": true,
1331 + "data_office365_GradingResult_Timestamp": true,
1332 + "data_office365_GradingResult_TriageCategory": true,
1333 + "data_office365_GradingResult_TriageVerdict": true,
1334 + "data_office365_Id": true,
1335 + "data_office365_IncidentId": true,
1336 + "data_office365_InsightData": true,
1337 + "data_office365_InsightId": true,
1338 + "data_office365_InterSystemsId": true,
1339 + "data_office365_IntraSystemId": true,
1340 + "data_office365_KesMailId": true,
1341 + "data_office365_Language": true,
1342 + "data_office365_LogonError": true,
1343 + "data_office365_MessageDate": true,
1344 + "data_office365_ModifiedProperties": true,
1345 + "data_office365_Name": true,
1346 + "data_office365_NonPIIParameters": true,
1347 + "data_office365_ObjectId": true,
1348 + "data_office365_ObjectType": true,
1349 + "data_office365_Operation": true,
1350 + "data_office365_OrganizationId": true,
1351 + "data_office365_P1Sender": true,
1352 + "data_office365_P1SenderDomain": true,
1353 + "data_office365_P2Sender": true,
1354 + "data_office365_P2SenderDomain": true,
1355 + "data_office365_Parameters": true,
1356 + "data_office365_PolicyDetails": true,
1357 + "data_office365_PolicyId": true,
1358 + "data_office365_Query": true,
1359 + "data_office365_Recipients": true,
1360 + "data_office365_RecordType": true,
1361 + "data_office365_RelativeUrl": true,
1362 + "data_office365_RescanResult_Id": true,
1363 + "data_office365_RescanResult_RescanVerdict": true,
1364 + "data_office365_RescanResult_Timestamp": true,
1365 + "data_office365_ResultCount": true,
1366 + "data_office365_ResultStatus": true,
1367 + "data_office365_SecurityComplianceCenterEventType": true,
1368 + "data_office365_SenderIP": true,
1369 + "data_office365_SenderIP_city_name": true,
1370 + "data_office365_SenderIP_country_code": true,
1371 + "data_office365_SenderIP_geolocation": true,
1372 + "data_office365_Severity": true,
1373 + "data_office365_SharePointMetaData_FileID": true,
1374 + "data_office365_SharePointMetaData_FileName": false,
1375 + "data_office365_SharePointMetaData_FileOwner": true,
1376 + "data_office365_SharePointMetaData_FilePathUrl": true,
1377 + "data_office365_SharePointMetaData_FileSize": true,
1378 + "data_office365_SharePointMetaData_From": true,
1379 + "data_office365_SharePointMetaData_IsViewableByExternalUsers": true,
1380 + "data_office365_SharePointMetaData_IsVisibleOnlyToOdbOwner": true,
1381 + "data_office365_SharePointMetaData_ItemCreationTime": true,
1382 + "data_office365_SharePointMetaData_ItemLastModifiedTime": true,
1383 + "data_office365_SharePointMetaData_ItemLastSharedTime": true,
1384 + "data_office365_SharePointMetaData_SiteCollectionGuid": true,
1385 + "data_office365_SharePointMetaData_SiteCollectionUrl": true,
1386 + "data_office365_SharePointMetaData_UniqueID": true,
1387 + "data_office365_Source": true,
1388 + "data_office365_StartTime": true,
1389 + "data_office365_Status": true,
1390 + "data_office365_Subject": true,
1391 + "data_office365_SubmissionContent": true,
1392 + "data_office365_SubmissionContentSubType": true,
1393 + "data_office365_SubmissionContentType": true,
1394 + "data_office365_SubmissionId": true,
1395 + "data_office365_SubmissionState": true,
1396 + "data_office365_SubmissionType": true,
1397 + "data_office365_SubmitterDisplayName": true,
1398 + "data_office365_SubmitterId": true,
1399 + "data_office365_Target": true,
1400 + "data_office365_TargetContextId": true,
1401 + "data_office365_UserId": true,
1402 + "data_office365_UserKey": true,
1403 + "data_office365_UserType": true,
1404 + "data_office365_Version": true,
1405 + "data_office365_Workload": true,
1406 + "data_win_system_version": true,
1407 + "decoder_name": true,
1408 + "decoder_parent": true,
1409 + "error": true,
1410 + "full_log": false,
1411 + "gl2_accounted_message_size": true,
1412 + "gl2_message_id": true,
1413 + "gl2_processing_error": true,
1414 + "gl2_remote_ip": true,
1415 + "gl2_remote_port": true,
1416 + "gl2_source_collector": true,
1417 + "gl2_source_input": true,
1418 + "gl2_source_node": true,
1419 + "highlight": true,
1420 + "id": true,
1421 + "input_type": true,
1422 + "level": true,
1423 + "location": true,
1424 + "log_file_path": true,
1425 + "log_offset": true,
1426 + "manager_name": true,
1427 + "message": true,
1428 + "module": true,
1429 + "rule_firedtimes": true,
1430 + "rule_group1": true,
1431 + "rule_groups": true,
1432 + "rule_id": true,
1433 + "rule_mail": true,
1434 + "rule_mitre_technique": false,
1435 + "sort": true,
1436 + "source": true,
1437 + "src_ip": true,
1438 + "streams": true,
1439 + "syslog_level": true,
1440 + "syslog_tag": true,
1441 + "syslog_type": true,
1442 + "time": true,
1443 + "timestamp": true,
1444 + "true": true
1445 + },
1446 + "indexByName": {
1447 + "_id": 2,
1448 + "_index": 8,
1449 + "_type": 9,
1450 + "agent_id": 10,
1451 + "agent_name": 4,
1452 + "cluster_name": 11,
1453 + "cluster_node": 12,
1454 + "data_office365_CreationTime": 0,
1455 + "data_office365_ExchangeMetaData_CC": 45,
1456 + "data_office365_ExchangeMetaData_FileSize": 47,
1457 + "data_office365_ExchangeMetaData_From": 48,
1458 + "data_office365_ExchangeMetaData_MessageID": 49,
1459 + "data_office365_ExchangeMetaData_RecipientCount": 51,
1460 + "data_office365_ExchangeMetaData_Sent": 52,
1461 + "data_office365_ExchangeMetaData_Subject": 50,
1462 + "data_office365_ExchangeMetaData_To": 53,
1463 + "data_office365_ExchangeMetaData_UniqueID": 54,
1464 + "data_office365_Id": 13,
1465 + "data_office365_IncidentId": 55,
1466 + "data_office365_ObjectId": 14,
1467 + "data_office365_Operation": 20,
1468 + "data_office365_OrganizationId": 15,
1469 + "data_office365_RecordType": 16,
1470 + "data_office365_SensitiveInfoDetectionIsIncluded": 46,
1471 + "data_office365_UserId": 3,
1472 + "data_office365_UserKey": 17,
1473 + "data_office365_UserType": 18,
1474 + "data_office365_Version": 19,
1475 + "data_office365_Workload": 44,
1476 + "decoder_name": 21,
1477 + "gl2_accounted_message_size": 22,
1478 + "gl2_message_id": 23,
1479 + "gl2_processing_error": 24,
1480 + "gl2_remote_ip": 25,
1481 + "gl2_remote_port": 26,
1482 + "gl2_source_input": 27,
1483 + "gl2_source_node": 28,
1484 + "highlight": 29,
1485 + "id": 30,
1486 + "location": 31,
1487 + "manager_name": 32,
1488 + "message": 33,
1489 + "rule_description": 5,
1490 + "rule_firedtimes": 34,
1491 + "rule_group1": 35,
1492 + "rule_groups": 36,
1493 + "rule_id": 7,
1494 + "rule_level": 6,
1495 + "rule_mail": 37,
1496 + "sort": 38,
1497 + "source": 39,
1498 + "streams": 40,
1499 + "syslog_level": 41,
1500 + "syslog_type": 42,
1501 + "timestamp": 1,
1502 + "true": 43
1503 + },
1504 + "renameByName": {
1505 + "_id": "EVENT ID",
1506 + "agent_name": "",
1507 + "data_office365_ActorIpAddress": "SRC IP",
1508 + "data_office365_CreationTime": "EVENT TIME",
1509 + "data_office365_ExchangeMetaData_FileSize": "FILE SIZE",
1510 + "data_office365_ExchangeMetaData_RecipientCount": "RECIPIENTS",
1511 + "data_office365_ExchangeMetaData_Sent": "",
1512 + "data_office365_ExchangeMetaData_Subject": "MAIL SUBJECT",
1513 + "data_office365_GradingResult_TriageCategory": "",
1514 + "data_office365_GradingResult_TriageVerdict": "VEREDICT",
1515 + "data_office365_InsightData": "",
1516 + "data_office365_ResultStatus": "RESULT",
1517 + "data_office365_SensitiveInfoDetectionIsIncluded": "SENSITIVE INFO",
1518 + "data_office365_Severity": "SEVERITY",
1519 + "data_office365_SharePointMetaData_FileName": "FILE",
1520 + "data_office365_Subject": "MAIL SUBJECT",
1521 + "data_office365_SubmissionState": "STATE",
1522 + "data_office365_SubmissionType": "TYPE",
1523 + "data_office365_UserId": "ACCOUNT",
1524 + "rule_description": "DESCRIPTION",
1525 + "rule_id": "RULE ID",
1526 + "rule_level": "",
1527 + "rule_mitre_id": "MITRE ID",
1528 + "rule_mitre_tactic": "MITRE TACTIC",
1529 + "rule_mitre_technique": "MITRE TECHNIQUE",
1530 + "timestamp": "Date/Time"
1531 + }
1532 + }
1533 + }
1534 + ],
1535 + "transparent": true,
1536 + "type": "table"
1537 + }
1538 + ],
1539 + "refresh": false,
1540 + "schemaVersion": 37,
1541 + "style": "dark",
1542 + "tags": [
1543 + "O365"
1544 + ],
1545 + "templating": {
1546 + "list": [
1547 + {
1548 + "datasource": {
1549 + "type": "elasticsearch",
1550 + "uid": "replace_datasource_uid"
1551 + },
1552 + "filters": [],
1553 + "hide": 0,
1554 + "label": "",
1555 + "name": "Filters",
1556 + "skipUrlSync": false,
1557 + "type": "adhoc"
1558 + },
1559 + {
1560 + "current": {
1561 + "selected": false,
1562 + "text": "All",
1563 + "value": "$__all"
1564 + },
1565 + "datasource": {
1566 + "type": "elasticsearch",
1567 + "uid": "replace_datasource_uid"
1568 + },
1569 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SecurityComplianceCenter\"}",
1570 + "hide": 0,
1571 + "includeAll": true,
1572 + "label": "Operation",
1573 + "multi": false,
1574 + "name": "operation",
1575 + "options": [],
1576 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SecurityComplianceCenter\"}",
1577 + "refresh": 2,
1578 + "regex": "",
1579 + "skipUrlSync": false,
1580 + "sort": 1,
1581 + "tagValuesQuery": "",
1582 + "tagsQuery": "",
1583 + "type": "query",
1584 + "useTags": false
1585 + },
1586 + {
1587 + "current": {
1588 + "selected": false,
1589 + "text": "All",
1590 + "value": "$__all"
1591 + },
1592 + "datasource": {
1593 + "type": "elasticsearch",
1594 + "uid": "replace_datasource_uid"
1595 + },
1596 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1597 + "hide": 0,
1598 + "includeAll": true,
1599 + "label": "Rule Level",
1600 + "multi": false,
1601 + "name": "rule_level",
1602 + "options": [],
1603 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1604 + "refresh": 2,
1605 + "regex": "",
1606 + "skipUrlSync": false,
1607 + "sort": 0,
1608 + "type": "query"
1609 + }
1610 + ]
1611 + },
1612 + "time": {
1613 + "from": "now-12h",
1614 + "to": "now"
1615 + },
1616 + "timepicker": {
1617 + "refresh_intervals": [
1618 + "5s",
1619 + "10s",
1620 + "30s",
1621 + "1m",
1622 + "5m",
1623 + "15m",
1624 + "30m",
1625 + "1h",
1626 + "2h",
1627 + "1d"
1628 + ],
1629 + "time_options": [
1630 + "5m",
1631 + "15m",
1632 + "1h",
1633 + "6h",
1634 + "12h",
1635 + "24h",
1636 + "2d",
1637 + "7d",
1638 + "30d"
1639 + ]
1640 + },
1641 + "timezone": "",
1642 + "title": "O365 - SECURITY COMPLIANCE CENTER",
1643 + "uid": "itiq7wq7z",
1644 + "version": 1,
1645 + "weekStart": ""
1646 +}
backend/app/connectors/grafana/dashboards/Office365/dashboard1.json deleted
-843
@@ -1,843 +0,0 @@
1 -{
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "grafana",
8 - "uid": "-- Grafana --"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [],
29 - "liveNow": false,
30 - "panels": [
31 - {
32 - "datasource": {
33 - "type": "elasticsearch",
34 - "uid": "wazuh_datasource_uid"
35 - },
36 - "fieldConfig": {
37 - "defaults": {
38 - "color": {
39 - "mode": "thresholds"
40 - },
41 - "mappings": [],
42 - "thresholds": {
43 - "mode": "absolute",
44 - "steps": [
45 - {
46 - "color": "blue",
47 - "value": null
48 - }
49 - ]
50 - }
51 - },
52 - "overrides": []
53 - },
54 - "gridPos": {
55 - "h": 7,
56 - "w": 4,
57 - "x": 0,
58 - "y": 0
59 - },
60 - "id": 2,
61 - "options": {
62 - "colorMode": "value",
63 - "graphMode": "none",
64 - "justifyMode": "auto",
65 - "orientation": "auto",
66 - "reduceOptions": {
67 - "calcs": ["sum"],
68 - "fields": "",
69 - "values": false
70 - },
71 - "textMode": "auto"
72 - },
73 - "pluginVersion": "9.3.1",
74 - "targets": [
75 - {
76 - "alias": "",
77 - "bucketAggs": [
78 - {
79 - "field": "timestamp",
80 - "id": "2",
81 - "settings": {
82 - "interval": "365d"
83 - },
84 - "type": "date_histogram"
85 - }
86 - ],
87 - "datasource": {
88 - "type": "elasticsearch",
89 - "uid": "wazuh_datasource_uid"
90 - },
91 - "metrics": [
92 - {
93 - "field": "data_machine_name",
94 - "id": "1",
95 - "type": "cardinality"
96 - }
97 - ],
98 - "query": "rule_groups:ad_inventory",
99 - "refId": "A",
100 - "timeField": "timestamp"
101 - }
102 - ],
103 - "title": "TOTAL MACHINES",
104 - "type": "stat"
105 - },
106 - {
107 - "datasource": {
108 - "type": "elasticsearch",
109 - "uid": "wazuh_datasource_uid"
110 - },
111 - "fieldConfig": {
112 - "defaults": {
113 - "color": {
114 - "mode": "palette-classic"
115 - },
116 - "custom": {
117 - "hideFrom": {
118 - "legend": false,
119 - "tooltip": false,
120 - "viz": false
121 - }
122 - },
123 - "mappings": []
124 - },
125 - "overrides": []
126 - },
127 - "gridPos": {
128 - "h": 7,
129 - "w": 7,
130 - "x": 4,
131 - "y": 0
132 - },
133 - "id": 6,
134 - "options": {
135 - "legend": {
136 - "displayMode": "table",
137 - "placement": "right",
138 - "showLegend": true
139 - },
140 - "pieType": "donut",
141 - "reduceOptions": {
142 - "calcs": ["sum"],
143 - "fields": "",
144 - "values": false
145 - },
146 - "tooltip": {
147 - "mode": "single",
148 - "sort": "none"
149 - }
150 - },
151 - "targets": [
152 - {
153 - "alias": "",
154 - "bucketAggs": [
155 - {
156 - "field": "data_OperatingSystem",
157 - "id": "3",
158 - "settings": {
159 - "min_doc_count": "1",
160 - "order": "desc",
161 - "orderBy": "_term",
162 - "size": "10"
163 - },
164 - "type": "terms"
165 - },
166 - {
167 - "field": "timestamp",
168 - "id": "2",
169 - "settings": {
170 - "interval": "auto"
171 - },
172 - "type": "date_histogram"
173 - }
174 - ],
175 - "datasource": {
176 - "type": "elasticsearch",
177 - "uid": "wazuh_datasource_uid"
178 - },
179 - "metrics": [
180 - {
181 - "id": "1",
182 - "type": "count"
183 - }
184 - ],
185 - "query": "rule_groups:ad_inventory",
186 - "refId": "A",
187 - "timeField": "timestamp"
188 - }
189 - ],
190 - "title": "COMPUTERS BY OS",
191 - "type": "piechart"
192 - },
193 - {
194 - "datasource": {
195 - "type": "elasticsearch",
196 - "uid": "wazuh_datasource_uid"
197 - },
198 - "fieldConfig": {
199 - "defaults": {
200 - "color": {
201 - "mode": "thresholds"
202 - },
203 - "mappings": [],
204 - "thresholds": {
205 - "mode": "absolute",
206 - "steps": [
207 - {
208 - "color": "green",
209 - "value": null
210 - },
211 - {
212 - "color": "red",
213 - "value": 80
214 - }
215 - ]
216 - }
217 - },
218 - "overrides": []
219 - },
220 - "gridPos": {
221 - "h": 7,
222 - "w": 13,
223 - "x": 11,
224 - "y": 0
225 - },
226 - "id": 7,
227 - "options": {
228 - "displayMode": "gradient",
229 - "minVizHeight": 10,
230 - "minVizWidth": 0,
231 - "orientation": "horizontal",
232 - "reduceOptions": {
233 - "calcs": ["sum"],
234 - "fields": "",
235 - "values": false
236 - },
237 - "showUnfilled": true
238 - },
239 - "pluginVersion": "9.3.1",
240 - "targets": [
241 - {
242 - "alias": "",
243 - "bucketAggs": [
244 - {
245 - "field": "data_PrimaryGroup",
246 - "id": "3",
247 - "settings": {
248 - "min_doc_count": "1",
249 - "order": "desc",
250 - "orderBy": "_term",
251 - "size": "10"
252 - },
253 - "type": "terms"
254 - },
255 - {
256 - "field": "timestamp",
257 - "id": "2",
258 - "settings": {
259 - "interval": "auto"
260 - },
261 - "type": "date_histogram"
262 - }
263 - ],
264 - "datasource": {
265 - "type": "elasticsearch",
266 - "uid": "wazuh_datasource_uid"
267 - },
268 - "metrics": [
269 - {
270 - "id": "1",
271 - "type": "count"
272 - }
273 - ],
274 - "query": "rule_groups:ad_inventory",
275 - "refId": "A",
276 - "timeField": "timestamp"
277 - }
278 - ],
279 - "title": "COMPUTERS BY PRIMARY GROUP",
280 - "type": "bargauge"
281 - },
282 - {
283 - "datasource": {
284 - "type": "elasticsearch",
285 - "uid": "wazuh_datasource_uid"
286 - },
287 - "fieldConfig": {
288 - "defaults": {
289 - "color": {
290 - "mode": "thresholds"
291 - },
292 - "mappings": [],
293 - "thresholds": {
294 - "mode": "absolute",
295 - "steps": [
296 - {
297 - "color": "orange",
298 - "value": null
299 - }
300 - ]
301 - }
302 - },
303 - "overrides": []
304 - },
305 - "gridPos": {
306 - "h": 7,
307 - "w": 4,
308 - "x": 0,
309 - "y": 7
310 - },
311 - "id": 8,
312 - "options": {
313 - "colorMode": "value",
314 - "graphMode": "none",
315 - "justifyMode": "auto",
316 - "orientation": "auto",
317 - "reduceOptions": {
318 - "calcs": ["sum"],
319 - "fields": "",
320 - "values": false
321 - },
322 - "textMode": "auto"
323 - },
324 - "pluginVersion": "9.3.1",
325 - "targets": [
326 - {
327 - "alias": "",
328 - "bucketAggs": [
329 - {
330 - "field": "timestamp",
331 - "id": "2",
332 - "settings": {
333 - "interval": "365d"
334 - },
335 - "type": "date_histogram"
336 - }
337 - ],
338 - "datasource": {
339 - "type": "elasticsearch",
340 - "uid": "wazuh_datasource_uid"
341 - },
342 - "metrics": [
343 - {
344 - "id": "1",
345 - "type": "count"
346 - }
347 - ],
348 - "query": "rule_groups:ad_inventory AND data_LockedOut:true",
349 - "refId": "A",
350 - "timeField": "timestamp"
351 - }
352 - ],
353 - "title": "LOCKED OUT MACHINES",
354 - "type": "stat"
355 - },
356 - {
357 - "datasource": {
358 - "type": "elasticsearch",
359 - "uid": "wazuh_datasource_uid"
360 - },
361 - "fieldConfig": {
362 - "defaults": {
363 - "color": {
364 - "mode": "palette-classic"
365 - },
366 - "custom": {
367 - "hideFrom": {
368 - "legend": false,
369 - "tooltip": false,
370 - "viz": false
371 - }
372 - },
373 - "mappings": []
374 - },
375 - "overrides": [
376 - {
377 - "matcher": {
378 - "id": "byName",
379 - "options": "13"
380 - },
381 - "properties": [
382 - {
383 - "id": "color",
384 - "value": {
385 - "fixedColor": "orange",
386 - "mode": "fixed"
387 - }
388 - }
389 - ]
390 - }
391 - ]
392 - },
393 - "gridPos": {
394 - "h": 7,
395 - "w": 7,
396 - "x": 4,
397 - "y": 7
398 - },
399 - "id": 9,
400 - "options": {
401 - "legend": {
402 - "displayMode": "table",
403 - "placement": "right",
404 - "showLegend": true
405 - },
406 - "pieType": "donut",
407 - "reduceOptions": {
408 - "calcs": ["sum"],
409 - "fields": "",
410 - "values": false
411 - },
412 - "tooltip": {
413 - "mode": "single",
414 - "sort": "none"
415 - }
416 - },
417 - "targets": [
418 - {
419 - "alias": "",
420 - "bucketAggs": [
421 - {
422 - "field": "data_asset_criticality",
423 - "id": "3",
424 - "settings": {
425 - "min_doc_count": "1",
426 - "order": "desc",
427 - "orderBy": "_term",
428 - "size": "10"
429 - },
430 - "type": "terms"
431 - },
432 - {
433 - "field": "timestamp",
434 - "id": "2",
435 - "settings": {
436 - "interval": "auto"
437 - },
438 - "type": "date_histogram"
439 - }
440 - ],
441 - "datasource": {
442 - "type": "elasticsearch",
443 - "uid": "wazuh_datasource_uid"
444 - },
445 - "metrics": [
446 - {
447 - "id": "1",
448 - "type": "count"
449 - }
450 - ],
451 - "query": "rule_groups:ad_inventory",
452 - "refId": "A",
453 - "timeField": "timestamp"
454 - }
455 - ],
456 - "title": "COMPUTERS BY CRITICALITY",
457 - "type": "piechart"
458 - },
459 - {
460 - "datasource": {
461 - "type": "elasticsearch",
462 - "uid": "wazuh_datasource_uid"
463 - },
464 - "fieldConfig": {
465 - "defaults": {
466 - "color": {
467 - "mode": "thresholds"
468 - },
469 - "mappings": [],
470 - "thresholds": {
471 - "mode": "absolute",
472 - "steps": [
473 - {
474 - "color": "green",
475 - "value": null
476 - },
477 - {
478 - "color": "red",
479 - "value": 80
480 - }
481 - ]
482 - }
483 - },
484 - "overrides": []
485 - },
486 - "gridPos": {
487 - "h": 7,
488 - "w": 13,
489 - "x": 11,
490 - "y": 7
491 - },
492 - "id": 10,
493 - "options": {
494 - "displayMode": "gradient",
495 - "minVizHeight": 10,
496 - "minVizWidth": 0,
497 - "orientation": "horizontal",
498 - "reduceOptions": {
499 - "calcs": ["sum"],
500 - "fields": "",
501 - "values": false
502 - },
503 - "showUnfilled": true
504 - },
505 - "pluginVersion": "9.3.1",
506 - "targets": [
507 - {
508 - "alias": "",
509 - "bucketAggs": [
510 - {
511 - "field": "data_Location",
512 - "id": "3",
513 - "settings": {
514 - "min_doc_count": "1",
515 - "order": "desc",
516 - "orderBy": "_term",
517 - "size": "10"
518 - },
519 - "type": "terms"
520 - },
521 - {
522 - "field": "timestamp",
523 - "id": "2",
524 - "settings": {
525 - "interval": "auto"
526 - },
527 - "type": "date_histogram"
528 - }
529 - ],
530 - "datasource": {
531 - "type": "elasticsearch",
532 - "uid": "wazuh_datasource_uid"
533 - },
534 - "metrics": [
535 - {
536 - "id": "1",
537 - "type": "count"
538 - }
539 - ],
540 - "query": "rule_groups:ad_inventory",
541 - "refId": "A",
542 - "timeField": "timestamp"
543 - }
544 - ],
545 - "title": "COMPUTERS BY LOCATION",
546 - "type": "bargauge"
547 - },
548 - {
549 - "datasource": {
550 - "type": "elasticsearch",
551 - "uid": "wazuh_datasource_uid"
552 - },
553 - "fieldConfig": {
554 - "defaults": {
555 - "color": {
556 - "mode": "thresholds"
557 - },
558 - "custom": {
559 - "align": "auto",
560 - "displayMode": "auto",
561 - "filterable": true,
562 - "inspect": false
563 - },
564 - "mappings": [],
565 - "thresholds": {
566 - "mode": "absolute",
567 - "steps": [
568 - {
569 - "color": "green",
570 - "value": null
571 - },
572 - {
573 - "color": "red",
574 - "value": 80
575 - }
576 - ]
577 - }
578 - },
579 - "overrides": [
580 - {
581 - "matcher": {
582 - "id": "byName",
583 - "options": "CRITICALITY"
584 - },
585 - "properties": [
586 - {
587 - "id": "custom.width",
588 - "value": 149
589 - }
590 - ]
591 - },
592 - {
593 - "matcher": {
594 - "id": "byName",
595 - "options": "LOCATION"
596 - },
597 - "properties": [
598 - {
599 - "id": "custom.width",
600 - "value": 124
601 - }
602 - ]
603 - },
604 - {
605 - "matcher": {
606 - "id": "byName",
607 - "options": "CN"
608 - },
609 - "properties": [
610 - {
611 - "id": "custom.width",
612 - "value": 161
613 - }
614 - ]
615 - },
616 - {
617 - "matcher": {
618 - "id": "byName",
619 - "options": "MEMBER OF"
620 - },
621 - "properties": [
622 - {
623 - "id": "custom.width",
624 - "value": 308
625 - }
626 - ]
627 - },
628 - {
629 - "matcher": {
630 - "id": "byName",
631 - "options": "OS VERSION"
632 - },
633 - "properties": [
634 - {
635 - "id": "custom.width",
636 - "value": 169
637 - }
638 - ]
639 - },
640 - {
641 - "matcher": {
642 - "id": "byName",
643 - "options": "COMPUTER"
644 - },
645 - "properties": [
646 - {
647 - "id": "custom.width",
648 - "value": 186
649 - }
650 - ]
651 - }
652 - ]
653 - },
654 - "gridPos": {
655 - "h": 13,
656 - "w": 24,
657 - "x": 0,
658 - "y": 14
659 - },
660 - "id": 4,
661 - "options": {
662 - "footer": {
663 - "enablePagination": true,
664 - "fields": "",
665 - "reducer": ["sum"],
666 - "show": false
667 - },
668 - "showHeader": true,
669 - "sortBy": []
670 - },
671 - "pluginVersion": "9.3.1",
672 - "targets": [
673 - {
674 - "alias": "",
675 - "bucketAggs": [],
676 - "datasource": {
677 - "type": "elasticsearch",
678 - "uid": "wazuh_datasource_uid"
679 - },
680 - "metrics": [
681 - {
682 - "id": "1",
683 - "settings": {
684 - "size": "500"
685 - },
686 - "type": "raw_data"
687 - }
688 - ],
689 - "query": "rule_groups:ad_inventory",
690 - "refId": "A",
691 - "timeField": "timestamp"
692 - }
693 - ],
694 - "title": "AD INVENTORY",
695 - "transformations": [
696 - {
697 - "id": "organize",
698 - "options": {
699 - "excludeByName": {
700 - "_id": true,
701 - "_index": true,
702 - "_type": true,
703 - "agent_id": true,
704 - "agent_ip": true,
705 - "agent_ip_city_name": true,
706 - "agent_ip_country_code": true,
707 - "agent_ip_geolocation": true,
708 - "agent_labels_customer": true,
709 - "agent_name": true,
710 - "data_Created": true,
711 - "data_DNSHostName": true,
712 - "data_LastLogonDate": true,
713 - "data_Modified": true,
714 - "data_Name": true,
715 - "data_ObjectCategory": true,
716 - "data_ObjectClass": true,
717 - "data_collection": true,
718 - "decoder_name": true,
719 - "gl2_accounted_message_size": true,
720 - "gl2_message_id": true,
721 - "gl2_processing_error": true,
722 - "gl2_remote_ip": true,
723 - "gl2_remote_port": true,
724 - "gl2_source_input": true,
725 - "gl2_source_node": true,
726 - "highlight": true,
727 - "id": true,
728 - "location": true,
729 - "manager_name": true,
730 - "message": true,
731 - "rule_description": true,
732 - "rule_firedtimes": true,
733 - "rule_group1": true,
734 - "rule_groups": true,
735 - "rule_id": true,
736 - "rule_level": true,
737 - "rule_mail": true,
738 - "sort": true,
739 - "source": true,
740 - "streams": true,
741 - "syslog_level": true,
742 - "syslog_type": true,
743 - "timestamp": true,
744 - "timestamp_utc": true,
745 - "true": true
746 - },
747 - "indexByName": {
748 - "_id": 10,
749 - "_index": 11,
750 - "_type": 12,
751 - "agent_id": 13,
752 - "agent_ip": 14,
753 - "agent_ip_city_name": 15,
754 - "agent_ip_country_code": 16,
755 - "agent_ip_geolocation": 17,
756 - "agent_labels_customer": 18,
757 - "agent_name": 19,
758 - "data_CN": 5,
759 - "data_Created": 20,
760 - "data_DNSHostName": 21,
761 - "data_DistinguishedName": 6,
762 - "data_LastLogonDate": 22,
763 - "data_Location": 8,
764 - "data_LockedOut": 23,
765 - "data_MemberOf": 9,
766 - "data_Modified": 24,
767 - "data_Name": 25,
768 - "data_ObjectCategory": 26,
769 - "data_ObjectClass": 27,
770 - "data_OperatingSystem": 2,
771 - "data_OperatingSystemVersion": 3,
772 - "data_PrimaryGroup": 7,
773 - "data_asset_criticality": 4,
774 - "data_collection": 28,
775 - "data_machine_name": 1,
776 - "decoder_name": 29,
777 - "gl2_accounted_message_size": 30,
778 - "gl2_message_id": 31,
779 - "gl2_processing_error": 32,
780 - "gl2_remote_ip": 33,
781 - "gl2_remote_port": 34,
782 - "gl2_source_input": 35,
783 - "gl2_source_node": 36,
784 - "highlight": 37,
785 - "id": 38,
786 - "location": 39,
787 - "manager_name": 40,
788 - "message": 41,
789 - "rule_description": 42,
790 - "rule_firedtimes": 43,
791 - "rule_group1": 44,
792 - "rule_groups": 45,
793 - "rule_id": 46,
794 - "rule_level": 47,
795 - "rule_mail": 48,
796 - "sort": 49,
797 - "source": 50,
798 - "streams": 51,
799 - "syslog_level": 52,
800 - "syslog_type": 53,
801 - "timestamp": 0,
802 - "timestamp_utc": 54,
803 - "true": 55
804 - },
805 - "renameByName": {
806 - "data_CN": "CN",
807 - "data_DistinguishedName": "DN",
808 - "data_LastLogonDate": "",
809 - "data_Location": "LOCATION",
810 - "data_LockedOut": "LOCKED OUT",
811 - "data_MemberOf": "MEMBER OF",
812 - "data_ObjectCategory": "",
813 - "data_ObjectClass": "CLASS",
814 - "data_OperatingSystem": "OS",
815 - "data_OperatingSystemVersion": "OS VERSION",
816 - "data_PrimaryGroup": "PRIMARY AD GROUP",
817 - "data_asset_criticality": "CRITICALITY",
818 - "data_collection": "",
819 - "data_machine_name": "COMPUTER",
820 - "timestamp": "DATE/TIME"
821 - }
822 - }
823 - }
824 - ],
825 - "transparent": true,
826 - "type": "table"
827 - }
828 - ],
829 - "schemaVersion": 37,
830 - "style": "dark",
831 - "tags": [],
832 - "templating": {
833 - "list": []
834 - },
835 - "time": {
836 - "from": "now-6h",
837 - "to": "now"
838 - },
839 - "timepicker": {},
840 - "timezone": "",
841 - "title": "EDR - ACTIVE DIRECTORY INVENTORY",
842 - "weekStart": ""
843 -}
backend/app/connectors/grafana/dashboards/Office365/defender_for_identity.json new
+2261
@@ -0,0 +1,2261 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "10.0.3",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:MicrosoftDefenderForIdentity",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "cellOptions": {
261 + "type": "auto"
262 + },
263 + "inspect": false
264 + },
265 + "mappings": [],
266 + "thresholds": {
267 + "mode": "absolute",
268 + "steps": [
269 + {
270 + "color": "red",
271 + "value": null
272 + }
273 + ]
274 + }
275 + },
276 + "overrides": [
277 + {
278 + "matcher": {
279 + "id": "byName",
280 + "options": "Count"
281 + },
282 + "properties": [
283 + {
284 + "id": "displayName",
285 + "value": "EVENTS"
286 + },
287 + {
288 + "id": "unit",
289 + "value": "short"
290 + },
291 + {
292 + "id": "decimals",
293 + "value": -1
294 + },
295 + {
296 + "id": "custom.align"
297 + },
298 + {
299 + "id": "thresholds",
300 + "value": {
301 + "mode": "absolute",
302 + "steps": [
303 + {
304 + "color": "red",
305 + "value": null
306 + }
307 + ]
308 + }
309 + }
310 + ]
311 + }
312 + ]
313 + },
314 + "gridPos": {
315 + "h": 7,
316 + "w": 6,
317 + "x": 8,
318 + "y": 0
319 + },
320 + "id": 54,
321 + "options": {
322 + "cellHeight": "sm",
323 + "footer": {
324 + "countRows": false,
325 + "fields": "",
326 + "reducer": [
327 + "sum"
328 + ],
329 + "show": false
330 + },
331 + "showHeader": true
332 + },
333 + "pluginVersion": "10.0.3",
334 + "targets": [
335 + {
336 + "bucketAggs": [
337 + {
338 + "fake": true,
339 + "field": "data_office365_Operation",
340 + "id": "4",
341 + "settings": {
342 + "min_doc_count": 1,
343 + "order": "desc",
344 + "orderBy": "_count",
345 + "size": "0"
346 + },
347 + "type": "terms"
348 + }
349 + ],
350 + "datasource": {
351 + "type": "elasticsearch",
352 + "uid": "replace_datasource_uid"
353 + },
354 + "metrics": [
355 + {
356 + "field": "select field",
357 + "id": "1",
358 + "type": "count"
359 + }
360 + ],
361 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
362 + "refId": "A",
363 + "timeField": "timestamp"
364 + }
365 + ],
366 + "title": "EVENTS BY OPERATION",
367 + "transformations": [
368 + {
369 + "id": "merge",
370 + "options": {
371 + "reducers": []
372 + }
373 + },
374 + {
375 + "id": "organize",
376 + "options": {
377 + "excludeByName": {},
378 + "indexByName": {},
379 + "renameByName": {
380 + "Count": "EVENTS",
381 + "data_office365_Operation": "OPERATION"
382 + }
383 + }
384 + }
385 + ],
386 + "type": "table"
387 + },
388 + {
389 + "datasource": {
390 + "type": "elasticsearch",
391 + "uid": "replace_datasource_uid"
392 + },
393 + "fieldConfig": {
394 + "defaults": {
395 + "color": {
396 + "mode": "thresholds"
397 + },
398 + "mappings": [
399 + {
400 + "options": {
401 + "match": "null",
402 + "result": {
403 + "text": "N/A"
404 + }
405 + },
406 + "type": "special"
407 + }
408 + ],
409 + "max": 15,
410 + "min": 0,
411 + "thresholds": {
412 + "mode": "absolute",
413 + "steps": [
414 + {
415 + "color": "#299c46",
416 + "value": null
417 + },
418 + {
419 + "color": "rgba(237, 129, 40, 0.89)",
420 + "value": 8
421 + },
422 + {
423 + "color": "#d44a3a",
424 + "value": 12
425 + }
426 + ]
427 + },
428 + "unit": "none"
429 + },
430 + "overrides": []
431 + },
432 + "gridPos": {
433 + "h": 7,
434 + "w": 4,
435 + "x": 0,
436 + "y": 7
437 + },
438 + "id": 16,
439 + "links": [],
440 + "options": {
441 + "orientation": "horizontal",
442 + "reduceOptions": {
443 + "calcs": [
444 + "max"
445 + ],
446 + "fields": "",
447 + "values": false
448 + },
449 + "showThresholdLabels": false,
450 + "showThresholdMarkers": true,
451 + "text": {}
452 + },
453 + "pluginVersion": "10.0.3",
454 + "targets": [
455 + {
456 + "bucketAggs": [
457 + {
458 + "field": "timestamp",
459 + "id": "2",
460 + "settings": {
461 + "interval": "auto",
462 + "min_doc_count": 0,
463 + "trimEdges": 0
464 + },
465 + "type": "date_histogram"
466 + }
467 + ],
468 + "datasource": {
469 + "type": "elasticsearch",
470 + "uid": "replace_datasource_uid"
471 + },
472 + "metrics": [
473 + {
474 + "field": "rule_level",
475 + "id": "1",
476 + "meta": {},
477 + "settings": {},
478 + "type": "max"
479 + }
480 + ],
481 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
482 + "refId": "A",
483 + "timeField": "timestamp"
484 + }
485 + ],
486 + "title": "MAX SEVERITY (0 - 15)",
487 + "type": "gauge"
488 + },
489 + {
490 + "datasource": {
491 + "type": "elasticsearch",
492 + "uid": "replace_datasource_uid"
493 + },
494 + "fieldConfig": {
495 + "defaults": {
496 + "color": {
497 + "mode": "palette-classic"
498 + },
499 + "custom": {
500 + "axisCenteredZero": false,
501 + "axisColorMode": "text",
502 + "axisLabel": "",
503 + "axisPlacement": "auto",
504 + "barAlignment": 0,
505 + "drawStyle": "bars",
506 + "fillOpacity": 0,
507 + "gradientMode": "none",
508 + "hideFrom": {
509 + "legend": false,
510 + "tooltip": false,
511 + "viz": false
512 + },
513 + "lineInterpolation": "linear",
514 + "lineWidth": 1,
515 + "pointSize": 5,
516 + "scaleDistribution": {
517 + "type": "linear"
518 + },
519 + "showPoints": "auto",
520 + "spanNulls": false,
521 + "stacking": {
522 + "group": "A",
523 + "mode": "normal"
524 + },
525 + "thresholdsStyle": {
526 + "mode": "off"
527 + }
528 + },
529 + "mappings": [],
530 + "thresholds": {
531 + "mode": "absolute",
532 + "steps": [
533 + {
534 + "color": "green",
535 + "value": null
536 + },
537 + {
538 + "color": "red",
539 + "value": 80
540 + }
541 + ]
542 + }
543 + },
544 + "overrides": []
545 + },
546 + "gridPos": {
547 + "h": 13,
548 + "w": 20,
549 + "x": 4,
550 + "y": 7
551 + },
552 + "id": 60,
553 + "options": {
554 + "legend": {
555 + "calcs": [],
556 + "displayMode": "table",
557 + "placement": "right",
558 + "showLegend": true
559 + },
560 + "tooltip": {
561 + "mode": "single",
562 + "sort": "none"
563 + }
564 + },
565 + "targets": [
566 + {
567 + "alias": "",
568 + "bucketAggs": [
569 + {
570 + "field": "data_office365_Operation",
571 + "id": "3",
572 + "settings": {
573 + "min_doc_count": "1",
574 + "order": "desc",
575 + "orderBy": "_count",
576 + "size": "10"
577 + },
578 + "type": "terms"
579 + },
580 + {
581 + "field": "timestamp",
582 + "id": "2",
583 + "settings": {
584 + "interval": "auto"
585 + },
586 + "type": "date_histogram"
587 + }
588 + ],
589 + "datasource": {
590 + "type": "elasticsearch",
591 + "uid": "replace_datasource_uid"
592 + },
593 + "metrics": [
594 + {
595 + "id": "1",
596 + "type": "count"
597 + }
598 + ],
599 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
600 + "refId": "A",
601 + "timeField": "timestamp"
602 + }
603 + ],
604 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
605 + "transparent": true,
606 + "type": "timeseries"
607 + },
608 + {
609 + "datasource": {
610 + "type": "elasticsearch",
611 + "uid": "replace_datasource_uid"
612 + },
613 + "fieldConfig": {
614 + "defaults": {
615 + "mappings": [
616 + {
617 + "options": {
618 + "match": "null",
619 + "result": {
620 + "text": "N/A"
621 + }
622 + },
623 + "type": "special"
624 + }
625 + ],
626 + "thresholds": {
627 + "mode": "absolute",
628 + "steps": [
629 + {
630 + "color": "blue",
631 + "value": null
632 + }
633 + ]
634 + },
635 + "unit": "locale"
636 + },
637 + "overrides": []
638 + },
639 + "gridPos": {
640 + "h": 6,
641 + "w": 4,
642 + "x": 0,
643 + "y": 14
644 + },
645 + "id": 51,
646 + "links": [],
647 + "options": {
648 + "colorMode": "value",
649 + "graphMode": "area",
650 + "justifyMode": "auto",
651 + "orientation": "horizontal",
652 + "reduceOptions": {
653 + "calcs": [
654 + "sum"
655 + ],
656 + "fields": "",
657 + "values": false
658 + },
659 + "text": {},
660 + "textMode": "auto"
661 + },
662 + "pluginVersion": "10.0.3",
663 + "targets": [
664 + {
665 + "bucketAggs": [
666 + {
667 + "$$hashKey": "object:331",
668 + "field": "timestamp",
669 + "id": "2",
670 + "settings": {
671 + "interval": "auto",
672 + "min_doc_count": 0,
673 + "trimEdges": 0
674 + },
675 + "type": "date_histogram"
676 + }
677 + ],
678 + "datasource": {
679 + "type": "elasticsearch",
680 + "uid": "replace_datasource_uid"
681 + },
682 + "metrics": [
683 + {
684 + "$$hashKey": "object:329",
685 + "field": "select field",
686 + "id": "1",
687 + "type": "count"
688 + }
689 + ],
690 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
691 + "refId": "A",
692 + "timeField": "timestamp"
693 + }
694 + ],
695 + "title": "EVENTS (Total)",
696 + "type": "stat"
697 + },
698 + {
699 + "datasource": {
700 + "type": "elasticsearch",
701 + "uid": "replace_datasource_uid"
702 + },
703 + "fieldConfig": {
704 + "defaults": {
705 + "color": {
706 + "mode": "thresholds"
707 + },
708 + "custom": {
709 + "align": "auto",
710 + "cellOptions": {
711 + "type": "auto"
712 + },
713 + "inspect": false
714 + },
715 + "mappings": [],
716 + "thresholds": {
717 + "mode": "absolute",
718 + "steps": [
719 + {
720 + "color": "red",
721 + "value": null
722 + }
723 + ]
724 + }
725 + },
726 + "overrides": [
727 + {
728 + "matcher": {
729 + "id": "byName",
730 + "options": "Count"
731 + },
732 + "properties": [
733 + {
734 + "id": "displayName",
735 + "value": "EVENTS"
736 + },
737 + {
738 + "id": "unit",
739 + "value": "short"
740 + },
741 + {
742 + "id": "decimals",
743 + "value": -1
744 + },
745 + {
746 + "id": "custom.align"
747 + },
748 + {
749 + "id": "thresholds",
750 + "value": {
751 + "mode": "absolute",
752 + "steps": [
753 + {
754 + "color": "red",
755 + "value": null
756 + }
757 + ]
758 + }
759 + }
760 + ]
761 + },
762 + {
763 + "matcher": {
764 + "id": "byName",
765 + "options": "DEVICE"
766 + },
767 + "properties": [
768 + {
769 + "id": "custom.width",
770 + "value": 324
771 + }
772 + ]
773 + }
774 + ]
775 + },
776 + "gridPos": {
777 + "h": 12,
778 + "w": 7,
779 + "x": 0,
780 + "y": 20
781 + },
782 + "id": 62,
783 + "options": {
784 + "cellHeight": "sm",
785 + "footer": {
786 + "countRows": false,
787 + "fields": "",
788 + "reducer": [
789 + "sum"
790 + ],
791 + "show": false
792 + },
793 + "showHeader": true,
794 + "sortBy": []
795 + },
796 + "pluginVersion": "10.0.3",
797 + "targets": [
798 + {
799 + "bucketAggs": [
800 + {
801 + "fake": true,
802 + "field": "data_office365_ResultStatus",
803 + "id": "4",
804 + "settings": {
805 + "min_doc_count": 1,
806 + "order": "desc",
807 + "orderBy": "_count",
808 + "size": "0"
809 + },
810 + "type": "terms"
811 + }
812 + ],
813 + "datasource": {
814 + "type": "elasticsearch",
815 + "uid": "replace_datasource_uid"
816 + },
817 + "metrics": [
818 + {
819 + "field": "select field",
820 + "id": "1",
821 + "type": "count"
822 + }
823 + ],
824 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
825 + "refId": "A",
826 + "timeField": "timestamp"
827 + }
828 + ],
829 + "title": "EVENTS BY RESULT",
830 + "transformations": [
831 + {
832 + "id": "merge",
833 + "options": {
834 + "reducers": []
835 + }
836 + },
837 + {
838 + "id": "organize",
839 + "options": {
840 + "excludeByName": {},
841 + "indexByName": {},
842 + "renameByName": {
843 + "Count": "EVENTS",
844 + "data_office365_ClientIP_country_code": "COUNTRY",
845 + "data_office365_DeviceName": "DEVICE",
846 + "data_office365_Operation": "OPERATION",
847 + "data_office365_ResultStatus": "RESULT STATUS"
848 + }
849 + }
850 + }
851 + ],
852 + "type": "table"
853 + },
854 + {
855 + "circleMaxSize": 30,
856 + "circleMinSize": 2,
857 + "colors": [
858 + "rgba(245, 54, 54, 0.9)",
859 + "rgba(237, 129, 40, 0.89)",
860 + "rgba(50, 172, 45, 0.97)"
861 + ],
862 + "datasource": {
863 + "type": "elasticsearch",
864 + "uid": "replace_datasource_uid"
865 + },
866 + "decimals": 0,
867 + "esMetric": "Count",
868 + "gridPos": {
869 + "h": 12,
870 + "w": 8,
871 + "x": 7,
872 + "y": 20
873 + },
874 + "hideEmpty": false,
875 + "hideZero": false,
876 + "id": 50,
877 + "initialZoom": 1,
878 + "locationData": "countries",
879 + "mapCenter": "(0°, 0°)",
880 + "mapCenterLatitude": 0,
881 + "mapCenterLongitude": 0,
882 + "maxDataPoints": 1,
883 + "mouseWheelZoom": false,
884 + "showLegend": true,
885 + "stickyLabels": false,
886 + "tableQueryOptions": {
887 + "geohashField": "geohash",
888 + "latitudeField": "latitude",
889 + "longitudeField": "longitude",
890 + "metricField": "metric",
891 + "queryType": "geohash"
892 + },
893 + "targets": [
894 + {
895 + "bucketAggs": [
896 + {
897 + "fake": true,
898 + "field": "data_office365_ClientIP_country_code",
899 + "id": "3",
900 + "settings": {
901 + "min_doc_count": 1,
902 + "order": "desc",
903 + "orderBy": "_count",
904 + "size": "0"
905 + },
906 + "type": "terms"
907 + },
908 + {
909 + "field": "timestamp",
910 + "id": "2",
911 + "settings": {
912 + "interval": "auto",
913 + "min_doc_count": 0,
914 + "trimEdges": 0
915 + },
916 + "type": "date_histogram"
917 + }
918 + ],
919 + "datasource": {
920 + "type": "elasticsearch",
921 + "uid": "replace_datasource_uid"
922 + },
923 + "metrics": [
924 + {
925 + "field": "select field",
926 + "id": "1",
927 + "type": "count"
928 + }
929 + ],
930 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
931 + "refId": "A",
932 + "timeField": "timestamp"
933 + }
934 + ],
935 + "thresholds": "0,10",
936 + "title": "Endpoint - ALL EVENTS BY SRC COUNTRY",
937 + "type": "grafana-worldmap-panel",
938 + "unitPlural": "",
939 + "unitSingle": "",
940 + "valueName": "total"
941 + },
942 + {
943 + "datasource": {
944 + "type": "elasticsearch",
945 + "uid": "replace_datasource_uid"
946 + },
947 + "fieldConfig": {
948 + "defaults": {
949 + "color": {
950 + "mode": "thresholds"
951 + },
952 + "custom": {
953 + "align": "auto",
954 + "cellOptions": {
955 + "type": "auto"
956 + },
957 + "inspect": false
958 + },
959 + "mappings": [],
960 + "thresholds": {
961 + "mode": "absolute",
962 + "steps": [
963 + {
964 + "color": "orange",
965 + "value": null
966 + }
967 + ]
968 + }
969 + },
970 + "overrides": [
971 + {
972 + "matcher": {
973 + "id": "byName",
974 + "options": "Count"
975 + },
976 + "properties": [
977 + {
978 + "id": "displayName",
979 + "value": "EVENTS"
980 + },
981 + {
982 + "id": "unit",
983 + "value": "short"
984 + },
985 + {
986 + "id": "decimals",
987 + "value": -1
988 + },
989 + {
990 + "id": "custom.align"
991 + }
992 + ]
993 + },
994 + {
995 + "matcher": {
996 + "id": "byName",
997 + "options": "AD ACCOUNT"
998 + },
999 + "properties": [
1000 + {
1001 + "id": "custom.width",
1002 + "value": 377
1003 + }
1004 + ]
1005 + }
1006 + ]
1007 + },
1008 + "gridPos": {
1009 + "h": 12,
1010 + "w": 9,
1011 + "x": 15,
1012 + "y": 20
1013 + },
1014 + "id": 58,
1015 + "options": {
1016 + "cellHeight": "sm",
1017 + "footer": {
1018 + "countRows": false,
1019 + "fields": "",
1020 + "reducer": [
1021 + "sum"
1022 + ],
1023 + "show": false
1024 + },
1025 + "showHeader": true,
1026 + "sortBy": []
1027 + },
1028 + "pluginVersion": "10.0.3",
1029 + "targets": [
1030 + {
1031 + "bucketAggs": [
1032 + {
1033 + "fake": true,
1034 + "field": "data_office365_UserId",
1035 + "id": "4",
1036 + "settings": {
1037 + "min_doc_count": 1,
1038 + "order": "desc",
1039 + "orderBy": "_count",
1040 + "size": "0"
1041 + },
1042 + "type": "terms"
1043 + },
1044 + {
1045 + "field": "data_office365_ClientIP_country_code",
1046 + "id": "5",
1047 + "settings": {
1048 + "min_doc_count": "1",
1049 + "order": "desc",
1050 + "orderBy": "_term",
1051 + "size": "10"
1052 + },
1053 + "type": "terms"
1054 + }
1055 + ],
1056 + "datasource": {
1057 + "type": "elasticsearch",
1058 + "uid": "replace_datasource_uid"
1059 + },
1060 + "metrics": [
1061 + {
1062 + "field": "select field",
1063 + "id": "1",
1064 + "type": "count"
1065 + }
1066 + ],
1067 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
1068 + "refId": "A",
1069 + "timeField": "timestamp"
1070 + }
1071 + ],
1072 + "title": "Endpoint EVENTS BY ACCOUNT",
1073 + "transformations": [
1074 + {
1075 + "id": "merge",
1076 + "options": {
1077 + "reducers": []
1078 + }
1079 + },
1080 + {
1081 + "id": "organize",
1082 + "options": {
1083 + "excludeByName": {},
1084 + "indexByName": {},
1085 + "renameByName": {
1086 + "Count": "EVENTS",
1087 + "data_office365_ClientIP_country_code": "COUNTRY",
1088 + "data_office365_LogonError": "ERROR",
1089 + "data_office365_Operation": "WORKLOAD",
1090 + "data_office365_UserId": "AD ACCOUNT"
1091 + }
1092 + }
1093 + }
1094 + ],
1095 + "type": "table"
1096 + },
1097 + {
1098 + "datasource": {
1099 + "type": "elasticsearch",
1100 + "uid": "replace_datasource_uid"
1101 + },
1102 + "fieldConfig": {
1103 + "defaults": {
1104 + "color": {
1105 + "mode": "thresholds"
1106 + },
1107 + "custom": {
1108 + "align": "auto",
1109 + "cellOptions": {
1110 + "type": "auto"
1111 + },
1112 + "filterable": true,
1113 + "inspect": false
1114 + },
1115 + "mappings": [],
1116 + "thresholds": {
1117 + "mode": "absolute",
1118 + "steps": [
1119 + {
1120 + "color": "green",
1121 + "value": null
1122 + },
1123 + {
1124 + "color": "red",
1125 + "value": 80
1126 + }
1127 + ]
1128 + }
1129 + },
1130 + "overrides": [
1131 + {
1132 + "matcher": {
1133 + "id": "byName",
1134 + "options": "rule_level"
1135 + },
1136 + "properties": [
1137 + {
1138 + "id": "displayName",
1139 + "value": "RULE LEVEL"
1140 + },
1141 + {
1142 + "id": "unit",
1143 + "value": "short"
1144 + },
1145 + {
1146 + "id": "decimals",
1147 + "value": -1
1148 + },
1149 + {
1150 + "id": "custom.cellOptions",
1151 + "value": {
1152 + "mode": "gradient",
1153 + "type": "color-background"
1154 + }
1155 + },
1156 + {
1157 + "id": "custom.align"
1158 + },
1159 + {
1160 + "id": "thresholds",
1161 + "value": {
1162 + "mode": "absolute",
1163 + "steps": [
1164 + {
1165 + "color": "#37872D",
1166 + "value": null
1167 + },
1168 + {
1169 + "color": "rgba(237, 129, 40, 0.89)",
1170 + "value": 7
1171 + },
1172 + {
1173 + "color": "rgba(245, 54, 54, 0.9)",
1174 + "value": 12
1175 + }
1176 + ]
1177 + }
1178 + }
1179 + ]
1180 + },
1181 + {
1182 + "matcher": {
1183 + "id": "byName",
1184 + "options": "Date/Time"
1185 + },
1186 + "properties": [
1187 + {
1188 + "id": "custom.width",
1189 + "value": 242
1190 + }
1191 + ]
1192 + },
1193 + {
1194 + "matcher": {
1195 + "id": "byName",
1196 + "options": "MITRE TACTIC"
1197 + },
1198 + "properties": [
1199 + {
1200 + "id": "custom.width",
1201 + "value": 332
1202 + }
1203 + ]
1204 + },
1205 + {
1206 + "matcher": {
1207 + "id": "byName",
1208 + "options": "IP ADDRESS"
1209 + },
1210 + "properties": [
1211 + {
1212 + "id": "custom.width",
1213 + "value": 163
1214 + }
1215 + ]
1216 + },
1217 + {
1218 + "matcher": {
1219 + "id": "byName",
1220 + "options": "MITRE TECHNIQUE"
1221 + },
1222 + "properties": [
1223 + {
1224 + "id": "custom.width",
1225 + "value": 312
1226 + }
1227 + ]
1228 + },
1229 + {
1230 + "matcher": {
1231 + "id": "byName",
1232 + "options": "EVENT ID"
1233 + },
1234 + "properties": [
1235 + {
1236 + "id": "links",
1237 + "value": [
1238 + {
1239 + "targetBlank": true,
1240 + "title": "VIEW EVENT DETAILS",
1241 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1242 + }
1243 + ]
1244 + },
1245 + {
1246 + "id": "custom.width",
1247 + "value": 265
1248 + }
1249 + ]
1250 + },
1251 + {
1252 + "matcher": {
1253 + "id": "byName",
1254 + "options": "RESULT"
1255 + },
1256 + "properties": [
1257 + {
1258 + "id": "custom.width",
1259 + "value": 118
1260 + },
1261 + {
1262 + "id": "mappings",
1263 + "value": [
1264 + {
1265 + "options": {
1266 + "Failed": {
1267 + "color": "orange",
1268 + "index": 1
1269 + },
1270 + "Success": {
1271 + "color": "green",
1272 + "index": 0
1273 + }
1274 + },
1275 + "type": "value"
1276 + }
1277 + ]
1278 + },
1279 + {
1280 + "id": "custom.cellOptions",
1281 + "value": {
1282 + "type": "color-text"
1283 + }
1284 + }
1285 + ]
1286 + },
1287 + {
1288 + "matcher": {
1289 + "id": "byName",
1290 + "options": "SRC IP"
1291 + },
1292 + "properties": [
1293 + {
1294 + "id": "custom.width",
1295 + "value": 265
1296 + }
1297 + ]
1298 + },
1299 + {
1300 + "matcher": {
1301 + "id": "byName",
1302 + "options": "ACCOUNT"
1303 + },
1304 + "properties": [
1305 + {
1306 + "id": "custom.width",
1307 + "value": 193
1308 + }
1309 + ]
1310 + },
1311 + {
1312 + "matcher": {
1313 + "id": "byName",
1314 + "options": "EVENT TIME"
1315 + },
1316 + "properties": [
1317 + {
1318 + "id": "custom.width",
1319 + "value": 195
1320 + }
1321 + ]
1322 + },
1323 + {
1324 + "matcher": {
1325 + "id": "byName",
1326 + "options": "CLIENT IP"
1327 + },
1328 + "properties": [
1329 + {
1330 + "id": "custom.width",
1331 + "value": 143
1332 + }
1333 + ]
1334 + },
1335 + {
1336 + "matcher": {
1337 + "id": "byName",
1338 + "options": "DESCRIPTION"
1339 + },
1340 + "properties": [
1341 + {
1342 + "id": "custom.width",
1343 + "value": 296
1344 + }
1345 + ]
1346 + },
1347 + {
1348 + "matcher": {
1349 + "id": "byName",
1350 + "options": "DEVICE"
1351 + },
1352 + "properties": [
1353 + {
1354 + "id": "custom.width",
1355 + "value": 182
1356 + }
1357 + ]
1358 + },
1359 + {
1360 + "matcher": {
1361 + "id": "byName",
1362 + "options": "RULE LEVEL"
1363 + },
1364 + "properties": [
1365 + {
1366 + "id": "custom.width",
1367 + "value": 145
1368 + }
1369 + ]
1370 + },
1371 + {
1372 + "matcher": {
1373 + "id": "byName",
1374 + "options": "APP"
1375 + },
1376 + "properties": [
1377 + {
1378 + "id": "custom.width",
1379 + "value": 187
1380 + }
1381 + ]
1382 + },
1383 + {
1384 + "matcher": {
1385 + "id": "byName",
1386 + "options": "FILE TYPE"
1387 + },
1388 + "properties": [
1389 + {
1390 + "id": "custom.width",
1391 + "value": 157
1392 + }
1393 + ]
1394 + }
1395 + ]
1396 + },
1397 + "gridPos": {
1398 + "h": 16,
1399 + "w": 24,
1400 + "x": 0,
1401 + "y": 32
1402 + },
1403 + "id": 27,
1404 + "options": {
1405 + "cellHeight": "sm",
1406 + "footer": {
1407 + "countRows": false,
1408 + "enablePagination": true,
1409 + "fields": "",
1410 + "reducer": [
1411 + "sum"
1412 + ],
1413 + "show": false
1414 + },
1415 + "showHeader": true,
1416 + "sortBy": []
1417 + },
1418 + "pluginVersion": "10.0.3",
1419 + "targets": [
1420 + {
1421 + "bucketAggs": [],
1422 + "datasource": {
1423 + "type": "elasticsearch",
1424 + "uid": "replace_datasource_uid"
1425 + },
1426 + "metrics": [
1427 + {
1428 + "id": "1",
1429 + "settings": {
1430 + "size": "250"
1431 + },
1432 + "type": "raw_data"
1433 + }
1434 + ],
1435 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
1436 + "refId": "A",
1437 + "timeField": "timestamp"
1438 + }
1439 + ],
1440 + "title": "EVENTS",
1441 + "transformations": [
1442 + {
1443 + "id": "organize",
1444 + "options": {
1445 + "excludeByName": {
1446 + "@metadata_beat": true,
1447 + "@metadata_type": true,
1448 + "@metadata_version": true,
1449 + "IMPHASH": true,
1450 + "MD5": true,
1451 + "SHA1": true,
1452 + "SHA256": true,
1453 + "_id": false,
1454 + "_index": true,
1455 + "_type": true,
1456 + "agent_ephemeral_id": true,
1457 + "agent_hostname": true,
1458 + "agent_id": true,
1459 + "agent_ip_city_name": true,
1460 + "agent_ip_country_code": true,
1461 + "agent_ip_geolocation": true,
1462 + "agent_name": true,
1463 + "agent_type": true,
1464 + "agent_version": true,
1465 + "beats_type": true,
1466 + "cluster_name": true,
1467 + "cluster_node": true,
1468 + "collector_node_id": true,
1469 + "data_alert_action": true,
1470 + "data_alert_category": true,
1471 + "data_alert_gid": true,
1472 + "data_alert_rev": true,
1473 + "data_alert_severity": true,
1474 + "data_alert_signature": true,
1475 + "data_alert_signature_id": true,
1476 + "data_app_proto": true,
1477 + "data_audit_auid": true,
1478 + "data_audit_command": true,
1479 + "data_audit_euid": true,
1480 + "data_audit_exe": true,
1481 + "data_audit_gid": true,
1482 + "data_audit_id": true,
1483 + "data_audit_pid": true,
1484 + "data_audit_res": true,
1485 + "data_audit_session": true,
1486 + "data_audit_type": true,
1487 + "data_audit_uid": true,
1488 + "data_dest_ip": true,
1489 + "data_dest_port": true,
1490 + "data_dstuser": true,
1491 + "data_event_type": true,
1492 + "data_extra_data": true,
1493 + "data_file": true,
1494 + "data_flow_bytes_toclient": true,
1495 + "data_flow_bytes_toserver": true,
1496 + "data_flow_id": true,
1497 + "data_flow_pkts_toclient": true,
1498 + "data_flow_pkts_toserver": true,
1499 + "data_flow_start": true,
1500 + "data_http_http_content_type": true,
1501 + "data_http_http_port": true,
1502 + "data_http_length": true,
1503 + "data_http_status": true,
1504 + "data_http_url": true,
1505 + "data_id": true,
1506 + "data_in_iface": true,
1507 + "data_integration": true,
1508 + "data_metadata_flowbits": true,
1509 + "data_metadata_flowints_http_anomaly_count": true,
1510 + "data_metadata_flowints_tcp_retransmission_count": true,
1511 + "data_office365_AADGroupId": true,
1512 + "data_office365_Actor": true,
1513 + "data_office365_ActorContextId": true,
1514 + "data_office365_ActorIpAddress": false,
1515 + "data_office365_ActorIpAddress_city_name": true,
1516 + "data_office365_ActorIpAddress_country_code": true,
1517 + "data_office365_ActorIpAddress_geolocation": true,
1518 + "data_office365_AppAccessContext_AADSessionId": true,
1519 + "data_office365_AppAccessContext_APIId": true,
1520 + "data_office365_AppAccessContext_ClientAppId": true,
1521 + "data_office365_AppAccessContext_ClientAppName": true,
1522 + "data_office365_AppAccessContext_CorrelationId": true,
1523 + "data_office365_AppAccessContext_UniqueTokenId": true,
1524 + "data_office365_AppId": true,
1525 + "data_office365_Application": false,
1526 + "data_office365_ApplicationId": true,
1527 + "data_office365_ArtifactsShared": true,
1528 + "data_office365_Attendees": true,
1529 + "data_office365_AuthenticationType": true,
1530 + "data_office365_AzureActiveDirectoryEventType": true,
1531 + "data_office365_BrowserVersion": true,
1532 + "data_office365_ChannelGuid": true,
1533 + "data_office365_ChannelName": true,
1534 + "data_office365_ChatName": true,
1535 + "data_office365_ChatThreadId": true,
1536 + "data_office365_ClientAppId": true,
1537 + "data_office365_ClientIP": false,
1538 + "data_office365_ClientIPAddress": true,
1539 + "data_office365_ClientIPAddress_city_name": true,
1540 + "data_office365_ClientIPAddress_country_code": true,
1541 + "data_office365_ClientIPAddress_geolocation": true,
1542 + "data_office365_ClientIP_city_name": true,
1543 + "data_office365_ClientIP_country_code": true,
1544 + "data_office365_ClientIP_geolocation": true,
1545 + "data_office365_ClientIP_reserved_ip": true,
1546 + "data_office365_ClientInfoString": true,
1547 + "data_office365_ClientProcessName": true,
1548 + "data_office365_ClientRequestId": true,
1549 + "data_office365_ClientVersion": true,
1550 + "data_office365_CommunicationSubType": true,
1551 + "data_office365_CommunicationType": true,
1552 + "data_office365_CorrelationId": true,
1553 + "data_office365_CreationTime": false,
1554 + "data_office365_CrossMailboxOperation": true,
1555 + "data_office365_DestFolder_Id": true,
1556 + "data_office365_DestFolder_Path": true,
1557 + "data_office365_DestinationLocationType": true,
1558 + "data_office365_DeviceDisplayName": true,
1559 + "data_office365_DeviceDisplayName_city_name": true,
1560 + "data_office365_DeviceDisplayName_country_code": true,
1561 + "data_office365_DeviceDisplayName_geolocation": true,
1562 + "data_office365_DeviceId": true,
1563 + "data_office365_DeviceInformation": true,
1564 + "data_office365_DeviceName": false,
1565 + "data_office365_DeviceProperties": true,
1566 + "data_office365_DlpOriginalFilePath": true,
1567 + "data_office365_EndTime": true,
1568 + "data_office365_EnforcementMode": true,
1569 + "data_office365_ErrorNumber": true,
1570 + "data_office365_EventSource": true,
1571 + "data_office365_ExchangeId": true,
1572 + "data_office365_ExtendedProperties": true,
1573 + "data_office365_ExternalAccess": true,
1574 + "data_office365_ExtraProperties": true,
1575 + "data_office365_FileExtension": true,
1576 + "data_office365_FileSize": true,
1577 + "data_office365_FileSizeBytes": true,
1578 + "data_office365_Folder_Id": true,
1579 + "data_office365_Folder_Path": true,
1580 + "data_office365_Hidden": true,
1581 + "data_office365_HighPriorityMediaProcessing": true,
1582 + "data_office365_HostedContents": true,
1583 + "data_office365_ICalUid": true,
1584 + "data_office365_Id": true,
1585 + "data_office365_InterSystemsId": true,
1586 + "data_office365_InternalLogonType": true,
1587 + "data_office365_IntraSystemId": true,
1588 + "data_office365_IsManagedDevice": true,
1589 + "data_office365_ItemName": true,
1590 + "data_office365_ItemType": true,
1591 + "data_office365_Item_Id": true,
1592 + "data_office365_Item_InternetMessageId": true,
1593 + "data_office365_Item_IsRecord": true,
1594 + "data_office365_Item_ParentFolder_Id": true,
1595 + "data_office365_Item_SizeInBytes": true,
1596 + "data_office365_JitTriggered": true,
1597 + "data_office365_JoinTime": true,
1598 + "data_office365_LeaveTime": true,
1599 + "data_office365_ListBaseType": true,
1600 + "data_office365_ListId": true,
1601 + "data_office365_ListItemUniqueId": true,
1602 + "data_office365_ListServerTemplate": true,
1603 + "data_office365_LogonError": true,
1604 + "data_office365_LogonType": true,
1605 + "data_office365_LogonUserSid": true,
1606 + "data_office365_MDATPDeviceId": true,
1607 + "data_office365_MailboxGuid": true,
1608 + "data_office365_MailboxOwnerSid": true,
1609 + "data_office365_MailboxOwnerUPN": true,
1610 + "data_office365_MeetingDetailId": true,
1611 + "data_office365_MeetingURL": true,
1612 + "data_office365_Members": true,
1613 + "data_office365_MessageId": true,
1614 + "data_office365_MessageSizeInBytes": true,
1615 + "data_office365_MessageURLs": true,
1616 + "data_office365_MessageVersion": true,
1617 + "data_office365_Modalities": true,
1618 + "data_office365_ModifiedProperties": true,
1619 + "data_office365_Name": true,
1620 + "data_office365_NewValue": true,
1621 + "data_office365_ObjectId": false,
1622 + "data_office365_Operation": true,
1623 + "data_office365_OperationScope": true,
1624 + "data_office365_OrganizationId": true,
1625 + "data_office365_OrganizationName": true,
1626 + "data_office365_Organizer_OrganizationId": true,
1627 + "data_office365_Organizer_RecipientType": true,
1628 + "data_office365_Organizer_Role": true,
1629 + "data_office365_Organizer_UserObjectId": true,
1630 + "data_office365_OriginatingDomain": true,
1631 + "data_office365_OriginatingServer": true,
1632 + "data_office365_Parameters": true,
1633 + "data_office365_ParentMessageId": true,
1634 + "data_office365_Platform": true,
1635 + "data_office365_PreviousFileName": true,
1636 + "data_office365_ProviderTypes": true,
1637 + "data_office365_RMSEncrypted": true,
1638 + "data_office365_RecordType": true,
1639 + "data_office365_ResultStatus": false,
1640 + "data_office365_Scope": true,
1641 + "data_office365_SensitiveInfoTypeData": true,
1642 + "data_office365_SessionId": true,
1643 + "data_office365_Sha1": true,
1644 + "data_office365_Sha256": true,
1645 + "data_office365_Site": true,
1646 + "data_office365_SiteUrl": true,
1647 + "data_office365_SourceFileExtension": true,
1648 + "data_office365_SourceFileName": true,
1649 + "data_office365_SourceLocationType": true,
1650 + "data_office365_SourceRelativeUrl": true,
1651 + "data_office365_StartTime": true,
1652 + "data_office365_Subscription": true,
1653 + "data_office365_SubscriptionId": true,
1654 + "data_office365_Target": true,
1655 + "data_office365_TargetContextId": true,
1656 + "data_office365_TargetFilePath": true,
1657 + "data_office365_TargetPrinterName": true,
1658 + "data_office365_TeamGuid": true,
1659 + "data_office365_TeamName": true,
1660 + "data_office365_UserId": false,
1661 + "data_office365_UserKey": true,
1662 + "data_office365_UserType": true,
1663 + "data_office365_Version": true,
1664 + "data_office365_WebId": true,
1665 + "data_office365_Workload": true,
1666 + "data_osquery_action": true,
1667 + "data_osquery_calendarTime": true,
1668 + "data_osquery_columns_address": true,
1669 + "data_osquery_columns_address_city_name": true,
1670 + "data_osquery_columns_address_country_code": true,
1671 + "data_osquery_columns_address_geolocation": true,
1672 + "data_osquery_columns_cmdline": true,
1673 + "data_osquery_columns_cwd": true,
1674 + "data_osquery_columns_description": true,
1675 + "data_osquery_columns_directory": true,
1676 + "data_osquery_columns_disk_bytes_read": true,
1677 + "data_osquery_columns_disk_bytes_written": true,
1678 + "data_osquery_columns_egid": true,
1679 + "data_osquery_columns_euid": true,
1680 + "data_osquery_columns_family": true,
1681 + "data_osquery_columns_fd": true,
1682 + "data_osquery_columns_gid": true,
1683 + "data_osquery_columns_gid_signed": true,
1684 + "data_osquery_columns_host": true,
1685 + "data_osquery_columns_interface": true,
1686 + "data_osquery_columns_local_address": true,
1687 + "data_osquery_columns_local_address_city_name": true,
1688 + "data_osquery_columns_local_address_country_code": true,
1689 + "data_osquery_columns_local_address_geolocation": true,
1690 + "data_osquery_columns_local_port": true,
1691 + "data_osquery_columns_mac": true,
1692 + "data_osquery_columns_name": true,
1693 + "data_osquery_columns_net_namespace": true,
1694 + "data_osquery_columns_nice": true,
1695 + "data_osquery_columns_on_disk": true,
1696 + "data_osquery_columns_parent": true,
1697 + "data_osquery_columns_path": true,
1698 + "data_osquery_columns_pgroup": true,
1699 + "data_osquery_columns_pid": true,
1700 + "data_osquery_columns_port": true,
1701 + "data_osquery_columns_protocol": true,
1702 + "data_osquery_columns_remote_address": true,
1703 + "data_osquery_columns_remote_address_city_name": true,
1704 + "data_osquery_columns_remote_address_country_code": true,
1705 + "data_osquery_columns_remote_address_geolocation": true,
1706 + "data_osquery_columns_remote_port": true,
1707 + "data_osquery_columns_resident_size": true,
1708 + "data_osquery_columns_root": true,
1709 + "data_osquery_columns_sgid": true,
1710 + "data_osquery_columns_shell": true,
1711 + "data_osquery_columns_socket": true,
1712 + "data_osquery_columns_start_time": true,
1713 + "data_osquery_columns_state": true,
1714 + "data_osquery_columns_suid": true,
1715 + "data_osquery_columns_system_time": true,
1716 + "data_osquery_columns_threads": true,
1717 + "data_osquery_columns_time_utc": true,
1718 + "data_osquery_columns_total_size": true,
1719 + "data_osquery_columns_tty": true,
1720 + "data_osquery_columns_type": true,
1721 + "data_osquery_columns_uid": true,
1722 + "data_osquery_columns_uid_signed": true,
1723 + "data_osquery_columns_user": true,
1724 + "data_osquery_columns_user_time": true,
1725 + "data_osquery_columns_username": true,
1726 + "data_osquery_columns_wired_size": true,
1727 + "data_osquery_counter": true,
1728 + "data_osquery_decorations_host_uuid": true,
1729 + "data_osquery_decorations_hostname": true,
1730 + "data_osquery_epoch": true,
1731 + "data_osquery_hostIdentifier": true,
1732 + "data_osquery_name": true,
1733 + "data_osquery_numerics": true,
1734 + "data_osquery_unixTime": true,
1735 + "data_proto": true,
1736 + "data_sca_check_command": true,
1737 + "data_sca_check_compliance_cis": true,
1738 + "data_sca_check_compliance_cis_csc": true,
1739 + "data_sca_check_compliance_gdpr_IV": true,
1740 + "data_sca_check_compliance_gpg_13": true,
1741 + "data_sca_check_compliance_hipaa": true,
1742 + "data_sca_check_compliance_nist_800_53": true,
1743 + "data_sca_check_compliance_pci_dss": true,
1744 + "data_sca_check_compliance_tsc": true,
1745 + "data_sca_check_description": true,
1746 + "data_sca_check_id": true,
1747 + "data_sca_check_previous_result": true,
1748 + "data_sca_check_rationale": true,
1749 + "data_sca_check_remediation": true,
1750 + "data_sca_check_result": true,
1751 + "data_sca_check_title": true,
1752 + "data_sca_description": true,
1753 + "data_sca_failed": true,
1754 + "data_sca_file": true,
1755 + "data_sca_invalid": true,
1756 + "data_sca_passed": true,
1757 + "data_sca_policy": true,
1758 + "data_sca_policy_id": true,
1759 + "data_sca_scan_id": true,
1760 + "data_sca_score": true,
1761 + "data_sca_total_checks": true,
1762 + "data_sca_type": true,
1763 + "data_script": true,
1764 + "data_src_ip": true,
1765 + "data_src_ip_city_name": true,
1766 + "data_src_ip_country_code": true,
1767 + "data_src_ip_geolocation": true,
1768 + "data_src_port": true,
1769 + "data_srcip": true,
1770 + "data_srcip_city_name": true,
1771 + "data_srcip_country_code": true,
1772 + "data_srcip_geolocation": true,
1773 + "data_srcuser": true,
1774 + "data_timestamp": true,
1775 + "data_title": true,
1776 + "data_tls_session_resumed": true,
1777 + "data_tls_version": true,
1778 + "data_tx_id": true,
1779 + "data_type": true,
1780 + "data_win_eventXML_binaryData": true,
1781 + "data_win_eventXML_binaryDataSize": true,
1782 + "data_win_eventXML_param1": true,
1783 + "data_win_eventdata_authenticationPackageName": true,
1784 + "data_win_eventdata_callTrace": true,
1785 + "data_win_eventdata_commandLine": true,
1786 + "data_win_eventdata_company": true,
1787 + "data_win_eventdata_creationUtcTime": true,
1788 + "data_win_eventdata_currentDirectory": true,
1789 + "data_win_eventdata_description": true,
1790 + "data_win_eventdata_destinationHostname": true,
1791 + "data_win_eventdata_destinationIp": true,
1792 + "data_win_eventdata_destinationIp_city_name": true,
1793 + "data_win_eventdata_destinationIp_country_code": true,
1794 + "data_win_eventdata_destinationIp_geolocation": true,
1795 + "data_win_eventdata_destinationIsIpv6": true,
1796 + "data_win_eventdata_destinationPort": true,
1797 + "data_win_eventdata_destinationPortName": true,
1798 + "data_win_eventdata_details": true,
1799 + "data_win_eventdata_elevatedToken": true,
1800 + "data_win_eventdata_eventType": true,
1801 + "data_win_eventdata_fileVersion": true,
1802 + "data_win_eventdata_fileVersion_city_name": true,
1803 + "data_win_eventdata_fileVersion_country_code": true,
1804 + "data_win_eventdata_fileVersion_geolocation": true,
1805 + "data_win_eventdata_grantedAccess": true,
1806 + "data_win_eventdata_hashes": true,
1807 + "data_win_eventdata_image": true,
1808 + "data_win_eventdata_imageLoaded": true,
1809 + "data_win_eventdata_impersonationLevel": true,
1810 + "data_win_eventdata_initiated": true,
1811 + "data_win_eventdata_integrityLevel": true,
1812 + "data_win_eventdata_ipAddress": true,
1813 + "data_win_eventdata_ipPort": true,
1814 + "data_win_eventdata_keyLength": true,
1815 + "data_win_eventdata_logonGuid": true,
1816 + "data_win_eventdata_logonId": true,
1817 + "data_win_eventdata_logonProcessName": true,
1818 + "data_win_eventdata_logonType": true,
1819 + "data_win_eventdata_originalFileName": true,
1820 + "data_win_eventdata_param1": true,
1821 + "data_win_eventdata_param2": true,
1822 + "data_win_eventdata_param3": true,
1823 + "data_win_eventdata_param4": true,
1824 + "data_win_eventdata_parentCommandLine": true,
1825 + "data_win_eventdata_parentImage": true,
1826 + "data_win_eventdata_parentProcessGuid": true,
1827 + "data_win_eventdata_parentProcessId": true,
1828 + "data_win_eventdata_processGuid": true,
1829 + "data_win_eventdata_processId": true,
1830 + "data_win_eventdata_processName": true,
1831 + "data_win_eventdata_product": true,
1832 + "data_win_eventdata_protocol": true,
1833 + "data_win_eventdata_queryName": true,
1834 + "data_win_eventdata_queryResults": true,
1835 + "data_win_eventdata_queryStatus": true,
1836 + "data_win_eventdata_ruleName": true,
1837 + "data_win_eventdata_serviceName": true,
1838 + "data_win_eventdata_serviceSid": true,
1839 + "data_win_eventdata_signature": true,
1840 + "data_win_eventdata_signatureStatus": true,
1841 + "data_win_eventdata_signed": true,
1842 + "data_win_eventdata_sourceHostname": true,
1843 + "data_win_eventdata_sourceImage": true,
1844 + "data_win_eventdata_sourceIp": true,
1845 + "data_win_eventdata_sourceIp_city_name": true,
1846 + "data_win_eventdata_sourceIp_country_code": true,
1847 + "data_win_eventdata_sourceIp_geolocation": true,
1848 + "data_win_eventdata_sourceIsIpv6": true,
1849 + "data_win_eventdata_sourcePort": true,
1850 + "data_win_eventdata_sourceProcessGUID": true,
1851 + "data_win_eventdata_sourceProcessId": true,
1852 + "data_win_eventdata_sourceThreadId": true,
1853 + "data_win_eventdata_status": true,
1854 + "data_win_eventdata_subjectDomainName": true,
1855 + "data_win_eventdata_subjectLogonId": true,
1856 + "data_win_eventdata_subjectUserName": true,
1857 + "data_win_eventdata_subjectUserSid": true,
1858 + "data_win_eventdata_targetDomainName": true,
1859 + "data_win_eventdata_targetFilename": true,
1860 + "data_win_eventdata_targetImage": true,
1861 + "data_win_eventdata_targetLinkedLogonId": true,
1862 + "data_win_eventdata_targetLogonId": true,
1863 + "data_win_eventdata_targetObject": true,
1864 + "data_win_eventdata_targetProcessGUID": true,
1865 + "data_win_eventdata_targetProcessId": true,
1866 + "data_win_eventdata_targetUserName": true,
1867 + "data_win_eventdata_targetUserSid": true,
1868 + "data_win_eventdata_terminalSessionId": true,
1869 + "data_win_eventdata_ticketEncryptionType": true,
1870 + "data_win_eventdata_ticketOptions": true,
1871 + "data_win_eventdata_user": true,
1872 + "data_win_eventdata_utcTime": true,
1873 + "data_win_eventdata_virtualAccount": true,
1874 + "data_win_system_channel": true,
1875 + "data_win_system_computer": true,
1876 + "data_win_system_eventID": true,
1877 + "data_win_system_eventRecordID": true,
1878 + "data_win_system_eventSourceName": true,
1879 + "data_win_system_keywords": true,
1880 + "data_win_system_level": true,
1881 + "data_win_system_message": true,
1882 + "data_win_system_opcode": true,
1883 + "data_win_system_processID": true,
1884 + "data_win_system_providerGuid": true,
1885 + "data_win_system_providerName": true,
1886 + "data_win_system_severityValue": true,
1887 + "data_win_system_systemTime": true,
1888 + "data_win_system_task": true,
1889 + "data_win_system_threadID": true,
1890 + "data_win_system_version": true,
1891 + "decoder_name": true,
1892 + "decoder_parent": true,
1893 + "dns_query": true,
1894 + "dns_query_threat_indicated": true,
1895 + "dst_ip": true,
1896 + "dst_ip_city_name": true,
1897 + "dst_ip_country_code": true,
1898 + "dst_ip_geolocation": true,
1899 + "dst_ip_threat_indicated": true,
1900 + "dst_port": true,
1901 + "ecs_version": true,
1902 + "error": true,
1903 + "event_hash": true,
1904 + "file_path": true,
1905 + "firewall_rule_name": true,
1906 + "full_log": false,
1907 + "gl2_accounted_message_size": true,
1908 + "gl2_message_id": true,
1909 + "gl2_processing_error": true,
1910 + "gl2_remote_ip": true,
1911 + "gl2_remote_port": true,
1912 + "gl2_source_collector": true,
1913 + "gl2_source_input": true,
1914 + "gl2_source_node": true,
1915 + "hash_md5": true,
1916 + "hash_sha1": true,
1917 + "hash_sha256": true,
1918 + "highlight": true,
1919 + "host_architecture": true,
1920 + "host_containerized": true,
1921 + "host_hostname": true,
1922 + "host_id": true,
1923 + "host_ip": true,
1924 + "host_mac": true,
1925 + "host_name": true,
1926 + "host_os_codename": true,
1927 + "host_os_kernel": true,
1928 + "host_os_name": true,
1929 + "host_os_platform": true,
1930 + "host_os_version": true,
1931 + "hostname": true,
1932 + "id": true,
1933 + "input_type": true,
1934 + "level": true,
1935 + "location": true,
1936 + "log_file_path": true,
1937 + "log_offset": true,
1938 + "manager_name": true,
1939 + "message": true,
1940 + "module": true,
1941 + "msg_timestamp": true,
1942 + "parent_process_cmd_line": true,
1943 + "parent_process_id": true,
1944 + "parent_process_image": true,
1945 + "pid": true,
1946 + "predecoder_hostname": true,
1947 + "predecoder_program_name": true,
1948 + "predecoder_timestamp": true,
1949 + "previous_log": true,
1950 + "previous_output": true,
1951 + "process_cmd_line": true,
1952 + "process_id": true,
1953 + "process_image": true,
1954 + "process_name": true,
1955 + "protocol": true,
1956 + "rule_cis": true,
1957 + "rule_cis_csc": true,
1958 + "rule_firedtimes": true,
1959 + "rule_gdpr": true,
1960 + "rule_gdpr_IV": true,
1961 + "rule_gpg13": true,
1962 + "rule_gpg_13": true,
1963 + "rule_group1": true,
1964 + "rule_group2": true,
1965 + "rule_groups": true,
1966 + "rule_hipaa": true,
1967 + "rule_id": true,
1968 + "rule_info": true,
1969 + "rule_mail": true,
1970 + "rule_mitre_id": true,
1971 + "rule_mitre_tactic": false,
1972 + "rule_nist_800_53": true,
1973 + "rule_pci_dss": true,
1974 + "rule_tsc": true,
1975 + "scanid": true,
1976 + "service": true,
1977 + "software_package": true,
1978 + "software_vendor": true,
1979 + "sort": true,
1980 + "source": true,
1981 + "source_reserved_ip": true,
1982 + "src_ip": true,
1983 + "src_ip_city_name": true,
1984 + "src_ip_country_code": true,
1985 + "src_ip_geolocation": true,
1986 + "src_port": true,
1987 + "streams": true,
1988 + "syscheck_attrs_after": true,
1989 + "syscheck_audit_effective_user_id": true,
1990 + "syscheck_audit_effective_user_name": true,
1991 + "syscheck_audit_group_id": true,
1992 + "syscheck_audit_group_name": true,
1993 + "syscheck_audit_login_user_id": true,
1994 + "syscheck_audit_login_user_name": true,
1995 + "syscheck_audit_process_cwd": true,
1996 + "syscheck_audit_process_id": true,
1997 + "syscheck_audit_process_name": true,
1998 + "syscheck_audit_process_parent_cwd": true,
1999 + "syscheck_audit_process_parent_name": true,
2000 + "syscheck_audit_process_ppid": true,
2001 + "syscheck_audit_user_id": true,
2002 + "syscheck_audit_user_name": true,
2003 + "syscheck_changed_attributes": true,
2004 + "syscheck_event": true,
2005 + "syscheck_gid_after": true,
2006 + "syscheck_gname_after": true,
2007 + "syscheck_hard_links": true,
2008 + "syscheck_inode_after": true,
2009 + "syscheck_inode_before": true,
2010 + "syscheck_md5_after": true,
2011 + "syscheck_md5_before": true,
2012 + "syscheck_mode": true,
2013 + "syscheck_mtime_after": true,
2014 + "syscheck_mtime_before": true,
2015 + "syscheck_path": true,
2016 + "syscheck_perm_after": true,
2017 + "syscheck_perm_before": true,
2018 + "syscheck_sha1_after": true,
2019 + "syscheck_sha1_before": true,
2020 + "syscheck_sha256_after": true,
2021 + "syscheck_sha256_before": true,
2022 + "syscheck_size_after": true,
2023 + "syscheck_size_before": true,
2024 + "syscheck_uid_after": true,
2025 + "syscheck_uname_after": true,
2026 + "syscheck_win_perm_after": true,
2027 + "syscheck_win_perm_after_0_allowed": true,
2028 + "syscheck_win_perm_after_0_name": true,
2029 + "syscheck_win_perm_after_1_allowed": true,
2030 + "syscheck_win_perm_after_1_name": true,
2031 + "syscheck_win_perm_after_2_allowed": true,
2032 + "syscheck_win_perm_after_2_name": true,
2033 + "syscheck_win_perm_after_3_allowed": true,
2034 + "syscheck_win_perm_after_3_name": true,
2035 + "syslog_customer": true,
2036 + "syslog_level": true,
2037 + "syslog_tag": true,
2038 + "syslog_type": true,
2039 + "sysmon_event_description": true,
2040 + "threat_ids": true,
2041 + "threat_indicated": true,
2042 + "threat_names": true,
2043 + "time": true,
2044 + "timestamp": true,
2045 + "true": true,
2046 + "user_name": true,
2047 + "win_registry_key": true,
2048 + "win_system_eventID": true,
2049 + "windows_auth_package": true,
2050 + "windows_domain": true,
2051 + "windows_event_id": true,
2052 + "windows_event_severity": true,
2053 + "windows_logon_type": true
2054 + },
2055 + "indexByName": {
2056 + "_id": 2,
2057 + "_index": 10,
2058 + "_type": 11,
2059 + "agent_id": 12,
2060 + "agent_name": 6,
2061 + "cluster_name": 13,
2062 + "cluster_node": 14,
2063 + "data_integration": 48,
2064 + "data_office365_Application": 49,
2065 + "data_office365_ClientIP": 4,
2066 + "data_office365_ClientIP_city_name": 15,
2067 + "data_office365_ClientIP_country_code": 16,
2068 + "data_office365_ClientIP_geolocation": 17,
2069 + "data_office365_CreationTime": 0,
2070 + "data_office365_DeviceName": 5,
2071 + "data_office365_FileSize": 50,
2072 + "data_office365_FileType": 51,
2073 + "data_office365_Hidden": 53,
2074 + "data_office365_Id": 18,
2075 + "data_office365_MDATPDeviceId": 54,
2076 + "data_office365_ObjectId": 52,
2077 + "data_office365_Operation": 24,
2078 + "data_office365_OrganizationId": 19,
2079 + "data_office365_Platform": 55,
2080 + "data_office365_RecordType": 20,
2081 + "data_office365_Scope": 56,
2082 + "data_office365_SourceLocationType": 57,
2083 + "data_office365_Subscription": 58,
2084 + "data_office365_UserId": 3,
2085 + "data_office365_UserKey": 21,
2086 + "data_office365_UserType": 22,
2087 + "data_office365_Version": 23,
2088 + "data_office365_Workload": 47,
2089 + "decoder_name": 25,
2090 + "gl2_accounted_message_size": 26,
2091 + "gl2_message_id": 27,
2092 + "gl2_processing_error": 28,
2093 + "gl2_remote_ip": 29,
2094 + "gl2_remote_port": 30,
2095 + "gl2_source_input": 31,
2096 + "gl2_source_node": 32,
2097 + "highlight": 33,
2098 + "id": 34,
2099 + "location": 35,
2100 + "manager_name": 36,
2101 + "message": 37,
2102 + "msg_timestamp": 59,
2103 + "rule_description": 7,
2104 + "rule_firedtimes": 38,
2105 + "rule_group1": 39,
2106 + "rule_group2": 60,
2107 + "rule_groups": 40,
2108 + "rule_hipaa": 61,
2109 + "rule_id": 9,
2110 + "rule_level": 8,
2111 + "rule_mail": 41,
2112 + "rule_pci_dss": 62,
2113 + "sort": 42,
2114 + "source": 43,
2115 + "source_reserved_ip": 63,
2116 + "streams": 44,
2117 + "syslog_type": 45,
2118 + "timestamp": 1,
2119 + "true": 46
2120 + },
2121 + "renameByName": {
2122 + "_id": "EVENT ID",
2123 + "agent_name": "",
2124 + "data_office365_ActorIpAddress": "SRC IP",
2125 + "data_office365_AffectedItems": "ITEMS",
2126 + "data_office365_Application": "APP",
2127 + "data_office365_BrowserName": "BROWSER",
2128 + "data_office365_ClientIP": "CLIENT IP",
2129 + "data_office365_ClientIP_city_name": "",
2130 + "data_office365_CreationTime": "EVENT TIME",
2131 + "data_office365_DeviceDisplayName": "",
2132 + "data_office365_DeviceName": "DEVICE",
2133 + "data_office365_FileType": "FILE TYPE",
2134 + "data_office365_Item_Attachments": "ATTACHMENT",
2135 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2136 + "data_office365_Item_Subject": "SUBJECT",
2137 + "data_office365_ObjectId": "OBJECT",
2138 + "data_office365_ResultDescription": "RESULT DESCRIPTION",
2139 + "data_office365_ResultStatus": "RESULT STATUS",
2140 + "data_office365_UserAgent": "USER AGENT",
2141 + "data_office365_UserId": "ACCOUNT",
2142 + "rule_description": "DESCRIPTION",
2143 + "rule_id": "RULE ID",
2144 + "rule_level": "",
2145 + "rule_mitre_tactic": "MITRE TACTIC",
2146 + "rule_mitre_technique": "MITRE TECHNIQUE",
2147 + "timestamp": "Date/Time"
2148 + }
2149 + }
2150 + }
2151 + ],
2152 + "transparent": true,
2153 + "type": "table"
2154 + }
2155 + ],
2156 + "refresh": "",
2157 + "schemaVersion": 38,
2158 + "style": "dark",
2159 + "tags": [
2160 + "O365"
2161 + ],
2162 + "templating": {
2163 + "list": [
2164 + {
2165 + "datasource": {
2166 + "type": "elasticsearch",
2167 + "uid": "replace_datasource_uid"
2168 + },
2169 + "filters": [],
2170 + "hide": 0,
2171 + "label": "",
2172 + "name": "Filters",
2173 + "skipUrlSync": false,
2174 + "type": "adhoc"
2175 + },
2176 + {
2177 + "current": {
2178 + "selected": false,
2179 + "text": "All",
2180 + "value": "$__all"
2181 + },
2182 + "datasource": {
2183 + "type": "elasticsearch",
2184 + "uid": "replace_datasource_uid"
2185 + },
2186 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2187 + "hide": 0,
2188 + "includeAll": true,
2189 + "label": "Operation",
2190 + "multi": false,
2191 + "name": "operation",
2192 + "options": [],
2193 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2194 + "refresh": 2,
2195 + "regex": "",
2196 + "skipUrlSync": false,
2197 + "sort": 1,
2198 + "tagValuesQuery": "",
2199 + "tagsQuery": "",
2200 + "type": "query",
2201 + "useTags": false
2202 + },
2203 + {
2204 + "current": {
2205 + "selected": false,
2206 + "text": "All",
2207 + "value": "$__all"
2208 + },
2209 + "datasource": {
2210 + "type": "elasticsearch",
2211 + "uid": "replace_datasource_uid"
2212 + },
2213 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2214 + "hide": 0,
2215 + "includeAll": true,
2216 + "label": "Rule Level",
2217 + "multi": false,
2218 + "name": "rule_level",
2219 + "options": [],
2220 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2221 + "refresh": 2,
2222 + "regex": "",
2223 + "skipUrlSync": false,
2224 + "sort": 0,
2225 + "type": "query"
2226 + }
2227 + ]
2228 + },
2229 + "time": {
2230 + "from": "now-6h",
2231 + "to": "now"
2232 + },
2233 + "timepicker": {
2234 + "refresh_intervals": [
2235 + "5s",
2236 + "10s",
2237 + "30s",
2238 + "1m",
2239 + "5m",
2240 + "15m",
2241 + "30m",
2242 + "1h",
2243 + "2h",
2244 + "1d"
2245 + ],
2246 + "time_options": [
2247 + "5m",
2248 + "15m",
2249 + "1h",
2250 + "6h",
2251 + "12h",
2252 + "24h",
2253 + "2d",
2254 + "7d",
2255 + "30d"
2256 + ]
2257 + },
2258 + "timezone": "",
2259 + "title": "O365 - DEFENDER FOR IDENTITY",
2260 + "weekStart": ""
2261 +}
backend/app/connectors/grafana/dashboards/Office365/dlp.json new
+1998
@@ -0,0 +1,1998 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "9.2.0",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Workload:$workload",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Workload",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY WORKLOAD (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "displayMode": "auto",
261 + "inspect": false
262 + },
263 + "mappings": [],
264 + "thresholds": {
265 + "mode": "absolute",
266 + "steps": [
267 + {
268 + "color": "red",
269 + "value": null
270 + }
271 + ]
272 + }
273 + },
274 + "overrides": [
275 + {
276 + "matcher": {
277 + "id": "byName",
278 + "options": "Count"
279 + },
280 + "properties": [
281 + {
282 + "id": "displayName",
283 + "value": "EVENTS"
284 + },
285 + {
286 + "id": "unit",
287 + "value": "short"
288 + },
289 + {
290 + "id": "decimals",
291 + "value": -1
292 + },
293 + {
294 + "id": "custom.align"
295 + },
296 + {
297 + "id": "thresholds",
298 + "value": {
299 + "mode": "absolute",
300 + "steps": [
301 + {
302 + "color": "red",
303 + "value": null
304 + }
305 + ]
306 + }
307 + }
308 + ]
309 + }
310 + ]
311 + },
312 + "gridPos": {
313 + "h": 7,
314 + "w": 6,
315 + "x": 8,
316 + "y": 0
317 + },
318 + "id": 54,
319 + "options": {
320 + "footer": {
321 + "fields": "",
322 + "reducer": [
323 + "sum"
324 + ],
325 + "show": false
326 + },
327 + "showHeader": true
328 + },
329 + "pluginVersion": "9.2.0",
330 + "targets": [
331 + {
332 + "bucketAggs": [
333 + {
334 + "fake": true,
335 + "field": "data_office365_Workload",
336 + "id": "4",
337 + "settings": {
338 + "min_doc_count": 1,
339 + "order": "desc",
340 + "orderBy": "_count",
341 + "size": "0"
342 + },
343 + "type": "terms"
344 + }
345 + ],
346 + "datasource": {
347 + "type": "elasticsearch",
348 + "uid": "replace_datasource_uid"
349 + },
350 + "metrics": [
351 + {
352 + "field": "select field",
353 + "id": "1",
354 + "type": "count"
355 + }
356 + ],
357 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
358 + "refId": "A",
359 + "timeField": "timestamp"
360 + }
361 + ],
362 + "title": "EVENTS BY WORKLOAD",
363 + "transformations": [
364 + {
365 + "id": "merge",
366 + "options": {
367 + "reducers": []
368 + }
369 + },
370 + {
371 + "id": "organize",
372 + "options": {
373 + "excludeByName": {},
374 + "indexByName": {},
375 + "renameByName": {
376 + "Count": "EVENTS",
377 + "data_office365_Operation": "OPERATION",
378 + "data_office365_Workload": "WORKLOAD"
379 + }
380 + }
381 + }
382 + ],
383 + "type": "table"
384 + },
385 + {
386 + "datasource": {
387 + "type": "elasticsearch",
388 + "uid": "replace_datasource_uid"
389 + },
390 + "fieldConfig": {
391 + "defaults": {
392 + "color": {
393 + "mode": "thresholds"
394 + },
395 + "mappings": [
396 + {
397 + "options": {
398 + "match": "null",
399 + "result": {
400 + "text": "N/A"
401 + }
402 + },
403 + "type": "special"
404 + }
405 + ],
406 + "max": 15,
407 + "min": 0,
408 + "thresholds": {
409 + "mode": "absolute",
410 + "steps": [
411 + {
412 + "color": "#299c46",
413 + "value": null
414 + },
415 + {
416 + "color": "rgba(237, 129, 40, 0.89)",
417 + "value": 8
418 + },
419 + {
420 + "color": "#d44a3a",
421 + "value": 12
422 + }
423 + ]
424 + },
425 + "unit": "none"
426 + },
427 + "overrides": []
428 + },
429 + "gridPos": {
430 + "h": 7,
431 + "w": 4,
432 + "x": 0,
433 + "y": 7
434 + },
435 + "id": 16,
436 + "links": [],
437 + "options": {
438 + "orientation": "horizontal",
439 + "reduceOptions": {
440 + "calcs": [
441 + "max"
442 + ],
443 + "fields": "",
444 + "values": false
445 + },
446 + "showThresholdLabels": false,
447 + "showThresholdMarkers": true,
448 + "text": {}
449 + },
450 + "pluginVersion": "9.2.0",
451 + "targets": [
452 + {
453 + "bucketAggs": [
454 + {
455 + "field": "timestamp",
456 + "id": "2",
457 + "settings": {
458 + "interval": "auto",
459 + "min_doc_count": 0,
460 + "trimEdges": 0
461 + },
462 + "type": "date_histogram"
463 + }
464 + ],
465 + "datasource": {
466 + "type": "elasticsearch",
467 + "uid": "replace_datasource_uid"
468 + },
469 + "metrics": [
470 + {
471 + "field": "rule_level",
472 + "id": "1",
473 + "meta": {},
474 + "settings": {},
475 + "type": "max"
476 + }
477 + ],
478 + "query": "data_office365_Workload:$workload",
479 + "refId": "A",
480 + "timeField": "timestamp"
481 + }
482 + ],
483 + "title": "MAX SEVERITY (0 - 15)",
484 + "type": "gauge"
485 + },
486 + {
487 + "datasource": {
488 + "type": "elasticsearch",
489 + "uid": "replace_datasource_uid"
490 + },
491 + "fieldConfig": {
492 + "defaults": {
493 + "color": {
494 + "mode": "palette-classic"
495 + },
496 + "custom": {
497 + "axisCenteredZero": false,
498 + "axisColorMode": "text",
499 + "axisLabel": "",
500 + "axisPlacement": "auto",
501 + "barAlignment": 0,
502 + "drawStyle": "bars",
503 + "fillOpacity": 0,
504 + "gradientMode": "none",
505 + "hideFrom": {
506 + "legend": false,
507 + "tooltip": false,
508 + "viz": false
509 + },
510 + "lineInterpolation": "linear",
511 + "lineWidth": 1,
512 + "pointSize": 5,
513 + "scaleDistribution": {
514 + "type": "linear"
515 + },
516 + "showPoints": "auto",
517 + "spanNulls": false,
518 + "stacking": {
519 + "group": "A",
520 + "mode": "normal"
521 + },
522 + "thresholdsStyle": {
523 + "mode": "off"
524 + }
525 + },
526 + "mappings": [],
527 + "thresholds": {
528 + "mode": "absolute",
529 + "steps": [
530 + {
531 + "color": "green",
532 + "value": null
533 + },
534 + {
535 + "color": "red",
536 + "value": 80
537 + }
538 + ]
539 + }
540 + },
541 + "overrides": []
542 + },
543 + "gridPos": {
544 + "h": 13,
545 + "w": 20,
546 + "x": 4,
547 + "y": 7
548 + },
549 + "id": 61,
550 + "options": {
551 + "legend": {
552 + "calcs": [],
553 + "displayMode": "table",
554 + "placement": "right",
555 + "showLegend": true
556 + },
557 + "tooltip": {
558 + "mode": "single",
559 + "sort": "none"
560 + }
561 + },
562 + "targets": [
563 + {
564 + "alias": "",
565 + "bucketAggs": [
566 + {
567 + "field": "data_office365_Workload",
568 + "id": "3",
569 + "settings": {
570 + "min_doc_count": "1",
571 + "order": "desc",
572 + "orderBy": "_count",
573 + "size": "10"
574 + },
575 + "type": "terms"
576 + },
577 + {
578 + "field": "timestamp",
579 + "id": "2",
580 + "settings": {
581 + "interval": "auto"
582 + },
583 + "type": "date_histogram"
584 + }
585 + ],
586 + "datasource": {
587 + "type": "elasticsearch",
588 + "uid": "replace_datasource_uid"
589 + },
590 + "metrics": [
591 + {
592 + "id": "1",
593 + "type": "count"
594 + }
595 + ],
596 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
597 + "refId": "A",
598 + "timeField": "timestamp"
599 + }
600 + ],
601 + "title": "TOP 10 WORKLOADS - HISTOGRAM",
602 + "transparent": true,
603 + "type": "timeseries"
604 + },
605 + {
606 + "datasource": {
607 + "type": "elasticsearch",
608 + "uid": "replace_datasource_uid"
609 + },
610 + "fieldConfig": {
611 + "defaults": {
612 + "mappings": [
613 + {
614 + "options": {
615 + "match": "null",
616 + "result": {
617 + "text": "N/A"
618 + }
619 + },
620 + "type": "special"
621 + }
622 + ],
623 + "thresholds": {
624 + "mode": "absolute",
625 + "steps": [
626 + {
627 + "color": "blue",
628 + "value": null
629 + }
630 + ]
631 + },
632 + "unit": "locale"
633 + },
634 + "overrides": []
635 + },
636 + "gridPos": {
637 + "h": 6,
638 + "w": 4,
639 + "x": 0,
640 + "y": 14
641 + },
642 + "id": 51,
643 + "links": [],
644 + "options": {
645 + "colorMode": "value",
646 + "graphMode": "area",
647 + "justifyMode": "auto",
648 + "orientation": "horizontal",
649 + "reduceOptions": {
650 + "calcs": [
651 + "sum"
652 + ],
653 + "fields": "",
654 + "values": false
655 + },
656 + "text": {},
657 + "textMode": "auto"
658 + },
659 + "pluginVersion": "9.2.0",
660 + "targets": [
661 + {
662 + "bucketAggs": [
663 + {
664 + "$$hashKey": "object:331",
665 + "field": "timestamp",
666 + "id": "2",
667 + "settings": {
668 + "interval": "auto",
669 + "min_doc_count": 0,
670 + "trimEdges": 0
671 + },
672 + "type": "date_histogram"
673 + }
674 + ],
675 + "datasource": {
676 + "type": "elasticsearch",
677 + "uid": "replace_datasource_uid"
678 + },
679 + "metrics": [
680 + {
681 + "$$hashKey": "object:329",
682 + "field": "select field",
683 + "id": "1",
684 + "type": "count"
685 + }
686 + ],
687 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
688 + "refId": "A",
689 + "timeField": "timestamp"
690 + }
691 + ],
692 + "title": "EVENTS (Total)",
693 + "type": "stat"
694 + },
695 + {
696 + "datasource": {
697 + "type": "elasticsearch",
698 + "uid": "replace_datasource_uid"
699 + },
700 + "fieldConfig": {
701 + "defaults": {
702 + "color": {
703 + "mode": "thresholds"
704 + },
705 + "custom": {
706 + "align": "auto",
707 + "displayMode": "auto",
708 + "inspect": false
709 + },
710 + "mappings": [],
711 + "thresholds": {
712 + "mode": "absolute",
713 + "steps": [
714 + {
715 + "color": "orange",
716 + "value": null
717 + }
718 + ]
719 + }
720 + },
721 + "overrides": [
722 + {
723 + "matcher": {
724 + "id": "byName",
725 + "options": "Count"
726 + },
727 + "properties": [
728 + {
729 + "id": "displayName",
730 + "value": "EVENTS"
731 + },
732 + {
733 + "id": "unit",
734 + "value": "short"
735 + },
736 + {
737 + "id": "decimals",
738 + "value": -1
739 + },
740 + {
741 + "id": "custom.align"
742 + },
743 + {
744 + "id": "custom.displayMode",
745 + "value": "color-text"
746 + }
747 + ]
748 + },
749 + {
750 + "matcher": {
751 + "id": "byName",
752 + "options": "AD ACCOUNT"
753 + },
754 + "properties": [
755 + {
756 + "id": "custom.width",
757 + "value": 377
758 + },
759 + {
760 + "id": "custom.displayMode",
761 + "value": "color-text"
762 + }
763 + ]
764 + },
765 + {
766 + "matcher": {
767 + "id": "byName",
768 + "options": "data_office365_LogonError"
769 + },
770 + "properties": [
771 + {
772 + "id": "custom.width",
773 + "value": 326
774 + },
775 + {
776 + "id": "custom.displayMode",
777 + "value": "color-text"
778 + }
779 + ]
780 + }
781 + ]
782 + },
783 + "gridPos": {
784 + "h": 12,
785 + "w": 10,
786 + "x": 0,
787 + "y": 20
788 + },
789 + "id": 58,
790 + "options": {
791 + "footer": {
792 + "fields": "",
793 + "reducer": [
794 + "sum"
795 + ],
796 + "show": false
797 + },
798 + "showHeader": true,
799 + "sortBy": []
800 + },
801 + "pluginVersion": "9.2.0",
802 + "targets": [
803 + {
804 + "bucketAggs": [
805 + {
806 + "fake": true,
807 + "field": "data_office365_UserId",
808 + "id": "4",
809 + "settings": {
810 + "min_doc_count": 1,
811 + "order": "desc",
812 + "orderBy": "_count",
813 + "size": "0"
814 + },
815 + "type": "terms"
816 + }
817 + ],
818 + "datasource": {
819 + "type": "elasticsearch",
820 + "uid": "replace_datasource_uid"
821 + },
822 + "metrics": [
823 + {
824 + "field": "select field",
825 + "id": "1",
826 + "type": "count"
827 + }
828 + ],
829 + "query": "(data_office365_Operation:DLPRuleMatch OR data_office365_Operation:DlpRuleMatch) AND data_office365_Workload:$workload",
830 + "refId": "A",
831 + "timeField": "timestamp"
832 + }
833 + ],
834 + "title": "DLP DETECTIONS BY USER ACCOUNT",
835 + "transformations": [
836 + {
837 + "id": "merge",
838 + "options": {
839 + "reducers": []
840 + }
841 + },
842 + {
843 + "id": "organize",
844 + "options": {
845 + "excludeByName": {},
846 + "indexByName": {},
847 + "renameByName": {
848 + "Count": "EVENTS",
849 + "data_office365_LogonError": "ERROR",
850 + "data_office365_Operation": "WORKLOAD",
851 + "data_office365_UserId": "AD ACCOUNT"
852 + }
853 + }
854 + }
855 + ],
856 + "type": "table"
857 + },
858 + {
859 + "datasource": {
860 + "type": "elasticsearch",
861 + "uid": "replace_datasource_uid"
862 + },
863 + "fieldConfig": {
864 + "defaults": {
865 + "color": {
866 + "mode": "thresholds"
867 + },
868 + "mappings": [],
869 + "thresholds": {
870 + "mode": "absolute",
871 + "steps": [
872 + {
873 + "color": "green",
874 + "value": null
875 + },
876 + {
877 + "color": "red",
878 + "value": 80
879 + }
880 + ]
881 + }
882 + },
883 + "overrides": []
884 + },
885 + "gridPos": {
886 + "h": 12,
887 + "w": 14,
888 + "x": 10,
889 + "y": 20
890 + },
891 + "id": 57,
892 + "options": {
893 + "displayMode": "gradient",
894 + "minVizHeight": 10,
895 + "minVizWidth": 0,
896 + "orientation": "horizontal",
897 + "reduceOptions": {
898 + "calcs": [
899 + "sum"
900 + ],
901 + "fields": "",
902 + "values": false
903 + },
904 + "showUnfilled": true
905 + },
906 + "pluginVersion": "9.2.0",
907 + "targets": [
908 + {
909 + "alias": "",
910 + "bucketAggs": [
911 + {
912 + "field": "data_office365_SharePointMetaData_FileName",
913 + "id": "2",
914 + "settings": {
915 + "min_doc_count": "1",
916 + "order": "desc",
917 + "orderBy": "_count",
918 + "size": "15"
919 + },
920 + "type": "terms"
921 + },
922 + {
923 + "field": "timestamp",
924 + "id": "3",
925 + "settings": {
926 + "interval": "auto",
927 + "min_doc_count": "1",
928 + "timeZone": "utc",
929 + "trimEdges": "0"
930 + },
931 + "type": "date_histogram"
932 + }
933 + ],
934 + "datasource": {
935 + "type": "elasticsearch",
936 + "uid": "replace_datasource_uid"
937 + },
938 + "metrics": [
939 + {
940 + "id": "1",
941 + "type": "count"
942 + }
943 + ],
944 + "query": "data_office365_Workload:$workload",
945 + "refId": "A",
946 + "timeField": "timestamp"
947 + }
948 + ],
949 + "title": "DLP - FILENAMES (Sharepoint/OneDrive)",
950 + "type": "bargauge"
951 + },
952 + {
953 + "datasource": {
954 + "type": "elasticsearch",
955 + "uid": "replace_datasource_uid"
956 + },
957 + "fieldConfig": {
958 + "defaults": {
959 + "color": {
960 + "mode": "thresholds"
961 + },
962 + "mappings": [],
963 + "thresholds": {
964 + "mode": "absolute",
965 + "steps": [
966 + {
967 + "color": "green",
968 + "value": null
969 + },
970 + {
971 + "color": "red",
972 + "value": 80
973 + }
974 + ]
975 + }
976 + },
977 + "overrides": []
978 + },
979 + "gridPos": {
980 + "h": 12,
981 + "w": 14,
982 + "x": 0,
983 + "y": 32
984 + },
985 + "id": 59,
986 + "options": {
987 + "displayMode": "gradient",
988 + "minVizHeight": 10,
989 + "minVizWidth": 0,
990 + "orientation": "horizontal",
991 + "reduceOptions": {
992 + "calcs": [
993 + "sum"
994 + ],
995 + "fields": "",
996 + "values": false
997 + },
998 + "showUnfilled": true
999 + },
1000 + "pluginVersion": "9.2.0",
1001 + "targets": [
1002 + {
1003 + "alias": "",
1004 + "bucketAggs": [
1005 + {
1006 + "field": "data_office365_ExchangeMetaData_Subject",
1007 + "id": "2",
1008 + "settings": {
1009 + "min_doc_count": "1",
1010 + "order": "desc",
1011 + "orderBy": "_count",
1012 + "size": "15"
1013 + },
1014 + "type": "terms"
1015 + },
1016 + {
1017 + "field": "timestamp",
1018 + "id": "3",
1019 + "settings": {
1020 + "interval": "auto",
1021 + "min_doc_count": "1",
1022 + "timeZone": "utc",
1023 + "trimEdges": "0"
1024 + },
1025 + "type": "date_histogram"
1026 + }
1027 + ],
1028 + "datasource": {
1029 + "type": "elasticsearch",
1030 + "uid": "replace_datasource_uid"
1031 + },
1032 + "metrics": [
1033 + {
1034 + "id": "1",
1035 + "type": "count"
1036 + }
1037 + ],
1038 + "query": "data_office365_Workload:$workload",
1039 + "refId": "A",
1040 + "timeField": "timestamp"
1041 + }
1042 + ],
1043 + "title": "DLP - MAIL SUBJECTS (Exchange)",
1044 + "type": "bargauge"
1045 + },
1046 + {
1047 + "datasource": {
1048 + "type": "elasticsearch",
1049 + "uid": "replace_datasource_uid"
1050 + },
1051 + "fieldConfig": {
1052 + "defaults": {
1053 + "color": {
1054 + "mode": "thresholds"
1055 + },
1056 + "custom": {
1057 + "align": "auto",
1058 + "displayMode": "auto",
1059 + "filterable": true,
1060 + "inspect": false
1061 + },
1062 + "mappings": [],
1063 + "thresholds": {
1064 + "mode": "absolute",
1065 + "steps": [
1066 + {
1067 + "color": "green"
1068 + },
1069 + {
1070 + "color": "red",
1071 + "value": 80
1072 + }
1073 + ]
1074 + }
1075 + },
1076 + "overrides": [
1077 + {
1078 + "matcher": {
1079 + "id": "byName",
1080 + "options": "rule_level"
1081 + },
1082 + "properties": [
1083 + {
1084 + "id": "displayName",
1085 + "value": "RULE LEVEL"
1086 + },
1087 + {
1088 + "id": "unit",
1089 + "value": "short"
1090 + },
1091 + {
1092 + "id": "decimals",
1093 + "value": -1
1094 + },
1095 + {
1096 + "id": "custom.displayMode",
1097 + "value": "color-background"
1098 + },
1099 + {
1100 + "id": "custom.align"
1101 + },
1102 + {
1103 + "id": "thresholds",
1104 + "value": {
1105 + "mode": "absolute",
1106 + "steps": [
1107 + {
1108 + "color": "#37872D"
1109 + },
1110 + {
1111 + "color": "rgba(237, 129, 40, 0.89)",
1112 + "value": 7
1113 + },
1114 + {
1115 + "color": "rgba(245, 54, 54, 0.9)",
1116 + "value": 12
1117 + }
1118 + ]
1119 + }
1120 + }
1121 + ]
1122 + },
1123 + {
1124 + "matcher": {
1125 + "id": "byName",
1126 + "options": "Date/Time"
1127 + },
1128 + "properties": [
1129 + {
1130 + "id": "custom.width",
1131 + "value": 242
1132 + }
1133 + ]
1134 + },
1135 + {
1136 + "matcher": {
1137 + "id": "byName",
1138 + "options": "MITRE TACTIC"
1139 + },
1140 + "properties": [
1141 + {
1142 + "id": "custom.width",
1143 + "value": 332
1144 + }
1145 + ]
1146 + },
1147 + {
1148 + "matcher": {
1149 + "id": "byName",
1150 + "options": "MITRE TECHNIQUE"
1151 + },
1152 + "properties": [
1153 + {
1154 + "id": "custom.width",
1155 + "value": 312
1156 + }
1157 + ]
1158 + },
1159 + {
1160 + "matcher": {
1161 + "id": "byName",
1162 + "options": "EVENT ID"
1163 + },
1164 + "properties": [
1165 + {
1166 + "id": "links",
1167 + "value": [
1168 + {
1169 + "targetBlank": true,
1170 + "title": "VIEW EVENT DETAILS",
1171 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1172 + }
1173 + ]
1174 + },
1175 + {
1176 + "id": "custom.width",
1177 + "value": 319
1178 + }
1179 + ]
1180 + },
1181 + {
1182 + "matcher": {
1183 + "id": "byName",
1184 + "options": "ACCOUNT"
1185 + },
1186 + "properties": [
1187 + {
1188 + "id": "custom.width",
1189 + "value": 343
1190 + }
1191 + ]
1192 + },
1193 + {
1194 + "matcher": {
1195 + "id": "byName",
1196 + "options": "EVENT TIME"
1197 + },
1198 + "properties": [
1199 + {
1200 + "id": "custom.width",
1201 + "value": 195
1202 + }
1203 + ]
1204 + },
1205 + {
1206 + "matcher": {
1207 + "id": "byName",
1208 + "options": "FILE SIZE"
1209 + },
1210 + "properties": [
1211 + {
1212 + "id": "unit",
1213 + "value": "bytes"
1214 + }
1215 + ]
1216 + },
1217 + {
1218 + "matcher": {
1219 + "id": "byName",
1220 + "options": "SENSITIVE INFO"
1221 + },
1222 + "properties": [
1223 + {
1224 + "id": "custom.width",
1225 + "value": 154
1226 + }
1227 + ]
1228 + },
1229 + {
1230 + "matcher": {
1231 + "id": "byName",
1232 + "options": "RULE LEVEL"
1233 + },
1234 + "properties": [
1235 + {
1236 + "id": "custom.width",
1237 + "value": 157
1238 + }
1239 + ]
1240 + }
1241 + ]
1242 + },
1243 + "gridPos": {
1244 + "h": 16,
1245 + "w": 24,
1246 + "x": 0,
1247 + "y": 44
1248 + },
1249 + "id": 27,
1250 + "options": {
1251 + "footer": {
1252 + "fields": "",
1253 + "reducer": [
1254 + "sum"
1255 + ],
1256 + "show": false
1257 + },
1258 + "showHeader": true,
1259 + "sortBy": []
1260 + },
1261 + "pluginVersion": "9.0.0",
1262 + "targets": [
1263 + {
1264 + "bucketAggs": [],
1265 + "datasource": {
1266 + "type": "elasticsearch",
1267 + "uid": "replace_datasource_uid"
1268 + },
1269 + "metrics": [
1270 + {
1271 + "id": "1",
1272 + "settings": {
1273 + "size": "250"
1274 + },
1275 + "type": "raw_data"
1276 + }
1277 + ],
1278 + "query": "(data_office365_Workload:$workload AND rule_level:$rule_level) AND data_office365_Workload:$workload",
1279 + "refId": "A",
1280 + "timeField": "timestamp"
1281 + }
1282 + ],
1283 + "title": "EVENTS",
1284 + "transformations": [
1285 + {
1286 + "id": "merge",
1287 + "options": {
1288 + "reducers": []
1289 + }
1290 + },
1291 + {
1292 + "id": "organize",
1293 + "options": {
1294 + "excludeByName": {
1295 + "@metadata_beat": true,
1296 + "@metadata_type": true,
1297 + "@metadata_version": true,
1298 + "IMPHASH": true,
1299 + "MD5": true,
1300 + "SHA1": true,
1301 + "SHA256": true,
1302 + "_id": false,
1303 + "_index": true,
1304 + "_type": true,
1305 + "agent_ephemeral_id": true,
1306 + "agent_hostname": true,
1307 + "agent_id": true,
1308 + "agent_ip_city_name": true,
1309 + "agent_ip_country_code": true,
1310 + "agent_ip_geolocation": true,
1311 + "agent_name": true,
1312 + "agent_type": true,
1313 + "agent_version": true,
1314 + "beats_type": true,
1315 + "cluster_name": true,
1316 + "cluster_node": true,
1317 + "collector_node_id": true,
1318 + "data_alert_action": true,
1319 + "data_alert_category": true,
1320 + "data_alert_gid": true,
1321 + "data_alert_rev": true,
1322 + "data_alert_severity": true,
1323 + "data_alert_signature": true,
1324 + "data_alert_signature_id": true,
1325 + "data_app_proto": true,
1326 + "data_audit_auid": true,
1327 + "data_audit_command": true,
1328 + "data_audit_euid": true,
1329 + "data_audit_exe": true,
1330 + "data_audit_gid": true,
1331 + "data_audit_id": true,
1332 + "data_audit_pid": true,
1333 + "data_audit_res": true,
1334 + "data_audit_session": true,
1335 + "data_audit_type": true,
1336 + "data_audit_uid": true,
1337 + "data_dest_ip": true,
1338 + "data_dest_port": true,
1339 + "data_dstuser": true,
1340 + "data_event_type": true,
1341 + "data_extra_data": true,
1342 + "data_file": true,
1343 + "data_flow_bytes_toclient": true,
1344 + "data_flow_bytes_toserver": true,
1345 + "data_flow_id": true,
1346 + "data_flow_pkts_toclient": true,
1347 + "data_flow_pkts_toserver": true,
1348 + "data_flow_start": true,
1349 + "data_http_http_content_type": true,
1350 + "data_http_http_port": true,
1351 + "data_http_length": true,
1352 + "data_http_status": true,
1353 + "data_http_url": true,
1354 + "data_id": true,
1355 + "data_in_iface": true,
1356 + "data_metadata_flowbits": true,
1357 + "data_metadata_flowints_http_anomaly_count": true,
1358 + "data_metadata_flowints_tcp_retransmission_count": true,
1359 + "data_office365_Actor": true,
1360 + "data_office365_ActorContextId": true,
1361 + "data_office365_ActorIpAddress": false,
1362 + "data_office365_ActorIpAddress_city_name": true,
1363 + "data_office365_ActorIpAddress_country_code": true,
1364 + "data_office365_ActorIpAddress_geolocation": true,
1365 + "data_office365_ApplicationId": true,
1366 + "data_office365_AzureActiveDirectoryEventType": true,
1367 + "data_office365_ClientIP": true,
1368 + "data_office365_ClientIP_city_name": true,
1369 + "data_office365_ClientIP_country_code": true,
1370 + "data_office365_ClientIP_geolocation": true,
1371 + "data_office365_CreationTime": false,
1372 + "data_office365_DeviceProperties": true,
1373 + "data_office365_ErrorNumber": true,
1374 + "data_office365_ExceptionInfo_Reason": true,
1375 + "data_office365_ExchangeMetaData_BCC": true,
1376 + "data_office365_ExchangeMetaData_CC": true,
1377 + "data_office365_ExchangeMetaData_FileSize": true,
1378 + "data_office365_ExchangeMetaData_From": true,
1379 + "data_office365_ExchangeMetaData_MessageID": true,
1380 + "data_office365_ExchangeMetaData_RecipientCount": true,
1381 + "data_office365_ExchangeMetaData_Sent": true,
1382 + "data_office365_ExchangeMetaData_Subject": true,
1383 + "data_office365_ExchangeMetaData_To": true,
1384 + "data_office365_ExchangeMetaData_UniqueID": true,
1385 + "data_office365_ExtendedProperties": true,
1386 + "data_office365_Id": true,
1387 + "data_office365_IncidentId": true,
1388 + "data_office365_InterSystemsId": true,
1389 + "data_office365_IntraSystemId": true,
1390 + "data_office365_LogonError": true,
1391 + "data_office365_ModifiedProperties": true,
1392 + "data_office365_ObjectId": true,
1393 + "data_office365_Operation": true,
1394 + "data_office365_OrganizationId": true,
1395 + "data_office365_PolicyDetails": true,
1396 + "data_office365_RecordType": true,
1397 + "data_office365_ResultStatus": false,
1398 + "data_office365_SensitiveInfoDetectionIsIncluded": true,
1399 + "data_office365_SharePointMetaData_FileID": true,
1400 + "data_office365_SharePointMetaData_FileName": false,
1401 + "data_office365_SharePointMetaData_FileOwner": true,
1402 + "data_office365_SharePointMetaData_FilePathUrl": true,
1403 + "data_office365_SharePointMetaData_FileSize": true,
1404 + "data_office365_SharePointMetaData_From": true,
1405 + "data_office365_SharePointMetaData_IsViewableByExternalUsers": true,
1406 + "data_office365_SharePointMetaData_IsVisibleOnlyToOdbOwner": true,
1407 + "data_office365_SharePointMetaData_ItemCreationTime": true,
1408 + "data_office365_SharePointMetaData_ItemLastModifiedTime": true,
1409 + "data_office365_SharePointMetaData_ItemLastSharedTime": true,
1410 + "data_office365_SharePointMetaData_SiteCollectionGuid": true,
1411 + "data_office365_SharePointMetaData_SiteCollectionUrl": true,
1412 + "data_office365_SharePointMetaData_UniqueID": true,
1413 + "data_office365_Target": true,
1414 + "data_office365_TargetContextId": true,
1415 + "data_office365_UserId": false,
1416 + "data_office365_UserKey": true,
1417 + "data_office365_UserType": true,
1418 + "data_office365_Version": true,
1419 + "data_office365_Workload": true,
1420 + "data_osquery_action": true,
1421 + "data_osquery_calendarTime": true,
1422 + "data_osquery_columns_address": true,
1423 + "data_osquery_columns_address_city_name": true,
1424 + "data_osquery_columns_address_country_code": true,
1425 + "data_osquery_columns_address_geolocation": true,
1426 + "data_osquery_columns_cmdline": true,
1427 + "data_osquery_columns_cwd": true,
1428 + "data_osquery_columns_description": true,
1429 + "data_osquery_columns_directory": true,
1430 + "data_osquery_columns_disk_bytes_read": true,
1431 + "data_osquery_columns_disk_bytes_written": true,
1432 + "data_osquery_columns_egid": true,
1433 + "data_osquery_columns_euid": true,
1434 + "data_osquery_columns_family": true,
1435 + "data_osquery_columns_fd": true,
1436 + "data_osquery_columns_gid": true,
1437 + "data_osquery_columns_gid_signed": true,
1438 + "data_osquery_columns_host": true,
1439 + "data_osquery_columns_interface": true,
1440 + "data_osquery_columns_local_address": true,
1441 + "data_osquery_columns_local_address_city_name": true,
1442 + "data_osquery_columns_local_address_country_code": true,
1443 + "data_osquery_columns_local_address_geolocation": true,
1444 + "data_osquery_columns_local_port": true,
1445 + "data_osquery_columns_mac": true,
1446 + "data_osquery_columns_name": true,
1447 + "data_osquery_columns_net_namespace": true,
1448 + "data_osquery_columns_nice": true,
1449 + "data_osquery_columns_on_disk": true,
1450 + "data_osquery_columns_parent": true,
1451 + "data_osquery_columns_path": true,
1452 + "data_osquery_columns_pgroup": true,
1453 + "data_osquery_columns_pid": true,
1454 + "data_osquery_columns_port": true,
1455 + "data_osquery_columns_protocol": true,
1456 + "data_osquery_columns_remote_address": true,
1457 + "data_osquery_columns_remote_address_city_name": true,
1458 + "data_osquery_columns_remote_address_country_code": true,
1459 + "data_osquery_columns_remote_address_geolocation": true,
1460 + "data_osquery_columns_remote_port": true,
1461 + "data_osquery_columns_resident_size": true,
1462 + "data_osquery_columns_root": true,
1463 + "data_osquery_columns_sgid": true,
1464 + "data_osquery_columns_shell": true,
1465 + "data_osquery_columns_socket": true,
1466 + "data_osquery_columns_start_time": true,
1467 + "data_osquery_columns_state": true,
1468 + "data_osquery_columns_suid": true,
1469 + "data_osquery_columns_system_time": true,
1470 + "data_osquery_columns_threads": true,
1471 + "data_osquery_columns_time_utc": true,
1472 + "data_osquery_columns_total_size": true,
1473 + "data_osquery_columns_tty": true,
1474 + "data_osquery_columns_type": true,
1475 + "data_osquery_columns_uid": true,
1476 + "data_osquery_columns_uid_signed": true,
1477 + "data_osquery_columns_user": true,
1478 + "data_osquery_columns_user_time": true,
1479 + "data_osquery_columns_username": true,
1480 + "data_osquery_columns_wired_size": true,
1481 + "data_osquery_counter": true,
1482 + "data_osquery_decorations_host_uuid": true,
1483 + "data_osquery_decorations_hostname": true,
1484 + "data_osquery_epoch": true,
1485 + "data_osquery_hostIdentifier": true,
1486 + "data_osquery_name": true,
1487 + "data_osquery_numerics": true,
1488 + "data_osquery_unixTime": true,
1489 + "data_proto": true,
1490 + "data_sca_check_command": true,
1491 + "data_sca_check_compliance_cis": true,
1492 + "data_sca_check_compliance_cis_csc": true,
1493 + "data_sca_check_compliance_gdpr_IV": true,
1494 + "data_sca_check_compliance_gpg_13": true,
1495 + "data_sca_check_compliance_hipaa": true,
1496 + "data_sca_check_compliance_nist_800_53": true,
1497 + "data_sca_check_compliance_pci_dss": true,
1498 + "data_sca_check_compliance_tsc": true,
1499 + "data_sca_check_description": true,
1500 + "data_sca_check_id": true,
1501 + "data_sca_check_previous_result": true,
1502 + "data_sca_check_rationale": true,
1503 + "data_sca_check_remediation": true,
1504 + "data_sca_check_result": true,
1505 + "data_sca_check_title": true,
1506 + "data_sca_description": true,
1507 + "data_sca_failed": true,
1508 + "data_sca_file": true,
1509 + "data_sca_invalid": true,
1510 + "data_sca_passed": true,
1511 + "data_sca_policy": true,
1512 + "data_sca_policy_id": true,
1513 + "data_sca_scan_id": true,
1514 + "data_sca_score": true,
1515 + "data_sca_total_checks": true,
1516 + "data_sca_type": true,
1517 + "data_script": true,
1518 + "data_src_ip": true,
1519 + "data_src_ip_city_name": true,
1520 + "data_src_ip_country_code": true,
1521 + "data_src_ip_geolocation": true,
1522 + "data_src_port": true,
1523 + "data_srcip": true,
1524 + "data_srcip_city_name": true,
1525 + "data_srcip_country_code": true,
1526 + "data_srcip_geolocation": true,
1527 + "data_srcuser": true,
1528 + "data_timestamp": true,
1529 + "data_title": true,
1530 + "data_tls_session_resumed": true,
1531 + "data_tls_version": true,
1532 + "data_tx_id": true,
1533 + "data_type": true,
1534 + "data_win_eventXML_binaryData": true,
1535 + "data_win_eventXML_binaryDataSize": true,
1536 + "data_win_eventXML_param1": true,
1537 + "data_win_eventdata_authenticationPackageName": true,
1538 + "data_win_eventdata_callTrace": true,
1539 + "data_win_eventdata_commandLine": true,
1540 + "data_win_eventdata_company": true,
1541 + "data_win_eventdata_creationUtcTime": true,
1542 + "data_win_eventdata_currentDirectory": true,
1543 + "data_win_eventdata_description": true,
1544 + "data_win_eventdata_destinationHostname": true,
1545 + "data_win_eventdata_destinationIp": true,
1546 + "data_win_eventdata_destinationIp_city_name": true,
1547 + "data_win_eventdata_destinationIp_country_code": true,
1548 + "data_win_eventdata_destinationIp_geolocation": true,
1549 + "data_win_eventdata_destinationIsIpv6": true,
1550 + "data_win_eventdata_destinationPort": true,
1551 + "data_win_eventdata_destinationPortName": true,
1552 + "data_win_eventdata_details": true,
1553 + "data_win_eventdata_elevatedToken": true,
1554 + "data_win_eventdata_eventType": true,
1555 + "data_win_eventdata_fileVersion": true,
1556 + "data_win_eventdata_fileVersion_city_name": true,
1557 + "data_win_eventdata_fileVersion_country_code": true,
1558 + "data_win_eventdata_fileVersion_geolocation": true,
1559 + "data_win_eventdata_grantedAccess": true,
1560 + "data_win_eventdata_hashes": true,
1561 + "data_win_eventdata_image": true,
1562 + "data_win_eventdata_imageLoaded": true,
1563 + "data_win_eventdata_impersonationLevel": true,
1564 + "data_win_eventdata_initiated": true,
1565 + "data_win_eventdata_integrityLevel": true,
1566 + "data_win_eventdata_ipAddress": true,
1567 + "data_win_eventdata_ipPort": true,
1568 + "data_win_eventdata_keyLength": true,
1569 + "data_win_eventdata_logonGuid": true,
1570 + "data_win_eventdata_logonId": true,
1571 + "data_win_eventdata_logonProcessName": true,
1572 + "data_win_eventdata_logonType": true,
1573 + "data_win_eventdata_originalFileName": true,
1574 + "data_win_eventdata_param1": true,
1575 + "data_win_eventdata_param2": true,
1576 + "data_win_eventdata_param3": true,
1577 + "data_win_eventdata_param4": true,
1578 + "data_win_eventdata_parentCommandLine": true,
1579 + "data_win_eventdata_parentImage": true,
1580 + "data_win_eventdata_parentProcessGuid": true,
1581 + "data_win_eventdata_parentProcessId": true,
1582 + "data_win_eventdata_processGuid": true,
1583 + "data_win_eventdata_processId": true,
1584 + "data_win_eventdata_processName": true,
1585 + "data_win_eventdata_product": true,
1586 + "data_win_eventdata_protocol": true,
1587 + "data_win_eventdata_queryName": true,
1588 + "data_win_eventdata_queryResults": true,
1589 + "data_win_eventdata_queryStatus": true,
1590 + "data_win_eventdata_ruleName": true,
1591 + "data_win_eventdata_serviceName": true,
1592 + "data_win_eventdata_serviceSid": true,
1593 + "data_win_eventdata_signature": true,
1594 + "data_win_eventdata_signatureStatus": true,
1595 + "data_win_eventdata_signed": true,
1596 + "data_win_eventdata_sourceHostname": true,
1597 + "data_win_eventdata_sourceImage": true,
1598 + "data_win_eventdata_sourceIp": true,
1599 + "data_win_eventdata_sourceIp_city_name": true,
1600 + "data_win_eventdata_sourceIp_country_code": true,
1601 + "data_win_eventdata_sourceIp_geolocation": true,
1602 + "data_win_eventdata_sourceIsIpv6": true,
1603 + "data_win_eventdata_sourcePort": true,
1604 + "data_win_eventdata_sourceProcessGUID": true,
1605 + "data_win_eventdata_sourceProcessId": true,
1606 + "data_win_eventdata_sourceThreadId": true,
1607 + "data_win_eventdata_status": true,
1608 + "data_win_eventdata_subjectDomainName": true,
1609 + "data_win_eventdata_subjectLogonId": true,
1610 + "data_win_eventdata_subjectUserName": true,
1611 + "data_win_eventdata_subjectUserSid": true,
1612 + "data_win_eventdata_targetDomainName": true,
1613 + "data_win_eventdata_targetFilename": true,
1614 + "data_win_eventdata_targetImage": true,
1615 + "data_win_eventdata_targetLinkedLogonId": true,
1616 + "data_win_eventdata_targetLogonId": true,
1617 + "data_win_eventdata_targetObject": true,
1618 + "data_win_eventdata_targetProcessGUID": true,
1619 + "data_win_eventdata_targetProcessId": true,
1620 + "data_win_eventdata_targetUserName": true,
1621 + "data_win_eventdata_targetUserSid": true,
1622 + "data_win_eventdata_terminalSessionId": true,
1623 + "data_win_eventdata_ticketEncryptionType": true,
1624 + "data_win_eventdata_ticketOptions": true,
1625 + "data_win_eventdata_user": true,
1626 + "data_win_eventdata_utcTime": true,
1627 + "data_win_eventdata_virtualAccount": true,
1628 + "data_win_system_channel": true,
1629 + "data_win_system_computer": true,
1630 + "data_win_system_eventID": true,
1631 + "data_win_system_eventRecordID": true,
1632 + "data_win_system_eventSourceName": true,
1633 + "data_win_system_keywords": true,
1634 + "data_win_system_level": true,
1635 + "data_win_system_message": true,
1636 + "data_win_system_opcode": true,
1637 + "data_win_system_processID": true,
1638 + "data_win_system_providerGuid": true,
1639 + "data_win_system_providerName": true,
1640 + "data_win_system_severityValue": true,
1641 + "data_win_system_systemTime": true,
1642 + "data_win_system_task": true,
1643 + "data_win_system_threadID": true,
1644 + "data_win_system_version": true,
1645 + "decoder_name": true,
1646 + "decoder_parent": true,
1647 + "dns_query": true,
1648 + "dns_query_threat_indicated": true,
1649 + "dst_ip": true,
1650 + "dst_ip_city_name": true,
1651 + "dst_ip_country_code": true,
1652 + "dst_ip_geolocation": true,
1653 + "dst_ip_threat_indicated": true,
1654 + "dst_port": true,
1655 + "ecs_version": true,
1656 + "error": true,
1657 + "event_hash": true,
1658 + "file_path": true,
1659 + "firewall_rule_name": true,
1660 + "full_log": false,
1661 + "gl2_accounted_message_size": true,
1662 + "gl2_message_id": true,
1663 + "gl2_processing_error": true,
1664 + "gl2_remote_ip": true,
1665 + "gl2_remote_port": true,
1666 + "gl2_source_collector": true,
1667 + "gl2_source_input": true,
1668 + "gl2_source_node": true,
1669 + "hash_md5": true,
1670 + "hash_sha1": true,
1671 + "hash_sha256": true,
1672 + "highlight": true,
1673 + "host_architecture": true,
1674 + "host_containerized": true,
1675 + "host_hostname": true,
1676 + "host_id": true,
1677 + "host_ip": true,
1678 + "host_mac": true,
1679 + "host_name": true,
1680 + "host_os_codename": true,
1681 + "host_os_kernel": true,
1682 + "host_os_name": true,
1683 + "host_os_platform": true,
1684 + "host_os_version": true,
1685 + "hostname": true,
1686 + "id": true,
1687 + "input_type": true,
1688 + "level": true,
1689 + "location": true,
1690 + "log_file_path": true,
1691 + "log_offset": true,
1692 + "manager_name": true,
1693 + "message": true,
1694 + "module": true,
1695 + "parent_process_cmd_line": true,
1696 + "parent_process_id": true,
1697 + "parent_process_image": true,
1698 + "pid": true,
1699 + "predecoder_hostname": true,
1700 + "predecoder_program_name": true,
1701 + "predecoder_timestamp": true,
1702 + "previous_log": true,
1703 + "previous_output": true,
1704 + "process_cmd_line": true,
1705 + "process_id": true,
1706 + "process_image": true,
1707 + "process_name": true,
1708 + "protocol": true,
1709 + "rule_cis": true,
1710 + "rule_cis_csc": true,
1711 + "rule_firedtimes": true,
1712 + "rule_gdpr": true,
1713 + "rule_gdpr_IV": true,
1714 + "rule_gpg13": true,
1715 + "rule_gpg_13": true,
1716 + "rule_group1": true,
1717 + "rule_groups": true,
1718 + "rule_hipaa": true,
1719 + "rule_id": true,
1720 + "rule_info": true,
1721 + "rule_mail": true,
1722 + "rule_mitre_id": true,
1723 + "rule_mitre_tactic": false,
1724 + "rule_nist_800_53": true,
1725 + "rule_pci_dss": true,
1726 + "rule_tsc": true,
1727 + "scanid": true,
1728 + "service": true,
1729 + "software_package": true,
1730 + "software_vendor": true,
1731 + "sort": true,
1732 + "source": true,
1733 + "src_ip": true,
1734 + "src_ip_city_name": true,
1735 + "src_ip_country_code": true,
1736 + "src_ip_geolocation": true,
1737 + "src_port": true,
1738 + "streams": true,
1739 + "syscheck_attrs_after": true,
1740 + "syscheck_audit_effective_user_id": true,
1741 + "syscheck_audit_effective_user_name": true,
1742 + "syscheck_audit_group_id": true,
1743 + "syscheck_audit_group_name": true,
1744 + "syscheck_audit_login_user_id": true,
1745 + "syscheck_audit_login_user_name": true,
1746 + "syscheck_audit_process_cwd": true,
1747 + "syscheck_audit_process_id": true,
1748 + "syscheck_audit_process_name": true,
1749 + "syscheck_audit_process_parent_cwd": true,
1750 + "syscheck_audit_process_parent_name": true,
1751 + "syscheck_audit_process_ppid": true,
1752 + "syscheck_audit_user_id": true,
1753 + "syscheck_audit_user_name": true,
1754 + "syscheck_changed_attributes": true,
1755 + "syscheck_event": true,
1756 + "syscheck_gid_after": true,
1757 + "syscheck_gname_after": true,
1758 + "syscheck_hard_links": true,
1759 + "syscheck_inode_after": true,
1760 + "syscheck_inode_before": true,
1761 + "syscheck_md5_after": true,
1762 + "syscheck_md5_before": true,
1763 + "syscheck_mode": true,
1764 + "syscheck_mtime_after": true,
1765 + "syscheck_mtime_before": true,
1766 + "syscheck_path": true,
1767 + "syscheck_perm_after": true,
1768 + "syscheck_perm_before": true,
1769 + "syscheck_sha1_after": true,
1770 + "syscheck_sha1_before": true,
1771 + "syscheck_sha256_after": true,
1772 + "syscheck_sha256_before": true,
1773 + "syscheck_size_after": true,
1774 + "syscheck_size_before": true,
1775 + "syscheck_uid_after": true,
1776 + "syscheck_uname_after": true,
1777 + "syscheck_win_perm_after": true,
1778 + "syscheck_win_perm_after_0_allowed": true,
1779 + "syscheck_win_perm_after_0_name": true,
1780 + "syscheck_win_perm_after_1_allowed": true,
1781 + "syscheck_win_perm_after_1_name": true,
1782 + "syscheck_win_perm_after_2_allowed": true,
1783 + "syscheck_win_perm_after_2_name": true,
1784 + "syscheck_win_perm_after_3_allowed": true,
1785 + "syscheck_win_perm_after_3_name": true,
1786 + "syslog_customer": true,
1787 + "syslog_level": true,
1788 + "syslog_tag": true,
1789 + "syslog_type": true,
1790 + "sysmon_event_description": true,
1791 + "threat_ids": true,
1792 + "threat_indicated": true,
1793 + "threat_names": true,
1794 + "time": true,
1795 + "timestamp": true,
1796 + "true": true,
1797 + "user_name": true,
1798 + "win_registry_key": true,
1799 + "win_system_eventID": true,
1800 + "windows_auth_package": true,
1801 + "windows_domain": true,
1802 + "windows_event_id": true,
1803 + "windows_event_severity": true,
1804 + "windows_logon_type": true
1805 + },
1806 + "indexByName": {
1807 + "_id": 2,
1808 + "_index": 8,
1809 + "_type": 9,
1810 + "agent_id": 10,
1811 + "agent_name": 4,
1812 + "cluster_name": 11,
1813 + "cluster_node": 12,
1814 + "data_office365_CreationTime": 0,
1815 + "data_office365_ExchangeMetaData_CC": 45,
1816 + "data_office365_ExchangeMetaData_FileSize": 47,
1817 + "data_office365_ExchangeMetaData_From": 48,
1818 + "data_office365_ExchangeMetaData_MessageID": 49,
1819 + "data_office365_ExchangeMetaData_RecipientCount": 51,
1820 + "data_office365_ExchangeMetaData_Sent": 52,
1821 + "data_office365_ExchangeMetaData_Subject": 50,
1822 + "data_office365_ExchangeMetaData_To": 53,
1823 + "data_office365_ExchangeMetaData_UniqueID": 54,
1824 + "data_office365_Id": 13,
1825 + "data_office365_IncidentId": 55,
1826 + "data_office365_ObjectId": 14,
1827 + "data_office365_Operation": 20,
1828 + "data_office365_OrganizationId": 15,
1829 + "data_office365_RecordType": 16,
1830 + "data_office365_SensitiveInfoDetectionIsIncluded": 46,
1831 + "data_office365_UserId": 3,
1832 + "data_office365_UserKey": 17,
1833 + "data_office365_UserType": 18,
1834 + "data_office365_Version": 19,
1835 + "data_office365_Workload": 44,
1836 + "decoder_name": 21,
1837 + "gl2_accounted_message_size": 22,
1838 + "gl2_message_id": 23,
1839 + "gl2_processing_error": 24,
1840 + "gl2_remote_ip": 25,
1841 + "gl2_remote_port": 26,
1842 + "gl2_source_input": 27,
1843 + "gl2_source_node": 28,
1844 + "highlight": 29,
1845 + "id": 30,
1846 + "location": 31,
1847 + "manager_name": 32,
1848 + "message": 33,
1849 + "rule_description": 5,
1850 + "rule_firedtimes": 34,
1851 + "rule_group1": 35,
1852 + "rule_groups": 36,
1853 + "rule_id": 7,
1854 + "rule_level": 6,
1855 + "rule_mail": 37,
1856 + "sort": 38,
1857 + "source": 39,
1858 + "streams": 40,
1859 + "syslog_level": 41,
1860 + "syslog_type": 42,
1861 + "timestamp": 1,
1862 + "true": 43
1863 + },
1864 + "renameByName": {
1865 + "_id": "EVENT ID",
1866 + "agent_name": "",
1867 + "data_office365_ActorIpAddress": "SRC IP",
1868 + "data_office365_CreationTime": "EVENT TIME",
1869 + "data_office365_ExchangeMetaData_FileSize": "FILE SIZE",
1870 + "data_office365_ExchangeMetaData_RecipientCount": "RECIPIENTS",
1871 + "data_office365_ExchangeMetaData_Sent": "",
1872 + "data_office365_ExchangeMetaData_Subject": "MAIL SUBJECT",
1873 + "data_office365_ResultStatus": "RESULT",
1874 + "data_office365_SensitiveInfoDetectionIsIncluded": "SENSITIVE INFO",
1875 + "data_office365_SharePointMetaData_FileName": "FILE",
1876 + "data_office365_UserId": "ACCOUNT",
1877 + "rule_description": "DESCRIPTION",
1878 + "rule_id": "RULE ID",
1879 + "rule_level": "",
1880 + "rule_mitre_tactic": "MITRE TACTIC",
1881 + "rule_mitre_technique": "MITRE TECHNIQUE",
1882 + "timestamp": "Date/Time"
1883 + }
1884 + }
1885 + }
1886 + ],
1887 + "transparent": true,
1888 + "type": "table"
1889 + }
1890 + ],
1891 + "refresh": false,
1892 + "schemaVersion": 37,
1893 + "style": "dark",
1894 + "tags": [
1895 + "O365"
1896 + ],
1897 + "templating": {
1898 + "list": [
1899 + {
1900 + "datasource": {
1901 + "type": "elasticsearch",
1902 + "uid": "replace_datasource_uid"
1903 + },
1904 + "filters": [],
1905 + "hide": 0,
1906 + "label": "",
1907 + "name": "Filters",
1908 + "skipUrlSync": false,
1909 + "type": "adhoc"
1910 + },
1911 + {
1912 + "current": {
1913 + "selected": false,
1914 + "text": "All",
1915 + "value": "$__all"
1916 + },
1917 + "datasource": {
1918 + "type": "elasticsearch",
1919 + "uid": "replace_datasource_uid"
1920 + },
1921 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"data_office365_Operation:DLPRuleMatch OR data_office365_Operation:DlpRuleMatch\"}",
1922 + "hide": 0,
1923 + "includeAll": true,
1924 + "label": "Workload",
1925 + "multi": false,
1926 + "name": "workload",
1927 + "options": [],
1928 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"data_office365_Operation:DLPRuleMatch OR data_office365_Operation:DlpRuleMatch\"}",
1929 + "refresh": 2,
1930 + "regex": "",
1931 + "skipUrlSync": false,
1932 + "sort": 1,
1933 + "tagValuesQuery": "",
1934 + "tagsQuery": "",
1935 + "type": "query",
1936 + "useTags": false
1937 + },
1938 + {
1939 + "current": {
1940 + "selected": false,
1941 + "text": "All",
1942 + "value": "$__all"
1943 + },
1944 + "datasource": {
1945 + "type": "elasticsearch",
1946 + "uid": "replace_datasource_uid"
1947 + },
1948 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1949 + "hide": 0,
1950 + "includeAll": true,
1951 + "label": "Rule Level",
1952 + "multi": false,
1953 + "name": "rule_level",
1954 + "options": [],
1955 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1956 + "refresh": 2,
1957 + "regex": "",
1958 + "skipUrlSync": false,
1959 + "sort": 0,
1960 + "type": "query"
1961 + }
1962 + ]
1963 + },
1964 + "time": {
1965 + "from": "now-6h",
1966 + "to": "now"
1967 + },
1968 + "timepicker": {
1969 + "refresh_intervals": [
1970 + "5s",
1971 + "10s",
1972 + "30s",
1973 + "1m",
1974 + "5m",
1975 + "15m",
1976 + "30m",
1977 + "1h",
1978 + "2h",
1979 + "1d"
1980 + ],
1981 + "time_options": [
1982 + "5m",
1983 + "15m",
1984 + "1h",
1985 + "6h",
1986 + "12h",
1987 + "24h",
1988 + "2d",
1989 + "7d",
1990 + "30d"
1991 + ]
1992 + },
1993 + "timezone": "",
1994 + "title": "O365 - DLP DETECTIONS",
1995 + "uid": "fpSr7wq7z",
1996 + "version": 1,
1997 + "weekStart": ""
1998 +}
backend/app/connectors/grafana/dashboards/Office365/endpoint.json new
+2411
@@ -0,0 +1,2411 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "10.0.3",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:Endpoint",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "cellOptions": {
261 + "type": "auto"
262 + },
263 + "inspect": false
264 + },
265 + "mappings": [],
266 + "thresholds": {
267 + "mode": "absolute",
268 + "steps": [
269 + {
270 + "color": "red",
271 + "value": null
272 + }
273 + ]
274 + }
275 + },
276 + "overrides": [
277 + {
278 + "matcher": {
279 + "id": "byName",
280 + "options": "Count"
281 + },
282 + "properties": [
283 + {
284 + "id": "displayName",
285 + "value": "EVENTS"
286 + },
287 + {
288 + "id": "unit",
289 + "value": "short"
290 + },
291 + {
292 + "id": "decimals",
293 + "value": -1
294 + },
295 + {
296 + "id": "custom.align"
297 + },
298 + {
299 + "id": "thresholds",
300 + "value": {
301 + "mode": "absolute",
302 + "steps": [
303 + {
304 + "color": "red",
305 + "value": null
306 + }
307 + ]
308 + }
309 + }
310 + ]
311 + }
312 + ]
313 + },
314 + "gridPos": {
315 + "h": 7,
316 + "w": 6,
317 + "x": 8,
318 + "y": 0
319 + },
320 + "id": 54,
321 + "options": {
322 + "cellHeight": "sm",
323 + "footer": {
324 + "countRows": false,
325 + "fields": "",
326 + "reducer": [
327 + "sum"
328 + ],
329 + "show": false
330 + },
331 + "showHeader": true
332 + },
333 + "pluginVersion": "10.0.3",
334 + "targets": [
335 + {
336 + "bucketAggs": [
337 + {
338 + "fake": true,
339 + "field": "data_office365_Operation",
340 + "id": "4",
341 + "settings": {
342 + "min_doc_count": 1,
343 + "order": "desc",
344 + "orderBy": "_count",
345 + "size": "0"
346 + },
347 + "type": "terms"
348 + }
349 + ],
350 + "datasource": {
351 + "type": "elasticsearch",
352 + "uid": "replace_datasource_uid"
353 + },
354 + "metrics": [
355 + {
356 + "field": "select field",
357 + "id": "1",
358 + "type": "count"
359 + }
360 + ],
361 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
362 + "refId": "A",
363 + "timeField": "timestamp"
364 + }
365 + ],
366 + "title": "EVENTS BY OPERATION",
367 + "transformations": [
368 + {
369 + "id": "merge",
370 + "options": {
371 + "reducers": []
372 + }
373 + },
374 + {
375 + "id": "organize",
376 + "options": {
377 + "excludeByName": {},
378 + "indexByName": {},
379 + "renameByName": {
380 + "Count": "EVENTS",
381 + "data_office365_Operation": "OPERATION"
382 + }
383 + }
384 + }
385 + ],
386 + "type": "table"
387 + },
388 + {
389 + "datasource": {
390 + "type": "elasticsearch",
391 + "uid": "replace_datasource_uid"
392 + },
393 + "fieldConfig": {
394 + "defaults": {
395 + "color": {
396 + "mode": "thresholds"
397 + },
398 + "custom": {
399 + "align": "auto",
400 + "cellOptions": {
401 + "type": "auto"
402 + },
403 + "inspect": false
404 + },
405 + "mappings": [],
406 + "thresholds": {
407 + "mode": "absolute",
408 + "steps": [
409 + {
410 + "color": "red",
411 + "value": null
412 + }
413 + ]
414 + }
415 + },
416 + "overrides": [
417 + {
418 + "matcher": {
419 + "id": "byName",
420 + "options": "Count"
421 + },
422 + "properties": [
423 + {
424 + "id": "displayName",
425 + "value": "EVENTS"
426 + },
427 + {
428 + "id": "unit",
429 + "value": "short"
430 + },
431 + {
432 + "id": "decimals",
433 + "value": -1
434 + },
435 + {
436 + "id": "custom.align"
437 + },
438 + {
439 + "id": "thresholds",
440 + "value": {
441 + "mode": "absolute",
442 + "steps": [
443 + {
444 + "color": "red",
445 + "value": null
446 + }
447 + ]
448 + }
449 + }
450 + ]
451 + }
452 + ]
453 + },
454 + "gridPos": {
455 + "h": 7,
456 + "w": 6,
457 + "x": 14,
458 + "y": 0
459 + },
460 + "id": 61,
461 + "options": {
462 + "cellHeight": "sm",
463 + "footer": {
464 + "countRows": false,
465 + "fields": "",
466 + "reducer": [
467 + "sum"
468 + ],
469 + "show": false
470 + },
471 + "showHeader": true
472 + },
473 + "pluginVersion": "10.0.3",
474 + "targets": [
475 + {
476 + "bucketAggs": [
477 + {
478 + "fake": true,
479 + "field": "data_office365_Application",
480 + "id": "4",
481 + "settings": {
482 + "min_doc_count": 1,
483 + "order": "desc",
484 + "orderBy": "_count",
485 + "size": "0"
486 + },
487 + "type": "terms"
488 + }
489 + ],
490 + "datasource": {
491 + "type": "elasticsearch",
492 + "uid": "replace_datasource_uid"
493 + },
494 + "metrics": [
495 + {
496 + "field": "select field",
497 + "id": "1",
498 + "type": "count"
499 + }
500 + ],
501 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
502 + "refId": "A",
503 + "timeField": "timestamp"
504 + }
505 + ],
506 + "title": "EVENTS BY APPLICATION",
507 + "transformations": [
508 + {
509 + "id": "merge",
510 + "options": {
511 + "reducers": []
512 + }
513 + },
514 + {
515 + "id": "organize",
516 + "options": {
517 + "excludeByName": {},
518 + "indexByName": {},
519 + "renameByName": {
520 + "Count": "EVENTS",
521 + "data_office365_Application": "APP",
522 + "data_office365_DeviceName": "DEVICE",
523 + "data_office365_Operation": "OPERATION"
524 + }
525 + }
526 + }
527 + ],
528 + "type": "table"
529 + },
530 + {
531 + "datasource": {
532 + "type": "elasticsearch",
533 + "uid": "replace_datasource_uid"
534 + },
535 + "fieldConfig": {
536 + "defaults": {
537 + "color": {
538 + "mode": "thresholds"
539 + },
540 + "mappings": [
541 + {
542 + "options": {
543 + "match": "null",
544 + "result": {
545 + "text": "N/A"
546 + }
547 + },
548 + "type": "special"
549 + }
550 + ],
551 + "max": 15,
552 + "min": 0,
553 + "thresholds": {
554 + "mode": "absolute",
555 + "steps": [
556 + {
557 + "color": "#299c46",
558 + "value": null
559 + },
560 + {
561 + "color": "rgba(237, 129, 40, 0.89)",
562 + "value": 8
563 + },
564 + {
565 + "color": "#d44a3a",
566 + "value": 12
567 + }
568 + ]
569 + },
570 + "unit": "none"
571 + },
572 + "overrides": []
573 + },
574 + "gridPos": {
575 + "h": 7,
576 + "w": 4,
577 + "x": 0,
578 + "y": 7
579 + },
580 + "id": 16,
581 + "links": [],
582 + "options": {
583 + "orientation": "horizontal",
584 + "reduceOptions": {
585 + "calcs": [
586 + "max"
587 + ],
588 + "fields": "",
589 + "values": false
590 + },
591 + "showThresholdLabels": false,
592 + "showThresholdMarkers": true,
593 + "text": {}
594 + },
595 + "pluginVersion": "10.0.3",
596 + "targets": [
597 + {
598 + "bucketAggs": [
599 + {
600 + "field": "timestamp",
601 + "id": "2",
602 + "settings": {
603 + "interval": "auto",
604 + "min_doc_count": 0,
605 + "trimEdges": 0
606 + },
607 + "type": "date_histogram"
608 + }
609 + ],
610 + "datasource": {
611 + "type": "elasticsearch",
612 + "uid": "replace_datasource_uid"
613 + },
614 + "metrics": [
615 + {
616 + "field": "rule_level",
617 + "id": "1",
618 + "meta": {},
619 + "settings": {},
620 + "type": "max"
621 + }
622 + ],
623 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
624 + "refId": "A",
625 + "timeField": "timestamp"
626 + }
627 + ],
628 + "title": "MAX SEVERITY (0 - 15)",
629 + "type": "gauge"
630 + },
631 + {
632 + "datasource": {
633 + "type": "elasticsearch",
634 + "uid": "replace_datasource_uid"
635 + },
636 + "fieldConfig": {
637 + "defaults": {
638 + "color": {
639 + "mode": "palette-classic"
640 + },
641 + "custom": {
642 + "axisCenteredZero": false,
643 + "axisColorMode": "text",
644 + "axisLabel": "",
645 + "axisPlacement": "auto",
646 + "barAlignment": 0,
647 + "drawStyle": "bars",
648 + "fillOpacity": 0,
649 + "gradientMode": "none",
650 + "hideFrom": {
651 + "legend": false,
652 + "tooltip": false,
653 + "viz": false
654 + },
655 + "lineInterpolation": "linear",
656 + "lineWidth": 1,
657 + "pointSize": 5,
658 + "scaleDistribution": {
659 + "type": "linear"
660 + },
661 + "showPoints": "auto",
662 + "spanNulls": false,
663 + "stacking": {
664 + "group": "A",
665 + "mode": "normal"
666 + },
667 + "thresholdsStyle": {
668 + "mode": "off"
669 + }
670 + },
671 + "mappings": [],
672 + "thresholds": {
673 + "mode": "absolute",
674 + "steps": [
675 + {
676 + "color": "green",
677 + "value": null
678 + },
679 + {
680 + "color": "red",
681 + "value": 80
682 + }
683 + ]
684 + }
685 + },
686 + "overrides": []
687 + },
688 + "gridPos": {
689 + "h": 13,
690 + "w": 20,
691 + "x": 4,
692 + "y": 7
693 + },
694 + "id": 60,
695 + "options": {
696 + "legend": {
697 + "calcs": [],
698 + "displayMode": "table",
699 + "placement": "right",
700 + "showLegend": true
701 + },
702 + "tooltip": {
703 + "mode": "single",
704 + "sort": "none"
705 + }
706 + },
707 + "targets": [
708 + {
709 + "alias": "",
710 + "bucketAggs": [
711 + {
712 + "field": "data_office365_Operation",
713 + "id": "3",
714 + "settings": {
715 + "min_doc_count": "1",
716 + "order": "desc",
717 + "orderBy": "_count",
718 + "size": "10"
719 + },
720 + "type": "terms"
721 + },
722 + {
723 + "field": "timestamp",
724 + "id": "2",
725 + "settings": {
726 + "interval": "auto"
727 + },
728 + "type": "date_histogram"
729 + }
730 + ],
731 + "datasource": {
732 + "type": "elasticsearch",
733 + "uid": "replace_datasource_uid"
734 + },
735 + "metrics": [
736 + {
737 + "id": "1",
738 + "type": "count"
739 + }
740 + ],
741 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
742 + "refId": "A",
743 + "timeField": "timestamp"
744 + }
745 + ],
746 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
747 + "transparent": true,
748 + "type": "timeseries"
749 + },
750 + {
751 + "datasource": {
752 + "type": "elasticsearch",
753 + "uid": "replace_datasource_uid"
754 + },
755 + "fieldConfig": {
756 + "defaults": {
757 + "mappings": [
758 + {
759 + "options": {
760 + "match": "null",
761 + "result": {
762 + "text": "N/A"
763 + }
764 + },
765 + "type": "special"
766 + }
767 + ],
768 + "thresholds": {
769 + "mode": "absolute",
770 + "steps": [
771 + {
772 + "color": "blue",
773 + "value": null
774 + }
775 + ]
776 + },
777 + "unit": "locale"
778 + },
779 + "overrides": []
780 + },
781 + "gridPos": {
782 + "h": 6,
783 + "w": 4,
784 + "x": 0,
785 + "y": 14
786 + },
787 + "id": 51,
788 + "links": [],
789 + "options": {
790 + "colorMode": "value",
791 + "graphMode": "area",
792 + "justifyMode": "auto",
793 + "orientation": "horizontal",
794 + "reduceOptions": {
795 + "calcs": [
796 + "sum"
797 + ],
798 + "fields": "",
799 + "values": false
800 + },
801 + "text": {},
802 + "textMode": "auto"
803 + },
804 + "pluginVersion": "10.0.3",
805 + "targets": [
806 + {
807 + "bucketAggs": [
808 + {
809 + "$$hashKey": "object:331",
810 + "field": "timestamp",
811 + "id": "2",
812 + "settings": {
813 + "interval": "auto",
814 + "min_doc_count": 0,
815 + "trimEdges": 0
816 + },
817 + "type": "date_histogram"
818 + }
819 + ],
820 + "datasource": {
821 + "type": "elasticsearch",
822 + "uid": "replace_datasource_uid"
823 + },
824 + "metrics": [
825 + {
826 + "$$hashKey": "object:329",
827 + "field": "select field",
828 + "id": "1",
829 + "type": "count"
830 + }
831 + ],
832 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
833 + "refId": "A",
834 + "timeField": "timestamp"
835 + }
836 + ],
837 + "title": "EVENTS (Total)",
838 + "type": "stat"
839 + },
840 + {
841 + "datasource": {
842 + "type": "elasticsearch",
843 + "uid": "replace_datasource_uid"
844 + },
845 + "fieldConfig": {
846 + "defaults": {
847 + "color": {
848 + "mode": "thresholds"
849 + },
850 + "custom": {
851 + "align": "auto",
852 + "cellOptions": {
853 + "type": "auto"
854 + },
855 + "inspect": false
856 + },
857 + "mappings": [],
858 + "thresholds": {
859 + "mode": "absolute",
860 + "steps": [
861 + {
862 + "color": "red",
863 + "value": null
864 + }
865 + ]
866 + }
867 + },
868 + "overrides": [
869 + {
870 + "matcher": {
871 + "id": "byName",
872 + "options": "Count"
873 + },
874 + "properties": [
875 + {
876 + "id": "displayName",
877 + "value": "EVENTS"
878 + },
879 + {
880 + "id": "unit",
881 + "value": "short"
882 + },
883 + {
884 + "id": "decimals",
885 + "value": -1
886 + },
887 + {
888 + "id": "custom.align"
889 + },
890 + {
891 + "id": "thresholds",
892 + "value": {
893 + "mode": "absolute",
894 + "steps": [
895 + {
896 + "color": "red",
897 + "value": null
898 + }
899 + ]
900 + }
901 + }
902 + ]
903 + },
904 + {
905 + "matcher": {
906 + "id": "byName",
907 + "options": "DEVICE"
908 + },
909 + "properties": [
910 + {
911 + "id": "custom.width",
912 + "value": 324
913 + }
914 + ]
915 + }
916 + ]
917 + },
918 + "gridPos": {
919 + "h": 12,
920 + "w": 7,
921 + "x": 0,
922 + "y": 20
923 + },
924 + "id": 62,
925 + "options": {
926 + "cellHeight": "sm",
927 + "footer": {
928 + "countRows": false,
929 + "fields": "",
930 + "reducer": [
931 + "sum"
932 + ],
933 + "show": false
934 + },
935 + "showHeader": true,
936 + "sortBy": []
937 + },
938 + "pluginVersion": "10.0.3",
939 + "targets": [
940 + {
941 + "bucketAggs": [
942 + {
943 + "fake": true,
944 + "field": "data_office365_DeviceName",
945 + "id": "4",
946 + "settings": {
947 + "min_doc_count": 1,
948 + "order": "desc",
949 + "orderBy": "_count",
950 + "size": "0"
951 + },
952 + "type": "terms"
953 + },
954 + {
955 + "field": "data_office365_ClientIP_country_code",
956 + "id": "5",
957 + "settings": {
958 + "min_doc_count": "1",
959 + "order": "desc",
960 + "orderBy": "_term",
961 + "size": "10"
962 + },
963 + "type": "terms"
964 + }
965 + ],
966 + "datasource": {
967 + "type": "elasticsearch",
968 + "uid": "replace_datasource_uid"
969 + },
970 + "metrics": [
971 + {
972 + "field": "select field",
973 + "id": "1",
974 + "type": "count"
975 + }
976 + ],
977 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
978 + "refId": "A",
979 + "timeField": "timestamp"
980 + }
981 + ],
982 + "title": "EVENTS BY DEVICE",
983 + "transformations": [
984 + {
985 + "id": "merge",
986 + "options": {
987 + "reducers": []
988 + }
989 + },
990 + {
991 + "id": "organize",
992 + "options": {
993 + "excludeByName": {},
994 + "indexByName": {},
995 + "renameByName": {
996 + "Count": "EVENTS",
997 + "data_office365_ClientIP_country_code": "COUNTRY",
998 + "data_office365_DeviceName": "DEVICE",
999 + "data_office365_Operation": "OPERATION"
1000 + }
1001 + }
1002 + }
1003 + ],
1004 + "type": "table"
1005 + },
1006 + {
1007 + "circleMaxSize": 30,
1008 + "circleMinSize": 2,
1009 + "colors": [
1010 + "rgba(245, 54, 54, 0.9)",
1011 + "rgba(237, 129, 40, 0.89)",
1012 + "rgba(50, 172, 45, 0.97)"
1013 + ],
1014 + "datasource": {
1015 + "type": "elasticsearch",
1016 + "uid": "replace_datasource_uid"
1017 + },
1018 + "decimals": 0,
1019 + "esMetric": "Count",
1020 + "gridPos": {
1021 + "h": 12,
1022 + "w": 8,
1023 + "x": 7,
1024 + "y": 20
1025 + },
1026 + "hideEmpty": false,
1027 + "hideZero": false,
1028 + "id": 50,
1029 + "initialZoom": 1,
1030 + "locationData": "countries",
1031 + "mapCenter": "(0°, 0°)",
1032 + "mapCenterLatitude": 0,
1033 + "mapCenterLongitude": 0,
1034 + "maxDataPoints": 1,
1035 + "mouseWheelZoom": false,
1036 + "showLegend": true,
1037 + "stickyLabels": false,
1038 + "tableQueryOptions": {
1039 + "geohashField": "geohash",
1040 + "latitudeField": "latitude",
1041 + "longitudeField": "longitude",
1042 + "metricField": "metric",
1043 + "queryType": "geohash"
1044 + },
1045 + "targets": [
1046 + {
1047 + "bucketAggs": [
1048 + {
1049 + "fake": true,
1050 + "field": "data_office365_ClientIP_country_code",
1051 + "id": "3",
1052 + "settings": {
1053 + "min_doc_count": 1,
1054 + "order": "desc",
1055 + "orderBy": "_count",
1056 + "size": "0"
1057 + },
1058 + "type": "terms"
1059 + },
1060 + {
1061 + "field": "timestamp",
1062 + "id": "2",
1063 + "settings": {
1064 + "interval": "auto",
1065 + "min_doc_count": 0,
1066 + "trimEdges": 0
1067 + },
1068 + "type": "date_histogram"
1069 + }
1070 + ],
1071 + "datasource": {
1072 + "type": "elasticsearch",
1073 + "uid": "replace_datasource_uid"
1074 + },
1075 + "metrics": [
1076 + {
1077 + "field": "select field",
1078 + "id": "1",
1079 + "type": "count"
1080 + }
1081 + ],
1082 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
1083 + "refId": "A",
1084 + "timeField": "timestamp"
1085 + }
1086 + ],
1087 + "thresholds": "0,10",
1088 + "title": "Endpoint - ALL EVENTS BY SRC COUNTRY",
1089 + "type": "grafana-worldmap-panel",
1090 + "unitPlural": "",
1091 + "unitSingle": "",
1092 + "valueName": "total"
1093 + },
1094 + {
1095 + "datasource": {
1096 + "type": "elasticsearch",
1097 + "uid": "replace_datasource_uid"
1098 + },
1099 + "fieldConfig": {
1100 + "defaults": {
1101 + "color": {
1102 + "mode": "thresholds"
1103 + },
1104 + "custom": {
1105 + "align": "auto",
1106 + "cellOptions": {
1107 + "type": "auto"
1108 + },
1109 + "inspect": false
1110 + },
1111 + "mappings": [],
1112 + "thresholds": {
1113 + "mode": "absolute",
1114 + "steps": [
1115 + {
1116 + "color": "orange",
1117 + "value": null
1118 + }
1119 + ]
1120 + }
1121 + },
1122 + "overrides": [
1123 + {
1124 + "matcher": {
1125 + "id": "byName",
1126 + "options": "Count"
1127 + },
1128 + "properties": [
1129 + {
1130 + "id": "displayName",
1131 + "value": "EVENTS"
1132 + },
1133 + {
1134 + "id": "unit",
1135 + "value": "short"
1136 + },
1137 + {
1138 + "id": "decimals",
1139 + "value": -1
1140 + },
1141 + {
1142 + "id": "custom.align"
1143 + }
1144 + ]
1145 + },
1146 + {
1147 + "matcher": {
1148 + "id": "byName",
1149 + "options": "AD ACCOUNT"
1150 + },
1151 + "properties": [
1152 + {
1153 + "id": "custom.width",
1154 + "value": 377
1155 + }
1156 + ]
1157 + }
1158 + ]
1159 + },
1160 + "gridPos": {
1161 + "h": 12,
1162 + "w": 9,
1163 + "x": 15,
1164 + "y": 20
1165 + },
1166 + "id": 58,
1167 + "options": {
1168 + "cellHeight": "sm",
1169 + "footer": {
1170 + "countRows": false,
1171 + "fields": "",
1172 + "reducer": [
1173 + "sum"
1174 + ],
1175 + "show": false
1176 + },
1177 + "showHeader": true,
1178 + "sortBy": []
1179 + },
1180 + "pluginVersion": "10.0.3",
1181 + "targets": [
1182 + {
1183 + "bucketAggs": [
1184 + {
1185 + "fake": true,
1186 + "field": "data_office365_UserId",
1187 + "id": "4",
1188 + "settings": {
1189 + "min_doc_count": 1,
1190 + "order": "desc",
1191 + "orderBy": "_count",
1192 + "size": "0"
1193 + },
1194 + "type": "terms"
1195 + },
1196 + {
1197 + "field": "data_office365_ClientIP_country_code",
1198 + "id": "5",
1199 + "settings": {
1200 + "min_doc_count": "1",
1201 + "order": "desc",
1202 + "orderBy": "_term",
1203 + "size": "10"
1204 + },
1205 + "type": "terms"
1206 + }
1207 + ],
1208 + "datasource": {
1209 + "type": "elasticsearch",
1210 + "uid": "replace_datasource_uid"
1211 + },
1212 + "metrics": [
1213 + {
1214 + "field": "select field",
1215 + "id": "1",
1216 + "type": "count"
1217 + }
1218 + ],
1219 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
1220 + "refId": "A",
1221 + "timeField": "timestamp"
1222 + }
1223 + ],
1224 + "title": "Endpoint EVENTS BY ACCOUNT",
1225 + "transformations": [
1226 + {
1227 + "id": "merge",
1228 + "options": {
1229 + "reducers": []
1230 + }
1231 + },
1232 + {
1233 + "id": "organize",
1234 + "options": {
1235 + "excludeByName": {},
1236 + "indexByName": {},
1237 + "renameByName": {
1238 + "Count": "EVENTS",
1239 + "data_office365_ClientIP_country_code": "COUNTRY",
1240 + "data_office365_LogonError": "ERROR",
1241 + "data_office365_Operation": "WORKLOAD",
1242 + "data_office365_UserId": "AD ACCOUNT"
1243 + }
1244 + }
1245 + }
1246 + ],
1247 + "type": "table"
1248 + },
1249 + {
1250 + "datasource": {
1251 + "type": "elasticsearch",
1252 + "uid": "replace_datasource_uid"
1253 + },
1254 + "fieldConfig": {
1255 + "defaults": {
1256 + "color": {
1257 + "mode": "thresholds"
1258 + },
1259 + "custom": {
1260 + "align": "auto",
1261 + "cellOptions": {
1262 + "type": "auto"
1263 + },
1264 + "filterable": true,
1265 + "inspect": false
1266 + },
1267 + "mappings": [],
1268 + "thresholds": {
1269 + "mode": "absolute",
1270 + "steps": [
1271 + {
1272 + "color": "green",
1273 + "value": null
1274 + },
1275 + {
1276 + "color": "red",
1277 + "value": 80
1278 + }
1279 + ]
1280 + }
1281 + },
1282 + "overrides": [
1283 + {
1284 + "matcher": {
1285 + "id": "byName",
1286 + "options": "rule_level"
1287 + },
1288 + "properties": [
1289 + {
1290 + "id": "displayName",
1291 + "value": "RULE LEVEL"
1292 + },
1293 + {
1294 + "id": "unit",
1295 + "value": "short"
1296 + },
1297 + {
1298 + "id": "decimals",
1299 + "value": -1
1300 + },
1301 + {
1302 + "id": "custom.cellOptions",
1303 + "value": {
1304 + "mode": "gradient",
1305 + "type": "color-background"
1306 + }
1307 + },
1308 + {
1309 + "id": "custom.align"
1310 + },
1311 + {
1312 + "id": "thresholds",
1313 + "value": {
1314 + "mode": "absolute",
1315 + "steps": [
1316 + {
1317 + "color": "#37872D",
1318 + "value": null
1319 + },
1320 + {
1321 + "color": "rgba(237, 129, 40, 0.89)",
1322 + "value": 7
1323 + },
1324 + {
1325 + "color": "rgba(245, 54, 54, 0.9)",
1326 + "value": 12
1327 + }
1328 + ]
1329 + }
1330 + }
1331 + ]
1332 + },
1333 + {
1334 + "matcher": {
1335 + "id": "byName",
1336 + "options": "Date/Time"
1337 + },
1338 + "properties": [
1339 + {
1340 + "id": "custom.width",
1341 + "value": 242
1342 + }
1343 + ]
1344 + },
1345 + {
1346 + "matcher": {
1347 + "id": "byName",
1348 + "options": "MITRE TACTIC"
1349 + },
1350 + "properties": [
1351 + {
1352 + "id": "custom.width",
1353 + "value": 332
1354 + }
1355 + ]
1356 + },
1357 + {
1358 + "matcher": {
1359 + "id": "byName",
1360 + "options": "IP ADDRESS"
1361 + },
1362 + "properties": [
1363 + {
1364 + "id": "custom.width",
1365 + "value": 163
1366 + }
1367 + ]
1368 + },
1369 + {
1370 + "matcher": {
1371 + "id": "byName",
1372 + "options": "MITRE TECHNIQUE"
1373 + },
1374 + "properties": [
1375 + {
1376 + "id": "custom.width",
1377 + "value": 312
1378 + }
1379 + ]
1380 + },
1381 + {
1382 + "matcher": {
1383 + "id": "byName",
1384 + "options": "EVENT ID"
1385 + },
1386 + "properties": [
1387 + {
1388 + "id": "links",
1389 + "value": [
1390 + {
1391 + "targetBlank": true,
1392 + "title": "VIEW EVENT DETAILS",
1393 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1394 + }
1395 + ]
1396 + },
1397 + {
1398 + "id": "custom.width",
1399 + "value": 265
1400 + }
1401 + ]
1402 + },
1403 + {
1404 + "matcher": {
1405 + "id": "byName",
1406 + "options": "RESULT"
1407 + },
1408 + "properties": [
1409 + {
1410 + "id": "custom.width",
1411 + "value": 118
1412 + },
1413 + {
1414 + "id": "mappings",
1415 + "value": [
1416 + {
1417 + "options": {
1418 + "Failed": {
1419 + "color": "orange",
1420 + "index": 1
1421 + },
1422 + "Success": {
1423 + "color": "green",
1424 + "index": 0
1425 + }
1426 + },
1427 + "type": "value"
1428 + }
1429 + ]
1430 + },
1431 + {
1432 + "id": "custom.cellOptions",
1433 + "value": {
1434 + "type": "color-text"
1435 + }
1436 + }
1437 + ]
1438 + },
1439 + {
1440 + "matcher": {
1441 + "id": "byName",
1442 + "options": "SRC IP"
1443 + },
1444 + "properties": [
1445 + {
1446 + "id": "custom.width",
1447 + "value": 265
1448 + }
1449 + ]
1450 + },
1451 + {
1452 + "matcher": {
1453 + "id": "byName",
1454 + "options": "ACCOUNT"
1455 + },
1456 + "properties": [
1457 + {
1458 + "id": "custom.width",
1459 + "value": 193
1460 + }
1461 + ]
1462 + },
1463 + {
1464 + "matcher": {
1465 + "id": "byName",
1466 + "options": "EVENT TIME"
1467 + },
1468 + "properties": [
1469 + {
1470 + "id": "custom.width",
1471 + "value": 195
1472 + }
1473 + ]
1474 + },
1475 + {
1476 + "matcher": {
1477 + "id": "byName",
1478 + "options": "CLIENT IP"
1479 + },
1480 + "properties": [
1481 + {
1482 + "id": "custom.width",
1483 + "value": 143
1484 + }
1485 + ]
1486 + },
1487 + {
1488 + "matcher": {
1489 + "id": "byName",
1490 + "options": "DESCRIPTION"
1491 + },
1492 + "properties": [
1493 + {
1494 + "id": "custom.width",
1495 + "value": 296
1496 + }
1497 + ]
1498 + },
1499 + {
1500 + "matcher": {
1501 + "id": "byName",
1502 + "options": "DEVICE"
1503 + },
1504 + "properties": [
1505 + {
1506 + "id": "custom.width",
1507 + "value": 182
1508 + }
1509 + ]
1510 + },
1511 + {
1512 + "matcher": {
1513 + "id": "byName",
1514 + "options": "RULE LEVEL"
1515 + },
1516 + "properties": [
1517 + {
1518 + "id": "custom.width",
1519 + "value": 145
1520 + }
1521 + ]
1522 + },
1523 + {
1524 + "matcher": {
1525 + "id": "byName",
1526 + "options": "APP"
1527 + },
1528 + "properties": [
1529 + {
1530 + "id": "custom.width",
1531 + "value": 187
1532 + }
1533 + ]
1534 + },
1535 + {
1536 + "matcher": {
1537 + "id": "byName",
1538 + "options": "FILE TYPE"
1539 + },
1540 + "properties": [
1541 + {
1542 + "id": "custom.width",
1543 + "value": 157
1544 + }
1545 + ]
1546 + }
1547 + ]
1548 + },
1549 + "gridPos": {
1550 + "h": 16,
1551 + "w": 24,
1552 + "x": 0,
1553 + "y": 32
1554 + },
1555 + "id": 27,
1556 + "options": {
1557 + "cellHeight": "sm",
1558 + "footer": {
1559 + "countRows": false,
1560 + "enablePagination": true,
1561 + "fields": "",
1562 + "reducer": [
1563 + "sum"
1564 + ],
1565 + "show": false
1566 + },
1567 + "showHeader": true,
1568 + "sortBy": []
1569 + },
1570 + "pluginVersion": "10.0.3",
1571 + "targets": [
1572 + {
1573 + "bucketAggs": [],
1574 + "datasource": {
1575 + "type": "elasticsearch",
1576 + "uid": "replace_datasource_uid"
1577 + },
1578 + "metrics": [
1579 + {
1580 + "id": "1",
1581 + "settings": {
1582 + "size": "250"
1583 + },
1584 + "type": "raw_data"
1585 + }
1586 + ],
1587 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
1588 + "refId": "A",
1589 + "timeField": "timestamp"
1590 + }
1591 + ],
1592 + "title": "EVENTS",
1593 + "transformations": [
1594 + {
1595 + "id": "organize",
1596 + "options": {
1597 + "excludeByName": {
1598 + "@metadata_beat": true,
1599 + "@metadata_type": true,
1600 + "@metadata_version": true,
1601 + "IMPHASH": true,
1602 + "MD5": true,
1603 + "SHA1": true,
1604 + "SHA256": true,
1605 + "_id": false,
1606 + "_index": true,
1607 + "_type": true,
1608 + "agent_ephemeral_id": true,
1609 + "agent_hostname": true,
1610 + "agent_id": true,
1611 + "agent_ip_city_name": true,
1612 + "agent_ip_country_code": true,
1613 + "agent_ip_geolocation": true,
1614 + "agent_name": true,
1615 + "agent_type": true,
1616 + "agent_version": true,
1617 + "beats_type": true,
1618 + "cluster_name": true,
1619 + "cluster_node": true,
1620 + "collector_node_id": true,
1621 + "data_alert_action": true,
1622 + "data_alert_category": true,
1623 + "data_alert_gid": true,
1624 + "data_alert_rev": true,
1625 + "data_alert_severity": true,
1626 + "data_alert_signature": true,
1627 + "data_alert_signature_id": true,
1628 + "data_app_proto": true,
1629 + "data_audit_auid": true,
1630 + "data_audit_command": true,
1631 + "data_audit_euid": true,
1632 + "data_audit_exe": true,
1633 + "data_audit_gid": true,
1634 + "data_audit_id": true,
1635 + "data_audit_pid": true,
1636 + "data_audit_res": true,
1637 + "data_audit_session": true,
1638 + "data_audit_type": true,
1639 + "data_audit_uid": true,
1640 + "data_dest_ip": true,
1641 + "data_dest_port": true,
1642 + "data_dstuser": true,
1643 + "data_event_type": true,
1644 + "data_extra_data": true,
1645 + "data_file": true,
1646 + "data_flow_bytes_toclient": true,
1647 + "data_flow_bytes_toserver": true,
1648 + "data_flow_id": true,
1649 + "data_flow_pkts_toclient": true,
1650 + "data_flow_pkts_toserver": true,
1651 + "data_flow_start": true,
1652 + "data_http_http_content_type": true,
1653 + "data_http_http_port": true,
1654 + "data_http_length": true,
1655 + "data_http_status": true,
1656 + "data_http_url": true,
1657 + "data_id": true,
1658 + "data_in_iface": true,
1659 + "data_integration": true,
1660 + "data_metadata_flowbits": true,
1661 + "data_metadata_flowints_http_anomaly_count": true,
1662 + "data_metadata_flowints_tcp_retransmission_count": true,
1663 + "data_office365_AADGroupId": true,
1664 + "data_office365_Actor": true,
1665 + "data_office365_ActorContextId": true,
1666 + "data_office365_ActorIpAddress": false,
1667 + "data_office365_ActorIpAddress_city_name": true,
1668 + "data_office365_ActorIpAddress_country_code": true,
1669 + "data_office365_ActorIpAddress_geolocation": true,
1670 + "data_office365_AppAccessContext_AADSessionId": true,
1671 + "data_office365_AppAccessContext_APIId": true,
1672 + "data_office365_AppAccessContext_ClientAppId": true,
1673 + "data_office365_AppAccessContext_ClientAppName": true,
1674 + "data_office365_AppAccessContext_CorrelationId": true,
1675 + "data_office365_AppAccessContext_UniqueTokenId": true,
1676 + "data_office365_AppId": true,
1677 + "data_office365_Application": false,
1678 + "data_office365_ApplicationId": true,
1679 + "data_office365_ArtifactsShared": true,
1680 + "data_office365_Attendees": true,
1681 + "data_office365_AuthenticationType": true,
1682 + "data_office365_AzureActiveDirectoryEventType": true,
1683 + "data_office365_BrowserVersion": true,
1684 + "data_office365_ChannelGuid": true,
1685 + "data_office365_ChannelName": true,
1686 + "data_office365_ChatName": true,
1687 + "data_office365_ChatThreadId": true,
1688 + "data_office365_ClientAppId": true,
1689 + "data_office365_ClientIP": false,
1690 + "data_office365_ClientIPAddress": true,
1691 + "data_office365_ClientIPAddress_city_name": true,
1692 + "data_office365_ClientIPAddress_country_code": true,
1693 + "data_office365_ClientIPAddress_geolocation": true,
1694 + "data_office365_ClientIP_city_name": true,
1695 + "data_office365_ClientIP_country_code": true,
1696 + "data_office365_ClientIP_geolocation": true,
1697 + "data_office365_ClientInfoString": true,
1698 + "data_office365_ClientProcessName": true,
1699 + "data_office365_ClientRequestId": true,
1700 + "data_office365_ClientVersion": true,
1701 + "data_office365_CommunicationSubType": true,
1702 + "data_office365_CommunicationType": true,
1703 + "data_office365_CorrelationId": true,
1704 + "data_office365_CreationTime": false,
1705 + "data_office365_CrossMailboxOperation": true,
1706 + "data_office365_DestFolder_Id": true,
1707 + "data_office365_DestFolder_Path": true,
1708 + "data_office365_DestinationLocationType": true,
1709 + "data_office365_DeviceDisplayName": true,
1710 + "data_office365_DeviceDisplayName_city_name": true,
1711 + "data_office365_DeviceDisplayName_country_code": true,
1712 + "data_office365_DeviceDisplayName_geolocation": true,
1713 + "data_office365_DeviceId": true,
1714 + "data_office365_DeviceInformation": true,
1715 + "data_office365_DeviceName": false,
1716 + "data_office365_DeviceProperties": true,
1717 + "data_office365_DlpOriginalFilePath": true,
1718 + "data_office365_EndTime": true,
1719 + "data_office365_EnforcementMode": true,
1720 + "data_office365_ErrorNumber": true,
1721 + "data_office365_EventSource": true,
1722 + "data_office365_ExchangeId": true,
1723 + "data_office365_ExtendedProperties": true,
1724 + "data_office365_ExternalAccess": true,
1725 + "data_office365_ExtraProperties": true,
1726 + "data_office365_FileExtension": true,
1727 + "data_office365_FileSize": true,
1728 + "data_office365_FileSizeBytes": true,
1729 + "data_office365_Folder_Id": true,
1730 + "data_office365_Folder_Path": true,
1731 + "data_office365_Hidden": true,
1732 + "data_office365_HighPriorityMediaProcessing": true,
1733 + "data_office365_HostedContents": true,
1734 + "data_office365_ICalUid": true,
1735 + "data_office365_Id": true,
1736 + "data_office365_InterSystemsId": true,
1737 + "data_office365_InternalLogonType": true,
1738 + "data_office365_IntraSystemId": true,
1739 + "data_office365_IsManagedDevice": true,
1740 + "data_office365_ItemName": true,
1741 + "data_office365_ItemType": true,
1742 + "data_office365_Item_Id": true,
1743 + "data_office365_Item_InternetMessageId": true,
1744 + "data_office365_Item_IsRecord": true,
1745 + "data_office365_Item_ParentFolder_Id": true,
1746 + "data_office365_Item_SizeInBytes": true,
1747 + "data_office365_JitTriggered": true,
1748 + "data_office365_JoinTime": true,
1749 + "data_office365_LeaveTime": true,
1750 + "data_office365_ListBaseType": true,
1751 + "data_office365_ListId": true,
1752 + "data_office365_ListItemUniqueId": true,
1753 + "data_office365_ListServerTemplate": true,
1754 + "data_office365_LogonError": true,
1755 + "data_office365_LogonType": true,
1756 + "data_office365_LogonUserSid": true,
1757 + "data_office365_MDATPDeviceId": true,
1758 + "data_office365_MailboxGuid": true,
1759 + "data_office365_MailboxOwnerSid": true,
1760 + "data_office365_MailboxOwnerUPN": true,
1761 + "data_office365_MeetingDetailId": true,
1762 + "data_office365_MeetingURL": true,
1763 + "data_office365_Members": true,
1764 + "data_office365_MessageId": true,
1765 + "data_office365_MessageSizeInBytes": true,
1766 + "data_office365_MessageURLs": true,
1767 + "data_office365_MessageVersion": true,
1768 + "data_office365_Modalities": true,
1769 + "data_office365_ModifiedProperties": true,
1770 + "data_office365_Name": true,
1771 + "data_office365_NewValue": true,
1772 + "data_office365_ObjectId": false,
1773 + "data_office365_Operation": true,
1774 + "data_office365_OperationScope": true,
1775 + "data_office365_OrganizationId": true,
1776 + "data_office365_OrganizationName": true,
1777 + "data_office365_Organizer_OrganizationId": true,
1778 + "data_office365_Organizer_RecipientType": true,
1779 + "data_office365_Organizer_Role": true,
1780 + "data_office365_Organizer_UserObjectId": true,
1781 + "data_office365_OriginatingDomain": true,
1782 + "data_office365_OriginatingServer": true,
1783 + "data_office365_Parameters": true,
1784 + "data_office365_ParentMessageId": true,
1785 + "data_office365_Platform": true,
1786 + "data_office365_PreviousFileName": true,
1787 + "data_office365_ProviderTypes": true,
1788 + "data_office365_RMSEncrypted": true,
1789 + "data_office365_RecordType": true,
1790 + "data_office365_ResultStatus": true,
1791 + "data_office365_Scope": true,
1792 + "data_office365_SensitiveInfoTypeData": true,
1793 + "data_office365_SessionId": true,
1794 + "data_office365_Sha1": true,
1795 + "data_office365_Sha256": true,
1796 + "data_office365_Site": true,
1797 + "data_office365_SiteUrl": true,
1798 + "data_office365_SourceFileExtension": true,
1799 + "data_office365_SourceFileName": true,
1800 + "data_office365_SourceLocationType": true,
1801 + "data_office365_SourceRelativeUrl": true,
1802 + "data_office365_StartTime": true,
1803 + "data_office365_Subscription": true,
1804 + "data_office365_SubscriptionId": true,
1805 + "data_office365_Target": true,
1806 + "data_office365_TargetContextId": true,
1807 + "data_office365_TargetFilePath": true,
1808 + "data_office365_TargetPrinterName": true,
1809 + "data_office365_TeamGuid": true,
1810 + "data_office365_TeamName": true,
1811 + "data_office365_UserId": false,
1812 + "data_office365_UserKey": true,
1813 + "data_office365_UserType": true,
1814 + "data_office365_Version": true,
1815 + "data_office365_WebId": true,
1816 + "data_office365_Workload": true,
1817 + "data_osquery_action": true,
1818 + "data_osquery_calendarTime": true,
1819 + "data_osquery_columns_address": true,
1820 + "data_osquery_columns_address_city_name": true,
1821 + "data_osquery_columns_address_country_code": true,
1822 + "data_osquery_columns_address_geolocation": true,
1823 + "data_osquery_columns_cmdline": true,
1824 + "data_osquery_columns_cwd": true,
1825 + "data_osquery_columns_description": true,
1826 + "data_osquery_columns_directory": true,
1827 + "data_osquery_columns_disk_bytes_read": true,
1828 + "data_osquery_columns_disk_bytes_written": true,
1829 + "data_osquery_columns_egid": true,
1830 + "data_osquery_columns_euid": true,
1831 + "data_osquery_columns_family": true,
1832 + "data_osquery_columns_fd": true,
1833 + "data_osquery_columns_gid": true,
1834 + "data_osquery_columns_gid_signed": true,
1835 + "data_osquery_columns_host": true,
1836 + "data_osquery_columns_interface": true,
1837 + "data_osquery_columns_local_address": true,
1838 + "data_osquery_columns_local_address_city_name": true,
1839 + "data_osquery_columns_local_address_country_code": true,
1840 + "data_osquery_columns_local_address_geolocation": true,
1841 + "data_osquery_columns_local_port": true,
1842 + "data_osquery_columns_mac": true,
1843 + "data_osquery_columns_name": true,
1844 + "data_osquery_columns_net_namespace": true,
1845 + "data_osquery_columns_nice": true,
1846 + "data_osquery_columns_on_disk": true,
1847 + "data_osquery_columns_parent": true,
1848 + "data_osquery_columns_path": true,
1849 + "data_osquery_columns_pgroup": true,
1850 + "data_osquery_columns_pid": true,
1851 + "data_osquery_columns_port": true,
1852 + "data_osquery_columns_protocol": true,
1853 + "data_osquery_columns_remote_address": true,
1854 + "data_osquery_columns_remote_address_city_name": true,
1855 + "data_osquery_columns_remote_address_country_code": true,
1856 + "data_osquery_columns_remote_address_geolocation": true,
1857 + "data_osquery_columns_remote_port": true,
1858 + "data_osquery_columns_resident_size": true,
1859 + "data_osquery_columns_root": true,
1860 + "data_osquery_columns_sgid": true,
1861 + "data_osquery_columns_shell": true,
1862 + "data_osquery_columns_socket": true,
1863 + "data_osquery_columns_start_time": true,
1864 + "data_osquery_columns_state": true,
1865 + "data_osquery_columns_suid": true,
1866 + "data_osquery_columns_system_time": true,
1867 + "data_osquery_columns_threads": true,
1868 + "data_osquery_columns_time_utc": true,
1869 + "data_osquery_columns_total_size": true,
1870 + "data_osquery_columns_tty": true,
1871 + "data_osquery_columns_type": true,
1872 + "data_osquery_columns_uid": true,
1873 + "data_osquery_columns_uid_signed": true,
1874 + "data_osquery_columns_user": true,
1875 + "data_osquery_columns_user_time": true,
1876 + "data_osquery_columns_username": true,
1877 + "data_osquery_columns_wired_size": true,
1878 + "data_osquery_counter": true,
1879 + "data_osquery_decorations_host_uuid": true,
1880 + "data_osquery_decorations_hostname": true,
1881 + "data_osquery_epoch": true,
1882 + "data_osquery_hostIdentifier": true,
1883 + "data_osquery_name": true,
1884 + "data_osquery_numerics": true,
1885 + "data_osquery_unixTime": true,
1886 + "data_proto": true,
1887 + "data_sca_check_command": true,
1888 + "data_sca_check_compliance_cis": true,
1889 + "data_sca_check_compliance_cis_csc": true,
1890 + "data_sca_check_compliance_gdpr_IV": true,
1891 + "data_sca_check_compliance_gpg_13": true,
1892 + "data_sca_check_compliance_hipaa": true,
1893 + "data_sca_check_compliance_nist_800_53": true,
1894 + "data_sca_check_compliance_pci_dss": true,
1895 + "data_sca_check_compliance_tsc": true,
1896 + "data_sca_check_description": true,
1897 + "data_sca_check_id": true,
1898 + "data_sca_check_previous_result": true,
1899 + "data_sca_check_rationale": true,
1900 + "data_sca_check_remediation": true,
1901 + "data_sca_check_result": true,
1902 + "data_sca_check_title": true,
1903 + "data_sca_description": true,
1904 + "data_sca_failed": true,
1905 + "data_sca_file": true,
1906 + "data_sca_invalid": true,
1907 + "data_sca_passed": true,
1908 + "data_sca_policy": true,
1909 + "data_sca_policy_id": true,
1910 + "data_sca_scan_id": true,
1911 + "data_sca_score": true,
1912 + "data_sca_total_checks": true,
1913 + "data_sca_type": true,
1914 + "data_script": true,
1915 + "data_src_ip": true,
1916 + "data_src_ip_city_name": true,
1917 + "data_src_ip_country_code": true,
1918 + "data_src_ip_geolocation": true,
1919 + "data_src_port": true,
1920 + "data_srcip": true,
1921 + "data_srcip_city_name": true,
1922 + "data_srcip_country_code": true,
1923 + "data_srcip_geolocation": true,
1924 + "data_srcuser": true,
1925 + "data_timestamp": true,
1926 + "data_title": true,
1927 + "data_tls_session_resumed": true,
1928 + "data_tls_version": true,
1929 + "data_tx_id": true,
1930 + "data_type": true,
1931 + "data_win_eventXML_binaryData": true,
1932 + "data_win_eventXML_binaryDataSize": true,
1933 + "data_win_eventXML_param1": true,
1934 + "data_win_eventdata_authenticationPackageName": true,
1935 + "data_win_eventdata_callTrace": true,
1936 + "data_win_eventdata_commandLine": true,
1937 + "data_win_eventdata_company": true,
1938 + "data_win_eventdata_creationUtcTime": true,
1939 + "data_win_eventdata_currentDirectory": true,
1940 + "data_win_eventdata_description": true,
1941 + "data_win_eventdata_destinationHostname": true,
1942 + "data_win_eventdata_destinationIp": true,
1943 + "data_win_eventdata_destinationIp_city_name": true,
1944 + "data_win_eventdata_destinationIp_country_code": true,
1945 + "data_win_eventdata_destinationIp_geolocation": true,
1946 + "data_win_eventdata_destinationIsIpv6": true,
1947 + "data_win_eventdata_destinationPort": true,
1948 + "data_win_eventdata_destinationPortName": true,
1949 + "data_win_eventdata_details": true,
1950 + "data_win_eventdata_elevatedToken": true,
1951 + "data_win_eventdata_eventType": true,
1952 + "data_win_eventdata_fileVersion": true,
1953 + "data_win_eventdata_fileVersion_city_name": true,
1954 + "data_win_eventdata_fileVersion_country_code": true,
1955 + "data_win_eventdata_fileVersion_geolocation": true,
1956 + "data_win_eventdata_grantedAccess": true,
1957 + "data_win_eventdata_hashes": true,
1958 + "data_win_eventdata_image": true,
1959 + "data_win_eventdata_imageLoaded": true,
1960 + "data_win_eventdata_impersonationLevel": true,
1961 + "data_win_eventdata_initiated": true,
1962 + "data_win_eventdata_integrityLevel": true,
1963 + "data_win_eventdata_ipAddress": true,
1964 + "data_win_eventdata_ipPort": true,
1965 + "data_win_eventdata_keyLength": true,
1966 + "data_win_eventdata_logonGuid": true,
1967 + "data_win_eventdata_logonId": true,
1968 + "data_win_eventdata_logonProcessName": true,
1969 + "data_win_eventdata_logonType": true,
1970 + "data_win_eventdata_originalFileName": true,
1971 + "data_win_eventdata_param1": true,
1972 + "data_win_eventdata_param2": true,
1973 + "data_win_eventdata_param3": true,
1974 + "data_win_eventdata_param4": true,
1975 + "data_win_eventdata_parentCommandLine": true,
1976 + "data_win_eventdata_parentImage": true,
1977 + "data_win_eventdata_parentProcessGuid": true,
1978 + "data_win_eventdata_parentProcessId": true,
1979 + "data_win_eventdata_processGuid": true,
1980 + "data_win_eventdata_processId": true,
1981 + "data_win_eventdata_processName": true,
1982 + "data_win_eventdata_product": true,
1983 + "data_win_eventdata_protocol": true,
1984 + "data_win_eventdata_queryName": true,
1985 + "data_win_eventdata_queryResults": true,
1986 + "data_win_eventdata_queryStatus": true,
1987 + "data_win_eventdata_ruleName": true,
1988 + "data_win_eventdata_serviceName": true,
1989 + "data_win_eventdata_serviceSid": true,
1990 + "data_win_eventdata_signature": true,
1991 + "data_win_eventdata_signatureStatus": true,
1992 + "data_win_eventdata_signed": true,
1993 + "data_win_eventdata_sourceHostname": true,
1994 + "data_win_eventdata_sourceImage": true,
1995 + "data_win_eventdata_sourceIp": true,
1996 + "data_win_eventdata_sourceIp_city_name": true,
1997 + "data_win_eventdata_sourceIp_country_code": true,
1998 + "data_win_eventdata_sourceIp_geolocation": true,
1999 + "data_win_eventdata_sourceIsIpv6": true,
2000 + "data_win_eventdata_sourcePort": true,
2001 + "data_win_eventdata_sourceProcessGUID": true,
2002 + "data_win_eventdata_sourceProcessId": true,
2003 + "data_win_eventdata_sourceThreadId": true,
2004 + "data_win_eventdata_status": true,
2005 + "data_win_eventdata_subjectDomainName": true,
2006 + "data_win_eventdata_subjectLogonId": true,
2007 + "data_win_eventdata_subjectUserName": true,
2008 + "data_win_eventdata_subjectUserSid": true,
2009 + "data_win_eventdata_targetDomainName": true,
2010 + "data_win_eventdata_targetFilename": true,
2011 + "data_win_eventdata_targetImage": true,
2012 + "data_win_eventdata_targetLinkedLogonId": true,
2013 + "data_win_eventdata_targetLogonId": true,
2014 + "data_win_eventdata_targetObject": true,
2015 + "data_win_eventdata_targetProcessGUID": true,
2016 + "data_win_eventdata_targetProcessId": true,
2017 + "data_win_eventdata_targetUserName": true,
2018 + "data_win_eventdata_targetUserSid": true,
2019 + "data_win_eventdata_terminalSessionId": true,
2020 + "data_win_eventdata_ticketEncryptionType": true,
2021 + "data_win_eventdata_ticketOptions": true,
2022 + "data_win_eventdata_user": true,
2023 + "data_win_eventdata_utcTime": true,
2024 + "data_win_eventdata_virtualAccount": true,
2025 + "data_win_system_channel": true,
2026 + "data_win_system_computer": true,
2027 + "data_win_system_eventID": true,
2028 + "data_win_system_eventRecordID": true,
2029 + "data_win_system_eventSourceName": true,
2030 + "data_win_system_keywords": true,
2031 + "data_win_system_level": true,
2032 + "data_win_system_message": true,
2033 + "data_win_system_opcode": true,
2034 + "data_win_system_processID": true,
2035 + "data_win_system_providerGuid": true,
2036 + "data_win_system_providerName": true,
2037 + "data_win_system_severityValue": true,
2038 + "data_win_system_systemTime": true,
2039 + "data_win_system_task": true,
2040 + "data_win_system_threadID": true,
2041 + "data_win_system_version": true,
2042 + "decoder_name": true,
2043 + "decoder_parent": true,
2044 + "dns_query": true,
2045 + "dns_query_threat_indicated": true,
2046 + "dst_ip": true,
2047 + "dst_ip_city_name": true,
2048 + "dst_ip_country_code": true,
2049 + "dst_ip_geolocation": true,
2050 + "dst_ip_threat_indicated": true,
2051 + "dst_port": true,
2052 + "ecs_version": true,
2053 + "error": true,
2054 + "event_hash": true,
2055 + "file_path": true,
2056 + "firewall_rule_name": true,
2057 + "full_log": false,
2058 + "gl2_accounted_message_size": true,
2059 + "gl2_message_id": true,
2060 + "gl2_processing_error": true,
2061 + "gl2_remote_ip": true,
2062 + "gl2_remote_port": true,
2063 + "gl2_source_collector": true,
2064 + "gl2_source_input": true,
2065 + "gl2_source_node": true,
2066 + "hash_md5": true,
2067 + "hash_sha1": true,
2068 + "hash_sha256": true,
2069 + "highlight": true,
2070 + "host_architecture": true,
2071 + "host_containerized": true,
2072 + "host_hostname": true,
2073 + "host_id": true,
2074 + "host_ip": true,
2075 + "host_mac": true,
2076 + "host_name": true,
2077 + "host_os_codename": true,
2078 + "host_os_kernel": true,
2079 + "host_os_name": true,
2080 + "host_os_platform": true,
2081 + "host_os_version": true,
2082 + "hostname": true,
2083 + "id": true,
2084 + "input_type": true,
2085 + "level": true,
2086 + "location": true,
2087 + "log_file_path": true,
2088 + "log_offset": true,
2089 + "manager_name": true,
2090 + "message": true,
2091 + "module": true,
2092 + "msg_timestamp": true,
2093 + "parent_process_cmd_line": true,
2094 + "parent_process_id": true,
2095 + "parent_process_image": true,
2096 + "pid": true,
2097 + "predecoder_hostname": true,
2098 + "predecoder_program_name": true,
2099 + "predecoder_timestamp": true,
2100 + "previous_log": true,
2101 + "previous_output": true,
2102 + "process_cmd_line": true,
2103 + "process_id": true,
2104 + "process_image": true,
2105 + "process_name": true,
2106 + "protocol": true,
2107 + "rule_cis": true,
2108 + "rule_cis_csc": true,
2109 + "rule_firedtimes": true,
2110 + "rule_gdpr": true,
2111 + "rule_gdpr_IV": true,
2112 + "rule_gpg13": true,
2113 + "rule_gpg_13": true,
2114 + "rule_group1": true,
2115 + "rule_group2": true,
2116 + "rule_groups": true,
2117 + "rule_hipaa": true,
2118 + "rule_id": true,
2119 + "rule_info": true,
2120 + "rule_mail": true,
2121 + "rule_mitre_id": true,
2122 + "rule_mitre_tactic": false,
2123 + "rule_nist_800_53": true,
2124 + "rule_pci_dss": true,
2125 + "rule_tsc": true,
2126 + "scanid": true,
2127 + "service": true,
2128 + "software_package": true,
2129 + "software_vendor": true,
2130 + "sort": true,
2131 + "source": true,
2132 + "source_reserved_ip": true,
2133 + "src_ip": true,
2134 + "src_ip_city_name": true,
2135 + "src_ip_country_code": true,
2136 + "src_ip_geolocation": true,
2137 + "src_port": true,
2138 + "streams": true,
2139 + "syscheck_attrs_after": true,
2140 + "syscheck_audit_effective_user_id": true,
2141 + "syscheck_audit_effective_user_name": true,
2142 + "syscheck_audit_group_id": true,
2143 + "syscheck_audit_group_name": true,
2144 + "syscheck_audit_login_user_id": true,
2145 + "syscheck_audit_login_user_name": true,
2146 + "syscheck_audit_process_cwd": true,
2147 + "syscheck_audit_process_id": true,
2148 + "syscheck_audit_process_name": true,
2149 + "syscheck_audit_process_parent_cwd": true,
2150 + "syscheck_audit_process_parent_name": true,
2151 + "syscheck_audit_process_ppid": true,
2152 + "syscheck_audit_user_id": true,
2153 + "syscheck_audit_user_name": true,
2154 + "syscheck_changed_attributes": true,
2155 + "syscheck_event": true,
2156 + "syscheck_gid_after": true,
2157 + "syscheck_gname_after": true,
2158 + "syscheck_hard_links": true,
2159 + "syscheck_inode_after": true,
2160 + "syscheck_inode_before": true,
2161 + "syscheck_md5_after": true,
2162 + "syscheck_md5_before": true,
2163 + "syscheck_mode": true,
2164 + "syscheck_mtime_after": true,
2165 + "syscheck_mtime_before": true,
2166 + "syscheck_path": true,
2167 + "syscheck_perm_after": true,
2168 + "syscheck_perm_before": true,
2169 + "syscheck_sha1_after": true,
2170 + "syscheck_sha1_before": true,
2171 + "syscheck_sha256_after": true,
2172 + "syscheck_sha256_before": true,
2173 + "syscheck_size_after": true,
2174 + "syscheck_size_before": true,
2175 + "syscheck_uid_after": true,
2176 + "syscheck_uname_after": true,
2177 + "syscheck_win_perm_after": true,
2178 + "syscheck_win_perm_after_0_allowed": true,
2179 + "syscheck_win_perm_after_0_name": true,
2180 + "syscheck_win_perm_after_1_allowed": true,
2181 + "syscheck_win_perm_after_1_name": true,
2182 + "syscheck_win_perm_after_2_allowed": true,
2183 + "syscheck_win_perm_after_2_name": true,
2184 + "syscheck_win_perm_after_3_allowed": true,
2185 + "syscheck_win_perm_after_3_name": true,
2186 + "syslog_customer": true,
2187 + "syslog_level": true,
2188 + "syslog_tag": true,
2189 + "syslog_type": true,
2190 + "sysmon_event_description": true,
2191 + "threat_ids": true,
2192 + "threat_indicated": true,
2193 + "threat_names": true,
2194 + "time": true,
2195 + "timestamp": true,
2196 + "true": true,
2197 + "user_name": true,
2198 + "win_registry_key": true,
2199 + "win_system_eventID": true,
2200 + "windows_auth_package": true,
2201 + "windows_domain": true,
2202 + "windows_event_id": true,
2203 + "windows_event_severity": true,
2204 + "windows_logon_type": true
2205 + },
2206 + "indexByName": {
2207 + "_id": 2,
2208 + "_index": 10,
2209 + "_type": 11,
2210 + "agent_id": 12,
2211 + "agent_name": 6,
2212 + "cluster_name": 13,
2213 + "cluster_node": 14,
2214 + "data_integration": 48,
2215 + "data_office365_Application": 49,
2216 + "data_office365_ClientIP": 4,
2217 + "data_office365_ClientIP_city_name": 15,
2218 + "data_office365_ClientIP_country_code": 16,
2219 + "data_office365_ClientIP_geolocation": 17,
2220 + "data_office365_CreationTime": 0,
2221 + "data_office365_DeviceName": 5,
2222 + "data_office365_FileSize": 50,
2223 + "data_office365_FileType": 51,
2224 + "data_office365_Hidden": 53,
2225 + "data_office365_Id": 18,
2226 + "data_office365_MDATPDeviceId": 54,
2227 + "data_office365_ObjectId": 52,
2228 + "data_office365_Operation": 24,
2229 + "data_office365_OrganizationId": 19,
2230 + "data_office365_Platform": 55,
2231 + "data_office365_RecordType": 20,
2232 + "data_office365_Scope": 56,
2233 + "data_office365_SourceLocationType": 57,
2234 + "data_office365_Subscription": 58,
2235 + "data_office365_UserId": 3,
2236 + "data_office365_UserKey": 21,
2237 + "data_office365_UserType": 22,
2238 + "data_office365_Version": 23,
2239 + "data_office365_Workload": 47,
2240 + "decoder_name": 25,
2241 + "gl2_accounted_message_size": 26,
2242 + "gl2_message_id": 27,
2243 + "gl2_processing_error": 28,
2244 + "gl2_remote_ip": 29,
2245 + "gl2_remote_port": 30,
2246 + "gl2_source_input": 31,
2247 + "gl2_source_node": 32,
2248 + "highlight": 33,
2249 + "id": 34,
2250 + "location": 35,
2251 + "manager_name": 36,
2252 + "message": 37,
2253 + "msg_timestamp": 59,
2254 + "rule_description": 7,
2255 + "rule_firedtimes": 38,
2256 + "rule_group1": 39,
2257 + "rule_group2": 60,
2258 + "rule_groups": 40,
2259 + "rule_hipaa": 61,
2260 + "rule_id": 9,
2261 + "rule_level": 8,
2262 + "rule_mail": 41,
2263 + "rule_pci_dss": 62,
2264 + "sort": 42,
2265 + "source": 43,
2266 + "source_reserved_ip": 63,
2267 + "streams": 44,
2268 + "syslog_type": 45,
2269 + "timestamp": 1,
2270 + "true": 46
2271 + },
2272 + "renameByName": {
2273 + "_id": "EVENT ID",
2274 + "agent_name": "",
2275 + "data_office365_ActorIpAddress": "SRC IP",
2276 + "data_office365_AffectedItems": "ITEMS",
2277 + "data_office365_Application": "APP",
2278 + "data_office365_BrowserName": "BROWSER",
2279 + "data_office365_ClientIP": "CLIENT IP",
2280 + "data_office365_ClientIP_city_name": "",
2281 + "data_office365_CreationTime": "EVENT TIME",
2282 + "data_office365_DeviceDisplayName": "",
2283 + "data_office365_DeviceName": "DEVICE",
2284 + "data_office365_FileType": "FILE TYPE",
2285 + "data_office365_Item_Attachments": "ATTACHMENT",
2286 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2287 + "data_office365_Item_Subject": "SUBJECT",
2288 + "data_office365_ObjectId": "OBJECT",
2289 + "data_office365_ResultStatus": "RESULT",
2290 + "data_office365_UserAgent": "USER AGENT",
2291 + "data_office365_UserId": "ACCOUNT",
2292 + "rule_description": "DESCRIPTION",
2293 + "rule_id": "RULE ID",
2294 + "rule_level": "",
2295 + "rule_mitre_tactic": "MITRE TACTIC",
2296 + "rule_mitre_technique": "MITRE TECHNIQUE",
2297 + "timestamp": "Date/Time"
2298 + }
2299 + }
2300 + }
2301 + ],
2302 + "transparent": true,
2303 + "type": "table"
2304 + }
2305 + ],
2306 + "refresh": "",
2307 + "schemaVersion": 38,
2308 + "style": "dark",
2309 + "tags": [
2310 + "O365"
2311 + ],
2312 + "templating": {
2313 + "list": [
2314 + {
2315 + "datasource": {
2316 + "type": "elasticsearch",
2317 + "uid": "replace_datasource_uid"
2318 + },
2319 + "filters": [],
2320 + "hide": 0,
2321 + "label": "",
2322 + "name": "Filters",
2323 + "skipUrlSync": false,
2324 + "type": "adhoc"
2325 + },
2326 + {
2327 + "current": {
2328 + "selected": false,
2329 + "text": "All",
2330 + "value": "$__all"
2331 + },
2332 + "datasource": {
2333 + "type": "elasticsearch",
2334 + "uid": "replace_datasource_uid"
2335 + },
2336 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Endpoint\"}",
2337 + "hide": 0,
2338 + "includeAll": true,
2339 + "label": "Operation",
2340 + "multi": false,
2341 + "name": "operation",
2342 + "options": [],
2343 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Endpoint\"}",
2344 + "refresh": 2,
2345 + "regex": "",
2346 + "skipUrlSync": false,
2347 + "sort": 1,
2348 + "tagValuesQuery": "",
2349 + "tagsQuery": "",
2350 + "type": "query",
2351 + "useTags": false
2352 + },
2353 + {
2354 + "current": {
2355 + "selected": false,
2356 + "text": "All",
2357 + "value": "$__all"
2358 + },
2359 + "datasource": {
2360 + "type": "elasticsearch",
2361 + "uid": "replace_datasource_uid"
2362 + },
2363 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:Endpoint\"}",
2364 + "hide": 0,
2365 + "includeAll": true,
2366 + "label": "Rule Level",
2367 + "multi": false,
2368 + "name": "rule_level",
2369 + "options": [],
2370 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:Endpoint\"}",
2371 + "refresh": 2,
2372 + "regex": "",
2373 + "skipUrlSync": false,
2374 + "sort": 0,
2375 + "type": "query"
2376 + }
2377 + ]
2378 + },
2379 + "time": {
2380 + "from": "now-12h",
2381 + "to": "now"
2382 + },
2383 + "timepicker": {
2384 + "refresh_intervals": [
2385 + "5s",
2386 + "10s",
2387 + "30s",
2388 + "1m",
2389 + "5m",
2390 + "15m",
2391 + "30m",
2392 + "1h",
2393 + "2h",
2394 + "1d"
2395 + ],
2396 + "time_options": [
2397 + "5m",
2398 + "15m",
2399 + "1h",
2400 + "6h",
2401 + "12h",
2402 + "24h",
2403 + "2d",
2404 + "7d",
2405 + "30d"
2406 + ]
2407 + },
2408 + "timezone": "",
2409 + "title": "O365 - ENDPOINT",
2410 + "weekStart": ""
2411 +}
backend/app/connectors/grafana/dashboards/Office365/exchange.json new
+2206
@@ -0,0 +1,2206 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "10.0.3",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "cellOptions": {
261 + "type": "auto"
262 + },
263 + "inspect": false
264 + },
265 + "mappings": [],
266 + "thresholds": {
267 + "mode": "absolute",
268 + "steps": [
269 + {
270 + "color": "red",
271 + "value": null
272 + }
273 + ]
274 + }
275 + },
276 + "overrides": [
277 + {
278 + "matcher": {
279 + "id": "byName",
280 + "options": "Count"
281 + },
282 + "properties": [
283 + {
284 + "id": "displayName",
285 + "value": "EVENTS"
286 + },
287 + {
288 + "id": "unit",
289 + "value": "short"
290 + },
291 + {
292 + "id": "decimals",
293 + "value": -1
294 + },
295 + {
296 + "id": "custom.align"
297 + },
298 + {
299 + "id": "thresholds",
300 + "value": {
301 + "mode": "absolute",
302 + "steps": [
303 + {
304 + "color": "red",
305 + "value": null
306 + }
307 + ]
308 + }
309 + }
310 + ]
311 + }
312 + ]
313 + },
314 + "gridPos": {
315 + "h": 7,
316 + "w": 6,
317 + "x": 8,
318 + "y": 0
319 + },
320 + "id": 54,
321 + "options": {
322 + "cellHeight": "sm",
323 + "footer": {
324 + "countRows": false,
325 + "fields": "",
326 + "reducer": [
327 + "sum"
328 + ],
329 + "show": false
330 + },
331 + "showHeader": true
332 + },
333 + "pluginVersion": "10.0.3",
334 + "targets": [
335 + {
336 + "bucketAggs": [
337 + {
338 + "fake": true,
339 + "field": "data_office365_Operation",
340 + "id": "4",
341 + "settings": {
342 + "min_doc_count": 1,
343 + "order": "desc",
344 + "orderBy": "_count",
345 + "size": "0"
346 + },
347 + "type": "terms"
348 + }
349 + ],
350 + "datasource": {
351 + "type": "elasticsearch",
352 + "uid": "replace_datasource_uid"
353 + },
354 + "metrics": [
355 + {
356 + "field": "select field",
357 + "id": "1",
358 + "type": "count"
359 + }
360 + ],
361 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
362 + "refId": "A",
363 + "timeField": "timestamp"
364 + }
365 + ],
366 + "title": "EVENTS BY OPERATION",
367 + "transformations": [
368 + {
369 + "id": "merge",
370 + "options": {
371 + "reducers": []
372 + }
373 + },
374 + {
375 + "id": "organize",
376 + "options": {
377 + "excludeByName": {},
378 + "indexByName": {},
379 + "renameByName": {
380 + "Count": "EVENTS",
381 + "data_office365_Operation": "OPERATION"
382 + }
383 + }
384 + }
385 + ],
386 + "type": "table"
387 + },
388 + {
389 + "datasource": {
390 + "type": "elasticsearch",
391 + "uid": "replace_datasource_uid"
392 + },
393 + "fieldConfig": {
394 + "defaults": {
395 + "color": {
396 + "mode": "thresholds"
397 + },
398 + "mappings": [
399 + {
400 + "options": {
401 + "match": "null",
402 + "result": {
403 + "text": "N/A"
404 + }
405 + },
406 + "type": "special"
407 + }
408 + ],
409 + "max": 15,
410 + "min": 0,
411 + "thresholds": {
412 + "mode": "absolute",
413 + "steps": [
414 + {
415 + "color": "#299c46",
416 + "value": null
417 + },
418 + {
419 + "color": "rgba(237, 129, 40, 0.89)",
420 + "value": 8
421 + },
422 + {
423 + "color": "#d44a3a",
424 + "value": 12
425 + }
426 + ]
427 + },
428 + "unit": "none"
429 + },
430 + "overrides": []
431 + },
432 + "gridPos": {
433 + "h": 7,
434 + "w": 4,
435 + "x": 0,
436 + "y": 7
437 + },
438 + "id": 16,
439 + "links": [],
440 + "options": {
441 + "orientation": "horizontal",
442 + "reduceOptions": {
443 + "calcs": [
444 + "max"
445 + ],
446 + "fields": "",
447 + "values": false
448 + },
449 + "showThresholdLabels": false,
450 + "showThresholdMarkers": true,
451 + "text": {}
452 + },
453 + "pluginVersion": "10.0.3",
454 + "targets": [
455 + {
456 + "bucketAggs": [
457 + {
458 + "field": "timestamp",
459 + "id": "2",
460 + "settings": {
461 + "interval": "auto",
462 + "min_doc_count": 0,
463 + "trimEdges": 0
464 + },
465 + "type": "date_histogram"
466 + }
467 + ],
468 + "datasource": {
469 + "type": "elasticsearch",
470 + "uid": "replace_datasource_uid"
471 + },
472 + "metrics": [
473 + {
474 + "field": "rule_level",
475 + "id": "1",
476 + "meta": {},
477 + "settings": {},
478 + "type": "max"
479 + }
480 + ],
481 + "query": "data_office365_Operation:$operation",
482 + "refId": "A",
483 + "timeField": "timestamp"
484 + }
485 + ],
486 + "title": "MAX SEVERITY (0 - 15)",
487 + "type": "gauge"
488 + },
489 + {
490 + "datasource": {
491 + "type": "elasticsearch",
492 + "uid": "replace_datasource_uid"
493 + },
494 + "fieldConfig": {
495 + "defaults": {
496 + "color": {
497 + "mode": "palette-classic"
498 + },
499 + "custom": {
500 + "axisCenteredZero": false,
501 + "axisColorMode": "text",
502 + "axisLabel": "",
503 + "axisPlacement": "auto",
504 + "barAlignment": 0,
505 + "drawStyle": "bars",
506 + "fillOpacity": 0,
507 + "gradientMode": "none",
508 + "hideFrom": {
509 + "legend": false,
510 + "tooltip": false,
511 + "viz": false
512 + },
513 + "lineInterpolation": "linear",
514 + "lineWidth": 1,
515 + "pointSize": 5,
516 + "scaleDistribution": {
517 + "type": "linear"
518 + },
519 + "showPoints": "auto",
520 + "spanNulls": false,
521 + "stacking": {
522 + "group": "A",
523 + "mode": "normal"
524 + },
525 + "thresholdsStyle": {
526 + "mode": "off"
527 + }
528 + },
529 + "mappings": [],
530 + "thresholds": {
531 + "mode": "absolute",
532 + "steps": [
533 + {
534 + "color": "green",
535 + "value": null
536 + },
537 + {
538 + "color": "red",
539 + "value": 80
540 + }
541 + ]
542 + }
543 + },
544 + "overrides": []
545 + },
546 + "gridPos": {
547 + "h": 13,
548 + "w": 20,
549 + "x": 4,
550 + "y": 7
551 + },
552 + "id": 60,
553 + "options": {
554 + "legend": {
555 + "calcs": [],
556 + "displayMode": "table",
557 + "placement": "right",
558 + "showLegend": true
559 + },
560 + "tooltip": {
561 + "mode": "single",
562 + "sort": "none"
563 + }
564 + },
565 + "targets": [
566 + {
567 + "alias": "",
568 + "bucketAggs": [
569 + {
570 + "field": "data_office365_Operation",
571 + "id": "3",
572 + "settings": {
573 + "min_doc_count": "1",
574 + "order": "desc",
575 + "orderBy": "_count",
576 + "size": "10"
577 + },
578 + "type": "terms"
579 + },
580 + {
581 + "field": "timestamp",
582 + "id": "2",
583 + "settings": {
584 + "interval": "auto"
585 + },
586 + "type": "date_histogram"
587 + }
588 + ],
589 + "datasource": {
590 + "type": "elasticsearch",
591 + "uid": "replace_datasource_uid"
592 + },
593 + "metrics": [
594 + {
595 + "id": "1",
596 + "type": "count"
597 + }
598 + ],
599 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
600 + "refId": "A",
601 + "timeField": "timestamp"
602 + }
603 + ],
604 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
605 + "transparent": true,
606 + "type": "timeseries"
607 + },
608 + {
609 + "datasource": {
610 + "type": "elasticsearch",
611 + "uid": "replace_datasource_uid"
612 + },
613 + "fieldConfig": {
614 + "defaults": {
615 + "mappings": [
616 + {
617 + "options": {
618 + "match": "null",
619 + "result": {
620 + "text": "N/A"
621 + }
622 + },
623 + "type": "special"
624 + }
625 + ],
626 + "thresholds": {
627 + "mode": "absolute",
628 + "steps": [
629 + {
630 + "color": "blue",
631 + "value": null
632 + }
633 + ]
634 + },
635 + "unit": "locale"
636 + },
637 + "overrides": []
638 + },
639 + "gridPos": {
640 + "h": 6,
641 + "w": 4,
642 + "x": 0,
643 + "y": 14
644 + },
645 + "id": 51,
646 + "links": [],
647 + "options": {
648 + "colorMode": "value",
649 + "graphMode": "area",
650 + "justifyMode": "auto",
651 + "orientation": "horizontal",
652 + "reduceOptions": {
653 + "calcs": [
654 + "sum"
655 + ],
656 + "fields": "",
657 + "values": false
658 + },
659 + "text": {},
660 + "textMode": "auto"
661 + },
662 + "pluginVersion": "10.0.3",
663 + "targets": [
664 + {
665 + "bucketAggs": [
666 + {
667 + "$$hashKey": "object:331",
668 + "field": "timestamp",
669 + "id": "2",
670 + "settings": {
671 + "interval": "auto",
672 + "min_doc_count": 0,
673 + "trimEdges": 0
674 + },
675 + "type": "date_histogram"
676 + }
677 + ],
678 + "datasource": {
679 + "type": "elasticsearch",
680 + "uid": "replace_datasource_uid"
681 + },
682 + "metrics": [
683 + {
684 + "$$hashKey": "object:329",
685 + "field": "select field",
686 + "id": "1",
687 + "type": "count"
688 + }
689 + ],
690 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
691 + "refId": "A",
692 + "timeField": "timestamp"
693 + }
694 + ],
695 + "title": "EVENTS (Total)",
696 + "type": "stat"
697 + },
698 + {
699 + "datasource": {
700 + "type": "elasticsearch",
701 + "uid": "replace_datasource_uid"
702 + },
703 + "fieldConfig": {
704 + "defaults": {
705 + "mappings": [
706 + {
707 + "options": {
708 + "match": "null",
709 + "result": {
710 + "text": "N/A"
711 + }
712 + },
713 + "type": "special"
714 + }
715 + ],
716 + "thresholds": {
717 + "mode": "absolute",
718 + "steps": [
719 + {
720 + "color": "orange",
721 + "value": null
722 + }
723 + ]
724 + },
725 + "unit": "locale"
726 + },
727 + "overrides": []
728 + },
729 + "gridPos": {
730 + "h": 6,
731 + "w": 4,
732 + "x": 0,
733 + "y": 20
734 + },
735 + "id": 52,
736 + "links": [],
737 + "options": {
738 + "colorMode": "value",
739 + "graphMode": "area",
740 + "justifyMode": "auto",
741 + "orientation": "horizontal",
742 + "reduceOptions": {
743 + "calcs": [
744 + "sum"
745 + ],
746 + "fields": "",
747 + "values": false
748 + },
749 + "text": {},
750 + "textMode": "auto"
751 + },
752 + "pluginVersion": "10.0.3",
753 + "targets": [
754 + {
755 + "bucketAggs": [
756 + {
757 + "$$hashKey": "object:331",
758 + "field": "timestamp",
759 + "id": "2",
760 + "settings": {
761 + "interval": "auto",
762 + "min_doc_count": 0,
763 + "trimEdges": 0
764 + },
765 + "type": "date_histogram"
766 + }
767 + ],
768 + "datasource": {
769 + "type": "elasticsearch",
770 + "uid": "replace_datasource_uid"
771 + },
772 + "metrics": [
773 + {
774 + "$$hashKey": "object:329",
775 + "field": "select field",
776 + "id": "1",
777 + "type": "count"
778 + }
779 + ],
780 + "query": "data_office365_Operation:MessageCreatedHasLink AND rule_level:$rule_level",
781 + "refId": "A",
782 + "timeField": "timestamp"
783 + }
784 + ],
785 + "title": "EXCHANGE - MESSAGES CONTAINING LINK",
786 + "type": "stat"
787 + },
788 + {
789 + "circleMaxSize": 30,
790 + "circleMinSize": 2,
791 + "colors": [
792 + "rgba(245, 54, 54, 0.9)",
793 + "rgba(237, 129, 40, 0.89)",
794 + "rgba(50, 172, 45, 0.97)"
795 + ],
796 + "datasource": {
797 + "type": "elasticsearch",
798 + "uid": "replace_datasource_uid"
799 + },
800 + "decimals": 0,
801 + "esMetric": "Count",
802 + "gridPos": {
803 + "h": 12,
804 + "w": 10,
805 + "x": 4,
806 + "y": 20
807 + },
808 + "hideEmpty": false,
809 + "hideZero": false,
810 + "id": 50,
811 + "initialZoom": 1,
812 + "locationData": "countries",
813 + "mapCenter": "(0°, 0°)",
814 + "mapCenterLatitude": 0,
815 + "mapCenterLongitude": 0,
816 + "maxDataPoints": 1,
817 + "mouseWheelZoom": false,
818 + "showLegend": true,
819 + "stickyLabels": false,
820 + "tableQueryOptions": {
821 + "geohashField": "geohash",
822 + "latitudeField": "latitude",
823 + "longitudeField": "longitude",
824 + "metricField": "metric",
825 + "queryType": "geohash"
826 + },
827 + "targets": [
828 + {
829 + "bucketAggs": [
830 + {
831 + "fake": true,
832 + "field": "data_office365_ClientIP_country_code",
833 + "id": "3",
834 + "settings": {
835 + "min_doc_count": 1,
836 + "order": "desc",
837 + "orderBy": "_term",
838 + "size": "0"
839 + },
840 + "type": "terms"
841 + },
842 + {
843 + "field": "timestamp",
844 + "id": "2",
845 + "settings": {
846 + "interval": "auto",
847 + "min_doc_count": 0,
848 + "trimEdges": 0
849 + },
850 + "type": "date_histogram"
851 + }
852 + ],
853 + "datasource": {
854 + "type": "elasticsearch",
855 + "uid": "replace_datasource_uid"
856 + },
857 + "metrics": [
858 + {
859 + "field": "select field",
860 + "id": "1",
861 + "type": "count"
862 + }
863 + ],
864 + "query": "data_office365_Workload:Exchange AND rule_level:$rule_level",
865 + "refId": "A",
866 + "timeField": "timestamp"
867 + }
868 + ],
869 + "thresholds": "0,10",
870 + "title": "EXCHANGE - ALL EVENTS BY SRC COUNTRY",
871 + "type": "grafana-worldmap-panel",
872 + "unitPlural": "",
873 + "unitSingle": "",
874 + "valueName": "total"
875 + },
876 + {
877 + "datasource": {
878 + "type": "elasticsearch",
879 + "uid": "replace_datasource_uid"
880 + },
881 + "fieldConfig": {
882 + "defaults": {
883 + "color": {
884 + "mode": "thresholds"
885 + },
886 + "custom": {
887 + "align": "auto",
888 + "cellOptions": {
889 + "type": "auto"
890 + },
891 + "inspect": false
892 + },
893 + "mappings": [],
894 + "thresholds": {
895 + "mode": "absolute",
896 + "steps": [
897 + {
898 + "color": "orange",
899 + "value": null
900 + }
901 + ]
902 + }
903 + },
904 + "overrides": [
905 + {
906 + "matcher": {
907 + "id": "byName",
908 + "options": "Count"
909 + },
910 + "properties": [
911 + {
912 + "id": "displayName",
913 + "value": "EVENTS"
914 + },
915 + {
916 + "id": "unit",
917 + "value": "short"
918 + },
919 + {
920 + "id": "decimals",
921 + "value": -1
922 + },
923 + {
924 + "id": "custom.align"
925 + }
926 + ]
927 + },
928 + {
929 + "matcher": {
930 + "id": "byName",
931 + "options": "AD ACCOUNT"
932 + },
933 + "properties": [
934 + {
935 + "id": "custom.width",
936 + "value": 377
937 + }
938 + ]
939 + }
940 + ]
941 + },
942 + "gridPos": {
943 + "h": 12,
944 + "w": 10,
945 + "x": 14,
946 + "y": 20
947 + },
948 + "id": 58,
949 + "options": {
950 + "cellHeight": "sm",
951 + "footer": {
952 + "countRows": false,
953 + "fields": "",
954 + "reducer": [
955 + "sum"
956 + ],
957 + "show": false
958 + },
959 + "showHeader": true,
960 + "sortBy": []
961 + },
962 + "pluginVersion": "10.0.3",
963 + "targets": [
964 + {
965 + "bucketAggs": [
966 + {
967 + "fake": true,
968 + "field": "data_office365_UserId",
969 + "id": "4",
970 + "settings": {
971 + "min_doc_count": 1,
972 + "order": "desc",
973 + "orderBy": "_count",
974 + "size": "0"
975 + },
976 + "type": "terms"
977 + },
978 + {
979 + "field": "data_office365_ClientIP_country_code",
980 + "id": "5",
981 + "settings": {
982 + "min_doc_count": "1",
983 + "order": "desc",
984 + "orderBy": "_term",
985 + "size": "10"
986 + },
987 + "type": "terms"
988 + }
989 + ],
990 + "datasource": {
991 + "type": "elasticsearch",
992 + "uid": "replace_datasource_uid"
993 + },
994 + "metrics": [
995 + {
996 + "field": "select field",
997 + "id": "1",
998 + "type": "count"
999 + }
1000 + ],
1001 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1002 + "refId": "A",
1003 + "timeField": "timestamp"
1004 + }
1005 + ],
1006 + "title": "EXCHANGE EVENTS BY ACCOUNT",
1007 + "transformations": [
1008 + {
1009 + "id": "merge",
1010 + "options": {
1011 + "reducers": []
1012 + }
1013 + },
1014 + {
1015 + "id": "organize",
1016 + "options": {
1017 + "excludeByName": {},
1018 + "indexByName": {},
1019 + "renameByName": {
1020 + "Count": "EVENTS",
1021 + "data_office365_ClientIP_country_code": "COUNTRY",
1022 + "data_office365_LogonError": "ERROR",
1023 + "data_office365_Operation": "WORKLOAD",
1024 + "data_office365_UserId": "AD ACCOUNT"
1025 + }
1026 + }
1027 + }
1028 + ],
1029 + "type": "table"
1030 + },
1031 + {
1032 + "datasource": {
1033 + "type": "elasticsearch",
1034 + "uid": "replace_datasource_uid"
1035 + },
1036 + "fieldConfig": {
1037 + "defaults": {
1038 + "mappings": [
1039 + {
1040 + "options": {
1041 + "match": "null",
1042 + "result": {
1043 + "text": "N/A"
1044 + }
1045 + },
1046 + "type": "special"
1047 + }
1048 + ],
1049 + "thresholds": {
1050 + "mode": "absolute",
1051 + "steps": [
1052 + {
1053 + "color": "blue",
1054 + "value": null
1055 + }
1056 + ]
1057 + },
1058 + "unit": "locale"
1059 + },
1060 + "overrides": []
1061 + },
1062 + "gridPos": {
1063 + "h": 6,
1064 + "w": 4,
1065 + "x": 0,
1066 + "y": 26
1067 + },
1068 + "id": 18,
1069 + "links": [],
1070 + "options": {
1071 + "colorMode": "value",
1072 + "graphMode": "area",
1073 + "justifyMode": "auto",
1074 + "orientation": "horizontal",
1075 + "reduceOptions": {
1076 + "calcs": [
1077 + "sum"
1078 + ],
1079 + "fields": "",
1080 + "values": false
1081 + },
1082 + "text": {},
1083 + "textMode": "auto"
1084 + },
1085 + "pluginVersion": "10.0.3",
1086 + "targets": [
1087 + {
1088 + "bucketAggs": [
1089 + {
1090 + "$$hashKey": "object:331",
1091 + "field": "timestamp",
1092 + "id": "2",
1093 + "settings": {
1094 + "interval": "auto",
1095 + "min_doc_count": 0,
1096 + "trimEdges": 0
1097 + },
1098 + "type": "date_histogram"
1099 + }
1100 + ],
1101 + "datasource": {
1102 + "type": "elasticsearch",
1103 + "uid": "replace_datasource_uid"
1104 + },
1105 + "metrics": [
1106 + {
1107 + "$$hashKey": "object:329",
1108 + "field": "select field",
1109 + "id": "1",
1110 + "type": "count"
1111 + }
1112 + ],
1113 + "query": "data_office365_Operation:TeamsSessionStarted AND rule_level:$rule_level",
1114 + "refId": "A",
1115 + "timeField": "timestamp"
1116 + }
1117 + ],
1118 + "title": "EXCHANGE - SESSIONS STARTED",
1119 + "type": "stat"
1120 + },
1121 + {
1122 + "datasource": {
1123 + "type": "elasticsearch",
1124 + "uid": "replace_datasource_uid"
1125 + },
1126 + "fieldConfig": {
1127 + "defaults": {
1128 + "color": {
1129 + "mode": "thresholds"
1130 + },
1131 + "custom": {
1132 + "align": "auto",
1133 + "cellOptions": {
1134 + "type": "auto"
1135 + },
1136 + "filterable": true,
1137 + "inspect": false
1138 + },
1139 + "mappings": [],
1140 + "thresholds": {
1141 + "mode": "absolute",
1142 + "steps": [
1143 + {
1144 + "color": "green",
1145 + "value": null
1146 + },
1147 + {
1148 + "color": "red",
1149 + "value": 80
1150 + }
1151 + ]
1152 + }
1153 + },
1154 + "overrides": [
1155 + {
1156 + "matcher": {
1157 + "id": "byName",
1158 + "options": "rule_level"
1159 + },
1160 + "properties": [
1161 + {
1162 + "id": "displayName",
1163 + "value": "RULE LEVEL"
1164 + },
1165 + {
1166 + "id": "unit",
1167 + "value": "short"
1168 + },
1169 + {
1170 + "id": "decimals",
1171 + "value": -1
1172 + },
1173 + {
1174 + "id": "custom.cellOptions",
1175 + "value": {
1176 + "mode": "gradient",
1177 + "type": "color-background"
1178 + }
1179 + },
1180 + {
1181 + "id": "custom.align"
1182 + },
1183 + {
1184 + "id": "thresholds",
1185 + "value": {
1186 + "mode": "absolute",
1187 + "steps": [
1188 + {
1189 + "color": "#37872D",
1190 + "value": null
1191 + },
1192 + {
1193 + "color": "rgba(237, 129, 40, 0.89)",
1194 + "value": 7
1195 + },
1196 + {
1197 + "color": "rgba(245, 54, 54, 0.9)",
1198 + "value": 12
1199 + }
1200 + ]
1201 + }
1202 + }
1203 + ]
1204 + },
1205 + {
1206 + "matcher": {
1207 + "id": "byName",
1208 + "options": "Date/Time"
1209 + },
1210 + "properties": [
1211 + {
1212 + "id": "custom.width",
1213 + "value": 242
1214 + }
1215 + ]
1216 + },
1217 + {
1218 + "matcher": {
1219 + "id": "byName",
1220 + "options": "MITRE TACTIC"
1221 + },
1222 + "properties": [
1223 + {
1224 + "id": "custom.width",
1225 + "value": 332
1226 + }
1227 + ]
1228 + },
1229 + {
1230 + "matcher": {
1231 + "id": "byName",
1232 + "options": "IP ADDRESS"
1233 + },
1234 + "properties": [
1235 + {
1236 + "id": "custom.width",
1237 + "value": 163
1238 + }
1239 + ]
1240 + },
1241 + {
1242 + "matcher": {
1243 + "id": "byName",
1244 + "options": "MITRE TECHNIQUE"
1245 + },
1246 + "properties": [
1247 + {
1248 + "id": "custom.width",
1249 + "value": 312
1250 + }
1251 + ]
1252 + },
1253 + {
1254 + "matcher": {
1255 + "id": "byName",
1256 + "options": "EVENT ID"
1257 + },
1258 + "properties": [
1259 + {
1260 + "id": "links",
1261 + "value": [
1262 + {
1263 + "targetBlank": true,
1264 + "title": "VIEW EVENT DETAILS",
1265 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1266 + }
1267 + ]
1268 + },
1269 + {
1270 + "id": "custom.width",
1271 + "value": 265
1272 + }
1273 + ]
1274 + },
1275 + {
1276 + "matcher": {
1277 + "id": "byName",
1278 + "options": "RESULT"
1279 + },
1280 + "properties": [
1281 + {
1282 + "id": "custom.width",
1283 + "value": 118
1284 + },
1285 + {
1286 + "id": "mappings",
1287 + "value": [
1288 + {
1289 + "options": {
1290 + "Failed": {
1291 + "color": "orange",
1292 + "index": 1
1293 + },
1294 + "Success": {
1295 + "color": "green",
1296 + "index": 0
1297 + }
1298 + },
1299 + "type": "value"
1300 + }
1301 + ]
1302 + },
1303 + {
1304 + "id": "custom.cellOptions",
1305 + "value": {
1306 + "type": "color-text"
1307 + }
1308 + }
1309 + ]
1310 + },
1311 + {
1312 + "matcher": {
1313 + "id": "byName",
1314 + "options": "SRC IP"
1315 + },
1316 + "properties": [
1317 + {
1318 + "id": "custom.width",
1319 + "value": 265
1320 + }
1321 + ]
1322 + },
1323 + {
1324 + "matcher": {
1325 + "id": "byName",
1326 + "options": "ACCOUNT"
1327 + },
1328 + "properties": [
1329 + {
1330 + "id": "custom.width",
1331 + "value": 227
1332 + }
1333 + ]
1334 + },
1335 + {
1336 + "matcher": {
1337 + "id": "byName",
1338 + "options": "EVENT TIME"
1339 + },
1340 + "properties": [
1341 + {
1342 + "id": "custom.width",
1343 + "value": 195
1344 + }
1345 + ]
1346 + },
1347 + {
1348 + "matcher": {
1349 + "id": "byName",
1350 + "options": "CLIENT IP"
1351 + },
1352 + "properties": [
1353 + {
1354 + "id": "custom.width",
1355 + "value": 229
1356 + }
1357 + ]
1358 + },
1359 + {
1360 + "matcher": {
1361 + "id": "byName",
1362 + "options": "DESCRIPTION"
1363 + },
1364 + "properties": [
1365 + {
1366 + "id": "custom.width",
1367 + "value": 491
1368 + }
1369 + ]
1370 + }
1371 + ]
1372 + },
1373 + "gridPos": {
1374 + "h": 16,
1375 + "w": 24,
1376 + "x": 0,
1377 + "y": 32
1378 + },
1379 + "id": 27,
1380 + "options": {
1381 + "cellHeight": "sm",
1382 + "footer": {
1383 + "countRows": false,
1384 + "enablePagination": true,
1385 + "fields": "",
1386 + "reducer": [
1387 + "sum"
1388 + ],
1389 + "show": false
1390 + },
1391 + "showHeader": true,
1392 + "sortBy": []
1393 + },
1394 + "pluginVersion": "10.0.3",
1395 + "targets": [
1396 + {
1397 + "bucketAggs": [],
1398 + "datasource": {
1399 + "type": "elasticsearch",
1400 + "uid": "replace_datasource_uid"
1401 + },
1402 + "metrics": [
1403 + {
1404 + "id": "1",
1405 + "settings": {
1406 + "size": "250"
1407 + },
1408 + "type": "raw_data"
1409 + }
1410 + ],
1411 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1412 + "refId": "A",
1413 + "timeField": "timestamp"
1414 + }
1415 + ],
1416 + "title": "EVENTS",
1417 + "transformations": [
1418 + {
1419 + "id": "organize",
1420 + "options": {
1421 + "excludeByName": {
1422 + "@metadata_beat": true,
1423 + "@metadata_type": true,
1424 + "@metadata_version": true,
1425 + "IMPHASH": true,
1426 + "MD5": true,
1427 + "SHA1": true,
1428 + "SHA256": true,
1429 + "_id": false,
1430 + "_index": true,
1431 + "_type": true,
1432 + "agent_ephemeral_id": true,
1433 + "agent_hostname": true,
1434 + "agent_id": true,
1435 + "agent_ip_city_name": true,
1436 + "agent_ip_country_code": true,
1437 + "agent_ip_geolocation": true,
1438 + "agent_name": true,
1439 + "agent_type": true,
1440 + "agent_version": true,
1441 + "beats_type": true,
1442 + "cluster_name": true,
1443 + "cluster_node": true,
1444 + "collector_node_id": true,
1445 + "data_alert_action": true,
1446 + "data_alert_category": true,
1447 + "data_alert_gid": true,
1448 + "data_alert_rev": true,
1449 + "data_alert_severity": true,
1450 + "data_alert_signature": true,
1451 + "data_alert_signature_id": true,
1452 + "data_app_proto": true,
1453 + "data_audit_auid": true,
1454 + "data_audit_command": true,
1455 + "data_audit_euid": true,
1456 + "data_audit_exe": true,
1457 + "data_audit_gid": true,
1458 + "data_audit_id": true,
1459 + "data_audit_pid": true,
1460 + "data_audit_res": true,
1461 + "data_audit_session": true,
1462 + "data_audit_type": true,
1463 + "data_audit_uid": true,
1464 + "data_dest_ip": true,
1465 + "data_dest_port": true,
1466 + "data_dstuser": true,
1467 + "data_event_type": true,
1468 + "data_extra_data": true,
1469 + "data_file": true,
1470 + "data_flow_bytes_toclient": true,
1471 + "data_flow_bytes_toserver": true,
1472 + "data_flow_id": true,
1473 + "data_flow_pkts_toclient": true,
1474 + "data_flow_pkts_toserver": true,
1475 + "data_flow_start": true,
1476 + "data_http_http_content_type": true,
1477 + "data_http_http_port": true,
1478 + "data_http_length": true,
1479 + "data_http_status": true,
1480 + "data_http_url": true,
1481 + "data_id": true,
1482 + "data_in_iface": true,
1483 + "data_integration": true,
1484 + "data_metadata_flowbits": true,
1485 + "data_metadata_flowints_http_anomaly_count": true,
1486 + "data_metadata_flowints_tcp_retransmission_count": true,
1487 + "data_office365_AADGroupId": true,
1488 + "data_office365_Actor": true,
1489 + "data_office365_ActorContextId": true,
1490 + "data_office365_ActorIpAddress": false,
1491 + "data_office365_ActorIpAddress_city_name": true,
1492 + "data_office365_ActorIpAddress_country_code": true,
1493 + "data_office365_ActorIpAddress_geolocation": true,
1494 + "data_office365_AppAccessContext_APIId": true,
1495 + "data_office365_AppAccessContext_ClientAppId": true,
1496 + "data_office365_AppAccessContext_ClientAppName": true,
1497 + "data_office365_AppAccessContext_CorrelationId": true,
1498 + "data_office365_AppId": true,
1499 + "data_office365_ApplicationId": true,
1500 + "data_office365_ArtifactsShared": true,
1501 + "data_office365_Attendees": true,
1502 + "data_office365_AzureActiveDirectoryEventType": true,
1503 + "data_office365_ChannelGuid": true,
1504 + "data_office365_ChannelName": true,
1505 + "data_office365_ChatName": true,
1506 + "data_office365_ChatThreadId": true,
1507 + "data_office365_ClientAppId": true,
1508 + "data_office365_ClientIP": false,
1509 + "data_office365_ClientIPAddress": true,
1510 + "data_office365_ClientIPAddress_city_name": true,
1511 + "data_office365_ClientIPAddress_country_code": true,
1512 + "data_office365_ClientIPAddress_geolocation": true,
1513 + "data_office365_ClientIP_city_name": true,
1514 + "data_office365_ClientIP_country_code": true,
1515 + "data_office365_ClientIP_geolocation": true,
1516 + "data_office365_ClientInfoString": true,
1517 + "data_office365_ClientProcessName": true,
1518 + "data_office365_ClientRequestId": true,
1519 + "data_office365_ClientVersion": true,
1520 + "data_office365_CommunicationSubType": true,
1521 + "data_office365_CommunicationType": true,
1522 + "data_office365_CreationTime": false,
1523 + "data_office365_CrossMailboxOperation": true,
1524 + "data_office365_DestFolder_Id": true,
1525 + "data_office365_DestFolder_Path": true,
1526 + "data_office365_DeviceId": true,
1527 + "data_office365_DeviceInformation": true,
1528 + "data_office365_DeviceProperties": true,
1529 + "data_office365_EndTime": true,
1530 + "data_office365_ErrorNumber": true,
1531 + "data_office365_ExchangeId": true,
1532 + "data_office365_ExtendedProperties": true,
1533 + "data_office365_ExternalAccess": true,
1534 + "data_office365_ExtraProperties": true,
1535 + "data_office365_Folder_Id": true,
1536 + "data_office365_Folder_Path": true,
1537 + "data_office365_HostedContents": true,
1538 + "data_office365_ICalUid": true,
1539 + "data_office365_Id": true,
1540 + "data_office365_InterSystemsId": true,
1541 + "data_office365_InternalLogonType": true,
1542 + "data_office365_IntraSystemId": true,
1543 + "data_office365_ItemName": true,
1544 + "data_office365_Item_Id": true,
1545 + "data_office365_Item_InternetMessageId": true,
1546 + "data_office365_Item_IsRecord": true,
1547 + "data_office365_Item_ParentFolder_Id": true,
1548 + "data_office365_Item_SizeInBytes": true,
1549 + "data_office365_JoinTime": true,
1550 + "data_office365_LeaveTime": true,
1551 + "data_office365_LogonError": true,
1552 + "data_office365_LogonType": true,
1553 + "data_office365_LogonUserSid": true,
1554 + "data_office365_MailboxGuid": true,
1555 + "data_office365_MailboxOwnerSid": true,
1556 + "data_office365_MailboxOwnerUPN": true,
1557 + "data_office365_MeetingDetailId": true,
1558 + "data_office365_MeetingURL": true,
1559 + "data_office365_Members": true,
1560 + "data_office365_MessageId": true,
1561 + "data_office365_MessageSizeInBytes": true,
1562 + "data_office365_MessageURLs": true,
1563 + "data_office365_MessageVersion": true,
1564 + "data_office365_Modalities": true,
1565 + "data_office365_ModifiedProperties": true,
1566 + "data_office365_Name": true,
1567 + "data_office365_NewValue": true,
1568 + "data_office365_ObjectId": true,
1569 + "data_office365_Operation": true,
1570 + "data_office365_OperationScope": true,
1571 + "data_office365_OrganizationId": true,
1572 + "data_office365_OrganizationName": true,
1573 + "data_office365_Organizer_OrganizationId": true,
1574 + "data_office365_Organizer_RecipientType": true,
1575 + "data_office365_Organizer_Role": true,
1576 + "data_office365_Organizer_UserObjectId": true,
1577 + "data_office365_OriginatingServer": true,
1578 + "data_office365_Parameters": true,
1579 + "data_office365_ParentMessageId": true,
1580 + "data_office365_ProviderTypes": true,
1581 + "data_office365_RecordType": true,
1582 + "data_office365_ResultStatus": true,
1583 + "data_office365_SessionId": true,
1584 + "data_office365_StartTime": true,
1585 + "data_office365_Subscription": true,
1586 + "data_office365_SubscriptionId": true,
1587 + "data_office365_Target": true,
1588 + "data_office365_TargetContextId": true,
1589 + "data_office365_TeamGuid": true,
1590 + "data_office365_TeamName": true,
1591 + "data_office365_UserId": false,
1592 + "data_office365_UserKey": true,
1593 + "data_office365_UserType": true,
1594 + "data_office365_Version": true,
1595 + "data_office365_Workload": true,
1596 + "data_osquery_action": true,
1597 + "data_osquery_calendarTime": true,
1598 + "data_osquery_columns_address": true,
1599 + "data_osquery_columns_address_city_name": true,
1600 + "data_osquery_columns_address_country_code": true,
1601 + "data_osquery_columns_address_geolocation": true,
1602 + "data_osquery_columns_cmdline": true,
1603 + "data_osquery_columns_cwd": true,
1604 + "data_osquery_columns_description": true,
1605 + "data_osquery_columns_directory": true,
1606 + "data_osquery_columns_disk_bytes_read": true,
1607 + "data_osquery_columns_disk_bytes_written": true,
1608 + "data_osquery_columns_egid": true,
1609 + "data_osquery_columns_euid": true,
1610 + "data_osquery_columns_family": true,
1611 + "data_osquery_columns_fd": true,
1612 + "data_osquery_columns_gid": true,
1613 + "data_osquery_columns_gid_signed": true,
1614 + "data_osquery_columns_host": true,
1615 + "data_osquery_columns_interface": true,
1616 + "data_osquery_columns_local_address": true,
1617 + "data_osquery_columns_local_address_city_name": true,
1618 + "data_osquery_columns_local_address_country_code": true,
1619 + "data_osquery_columns_local_address_geolocation": true,
1620 + "data_osquery_columns_local_port": true,
1621 + "data_osquery_columns_mac": true,
1622 + "data_osquery_columns_name": true,
1623 + "data_osquery_columns_net_namespace": true,
1624 + "data_osquery_columns_nice": true,
1625 + "data_osquery_columns_on_disk": true,
1626 + "data_osquery_columns_parent": true,
1627 + "data_osquery_columns_path": true,
1628 + "data_osquery_columns_pgroup": true,
1629 + "data_osquery_columns_pid": true,
1630 + "data_osquery_columns_port": true,
1631 + "data_osquery_columns_protocol": true,
1632 + "data_osquery_columns_remote_address": true,
1633 + "data_osquery_columns_remote_address_city_name": true,
1634 + "data_osquery_columns_remote_address_country_code": true,
1635 + "data_osquery_columns_remote_address_geolocation": true,
1636 + "data_osquery_columns_remote_port": true,
1637 + "data_osquery_columns_resident_size": true,
1638 + "data_osquery_columns_root": true,
1639 + "data_osquery_columns_sgid": true,
1640 + "data_osquery_columns_shell": true,
1641 + "data_osquery_columns_socket": true,
1642 + "data_osquery_columns_start_time": true,
1643 + "data_osquery_columns_state": true,
1644 + "data_osquery_columns_suid": true,
1645 + "data_osquery_columns_system_time": true,
1646 + "data_osquery_columns_threads": true,
1647 + "data_osquery_columns_time_utc": true,
1648 + "data_osquery_columns_total_size": true,
1649 + "data_osquery_columns_tty": true,
1650 + "data_osquery_columns_type": true,
1651 + "data_osquery_columns_uid": true,
1652 + "data_osquery_columns_uid_signed": true,
1653 + "data_osquery_columns_user": true,
1654 + "data_osquery_columns_user_time": true,
1655 + "data_osquery_columns_username": true,
1656 + "data_osquery_columns_wired_size": true,
1657 + "data_osquery_counter": true,
1658 + "data_osquery_decorations_host_uuid": true,
1659 + "data_osquery_decorations_hostname": true,
1660 + "data_osquery_epoch": true,
1661 + "data_osquery_hostIdentifier": true,
1662 + "data_osquery_name": true,
1663 + "data_osquery_numerics": true,
1664 + "data_osquery_unixTime": true,
1665 + "data_proto": true,
1666 + "data_sca_check_command": true,
1667 + "data_sca_check_compliance_cis": true,
1668 + "data_sca_check_compliance_cis_csc": true,
1669 + "data_sca_check_compliance_gdpr_IV": true,
1670 + "data_sca_check_compliance_gpg_13": true,
1671 + "data_sca_check_compliance_hipaa": true,
1672 + "data_sca_check_compliance_nist_800_53": true,
1673 + "data_sca_check_compliance_pci_dss": true,
1674 + "data_sca_check_compliance_tsc": true,
1675 + "data_sca_check_description": true,
1676 + "data_sca_check_id": true,
1677 + "data_sca_check_previous_result": true,
1678 + "data_sca_check_rationale": true,
1679 + "data_sca_check_remediation": true,
1680 + "data_sca_check_result": true,
1681 + "data_sca_check_title": true,
1682 + "data_sca_description": true,
1683 + "data_sca_failed": true,
1684 + "data_sca_file": true,
1685 + "data_sca_invalid": true,
1686 + "data_sca_passed": true,
1687 + "data_sca_policy": true,
1688 + "data_sca_policy_id": true,
1689 + "data_sca_scan_id": true,
1690 + "data_sca_score": true,
1691 + "data_sca_total_checks": true,
1692 + "data_sca_type": true,
1693 + "data_script": true,
1694 + "data_src_ip": true,
1695 + "data_src_ip_city_name": true,
1696 + "data_src_ip_country_code": true,
1697 + "data_src_ip_geolocation": true,
1698 + "data_src_port": true,
1699 + "data_srcip": true,
1700 + "data_srcip_city_name": true,
1701 + "data_srcip_country_code": true,
1702 + "data_srcip_geolocation": true,
1703 + "data_srcuser": true,
1704 + "data_timestamp": true,
1705 + "data_title": true,
1706 + "data_tls_session_resumed": true,
1707 + "data_tls_version": true,
1708 + "data_tx_id": true,
1709 + "data_type": true,
1710 + "data_win_eventXML_binaryData": true,
1711 + "data_win_eventXML_binaryDataSize": true,
1712 + "data_win_eventXML_param1": true,
1713 + "data_win_eventdata_authenticationPackageName": true,
1714 + "data_win_eventdata_callTrace": true,
1715 + "data_win_eventdata_commandLine": true,
1716 + "data_win_eventdata_company": true,
1717 + "data_win_eventdata_creationUtcTime": true,
1718 + "data_win_eventdata_currentDirectory": true,
1719 + "data_win_eventdata_description": true,
1720 + "data_win_eventdata_destinationHostname": true,
1721 + "data_win_eventdata_destinationIp": true,
1722 + "data_win_eventdata_destinationIp_city_name": true,
1723 + "data_win_eventdata_destinationIp_country_code": true,
1724 + "data_win_eventdata_destinationIp_geolocation": true,
1725 + "data_win_eventdata_destinationIsIpv6": true,
1726 + "data_win_eventdata_destinationPort": true,
1727 + "data_win_eventdata_destinationPortName": true,
1728 + "data_win_eventdata_details": true,
1729 + "data_win_eventdata_elevatedToken": true,
1730 + "data_win_eventdata_eventType": true,
1731 + "data_win_eventdata_fileVersion": true,
1732 + "data_win_eventdata_fileVersion_city_name": true,
1733 + "data_win_eventdata_fileVersion_country_code": true,
1734 + "data_win_eventdata_fileVersion_geolocation": true,
1735 + "data_win_eventdata_grantedAccess": true,
1736 + "data_win_eventdata_hashes": true,
1737 + "data_win_eventdata_image": true,
1738 + "data_win_eventdata_imageLoaded": true,
1739 + "data_win_eventdata_impersonationLevel": true,
1740 + "data_win_eventdata_initiated": true,
1741 + "data_win_eventdata_integrityLevel": true,
1742 + "data_win_eventdata_ipAddress": true,
1743 + "data_win_eventdata_ipPort": true,
1744 + "data_win_eventdata_keyLength": true,
1745 + "data_win_eventdata_logonGuid": true,
1746 + "data_win_eventdata_logonId": true,
1747 + "data_win_eventdata_logonProcessName": true,
1748 + "data_win_eventdata_logonType": true,
1749 + "data_win_eventdata_originalFileName": true,
1750 + "data_win_eventdata_param1": true,
1751 + "data_win_eventdata_param2": true,
1752 + "data_win_eventdata_param3": true,
1753 + "data_win_eventdata_param4": true,
1754 + "data_win_eventdata_parentCommandLine": true,
1755 + "data_win_eventdata_parentImage": true,
1756 + "data_win_eventdata_parentProcessGuid": true,
1757 + "data_win_eventdata_parentProcessId": true,
1758 + "data_win_eventdata_processGuid": true,
1759 + "data_win_eventdata_processId": true,
1760 + "data_win_eventdata_processName": true,
1761 + "data_win_eventdata_product": true,
1762 + "data_win_eventdata_protocol": true,
1763 + "data_win_eventdata_queryName": true,
1764 + "data_win_eventdata_queryResults": true,
1765 + "data_win_eventdata_queryStatus": true,
1766 + "data_win_eventdata_ruleName": true,
1767 + "data_win_eventdata_serviceName": true,
1768 + "data_win_eventdata_serviceSid": true,
1769 + "data_win_eventdata_signature": true,
1770 + "data_win_eventdata_signatureStatus": true,
1771 + "data_win_eventdata_signed": true,
1772 + "data_win_eventdata_sourceHostname": true,
1773 + "data_win_eventdata_sourceImage": true,
1774 + "data_win_eventdata_sourceIp": true,
1775 + "data_win_eventdata_sourceIp_city_name": true,
1776 + "data_win_eventdata_sourceIp_country_code": true,
1777 + "data_win_eventdata_sourceIp_geolocation": true,
1778 + "data_win_eventdata_sourceIsIpv6": true,
1779 + "data_win_eventdata_sourcePort": true,
1780 + "data_win_eventdata_sourceProcessGUID": true,
1781 + "data_win_eventdata_sourceProcessId": true,
1782 + "data_win_eventdata_sourceThreadId": true,
1783 + "data_win_eventdata_status": true,
1784 + "data_win_eventdata_subjectDomainName": true,
1785 + "data_win_eventdata_subjectLogonId": true,
1786 + "data_win_eventdata_subjectUserName": true,
1787 + "data_win_eventdata_subjectUserSid": true,
1788 + "data_win_eventdata_targetDomainName": true,
1789 + "data_win_eventdata_targetFilename": true,
1790 + "data_win_eventdata_targetImage": true,
1791 + "data_win_eventdata_targetLinkedLogonId": true,
1792 + "data_win_eventdata_targetLogonId": true,
1793 + "data_win_eventdata_targetObject": true,
1794 + "data_win_eventdata_targetProcessGUID": true,
1795 + "data_win_eventdata_targetProcessId": true,
1796 + "data_win_eventdata_targetUserName": true,
1797 + "data_win_eventdata_targetUserSid": true,
1798 + "data_win_eventdata_terminalSessionId": true,
1799 + "data_win_eventdata_ticketEncryptionType": true,
1800 + "data_win_eventdata_ticketOptions": true,
1801 + "data_win_eventdata_user": true,
1802 + "data_win_eventdata_utcTime": true,
1803 + "data_win_eventdata_virtualAccount": true,
1804 + "data_win_system_channel": true,
1805 + "data_win_system_computer": true,
1806 + "data_win_system_eventID": true,
1807 + "data_win_system_eventRecordID": true,
1808 + "data_win_system_eventSourceName": true,
1809 + "data_win_system_keywords": true,
1810 + "data_win_system_level": true,
1811 + "data_win_system_message": true,
1812 + "data_win_system_opcode": true,
1813 + "data_win_system_processID": true,
1814 + "data_win_system_providerGuid": true,
1815 + "data_win_system_providerName": true,
1816 + "data_win_system_severityValue": true,
1817 + "data_win_system_systemTime": true,
1818 + "data_win_system_task": true,
1819 + "data_win_system_threadID": true,
1820 + "data_win_system_version": true,
1821 + "decoder_name": true,
1822 + "decoder_parent": true,
1823 + "dns_query": true,
1824 + "dns_query_threat_indicated": true,
1825 + "dst_ip": true,
1826 + "dst_ip_city_name": true,
1827 + "dst_ip_country_code": true,
1828 + "dst_ip_geolocation": true,
1829 + "dst_ip_threat_indicated": true,
1830 + "dst_port": true,
1831 + "ecs_version": true,
1832 + "error": true,
1833 + "event_hash": true,
1834 + "file_path": true,
1835 + "firewall_rule_name": true,
1836 + "full_log": false,
1837 + "gl2_accounted_message_size": true,
1838 + "gl2_message_id": true,
1839 + "gl2_processing_error": true,
1840 + "gl2_remote_ip": true,
1841 + "gl2_remote_port": true,
1842 + "gl2_source_collector": true,
1843 + "gl2_source_input": true,
1844 + "gl2_source_node": true,
1845 + "hash_md5": true,
1846 + "hash_sha1": true,
1847 + "hash_sha256": true,
1848 + "highlight": true,
1849 + "host_architecture": true,
1850 + "host_containerized": true,
1851 + "host_hostname": true,
1852 + "host_id": true,
1853 + "host_ip": true,
1854 + "host_mac": true,
1855 + "host_name": true,
1856 + "host_os_codename": true,
1857 + "host_os_kernel": true,
1858 + "host_os_name": true,
1859 + "host_os_platform": true,
1860 + "host_os_version": true,
1861 + "hostname": true,
1862 + "id": true,
1863 + "input_type": true,
1864 + "level": true,
1865 + "location": true,
1866 + "log_file_path": true,
1867 + "log_offset": true,
1868 + "manager_name": true,
1869 + "message": true,
1870 + "module": true,
1871 + "msg_timestamp": true,
1872 + "parent_process_cmd_line": true,
1873 + "parent_process_id": true,
1874 + "parent_process_image": true,
1875 + "pid": true,
1876 + "predecoder_hostname": true,
1877 + "predecoder_program_name": true,
1878 + "predecoder_timestamp": true,
1879 + "previous_log": true,
1880 + "previous_output": true,
1881 + "process_cmd_line": true,
1882 + "process_id": true,
1883 + "process_image": true,
1884 + "process_name": true,
1885 + "protocol": true,
1886 + "rule_cis": true,
1887 + "rule_cis_csc": true,
1888 + "rule_firedtimes": true,
1889 + "rule_gdpr": true,
1890 + "rule_gdpr_IV": true,
1891 + "rule_gpg13": true,
1892 + "rule_gpg_13": true,
1893 + "rule_group1": true,
1894 + "rule_group2": true,
1895 + "rule_groups": true,
1896 + "rule_hipaa": true,
1897 + "rule_id": true,
1898 + "rule_info": true,
1899 + "rule_mail": true,
1900 + "rule_mitre_id": true,
1901 + "rule_mitre_tactic": false,
1902 + "rule_nist_800_53": true,
1903 + "rule_pci_dss": true,
1904 + "rule_tsc": true,
1905 + "scanid": true,
1906 + "service": true,
1907 + "software_package": true,
1908 + "software_vendor": true,
1909 + "sort": true,
1910 + "source": true,
1911 + "source_reserved_ip": true,
1912 + "src_ip": true,
1913 + "src_ip_city_name": true,
1914 + "src_ip_country_code": true,
1915 + "src_ip_geolocation": true,
1916 + "src_port": true,
1917 + "streams": true,
1918 + "syscheck_attrs_after": true,
1919 + "syscheck_audit_effective_user_id": true,
1920 + "syscheck_audit_effective_user_name": true,
1921 + "syscheck_audit_group_id": true,
1922 + "syscheck_audit_group_name": true,
1923 + "syscheck_audit_login_user_id": true,
1924 + "syscheck_audit_login_user_name": true,
1925 + "syscheck_audit_process_cwd": true,
1926 + "syscheck_audit_process_id": true,
1927 + "syscheck_audit_process_name": true,
1928 + "syscheck_audit_process_parent_cwd": true,
1929 + "syscheck_audit_process_parent_name": true,
1930 + "syscheck_audit_process_ppid": true,
1931 + "syscheck_audit_user_id": true,
1932 + "syscheck_audit_user_name": true,
1933 + "syscheck_changed_attributes": true,
1934 + "syscheck_event": true,
1935 + "syscheck_gid_after": true,
1936 + "syscheck_gname_after": true,
1937 + "syscheck_hard_links": true,
1938 + "syscheck_inode_after": true,
1939 + "syscheck_inode_before": true,
1940 + "syscheck_md5_after": true,
1941 + "syscheck_md5_before": true,
1942 + "syscheck_mode": true,
1943 + "syscheck_mtime_after": true,
1944 + "syscheck_mtime_before": true,
1945 + "syscheck_path": true,
1946 + "syscheck_perm_after": true,
1947 + "syscheck_perm_before": true,
1948 + "syscheck_sha1_after": true,
1949 + "syscheck_sha1_before": true,
1950 + "syscheck_sha256_after": true,
1951 + "syscheck_sha256_before": true,
1952 + "syscheck_size_after": true,
1953 + "syscheck_size_before": true,
1954 + "syscheck_uid_after": true,
1955 + "syscheck_uname_after": true,
1956 + "syscheck_win_perm_after": true,
1957 + "syscheck_win_perm_after_0_allowed": true,
1958 + "syscheck_win_perm_after_0_name": true,
1959 + "syscheck_win_perm_after_1_allowed": true,
1960 + "syscheck_win_perm_after_1_name": true,
1961 + "syscheck_win_perm_after_2_allowed": true,
1962 + "syscheck_win_perm_after_2_name": true,
1963 + "syscheck_win_perm_after_3_allowed": true,
1964 + "syscheck_win_perm_after_3_name": true,
1965 + "syslog_customer": true,
1966 + "syslog_level": true,
1967 + "syslog_tag": true,
1968 + "syslog_type": true,
1969 + "sysmon_event_description": true,
1970 + "threat_ids": true,
1971 + "threat_indicated": true,
1972 + "threat_names": true,
1973 + "time": true,
1974 + "timestamp": true,
1975 + "true": true,
1976 + "user_name": true,
1977 + "win_registry_key": true,
1978 + "win_system_eventID": true,
1979 + "windows_auth_package": true,
1980 + "windows_domain": true,
1981 + "windows_event_id": true,
1982 + "windows_event_severity": true,
1983 + "windows_logon_type": true
1984 + },
1985 + "indexByName": {
1986 + "_id": 2,
1987 + "_index": 9,
1988 + "_type": 10,
1989 + "agent_id": 11,
1990 + "agent_name": 5,
1991 + "cluster_name": 12,
1992 + "cluster_node": 13,
1993 + "data_office365_AppAccessContext_APIId": 49,
1994 + "data_office365_AppAccessContext_ClientAppId": 50,
1995 + "data_office365_AppAccessContext_ClientAppName": 51,
1996 + "data_office365_AppAccessContext_CorrelationId": 52,
1997 + "data_office365_ArtifactsShared": 53,
1998 + "data_office365_Attendees": 54,
1999 + "data_office365_ChatName": 55,
2000 + "data_office365_ChatThreadId": 56,
2001 + "data_office365_ClientIP": 4,
2002 + "data_office365_ClientIP_city_name": 14,
2003 + "data_office365_ClientIP_country_code": 15,
2004 + "data_office365_ClientIP_geolocation": 16,
2005 + "data_office365_CommunicationSubType": 57,
2006 + "data_office365_CommunicationType": 58,
2007 + "data_office365_CreationTime": 0,
2008 + "data_office365_DeviceId": 59,
2009 + "data_office365_DeviceInformation": 60,
2010 + "data_office365_EndTime": 61,
2011 + "data_office365_ExchangeId": 62,
2012 + "data_office365_ExtraProperties": 63,
2013 + "data_office365_ICalUid": 64,
2014 + "data_office365_Id": 17,
2015 + "data_office365_ItemName": 65,
2016 + "data_office365_JoinTime": 66,
2017 + "data_office365_LeaveTime": 67,
2018 + "data_office365_MeetingDetailId": 68,
2019 + "data_office365_MeetingURL": 69,
2020 + "data_office365_Members": 70,
2021 + "data_office365_MessageId": 71,
2022 + "data_office365_MessageSizeInBytes": 72,
2023 + "data_office365_MessageURLs": 73,
2024 + "data_office365_MessageVersion": 74,
2025 + "data_office365_Modalities": 75,
2026 + "data_office365_Name": 76,
2027 + "data_office365_NewValue": 77,
2028 + "data_office365_ObjectId": 18,
2029 + "data_office365_Operation": 24,
2030 + "data_office365_OperationScope": 78,
2031 + "data_office365_OrganizationId": 19,
2032 + "data_office365_Organizer_OrganizationId": 79,
2033 + "data_office365_Organizer_RecipientType": 80,
2034 + "data_office365_Organizer_Role": 81,
2035 + "data_office365_Organizer_UserObjectId": 82,
2036 + "data_office365_ProviderTypes": 83,
2037 + "data_office365_RecordType": 20,
2038 + "data_office365_StartTime": 84,
2039 + "data_office365_SubscriptionId": 85,
2040 + "data_office365_TeamGuid": 86,
2041 + "data_office365_UserId": 3,
2042 + "data_office365_UserKey": 21,
2043 + "data_office365_UserType": 22,
2044 + "data_office365_Version": 23,
2045 + "data_office365_Workload": 48,
2046 + "decoder_name": 25,
2047 + "gl2_accounted_message_size": 26,
2048 + "gl2_message_id": 27,
2049 + "gl2_processing_error": 28,
2050 + "gl2_remote_ip": 29,
2051 + "gl2_remote_port": 30,
2052 + "gl2_source_input": 31,
2053 + "gl2_source_node": 32,
2054 + "highlight": 33,
2055 + "id": 34,
2056 + "location": 35,
2057 + "manager_name": 36,
2058 + "message": 37,
2059 + "rule_description": 6,
2060 + "rule_firedtimes": 38,
2061 + "rule_group1": 39,
2062 + "rule_groups": 40,
2063 + "rule_id": 8,
2064 + "rule_level": 7,
2065 + "rule_mail": 41,
2066 + "sort": 42,
2067 + "source": 43,
2068 + "streams": 44,
2069 + "syslog_level": 45,
2070 + "syslog_type": 46,
2071 + "timestamp": 1,
2072 + "true": 47
2073 + },
2074 + "renameByName": {
2075 + "_id": "EVENT ID",
2076 + "agent_name": "",
2077 + "data_office365_ActorIpAddress": "SRC IP",
2078 + "data_office365_AffectedItems": "ITEMS",
2079 + "data_office365_ClientIP": "CLIENT IP",
2080 + "data_office365_ClientIP_city_name": "",
2081 + "data_office365_CreationTime": "EVENT TIME",
2082 + "data_office365_Item_Attachments": "ATTACHMENT",
2083 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2084 + "data_office365_Item_Subject": "SUBJECT",
2085 + "data_office365_ResultStatus": "RESULT",
2086 + "data_office365_UserId": "ACCOUNT",
2087 + "rule_description": "DESCRIPTION",
2088 + "rule_id": "RULE ID",
2089 + "rule_level": "",
2090 + "rule_mitre_tactic": "MITRE TACTIC",
2091 + "rule_mitre_technique": "MITRE TECHNIQUE",
2092 + "timestamp": "Date/Time"
2093 + }
2094 + }
2095 + }
2096 + ],
2097 + "transparent": true,
2098 + "type": "table"
2099 + }
2100 + ],
2101 + "refresh": "",
2102 + "schemaVersion": 38,
2103 + "style": "dark",
2104 + "tags": [
2105 + "O365"
2106 + ],
2107 + "templating": {
2108 + "list": [
2109 + {
2110 + "datasource": {
2111 + "type": "elasticsearch",
2112 + "uid": "replace_datasource_uid"
2113 + },
2114 + "filters": [],
2115 + "hide": 0,
2116 + "label": "",
2117 + "name": "Filters",
2118 + "skipUrlSync": false,
2119 + "type": "adhoc"
2120 + },
2121 + {
2122 + "current": {
2123 + "selected": false,
2124 + "text": "All",
2125 + "value": "$__all"
2126 + },
2127 + "datasource": {
2128 + "type": "elasticsearch",
2129 + "uid": "replace_datasource_uid"
2130 + },
2131 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Exchange\"}",
2132 + "hide": 0,
2133 + "includeAll": true,
2134 + "label": "Operation",
2135 + "multi": false,
2136 + "name": "operation",
2137 + "options": [],
2138 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Exchange\"}",
2139 + "refresh": 2,
2140 + "regex": "",
2141 + "skipUrlSync": false,
2142 + "sort": 1,
2143 + "tagValuesQuery": "",
2144 + "tagsQuery": "",
2145 + "type": "query",
2146 + "useTags": false
2147 + },
2148 + {
2149 + "current": {
2150 + "selected": false,
2151 + "text": "All",
2152 + "value": "$__all"
2153 + },
2154 + "datasource": {
2155 + "type": "elasticsearch",
2156 + "uid": "replace_datasource_uid"
2157 + },
2158 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2159 + "hide": 0,
2160 + "includeAll": true,
2161 + "label": "Rule Level",
2162 + "multi": false,
2163 + "name": "rule_level",
2164 + "options": [],
2165 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2166 + "refresh": 2,
2167 + "regex": "",
2168 + "skipUrlSync": false,
2169 + "sort": 0,
2170 + "type": "query"
2171 + }
2172 + ]
2173 + },
2174 + "time": {
2175 + "from": "now-12h",
2176 + "to": "now"
2177 + },
2178 + "timepicker": {
2179 + "refresh_intervals": [
2180 + "5s",
2181 + "10s",
2182 + "30s",
2183 + "1m",
2184 + "5m",
2185 + "15m",
2186 + "30m",
2187 + "1h",
2188 + "2h",
2189 + "1d"
2190 + ],
2191 + "time_options": [
2192 + "5m",
2193 + "15m",
2194 + "1h",
2195 + "6h",
2196 + "12h",
2197 + "24h",
2198 + "2d",
2199 + "7d",
2200 + "30d"
2201 + ]
2202 + },
2203 + "timezone": "",
2204 + "title": "O365 - EXCHANGE",
2205 + "weekStart": ""
2206 +}
backend/app/connectors/grafana/dashboards/Office365/forms.json new
+2410
@@ -0,0 +1,2410 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "10.0.3",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:MicrosoftForms",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "cellOptions": {
261 + "type": "auto"
262 + },
263 + "inspect": false
264 + },
265 + "mappings": [],
266 + "thresholds": {
267 + "mode": "absolute",
268 + "steps": [
269 + {
270 + "color": "red",
271 + "value": null
272 + }
273 + ]
274 + }
275 + },
276 + "overrides": [
277 + {
278 + "matcher": {
279 + "id": "byName",
280 + "options": "Count"
281 + },
282 + "properties": [
283 + {
284 + "id": "displayName",
285 + "value": "EVENTS"
286 + },
287 + {
288 + "id": "unit",
289 + "value": "short"
290 + },
291 + {
292 + "id": "decimals",
293 + "value": -1
294 + },
295 + {
296 + "id": "custom.align"
297 + },
298 + {
299 + "id": "thresholds",
300 + "value": {
301 + "mode": "absolute",
302 + "steps": [
303 + {
304 + "color": "red",
305 + "value": null
306 + }
307 + ]
308 + }
309 + }
310 + ]
311 + }
312 + ]
313 + },
314 + "gridPos": {
315 + "h": 7,
316 + "w": 6,
317 + "x": 8,
318 + "y": 0
319 + },
320 + "id": 54,
321 + "options": {
322 + "cellHeight": "sm",
323 + "footer": {
324 + "countRows": false,
325 + "fields": "",
326 + "reducer": [
327 + "sum"
328 + ],
329 + "show": false
330 + },
331 + "showHeader": true
332 + },
333 + "pluginVersion": "10.0.3",
334 + "targets": [
335 + {
336 + "bucketAggs": [
337 + {
338 + "fake": true,
339 + "field": "data_office365_Operation",
340 + "id": "4",
341 + "settings": {
342 + "min_doc_count": 1,
343 + "order": "desc",
344 + "orderBy": "_count",
345 + "size": "0"
346 + },
347 + "type": "terms"
348 + }
349 + ],
350 + "datasource": {
351 + "type": "elasticsearch",
352 + "uid": "replace_datasource_uid"
353 + },
354 + "metrics": [
355 + {
356 + "field": "select field",
357 + "id": "1",
358 + "type": "count"
359 + }
360 + ],
361 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
362 + "refId": "A",
363 + "timeField": "timestamp"
364 + }
365 + ],
366 + "title": "EVENTS BY OPERATION",
367 + "transformations": [
368 + {
369 + "id": "merge",
370 + "options": {
371 + "reducers": []
372 + }
373 + },
374 + {
375 + "id": "organize",
376 + "options": {
377 + "excludeByName": {},
378 + "indexByName": {},
379 + "renameByName": {
380 + "Count": "EVENTS",
381 + "data_office365_Operation": "OPERATION"
382 + }
383 + }
384 + }
385 + ],
386 + "type": "table"
387 + },
388 + {
389 + "datasource": {
390 + "type": "elasticsearch",
391 + "uid": "replace_datasource_uid"
392 + },
393 + "fieldConfig": {
394 + "defaults": {
395 + "color": {
396 + "mode": "thresholds"
397 + },
398 + "custom": {
399 + "align": "auto",
400 + "cellOptions": {
401 + "type": "auto"
402 + },
403 + "inspect": false
404 + },
405 + "mappings": [],
406 + "thresholds": {
407 + "mode": "absolute",
408 + "steps": [
409 + {
410 + "color": "red",
411 + "value": null
412 + }
413 + ]
414 + }
415 + },
416 + "overrides": [
417 + {
418 + "matcher": {
419 + "id": "byName",
420 + "options": "Count"
421 + },
422 + "properties": [
423 + {
424 + "id": "displayName",
425 + "value": "EVENTS"
426 + },
427 + {
428 + "id": "unit",
429 + "value": "short"
430 + },
431 + {
432 + "id": "decimals",
433 + "value": -1
434 + },
435 + {
436 + "id": "custom.align"
437 + },
438 + {
439 + "id": "thresholds",
440 + "value": {
441 + "mode": "absolute",
442 + "steps": [
443 + {
444 + "color": "red",
445 + "value": null
446 + }
447 + ]
448 + }
449 + }
450 + ]
451 + }
452 + ]
453 + },
454 + "gridPos": {
455 + "h": 7,
456 + "w": 6,
457 + "x": 14,
458 + "y": 0
459 + },
460 + "id": 62,
461 + "options": {
462 + "cellHeight": "sm",
463 + "footer": {
464 + "countRows": false,
465 + "fields": "",
466 + "reducer": [
467 + "sum"
468 + ],
469 + "show": false
470 + },
471 + "showHeader": true
472 + },
473 + "pluginVersion": "10.0.3",
474 + "targets": [
475 + {
476 + "bucketAggs": [
477 + {
478 + "fake": true,
479 + "field": "data_office365_SourceApp",
480 + "id": "4",
481 + "settings": {
482 + "min_doc_count": 1,
483 + "order": "desc",
484 + "orderBy": "_count",
485 + "size": "0"
486 + },
487 + "type": "terms"
488 + }
489 + ],
490 + "datasource": {
491 + "type": "elasticsearch",
492 + "uid": "replace_datasource_uid"
493 + },
494 + "metrics": [
495 + {
496 + "field": "select field",
497 + "id": "1",
498 + "type": "count"
499 + }
500 + ],
501 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
502 + "refId": "A",
503 + "timeField": "timestamp"
504 + }
505 + ],
506 + "title": "EVENTS BY APP",
507 + "transformations": [
508 + {
509 + "id": "merge",
510 + "options": {
511 + "reducers": []
512 + }
513 + },
514 + {
515 + "id": "organize",
516 + "options": {
517 + "excludeByName": {},
518 + "indexByName": {},
519 + "renameByName": {
520 + "Count": "EVENTS",
521 + "data_office365_Operation": "OPERATION",
522 + "data_office365_SourceApp": "SOURCE APP",
523 + "data_office365_UserAgent": "USER AGENT"
524 + }
525 + }
526 + }
527 + ],
528 + "type": "table"
529 + },
530 + {
531 + "datasource": {
532 + "type": "elasticsearch",
533 + "uid": "replace_datasource_uid"
534 + },
535 + "fieldConfig": {
536 + "defaults": {
537 + "color": {
538 + "mode": "thresholds"
539 + },
540 + "mappings": [
541 + {
542 + "options": {
543 + "match": "null",
544 + "result": {
545 + "text": "N/A"
546 + }
547 + },
548 + "type": "special"
549 + }
550 + ],
551 + "max": 15,
552 + "min": 0,
553 + "thresholds": {
554 + "mode": "absolute",
555 + "steps": [
556 + {
557 + "color": "#299c46",
558 + "value": null
559 + },
560 + {
561 + "color": "rgba(237, 129, 40, 0.89)",
562 + "value": 8
563 + },
564 + {
565 + "color": "#d44a3a",
566 + "value": 12
567 + }
568 + ]
569 + },
570 + "unit": "none"
571 + },
572 + "overrides": []
573 + },
574 + "gridPos": {
575 + "h": 7,
576 + "w": 4,
577 + "x": 0,
578 + "y": 7
579 + },
580 + "id": 16,
581 + "links": [],
582 + "options": {
583 + "orientation": "horizontal",
584 + "reduceOptions": {
585 + "calcs": [
586 + "max"
587 + ],
588 + "fields": "",
589 + "values": false
590 + },
591 + "showThresholdLabels": false,
592 + "showThresholdMarkers": true,
593 + "text": {}
594 + },
595 + "pluginVersion": "10.0.3",
596 + "targets": [
597 + {
598 + "bucketAggs": [
599 + {
600 + "field": "timestamp",
601 + "id": "2",
602 + "settings": {
603 + "interval": "auto",
604 + "min_doc_count": 0,
605 + "trimEdges": 0
606 + },
607 + "type": "date_histogram"
608 + }
609 + ],
610 + "datasource": {
611 + "type": "elasticsearch",
612 + "uid": "replace_datasource_uid"
613 + },
614 + "metrics": [
615 + {
616 + "field": "rule_level",
617 + "id": "1",
618 + "meta": {},
619 + "settings": {},
620 + "type": "max"
621 + }
622 + ],
623 + "query": "data_office365_Operation:$operation AND data_office365_Workload:MicrosoftForms",
624 + "refId": "A",
625 + "timeField": "timestamp"
626 + }
627 + ],
628 + "title": "MAX SEVERITY (0 - 15)",
629 + "type": "gauge"
630 + },
631 + {
632 + "datasource": {
633 + "type": "elasticsearch",
634 + "uid": "replace_datasource_uid"
635 + },
636 + "fieldConfig": {
637 + "defaults": {
638 + "color": {
639 + "mode": "palette-classic"
640 + },
641 + "custom": {
642 + "axisCenteredZero": false,
643 + "axisColorMode": "text",
644 + "axisLabel": "",
645 + "axisPlacement": "auto",
646 + "barAlignment": 0,
647 + "drawStyle": "bars",
648 + "fillOpacity": 0,
649 + "gradientMode": "none",
650 + "hideFrom": {
651 + "legend": false,
652 + "tooltip": false,
653 + "viz": false
654 + },
655 + "lineInterpolation": "linear",
656 + "lineWidth": 1,
657 + "pointSize": 5,
658 + "scaleDistribution": {
659 + "type": "linear"
660 + },
661 + "showPoints": "auto",
662 + "spanNulls": false,
663 + "stacking": {
664 + "group": "A",
665 + "mode": "normal"
666 + },
667 + "thresholdsStyle": {
668 + "mode": "off"
669 + }
670 + },
671 + "mappings": [],
672 + "thresholds": {
673 + "mode": "absolute",
674 + "steps": [
675 + {
676 + "color": "green",
677 + "value": null
678 + },
679 + {
680 + "color": "red",
681 + "value": 80
682 + }
683 + ]
684 + }
685 + },
686 + "overrides": []
687 + },
688 + "gridPos": {
689 + "h": 13,
690 + "w": 20,
691 + "x": 4,
692 + "y": 7
693 + },
694 + "id": 60,
695 + "options": {
696 + "legend": {
697 + "calcs": [],
698 + "displayMode": "table",
699 + "placement": "right",
700 + "showLegend": true
701 + },
702 + "tooltip": {
703 + "mode": "single",
704 + "sort": "none"
705 + }
706 + },
707 + "targets": [
708 + {
709 + "alias": "",
710 + "bucketAggs": [
711 + {
712 + "field": "data_office365_Operation",
713 + "id": "3",
714 + "settings": {
715 + "min_doc_count": "1",
716 + "order": "desc",
717 + "orderBy": "_count",
718 + "size": "10"
719 + },
720 + "type": "terms"
721 + },
722 + {
723 + "field": "timestamp",
724 + "id": "2",
725 + "settings": {
726 + "interval": "auto"
727 + },
728 + "type": "date_histogram"
729 + }
730 + ],
731 + "datasource": {
732 + "type": "elasticsearch",
733 + "uid": "replace_datasource_uid"
734 + },
735 + "metrics": [
736 + {
737 + "id": "1",
738 + "type": "count"
739 + }
740 + ],
741 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
742 + "refId": "A",
743 + "timeField": "timestamp"
744 + }
745 + ],
746 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
747 + "transparent": true,
748 + "type": "timeseries"
749 + },
750 + {
751 + "datasource": {
752 + "type": "elasticsearch",
753 + "uid": "replace_datasource_uid"
754 + },
755 + "fieldConfig": {
756 + "defaults": {
757 + "mappings": [
758 + {
759 + "options": {
760 + "match": "null",
761 + "result": {
762 + "text": "N/A"
763 + }
764 + },
765 + "type": "special"
766 + }
767 + ],
768 + "thresholds": {
769 + "mode": "absolute",
770 + "steps": [
771 + {
772 + "color": "blue",
773 + "value": null
774 + }
775 + ]
776 + },
777 + "unit": "locale"
778 + },
779 + "overrides": []
780 + },
781 + "gridPos": {
782 + "h": 6,
783 + "w": 4,
784 + "x": 0,
785 + "y": 14
786 + },
787 + "id": 51,
788 + "links": [],
789 + "options": {
790 + "colorMode": "value",
791 + "graphMode": "area",
792 + "justifyMode": "auto",
793 + "orientation": "horizontal",
794 + "reduceOptions": {
795 + "calcs": [
796 + "sum"
797 + ],
798 + "fields": "",
799 + "values": false
800 + },
801 + "text": {},
802 + "textMode": "auto"
803 + },
804 + "pluginVersion": "10.0.3",
805 + "targets": [
806 + {
807 + "bucketAggs": [
808 + {
809 + "$$hashKey": "object:331",
810 + "field": "timestamp",
811 + "id": "2",
812 + "settings": {
813 + "interval": "auto",
814 + "min_doc_count": 0,
815 + "trimEdges": 0
816 + },
817 + "type": "date_histogram"
818 + }
819 + ],
820 + "datasource": {
821 + "type": "elasticsearch",
822 + "uid": "replace_datasource_uid"
823 + },
824 + "metrics": [
825 + {
826 + "$$hashKey": "object:329",
827 + "field": "select field",
828 + "id": "1",
829 + "type": "count"
830 + }
831 + ],
832 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
833 + "refId": "A",
834 + "timeField": "timestamp"
835 + }
836 + ],
837 + "title": "EVENTS (Total)",
838 + "type": "stat"
839 + },
840 + {
841 + "datasource": {
842 + "type": "elasticsearch",
843 + "uid": "replace_datasource_uid"
844 + },
845 + "fieldConfig": {
846 + "defaults": {
847 + "color": {
848 + "mode": "thresholds"
849 + },
850 + "custom": {
851 + "align": "auto",
852 + "cellOptions": {
853 + "type": "auto"
854 + },
855 + "inspect": false
856 + },
857 + "mappings": [],
858 + "thresholds": {
859 + "mode": "absolute",
860 + "steps": [
861 + {
862 + "color": "orange",
863 + "value": null
864 + }
865 + ]
866 + }
867 + },
868 + "overrides": [
869 + {
870 + "matcher": {
871 + "id": "byName",
872 + "options": "Count"
873 + },
874 + "properties": [
875 + {
876 + "id": "displayName",
877 + "value": "EVENTS"
878 + },
879 + {
880 + "id": "unit",
881 + "value": "short"
882 + },
883 + {
884 + "id": "decimals",
885 + "value": -1
886 + },
887 + {
888 + "id": "custom.align"
889 + }
890 + ]
891 + },
892 + {
893 + "matcher": {
894 + "id": "byName",
895 + "options": "AD ACCOUNT"
896 + },
897 + "properties": [
898 + {
899 + "id": "custom.width",
900 + "value": 377
901 + }
902 + ]
903 + }
904 + ]
905 + },
906 + "gridPos": {
907 + "h": 12,
908 + "w": 8,
909 + "x": 0,
910 + "y": 20
911 + },
912 + "id": 61,
913 + "options": {
914 + "cellHeight": "sm",
915 + "footer": {
916 + "countRows": false,
917 + "fields": "",
918 + "reducer": [
919 + "sum"
920 + ],
921 + "show": false
922 + },
923 + "showHeader": true,
924 + "sortBy": []
925 + },
926 + "pluginVersion": "10.0.3",
927 + "targets": [
928 + {
929 + "bucketAggs": [
930 + {
931 + "fake": true,
932 + "field": "data_office365_FormName",
933 + "id": "4",
934 + "settings": {
935 + "min_doc_count": 1,
936 + "order": "desc",
937 + "orderBy": "_count",
938 + "size": "0"
939 + },
940 + "type": "terms"
941 + }
942 + ],
943 + "datasource": {
944 + "type": "elasticsearch",
945 + "uid": "replace_datasource_uid"
946 + },
947 + "metrics": [
948 + {
949 + "field": "select field",
950 + "id": "1",
951 + "type": "count"
952 + }
953 + ],
954 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
955 + "refId": "A",
956 + "timeField": "timestamp"
957 + }
958 + ],
959 + "title": "MS-FORMS EVENTS BY FORM NAME",
960 + "transformations": [
961 + {
962 + "id": "merge",
963 + "options": {
964 + "reducers": []
965 + }
966 + },
967 + {
968 + "id": "organize",
969 + "options": {
970 + "excludeByName": {},
971 + "indexByName": {},
972 + "renameByName": {
973 + "Count": "EVENTS",
974 + "data_office365_AuthenticationType": "AUTH TYPE",
975 + "data_office365_ClientIP_country_code": "COUNTRY",
976 + "data_office365_FormName": "FORM NAME",
977 + "data_office365_LogonError": "ERROR",
978 + "data_office365_Operation": "WORKLOAD",
979 + "data_office365_UserId": "AD ACCOUNT"
980 + }
981 + }
982 + }
983 + ],
984 + "type": "table"
985 + },
986 + {
987 + "circleMaxSize": 30,
988 + "circleMinSize": 2,
989 + "colors": [
990 + "rgba(245, 54, 54, 0.9)",
991 + "rgba(237, 129, 40, 0.89)",
992 + "rgba(50, 172, 45, 0.97)"
993 + ],
994 + "datasource": {
995 + "type": "elasticsearch",
996 + "uid": "replace_datasource_uid"
997 + },
998 + "decimals": 0,
999 + "esMetric": "Count",
1000 + "gridPos": {
1001 + "h": 12,
1002 + "w": 8,
1003 + "x": 8,
1004 + "y": 20
1005 + },
1006 + "hideEmpty": false,
1007 + "hideZero": false,
1008 + "id": 50,
1009 + "initialZoom": 1,
1010 + "locationData": "countries",
1011 + "mapCenter": "(0°, 0°)",
1012 + "mapCenterLatitude": 0,
1013 + "mapCenterLongitude": 0,
1014 + "maxDataPoints": 1,
1015 + "mouseWheelZoom": false,
1016 + "showLegend": true,
1017 + "stickyLabels": false,
1018 + "tableQueryOptions": {
1019 + "geohashField": "geohash",
1020 + "latitudeField": "latitude",
1021 + "longitudeField": "longitude",
1022 + "metricField": "metric",
1023 + "queryType": "geohash"
1024 + },
1025 + "targets": [
1026 + {
1027 + "bucketAggs": [
1028 + {
1029 + "fake": true,
1030 + "field": "data_office365_ClientIP_country_code",
1031 + "id": "3",
1032 + "settings": {
1033 + "min_doc_count": 1,
1034 + "order": "desc",
1035 + "orderBy": "_term",
1036 + "size": "0"
1037 + },
1038 + "type": "terms"
1039 + },
1040 + {
1041 + "field": "timestamp",
1042 + "id": "2",
1043 + "settings": {
1044 + "interval": "auto",
1045 + "min_doc_count": 0,
1046 + "trimEdges": 0
1047 + },
1048 + "type": "date_histogram"
1049 + }
1050 + ],
1051 + "datasource": {
1052 + "type": "elasticsearch",
1053 + "uid": "replace_datasource_uid"
1054 + },
1055 + "metrics": [
1056 + {
1057 + "field": "select field",
1058 + "id": "1",
1059 + "type": "count"
1060 + }
1061 + ],
1062 + "query": "data_office365_Workload:MicrosoftForms AND rule_level:$rule_level",
1063 + "refId": "A",
1064 + "timeField": "timestamp"
1065 + }
1066 + ],
1067 + "thresholds": "0,10",
1068 + "title": "MS-FORMS - ALL EVENTS BY SRC COUNTRY",
1069 + "type": "grafana-worldmap-panel",
1070 + "unitPlural": "",
1071 + "unitSingle": "",
1072 + "valueName": "total"
1073 + },
1074 + {
1075 + "datasource": {
1076 + "type": "elasticsearch",
1077 + "uid": "replace_datasource_uid"
1078 + },
1079 + "fieldConfig": {
1080 + "defaults": {
1081 + "color": {
1082 + "mode": "thresholds"
1083 + },
1084 + "custom": {
1085 + "align": "auto",
1086 + "cellOptions": {
1087 + "type": "auto"
1088 + },
1089 + "inspect": false
1090 + },
1091 + "mappings": [],
1092 + "thresholds": {
1093 + "mode": "absolute",
1094 + "steps": [
1095 + {
1096 + "color": "orange",
1097 + "value": null
1098 + }
1099 + ]
1100 + }
1101 + },
1102 + "overrides": [
1103 + {
1104 + "matcher": {
1105 + "id": "byName",
1106 + "options": "Count"
1107 + },
1108 + "properties": [
1109 + {
1110 + "id": "displayName",
1111 + "value": "EVENTS"
1112 + },
1113 + {
1114 + "id": "unit",
1115 + "value": "short"
1116 + },
1117 + {
1118 + "id": "decimals",
1119 + "value": -1
1120 + },
1121 + {
1122 + "id": "custom.align"
1123 + }
1124 + ]
1125 + },
1126 + {
1127 + "matcher": {
1128 + "id": "byName",
1129 + "options": "AD ACCOUNT"
1130 + },
1131 + "properties": [
1132 + {
1133 + "id": "custom.width",
1134 + "value": 377
1135 + }
1136 + ]
1137 + }
1138 + ]
1139 + },
1140 + "gridPos": {
1141 + "h": 12,
1142 + "w": 8,
1143 + "x": 16,
1144 + "y": 20
1145 + },
1146 + "id": 58,
1147 + "options": {
1148 + "cellHeight": "sm",
1149 + "footer": {
1150 + "countRows": false,
1151 + "fields": "",
1152 + "reducer": [
1153 + "sum"
1154 + ],
1155 + "show": false
1156 + },
1157 + "showHeader": true,
1158 + "sortBy": []
1159 + },
1160 + "pluginVersion": "10.0.3",
1161 + "targets": [
1162 + {
1163 + "bucketAggs": [
1164 + {
1165 + "fake": true,
1166 + "field": "data_office365_UserId",
1167 + "id": "4",
1168 + "settings": {
1169 + "min_doc_count": 1,
1170 + "order": "desc",
1171 + "orderBy": "_count",
1172 + "size": "0"
1173 + },
1174 + "type": "terms"
1175 + },
1176 + {
1177 + "field": "data_office365_ClientIP_country_code",
1178 + "id": "5",
1179 + "settings": {
1180 + "min_doc_count": "1",
1181 + "order": "desc",
1182 + "orderBy": "_term",
1183 + "size": "10"
1184 + },
1185 + "type": "terms"
1186 + }
1187 + ],
1188 + "datasource": {
1189 + "type": "elasticsearch",
1190 + "uid": "replace_datasource_uid"
1191 + },
1192 + "metrics": [
1193 + {
1194 + "field": "select field",
1195 + "id": "1",
1196 + "type": "count"
1197 + }
1198 + ],
1199 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
1200 + "refId": "A",
1201 + "timeField": "timestamp"
1202 + }
1203 + ],
1204 + "title": "MS-FORMS EVENTS BY ACCOUNT",
1205 + "transformations": [
1206 + {
1207 + "id": "merge",
1208 + "options": {
1209 + "reducers": []
1210 + }
1211 + },
1212 + {
1213 + "id": "organize",
1214 + "options": {
1215 + "excludeByName": {},
1216 + "indexByName": {},
1217 + "renameByName": {
1218 + "Count": "EVENTS",
1219 + "data_office365_ClientIP_country_code": "COUNTRY",
1220 + "data_office365_LogonError": "ERROR",
1221 + "data_office365_Operation": "WORKLOAD",
1222 + "data_office365_UserId": "AD ACCOUNT"
1223 + }
1224 + }
1225 + }
1226 + ],
1227 + "type": "table"
1228 + },
1229 + {
1230 + "datasource": {
1231 + "type": "elasticsearch",
1232 + "uid": "replace_datasource_uid"
1233 + },
1234 + "fieldConfig": {
1235 + "defaults": {
1236 + "color": {
1237 + "mode": "thresholds"
1238 + },
1239 + "custom": {
1240 + "align": "auto",
1241 + "cellOptions": {
1242 + "type": "auto"
1243 + },
1244 + "filterable": true,
1245 + "inspect": false
1246 + },
1247 + "mappings": [],
1248 + "thresholds": {
1249 + "mode": "absolute",
1250 + "steps": [
1251 + {
1252 + "color": "green",
1253 + "value": null
1254 + },
1255 + {
1256 + "color": "red",
1257 + "value": 80
1258 + }
1259 + ]
1260 + }
1261 + },
1262 + "overrides": [
1263 + {
1264 + "matcher": {
1265 + "id": "byName",
1266 + "options": "rule_level"
1267 + },
1268 + "properties": [
1269 + {
1270 + "id": "displayName",
1271 + "value": "RULE LEVEL"
1272 + },
1273 + {
1274 + "id": "unit",
1275 + "value": "short"
1276 + },
1277 + {
1278 + "id": "decimals",
1279 + "value": -1
1280 + },
1281 + {
1282 + "id": "custom.cellOptions",
1283 + "value": {
1284 + "mode": "gradient",
1285 + "type": "color-background"
1286 + }
1287 + },
1288 + {
1289 + "id": "custom.align"
1290 + },
1291 + {
1292 + "id": "thresholds",
1293 + "value": {
1294 + "mode": "absolute",
1295 + "steps": [
1296 + {
1297 + "color": "#37872D",
1298 + "value": null
1299 + },
1300 + {
1301 + "color": "rgba(237, 129, 40, 0.89)",
1302 + "value": 7
1303 + },
1304 + {
1305 + "color": "rgba(245, 54, 54, 0.9)",
1306 + "value": 12
1307 + }
1308 + ]
1309 + }
1310 + }
1311 + ]
1312 + },
1313 + {
1314 + "matcher": {
1315 + "id": "byName",
1316 + "options": "Date/Time"
1317 + },
1318 + "properties": [
1319 + {
1320 + "id": "custom.width",
1321 + "value": 242
1322 + }
1323 + ]
1324 + },
1325 + {
1326 + "matcher": {
1327 + "id": "byName",
1328 + "options": "MITRE TACTIC"
1329 + },
1330 + "properties": [
1331 + {
1332 + "id": "custom.width",
1333 + "value": 332
1334 + }
1335 + ]
1336 + },
1337 + {
1338 + "matcher": {
1339 + "id": "byName",
1340 + "options": "IP ADDRESS"
1341 + },
1342 + "properties": [
1343 + {
1344 + "id": "custom.width",
1345 + "value": 163
1346 + }
1347 + ]
1348 + },
1349 + {
1350 + "matcher": {
1351 + "id": "byName",
1352 + "options": "MITRE TECHNIQUE"
1353 + },
1354 + "properties": [
1355 + {
1356 + "id": "custom.width",
1357 + "value": 312
1358 + }
1359 + ]
1360 + },
1361 + {
1362 + "matcher": {
1363 + "id": "byName",
1364 + "options": "EVENT ID"
1365 + },
1366 + "properties": [
1367 + {
1368 + "id": "links",
1369 + "value": [
1370 + {
1371 + "targetBlank": true,
1372 + "title": "VIEW EVENT DETAILS",
1373 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1374 + }
1375 + ]
1376 + },
1377 + {
1378 + "id": "custom.width",
1379 + "value": 265
1380 + }
1381 + ]
1382 + },
1383 + {
1384 + "matcher": {
1385 + "id": "byName",
1386 + "options": "RESULT"
1387 + },
1388 + "properties": [
1389 + {
1390 + "id": "custom.width",
1391 + "value": 118
1392 + },
1393 + {
1394 + "id": "mappings",
1395 + "value": [
1396 + {
1397 + "options": {
1398 + "Failed": {
1399 + "color": "orange",
1400 + "index": 1
1401 + },
1402 + "Success": {
1403 + "color": "green",
1404 + "index": 0
1405 + }
1406 + },
1407 + "type": "value"
1408 + }
1409 + ]
1410 + },
1411 + {
1412 + "id": "custom.cellOptions",
1413 + "value": {
1414 + "type": "color-text"
1415 + }
1416 + }
1417 + ]
1418 + },
1419 + {
1420 + "matcher": {
1421 + "id": "byName",
1422 + "options": "SRC IP"
1423 + },
1424 + "properties": [
1425 + {
1426 + "id": "custom.width",
1427 + "value": 265
1428 + }
1429 + ]
1430 + },
1431 + {
1432 + "matcher": {
1433 + "id": "byName",
1434 + "options": "ACCOUNT"
1435 + },
1436 + "properties": [
1437 + {
1438 + "id": "custom.width",
1439 + "value": 227
1440 + }
1441 + ]
1442 + },
1443 + {
1444 + "matcher": {
1445 + "id": "byName",
1446 + "options": "EVENT TIME"
1447 + },
1448 + "properties": [
1449 + {
1450 + "id": "custom.width",
1451 + "value": 195
1452 + }
1453 + ]
1454 + },
1455 + {
1456 + "matcher": {
1457 + "id": "byName",
1458 + "options": "CLIENT IP"
1459 + },
1460 + "properties": [
1461 + {
1462 + "id": "custom.width",
1463 + "value": 191
1464 + }
1465 + ]
1466 + },
1467 + {
1468 + "matcher": {
1469 + "id": "byName",
1470 + "options": "DESCRIPTION"
1471 + },
1472 + "properties": [
1473 + {
1474 + "id": "custom.width",
1475 + "value": 367
1476 + }
1477 + ]
1478 + },
1479 + {
1480 + "matcher": {
1481 + "id": "byName",
1482 + "options": "FILE"
1483 + },
1484 + "properties": [
1485 + {
1486 + "id": "custom.width",
1487 + "value": 855
1488 + }
1489 + ]
1490 + },
1491 + {
1492 + "matcher": {
1493 + "id": "byName",
1494 + "options": "BROWSER"
1495 + },
1496 + "properties": [
1497 + {
1498 + "id": "custom.width",
1499 + "value": 205
1500 + }
1501 + ]
1502 + },
1503 + {
1504 + "matcher": {
1505 + "id": "byName",
1506 + "options": "RULE LEVEL"
1507 + },
1508 + "properties": [
1509 + {
1510 + "id": "custom.width",
1511 + "value": 197
1512 + }
1513 + ]
1514 + }
1515 + ]
1516 + },
1517 + "gridPos": {
1518 + "h": 16,
1519 + "w": 24,
1520 + "x": 0,
1521 + "y": 32
1522 + },
1523 + "id": 27,
1524 + "options": {
1525 + "cellHeight": "sm",
1526 + "footer": {
1527 + "countRows": false,
1528 + "enablePagination": true,
1529 + "fields": "",
1530 + "reducer": [
1531 + "sum"
1532 + ],
1533 + "show": false
1534 + },
1535 + "showHeader": true,
1536 + "sortBy": []
1537 + },
1538 + "pluginVersion": "10.0.3",
1539 + "targets": [
1540 + {
1541 + "bucketAggs": [],
1542 + "datasource": {
1543 + "type": "elasticsearch",
1544 + "uid": "replace_datasource_uid"
1545 + },
1546 + "metrics": [
1547 + {
1548 + "id": "1",
1549 + "settings": {
1550 + "size": "250"
1551 + },
1552 + "type": "raw_data"
1553 + }
1554 + ],
1555 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
1556 + "refId": "A",
1557 + "timeField": "timestamp"
1558 + }
1559 + ],
1560 + "title": "EVENTS",
1561 + "transformations": [
1562 + {
1563 + "id": "organize",
1564 + "options": {
1565 + "excludeByName": {
1566 + "@metadata_beat": true,
1567 + "@metadata_type": true,
1568 + "@metadata_version": true,
1569 + "IMPHASH": true,
1570 + "MD5": true,
1571 + "SHA1": true,
1572 + "SHA256": true,
1573 + "_id": false,
1574 + "_index": true,
1575 + "_type": true,
1576 + "agent_ephemeral_id": true,
1577 + "agent_hostname": true,
1578 + "agent_id": true,
1579 + "agent_ip_city_name": true,
1580 + "agent_ip_country_code": true,
1581 + "agent_ip_geolocation": true,
1582 + "agent_name": true,
1583 + "agent_type": true,
1584 + "agent_version": true,
1585 + "beats_type": true,
1586 + "cluster_name": true,
1587 + "cluster_node": true,
1588 + "collector_node_id": true,
1589 + "data_alert_action": true,
1590 + "data_alert_category": true,
1591 + "data_alert_gid": true,
1592 + "data_alert_rev": true,
1593 + "data_alert_severity": true,
1594 + "data_alert_signature": true,
1595 + "data_alert_signature_id": true,
1596 + "data_app_proto": true,
1597 + "data_audit_auid": true,
1598 + "data_audit_command": true,
1599 + "data_audit_euid": true,
1600 + "data_audit_exe": true,
1601 + "data_audit_gid": true,
1602 + "data_audit_id": true,
1603 + "data_audit_pid": true,
1604 + "data_audit_res": true,
1605 + "data_audit_session": true,
1606 + "data_audit_type": true,
1607 + "data_audit_uid": true,
1608 + "data_dest_ip": true,
1609 + "data_dest_port": true,
1610 + "data_dstuser": true,
1611 + "data_event_type": true,
1612 + "data_extra_data": true,
1613 + "data_file": true,
1614 + "data_flow_bytes_toclient": true,
1615 + "data_flow_bytes_toserver": true,
1616 + "data_flow_id": true,
1617 + "data_flow_pkts_toclient": true,
1618 + "data_flow_pkts_toserver": true,
1619 + "data_flow_start": true,
1620 + "data_http_http_content_type": true,
1621 + "data_http_http_port": true,
1622 + "data_http_length": true,
1623 + "data_http_status": true,
1624 + "data_http_url": true,
1625 + "data_id": true,
1626 + "data_in_iface": true,
1627 + "data_integration": true,
1628 + "data_metadata_flowbits": true,
1629 + "data_metadata_flowints_http_anomaly_count": true,
1630 + "data_metadata_flowints_tcp_retransmission_count": true,
1631 + "data_office365_AADGroupId": true,
1632 + "data_office365_ActivityParameters": true,
1633 + "data_office365_Actor": true,
1634 + "data_office365_ActorContextId": true,
1635 + "data_office365_ActorIpAddress": false,
1636 + "data_office365_ActorIpAddress_city_name": true,
1637 + "data_office365_ActorIpAddress_country_code": true,
1638 + "data_office365_ActorIpAddress_geolocation": true,
1639 + "data_office365_AppAccessContext_AADSessionId": true,
1640 + "data_office365_AppAccessContext_APIId": true,
1641 + "data_office365_AppAccessContext_ClientAppId": true,
1642 + "data_office365_AppAccessContext_ClientAppName": true,
1643 + "data_office365_AppAccessContext_CorrelationId": true,
1644 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1645 + "data_office365_AppAccessContext_UniqueTokenId": true,
1646 + "data_office365_AppId": true,
1647 + "data_office365_ApplicationDisplayName": true,
1648 + "data_office365_ApplicationId": true,
1649 + "data_office365_ArtifactsShared": true,
1650 + "data_office365_AssertingApplicationId": true,
1651 + "data_office365_Attendees": true,
1652 + "data_office365_AuthenticationType": true,
1653 + "data_office365_AzureActiveDirectoryEventType": true,
1654 + "data_office365_BrowserVersion": true,
1655 + "data_office365_BrowserVersion_city_name": true,
1656 + "data_office365_BrowserVersion_country_code": true,
1657 + "data_office365_BrowserVersion_geolocation": true,
1658 + "data_office365_ChannelGuid": true,
1659 + "data_office365_ChannelName": true,
1660 + "data_office365_ChatName": true,
1661 + "data_office365_ChatThreadId": true,
1662 + "data_office365_ClientAppId": true,
1663 + "data_office365_ClientIP": false,
1664 + "data_office365_ClientIPAddress": true,
1665 + "data_office365_ClientIPAddress_city_name": true,
1666 + "data_office365_ClientIPAddress_country_code": true,
1667 + "data_office365_ClientIPAddress_geolocation": true,
1668 + "data_office365_ClientIP_city_name": true,
1669 + "data_office365_ClientIP_country_code": true,
1670 + "data_office365_ClientIP_geolocation": true,
1671 + "data_office365_ClientIP_reserved_ip": true,
1672 + "data_office365_ClientInfoString": true,
1673 + "data_office365_ClientProcessName": true,
1674 + "data_office365_ClientRequestId": true,
1675 + "data_office365_ClientVersion": true,
1676 + "data_office365_CommunicationSubType": true,
1677 + "data_office365_CommunicationType": true,
1678 + "data_office365_CorrelationId": true,
1679 + "data_office365_CreationTime": false,
1680 + "data_office365_CrossMailboxOperation": true,
1681 + "data_office365_CustomUniqueId": true,
1682 + "data_office365_CustomizedDoclib": true,
1683 + "data_office365_DestFolder_Id": true,
1684 + "data_office365_DestFolder_Path": true,
1685 + "data_office365_DestinationFileExtension": true,
1686 + "data_office365_DestinationFileName": true,
1687 + "data_office365_DestinationRelativeUrl": true,
1688 + "data_office365_DeviceDisplayName": true,
1689 + "data_office365_DeviceDisplayName_city_name": true,
1690 + "data_office365_DeviceDisplayName_country_code": true,
1691 + "data_office365_DeviceDisplayName_geolocation": true,
1692 + "data_office365_DeviceId": true,
1693 + "data_office365_DeviceInformation": true,
1694 + "data_office365_DeviceProperties": true,
1695 + "data_office365_DoNotDistributeEvent": true,
1696 + "data_office365_EndTime": true,
1697 + "data_office365_ErrorNumber": true,
1698 + "data_office365_EventData": true,
1699 + "data_office365_EventSource": true,
1700 + "data_office365_ExchangeId": true,
1701 + "data_office365_ExtendedProperties": true,
1702 + "data_office365_ExternalAccess": true,
1703 + "data_office365_ExtraProperties": true,
1704 + "data_office365_FileSizeBytes": true,
1705 + "data_office365_FileSyncBytesCommitted": true,
1706 + "data_office365_Folder_Id": true,
1707 + "data_office365_Folder_Path": true,
1708 + "data_office365_FormId": true,
1709 + "data_office365_FormsUserType": true,
1710 + "data_office365_FromApp": true,
1711 + "data_office365_HighPriorityMediaProcessing": true,
1712 + "data_office365_HostedContents": true,
1713 + "data_office365_ICalUid": true,
1714 + "data_office365_Id": true,
1715 + "data_office365_ImplicitShare": true,
1716 + "data_office365_InterSystemsId": true,
1717 + "data_office365_InternalLogonType": true,
1718 + "data_office365_IntraSystemId": true,
1719 + "data_office365_IsManagedDevice": true,
1720 + "data_office365_ItemCount": true,
1721 + "data_office365_ItemName": true,
1722 + "data_office365_ItemType": true,
1723 + "data_office365_Item_Id": true,
1724 + "data_office365_Item_InternetMessageId": true,
1725 + "data_office365_Item_IsRecord": true,
1726 + "data_office365_Item_ParentFolder_Id": true,
1727 + "data_office365_Item_SizeInBytes": true,
1728 + "data_office365_JoinTime": true,
1729 + "data_office365_LeaveTime": true,
1730 + "data_office365_ListBaseTemplateType": true,
1731 + "data_office365_ListBaseType": true,
1732 + "data_office365_ListId": true,
1733 + "data_office365_ListItemUniqueId": true,
1734 + "data_office365_ListServerTemplate": true,
1735 + "data_office365_ListTitle": true,
1736 + "data_office365_LogonError": true,
1737 + "data_office365_LogonType": true,
1738 + "data_office365_LogonUserSid": true,
1739 + "data_office365_MachineId": true,
1740 + "data_office365_MailboxGuid": true,
1741 + "data_office365_MailboxOwnerSid": true,
1742 + "data_office365_MailboxOwnerUPN": true,
1743 + "data_office365_MeetingDetailId": true,
1744 + "data_office365_MeetingURL": true,
1745 + "data_office365_Members": true,
1746 + "data_office365_MessageId": true,
1747 + "data_office365_MessageSizeInBytes": true,
1748 + "data_office365_MessageURLs": true,
1749 + "data_office365_MessageVersion": true,
1750 + "data_office365_Modalities": true,
1751 + "data_office365_ModifiedProperties": true,
1752 + "data_office365_Name": true,
1753 + "data_office365_NewValue": true,
1754 + "data_office365_ObjectId": true,
1755 + "data_office365_Operation": true,
1756 + "data_office365_OperationScope": true,
1757 + "data_office365_OrganizationId": true,
1758 + "data_office365_OrganizationName": true,
1759 + "data_office365_Organizer_OrganizationId": true,
1760 + "data_office365_Organizer_RecipientType": true,
1761 + "data_office365_Organizer_Role": true,
1762 + "data_office365_Organizer_UserObjectId": true,
1763 + "data_office365_OriginatingServer": true,
1764 + "data_office365_Parameters": true,
1765 + "data_office365_ParentMessageId": true,
1766 + "data_office365_Platform": true,
1767 + "data_office365_ProviderTypes": true,
1768 + "data_office365_RecordType": true,
1769 + "data_office365_ResultStatus": false,
1770 + "data_office365_SearchQueryText": true,
1771 + "data_office365_SessionId": true,
1772 + "data_office365_Site": true,
1773 + "data_office365_SiteUrl": true,
1774 + "data_office365_SkipForServiceWorker": true,
1775 + "data_office365_Source": true,
1776 + "data_office365_SourceFileExtension": true,
1777 + "data_office365_SourceRelativeUrl": true,
1778 + "data_office365_StartTime": true,
1779 + "data_office365_Subscription": true,
1780 + "data_office365_SubscriptionId": true,
1781 + "data_office365_Target": true,
1782 + "data_office365_TargetContextId": true,
1783 + "data_office365_TargetUserOrGroupName": true,
1784 + "data_office365_TargetUserOrGroupType": true,
1785 + "data_office365_TeamGuid": true,
1786 + "data_office365_TeamName": true,
1787 + "data_office365_UniqueSharingId": true,
1788 + "data_office365_UserAgent": true,
1789 + "data_office365_UserId": false,
1790 + "data_office365_UserKey": true,
1791 + "data_office365_UserType": true,
1792 + "data_office365_Version": true,
1793 + "data_office365_WebId": true,
1794 + "data_office365_Workload": true,
1795 + "data_osquery_action": true,
1796 + "data_osquery_calendarTime": true,
1797 + "data_osquery_columns_address": true,
1798 + "data_osquery_columns_address_city_name": true,
1799 + "data_osquery_columns_address_country_code": true,
1800 + "data_osquery_columns_address_geolocation": true,
1801 + "data_osquery_columns_cmdline": true,
1802 + "data_osquery_columns_cwd": true,
1803 + "data_osquery_columns_description": true,
1804 + "data_osquery_columns_directory": true,
1805 + "data_osquery_columns_disk_bytes_read": true,
1806 + "data_osquery_columns_disk_bytes_written": true,
1807 + "data_osquery_columns_egid": true,
1808 + "data_osquery_columns_euid": true,
1809 + "data_osquery_columns_family": true,
1810 + "data_osquery_columns_fd": true,
1811 + "data_osquery_columns_gid": true,
1812 + "data_osquery_columns_gid_signed": true,
1813 + "data_osquery_columns_host": true,
1814 + "data_osquery_columns_interface": true,
1815 + "data_osquery_columns_local_address": true,
1816 + "data_osquery_columns_local_address_city_name": true,
1817 + "data_osquery_columns_local_address_country_code": true,
1818 + "data_osquery_columns_local_address_geolocation": true,
1819 + "data_osquery_columns_local_port": true,
1820 + "data_osquery_columns_mac": true,
1821 + "data_osquery_columns_name": true,
1822 + "data_osquery_columns_net_namespace": true,
1823 + "data_osquery_columns_nice": true,
1824 + "data_osquery_columns_on_disk": true,
1825 + "data_osquery_columns_parent": true,
1826 + "data_osquery_columns_path": true,
1827 + "data_osquery_columns_pgroup": true,
1828 + "data_osquery_columns_pid": true,
1829 + "data_osquery_columns_port": true,
1830 + "data_osquery_columns_protocol": true,
1831 + "data_osquery_columns_remote_address": true,
1832 + "data_osquery_columns_remote_address_city_name": true,
1833 + "data_osquery_columns_remote_address_country_code": true,
1834 + "data_osquery_columns_remote_address_geolocation": true,
1835 + "data_osquery_columns_remote_port": true,
1836 + "data_osquery_columns_resident_size": true,
1837 + "data_osquery_columns_root": true,
1838 + "data_osquery_columns_sgid": true,
1839 + "data_osquery_columns_shell": true,
1840 + "data_osquery_columns_socket": true,
1841 + "data_osquery_columns_start_time": true,
1842 + "data_osquery_columns_state": true,
1843 + "data_osquery_columns_suid": true,
1844 + "data_osquery_columns_system_time": true,
1845 + "data_osquery_columns_threads": true,
1846 + "data_osquery_columns_time_utc": true,
1847 + "data_osquery_columns_total_size": true,
1848 + "data_osquery_columns_tty": true,
1849 + "data_osquery_columns_type": true,
1850 + "data_osquery_columns_uid": true,
1851 + "data_osquery_columns_uid_signed": true,
1852 + "data_osquery_columns_user": true,
1853 + "data_osquery_columns_user_time": true,
1854 + "data_osquery_columns_username": true,
1855 + "data_osquery_columns_wired_size": true,
1856 + "data_osquery_counter": true,
1857 + "data_osquery_decorations_host_uuid": true,
1858 + "data_osquery_decorations_hostname": true,
1859 + "data_osquery_epoch": true,
1860 + "data_osquery_hostIdentifier": true,
1861 + "data_osquery_name": true,
1862 + "data_osquery_numerics": true,
1863 + "data_osquery_unixTime": true,
1864 + "data_proto": true,
1865 + "data_sca_check_command": true,
1866 + "data_sca_check_compliance_cis": true,
1867 + "data_sca_check_compliance_cis_csc": true,
1868 + "data_sca_check_compliance_gdpr_IV": true,
1869 + "data_sca_check_compliance_gpg_13": true,
1870 + "data_sca_check_compliance_hipaa": true,
1871 + "data_sca_check_compliance_nist_800_53": true,
1872 + "data_sca_check_compliance_pci_dss": true,
1873 + "data_sca_check_compliance_tsc": true,
1874 + "data_sca_check_description": true,
1875 + "data_sca_check_id": true,
1876 + "data_sca_check_previous_result": true,
1877 + "data_sca_check_rationale": true,
1878 + "data_sca_check_remediation": true,
1879 + "data_sca_check_result": true,
1880 + "data_sca_check_title": true,
1881 + "data_sca_description": true,
1882 + "data_sca_failed": true,
1883 + "data_sca_file": true,
1884 + "data_sca_invalid": true,
1885 + "data_sca_passed": true,
1886 + "data_sca_policy": true,
1887 + "data_sca_policy_id": true,
1888 + "data_sca_scan_id": true,
1889 + "data_sca_score": true,
1890 + "data_sca_total_checks": true,
1891 + "data_sca_type": true,
1892 + "data_script": true,
1893 + "data_src_ip": true,
1894 + "data_src_ip_city_name": true,
1895 + "data_src_ip_country_code": true,
1896 + "data_src_ip_geolocation": true,
1897 + "data_src_port": true,
1898 + "data_srcip": true,
1899 + "data_srcip_city_name": true,
1900 + "data_srcip_country_code": true,
1901 + "data_srcip_geolocation": true,
1902 + "data_srcuser": true,
1903 + "data_timestamp": true,
1904 + "data_title": true,
1905 + "data_tls_session_resumed": true,
1906 + "data_tls_version": true,
1907 + "data_tx_id": true,
1908 + "data_type": true,
1909 + "data_win_eventXML_binaryData": true,
1910 + "data_win_eventXML_binaryDataSize": true,
1911 + "data_win_eventXML_param1": true,
1912 + "data_win_eventdata_authenticationPackageName": true,
1913 + "data_win_eventdata_callTrace": true,
1914 + "data_win_eventdata_commandLine": true,
1915 + "data_win_eventdata_company": true,
1916 + "data_win_eventdata_creationUtcTime": true,
1917 + "data_win_eventdata_currentDirectory": true,
1918 + "data_win_eventdata_description": true,
1919 + "data_win_eventdata_destinationHostname": true,
1920 + "data_win_eventdata_destinationIp": true,
1921 + "data_win_eventdata_destinationIp_city_name": true,
1922 + "data_win_eventdata_destinationIp_country_code": true,
1923 + "data_win_eventdata_destinationIp_geolocation": true,
1924 + "data_win_eventdata_destinationIsIpv6": true,
1925 + "data_win_eventdata_destinationPort": true,
1926 + "data_win_eventdata_destinationPortName": true,
1927 + "data_win_eventdata_details": true,
1928 + "data_win_eventdata_elevatedToken": true,
1929 + "data_win_eventdata_eventType": true,
1930 + "data_win_eventdata_fileVersion": true,
1931 + "data_win_eventdata_fileVersion_city_name": true,
1932 + "data_win_eventdata_fileVersion_country_code": true,
1933 + "data_win_eventdata_fileVersion_geolocation": true,
1934 + "data_win_eventdata_grantedAccess": true,
1935 + "data_win_eventdata_hashes": true,
1936 + "data_win_eventdata_image": true,
1937 + "data_win_eventdata_imageLoaded": true,
1938 + "data_win_eventdata_impersonationLevel": true,
1939 + "data_win_eventdata_initiated": true,
1940 + "data_win_eventdata_integrityLevel": true,
1941 + "data_win_eventdata_ipAddress": true,
1942 + "data_win_eventdata_ipPort": true,
1943 + "data_win_eventdata_keyLength": true,
1944 + "data_win_eventdata_logonGuid": true,
1945 + "data_win_eventdata_logonId": true,
1946 + "data_win_eventdata_logonProcessName": true,
1947 + "data_win_eventdata_logonType": true,
1948 + "data_win_eventdata_originalFileName": true,
1949 + "data_win_eventdata_param1": true,
1950 + "data_win_eventdata_param2": true,
1951 + "data_win_eventdata_param3": true,
1952 + "data_win_eventdata_param4": true,
1953 + "data_win_eventdata_parentCommandLine": true,
1954 + "data_win_eventdata_parentImage": true,
1955 + "data_win_eventdata_parentProcessGuid": true,
1956 + "data_win_eventdata_parentProcessId": true,
1957 + "data_win_eventdata_processGuid": true,
1958 + "data_win_eventdata_processId": true,
1959 + "data_win_eventdata_processName": true,
1960 + "data_win_eventdata_product": true,
1961 + "data_win_eventdata_protocol": true,
1962 + "data_win_eventdata_queryName": true,
1963 + "data_win_eventdata_queryResults": true,
1964 + "data_win_eventdata_queryStatus": true,
1965 + "data_win_eventdata_ruleName": true,
1966 + "data_win_eventdata_serviceName": true,
1967 + "data_win_eventdata_serviceSid": true,
1968 + "data_win_eventdata_signature": true,
1969 + "data_win_eventdata_signatureStatus": true,
1970 + "data_win_eventdata_signed": true,
1971 + "data_win_eventdata_sourceHostname": true,
1972 + "data_win_eventdata_sourceImage": true,
1973 + "data_win_eventdata_sourceIp": true,
1974 + "data_win_eventdata_sourceIp_city_name": true,
1975 + "data_win_eventdata_sourceIp_country_code": true,
1976 + "data_win_eventdata_sourceIp_geolocation": true,
1977 + "data_win_eventdata_sourceIsIpv6": true,
1978 + "data_win_eventdata_sourcePort": true,
1979 + "data_win_eventdata_sourceProcessGUID": true,
1980 + "data_win_eventdata_sourceProcessId": true,
1981 + "data_win_eventdata_sourceThreadId": true,
1982 + "data_win_eventdata_status": true,
1983 + "data_win_eventdata_subjectDomainName": true,
1984 + "data_win_eventdata_subjectLogonId": true,
1985 + "data_win_eventdata_subjectUserName": true,
1986 + "data_win_eventdata_subjectUserSid": true,
1987 + "data_win_eventdata_targetDomainName": true,
1988 + "data_win_eventdata_targetFilename": true,
1989 + "data_win_eventdata_targetImage": true,
1990 + "data_win_eventdata_targetLinkedLogonId": true,
1991 + "data_win_eventdata_targetLogonId": true,
1992 + "data_win_eventdata_targetObject": true,
1993 + "data_win_eventdata_targetProcessGUID": true,
1994 + "data_win_eventdata_targetProcessId": true,
1995 + "data_win_eventdata_targetUserName": true,
1996 + "data_win_eventdata_targetUserSid": true,
1997 + "data_win_eventdata_terminalSessionId": true,
1998 + "data_win_eventdata_ticketEncryptionType": true,
1999 + "data_win_eventdata_ticketOptions": true,
2000 + "data_win_eventdata_user": true,
2001 + "data_win_eventdata_utcTime": true,
2002 + "data_win_eventdata_virtualAccount": true,
2003 + "data_win_system_channel": true,
2004 + "data_win_system_computer": true,
2005 + "data_win_system_eventID": true,
2006 + "data_win_system_eventRecordID": true,
2007 + "data_win_system_eventSourceName": true,
2008 + "data_win_system_keywords": true,
2009 + "data_win_system_level": true,
2010 + "data_win_system_message": true,
2011 + "data_win_system_opcode": true,
2012 + "data_win_system_processID": true,
2013 + "data_win_system_providerGuid": true,
2014 + "data_win_system_providerName": true,
2015 + "data_win_system_severityValue": true,
2016 + "data_win_system_systemTime": true,
2017 + "data_win_system_task": true,
2018 + "data_win_system_threadID": true,
2019 + "data_win_system_version": true,
2020 + "decoder_name": true,
2021 + "decoder_parent": true,
2022 + "dns_query": true,
2023 + "dns_query_threat_indicated": true,
2024 + "dst_ip": true,
2025 + "dst_ip_city_name": true,
2026 + "dst_ip_country_code": true,
2027 + "dst_ip_geolocation": true,
2028 + "dst_ip_threat_indicated": true,
2029 + "dst_port": true,
2030 + "ecs_version": true,
2031 + "error": true,
2032 + "event_hash": true,
2033 + "file_path": true,
2034 + "firewall_rule_name": true,
2035 + "full_log": false,
2036 + "gl2_accounted_message_size": true,
2037 + "gl2_message_id": true,
2038 + "gl2_processing_error": true,
2039 + "gl2_remote_ip": true,
2040 + "gl2_remote_port": true,
2041 + "gl2_source_collector": true,
2042 + "gl2_source_input": true,
2043 + "gl2_source_node": true,
2044 + "hash_md5": true,
2045 + "hash_sha1": true,
2046 + "hash_sha256": true,
2047 + "highlight": true,
2048 + "host_architecture": true,
2049 + "host_containerized": true,
2050 + "host_hostname": true,
2051 + "host_id": true,
2052 + "host_ip": true,
2053 + "host_mac": true,
2054 + "host_name": true,
2055 + "host_os_codename": true,
2056 + "host_os_kernel": true,
2057 + "host_os_name": true,
2058 + "host_os_platform": true,
2059 + "host_os_version": true,
2060 + "hostname": true,
2061 + "id": true,
2062 + "input_type": true,
2063 + "level": true,
2064 + "location": true,
2065 + "log_file_path": true,
2066 + "log_offset": true,
2067 + "manager_name": true,
2068 + "message": true,
2069 + "module": true,
2070 + "msg_timestamp": true,
2071 + "parent_process_cmd_line": true,
2072 + "parent_process_id": true,
2073 + "parent_process_image": true,
2074 + "pid": true,
2075 + "predecoder_hostname": true,
2076 + "predecoder_program_name": true,
2077 + "predecoder_timestamp": true,
2078 + "previous_log": true,
2079 + "previous_output": true,
2080 + "process_cmd_line": true,
2081 + "process_id": true,
2082 + "process_image": true,
2083 + "process_name": true,
2084 + "protocol": true,
2085 + "rule_cis": true,
2086 + "rule_cis_csc": true,
2087 + "rule_firedtimes": true,
2088 + "rule_gdpr": true,
2089 + "rule_gdpr_IV": true,
2090 + "rule_gpg13": true,
2091 + "rule_gpg_13": true,
2092 + "rule_group1": true,
2093 + "rule_group2": true,
2094 + "rule_group3": true,
2095 + "rule_groups": true,
2096 + "rule_hipaa": true,
2097 + "rule_id": true,
2098 + "rule_info": true,
2099 + "rule_mail": true,
2100 + "rule_mitre_id": true,
2101 + "rule_mitre_tactic": false,
2102 + "rule_nist_800_53": true,
2103 + "rule_pci_dss": true,
2104 + "rule_tsc": true,
2105 + "scanid": true,
2106 + "service": true,
2107 + "software_package": true,
2108 + "software_vendor": true,
2109 + "sort": true,
2110 + "source": true,
2111 + "source_reserved_ip": true,
2112 + "src_ip": true,
2113 + "src_ip_city_name": true,
2114 + "src_ip_country_code": true,
2115 + "src_ip_geolocation": true,
2116 + "src_port": true,
2117 + "streams": true,
2118 + "syscheck_attrs_after": true,
2119 + "syscheck_audit_effective_user_id": true,
2120 + "syscheck_audit_effective_user_name": true,
2121 + "syscheck_audit_group_id": true,
2122 + "syscheck_audit_group_name": true,
2123 + "syscheck_audit_login_user_id": true,
2124 + "syscheck_audit_login_user_name": true,
2125 + "syscheck_audit_process_cwd": true,
2126 + "syscheck_audit_process_id": true,
2127 + "syscheck_audit_process_name": true,
2128 + "syscheck_audit_process_parent_cwd": true,
2129 + "syscheck_audit_process_parent_name": true,
2130 + "syscheck_audit_process_ppid": true,
2131 + "syscheck_audit_user_id": true,
2132 + "syscheck_audit_user_name": true,
2133 + "syscheck_changed_attributes": true,
2134 + "syscheck_event": true,
2135 + "syscheck_gid_after": true,
2136 + "syscheck_gname_after": true,
2137 + "syscheck_hard_links": true,
2138 + "syscheck_inode_after": true,
2139 + "syscheck_inode_before": true,
2140 + "syscheck_md5_after": true,
2141 + "syscheck_md5_before": true,
2142 + "syscheck_mode": true,
2143 + "syscheck_mtime_after": true,
2144 + "syscheck_mtime_before": true,
2145 + "syscheck_path": true,
2146 + "syscheck_perm_after": true,
2147 + "syscheck_perm_before": true,
2148 + "syscheck_sha1_after": true,
2149 + "syscheck_sha1_before": true,
2150 + "syscheck_sha256_after": true,
2151 + "syscheck_sha256_before": true,
2152 + "syscheck_size_after": true,
2153 + "syscheck_size_before": true,
2154 + "syscheck_uid_after": true,
2155 + "syscheck_uname_after": true,
2156 + "syscheck_win_perm_after": true,
2157 + "syscheck_win_perm_after_0_allowed": true,
2158 + "syscheck_win_perm_after_0_name": true,
2159 + "syscheck_win_perm_after_1_allowed": true,
2160 + "syscheck_win_perm_after_1_name": true,
2161 + "syscheck_win_perm_after_2_allowed": true,
2162 + "syscheck_win_perm_after_2_name": true,
2163 + "syscheck_win_perm_after_3_allowed": true,
2164 + "syscheck_win_perm_after_3_name": true,
2165 + "syslog_customer": true,
2166 + "syslog_level": true,
2167 + "syslog_tag": true,
2168 + "syslog_type": true,
2169 + "sysmon_event_description": true,
2170 + "threat_ids": true,
2171 + "threat_indicated": true,
2172 + "threat_names": true,
2173 + "time": true,
2174 + "timestamp": true,
2175 + "true": true,
2176 + "user_name": true,
2177 + "win_registry_key": true,
2178 + "win_system_eventID": true,
2179 + "windows_auth_package": true,
2180 + "windows_domain": true,
2181 + "windows_event_id": true,
2182 + "windows_event_severity": true,
2183 + "windows_logon_type": true
2184 + },
2185 + "indexByName": {
2186 + "_id": 2,
2187 + "_index": 9,
2188 + "_type": 10,
2189 + "agent_id": 11,
2190 + "agent_name": 5,
2191 + "cluster_name": 12,
2192 + "cluster_node": 13,
2193 + "data_office365_AppAccessContext_APIId": 49,
2194 + "data_office365_AppAccessContext_ClientAppId": 50,
2195 + "data_office365_AppAccessContext_ClientAppName": 51,
2196 + "data_office365_AppAccessContext_CorrelationId": 52,
2197 + "data_office365_ArtifactsShared": 53,
2198 + "data_office365_Attendees": 54,
2199 + "data_office365_ChatName": 55,
2200 + "data_office365_ChatThreadId": 56,
2201 + "data_office365_ClientIP": 4,
2202 + "data_office365_ClientIP_city_name": 14,
2203 + "data_office365_ClientIP_country_code": 15,
2204 + "data_office365_ClientIP_geolocation": 16,
2205 + "data_office365_CommunicationSubType": 57,
2206 + "data_office365_CommunicationType": 58,
2207 + "data_office365_CreationTime": 0,
2208 + "data_office365_DeviceId": 59,
2209 + "data_office365_DeviceInformation": 60,
2210 + "data_office365_EndTime": 61,
2211 + "data_office365_ExchangeId": 62,
2212 + "data_office365_ExtraProperties": 63,
2213 + "data_office365_ICalUid": 64,
2214 + "data_office365_Id": 17,
2215 + "data_office365_ItemName": 65,
2216 + "data_office365_JoinTime": 66,
2217 + "data_office365_LeaveTime": 67,
2218 + "data_office365_MeetingDetailId": 68,
2219 + "data_office365_MeetingURL": 69,
2220 + "data_office365_Members": 70,
2221 + "data_office365_MessageId": 71,
2222 + "data_office365_MessageSizeInBytes": 72,
2223 + "data_office365_MessageURLs": 73,
2224 + "data_office365_MessageVersion": 74,
2225 + "data_office365_Modalities": 75,
2226 + "data_office365_Name": 76,
2227 + "data_office365_NewValue": 77,
2228 + "data_office365_ObjectId": 18,
2229 + "data_office365_Operation": 24,
2230 + "data_office365_OperationScope": 78,
2231 + "data_office365_OrganizationId": 19,
2232 + "data_office365_Organizer_OrganizationId": 79,
2233 + "data_office365_Organizer_RecipientType": 80,
2234 + "data_office365_Organizer_Role": 81,
2235 + "data_office365_Organizer_UserObjectId": 82,
2236 + "data_office365_ProviderTypes": 83,
2237 + "data_office365_RecordType": 20,
2238 + "data_office365_StartTime": 84,
2239 + "data_office365_SubscriptionId": 85,
2240 + "data_office365_TeamGuid": 86,
2241 + "data_office365_UserId": 3,
2242 + "data_office365_UserKey": 21,
2243 + "data_office365_UserType": 22,
2244 + "data_office365_Version": 23,
2245 + "data_office365_Workload": 48,
2246 + "decoder_name": 25,
2247 + "gl2_accounted_message_size": 26,
2248 + "gl2_message_id": 27,
2249 + "gl2_processing_error": 28,
2250 + "gl2_remote_ip": 29,
2251 + "gl2_remote_port": 30,
2252 + "gl2_source_input": 31,
2253 + "gl2_source_node": 32,
2254 + "highlight": 33,
2255 + "id": 34,
2256 + "location": 35,
2257 + "manager_name": 36,
2258 + "message": 37,
2259 + "rule_description": 6,
2260 + "rule_firedtimes": 38,
2261 + "rule_group1": 39,
2262 + "rule_groups": 40,
2263 + "rule_id": 8,
2264 + "rule_level": 7,
2265 + "rule_mail": 41,
2266 + "sort": 42,
2267 + "source": 43,
2268 + "streams": 44,
2269 + "syslog_level": 45,
2270 + "syslog_type": 46,
2271 + "timestamp": 1,
2272 + "true": 47
2273 + },
2274 + "renameByName": {
2275 + "_id": "EVENT ID",
2276 + "agent_name": "",
2277 + "data_office365_ActorIpAddress": "SRC IP",
2278 + "data_office365_AffectedItems": "ITEMS",
2279 + "data_office365_BrowserName": "BROWSER",
2280 + "data_office365_ClientIP": "CLIENT IP",
2281 + "data_office365_ClientIP_city_name": "",
2282 + "data_office365_CreationTime": "EVENT TIME",
2283 + "data_office365_FormName": "FORM",
2284 + "data_office365_Item_Attachments": "ATTACHMENT",
2285 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2286 + "data_office365_Item_Subject": "SUBJECT",
2287 + "data_office365_ResultStatus": "RESULT",
2288 + "data_office365_SourceApp": "SRC APP",
2289 + "data_office365_SourceFileName": "FILE",
2290 + "data_office365_UserId": "ACCOUNT",
2291 + "rule_description": "DESCRIPTION",
2292 + "rule_id": "RULE ID",
2293 + "rule_level": "",
2294 + "rule_mitre_tactic": "MITRE TACTIC",
2295 + "rule_mitre_technique": "MITRE TECHNIQUE",
2296 + "timestamp": "Date/Time"
2297 + }
2298 + }
2299 + }
2300 + ],
2301 + "transparent": true,
2302 + "type": "table"
2303 + }
2304 + ],
2305 + "refresh": "",
2306 + "schemaVersion": 38,
2307 + "style": "dark",
2308 + "tags": [
2309 + "O365"
2310 + ],
2311 + "templating": {
2312 + "list": [
2313 + {
2314 + "datasource": {
2315 + "type": "elasticsearch",
2316 + "uid": "replace_datasource_uid"
2317 + },
2318 + "filters": [],
2319 + "hide": 0,
2320 + "label": "",
2321 + "name": "Filters",
2322 + "skipUrlSync": false,
2323 + "type": "adhoc"
2324 + },
2325 + {
2326 + "current": {
2327 + "selected": false,
2328 + "text": "All",
2329 + "value": "$__all"
2330 + },
2331 + "datasource": {
2332 + "type": "elasticsearch",
2333 + "uid": "replace_datasource_uid"
2334 + },
2335 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2336 + "hide": 0,
2337 + "includeAll": true,
2338 + "label": "Operation",
2339 + "multi": false,
2340 + "name": "operation",
2341 + "options": [],
2342 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2343 + "refresh": 2,
2344 + "regex": "",
2345 + "skipUrlSync": false,
2346 + "sort": 1,
2347 + "tagValuesQuery": "",
2348 + "tagsQuery": "",
2349 + "type": "query",
2350 + "useTags": false
2351 + },
2352 + {
2353 + "current": {
2354 + "selected": false,
2355 + "text": "All",
2356 + "value": "$__all"
2357 + },
2358 + "datasource": {
2359 + "type": "elasticsearch",
2360 + "uid": "replace_datasource_uid"
2361 + },
2362 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2363 + "hide": 0,
2364 + "includeAll": true,
2365 + "label": "Rule Level",
2366 + "multi": false,
2367 + "name": "rule_level",
2368 + "options": [],
2369 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2370 + "refresh": 2,
2371 + "regex": "",
2372 + "skipUrlSync": false,
2373 + "sort": 0,
2374 + "type": "query"
2375 + }
2376 + ]
2377 + },
2378 + "time": {
2379 + "from": "now-2d",
2380 + "to": "now"
2381 + },
2382 + "timepicker": {
2383 + "refresh_intervals": [
2384 + "5s",
2385 + "10s",
2386 + "30s",
2387 + "1m",
2388 + "5m",
2389 + "15m",
2390 + "30m",
2391 + "1h",
2392 + "2h",
2393 + "1d"
2394 + ],
2395 + "time_options": [
2396 + "5m",
2397 + "15m",
2398 + "1h",
2399 + "6h",
2400 + "12h",
2401 + "24h",
2402 + "2d",
2403 + "7d",
2404 + "30d"
2405 + ]
2406 + },
2407 + "timezone": "",
2408 + "title": "O365 - MICROSOFT FORMS",
2409 + "weekStart": ""
2410 +}
backend/app/connectors/grafana/dashboards/Office365/mitre.json new
+1757
@@ -0,0 +1,1757 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "$$hashKey": "object:325",
31 + "asDropdown": true,
32 + "icon": "external link",
33 + "includeVars": true,
34 + "keepTime": true,
35 + "tags": [
36 + "O365"
37 + ],
38 + "targetBlank": true,
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [],
52 + "thresholds": {
53 + "mode": "absolute",
54 + "steps": [
55 + {
56 + "color": "light-red",
57 + "value": null
58 + }
59 + ]
60 + }
61 + },
62 + "overrides": [
63 + {
64 + "matcher": {
65 + "id": "byName",
66 + "options": "MITRE ENRICHED EVENTS"
67 + },
68 + "properties": [
69 + {
70 + "id": "color",
71 + "value": {
72 + "mode": "palette-classic"
73 + }
74 + }
75 + ]
76 + },
77 + {
78 + "matcher": {
79 + "id": "byName",
80 + "options": "ALL EVENTS"
81 + },
82 + "properties": [
83 + {
84 + "id": "color",
85 + "value": {
86 + "mode": "palette-classic"
87 + }
88 + }
89 + ]
90 + }
91 + ]
92 + },
93 + "gridPos": {
94 + "h": 7,
95 + "w": 4,
96 + "x": 0,
97 + "y": 0
98 + },
99 + "id": 2,
100 + "options": {
101 + "colorMode": "value",
102 + "graphMode": "area",
103 + "justifyMode": "auto",
104 + "orientation": "horizontal",
105 + "reduceOptions": {
106 + "calcs": [
107 + "sum"
108 + ],
109 + "fields": "",
110 + "values": false
111 + },
112 + "text": {},
113 + "textMode": "auto"
114 + },
115 + "pluginVersion": "9.2.0",
116 + "targets": [
117 + {
118 + "alias": "MITRE ENRICHED EVENTS",
119 + "bucketAggs": [
120 + {
121 + "$$hashKey": "object:266",
122 + "field": "timestamp",
123 + "id": "2",
124 + "settings": {
125 + "interval": "auto",
126 + "min_doc_count": 0,
127 + "trimEdges": 0
128 + },
129 + "type": "date_histogram"
130 + }
131 + ],
132 + "datasource": {
133 + "type": "elasticsearch",
134 + "uid": "replace_datasource_uid"
135 + },
136 + "metrics": [
137 + {
138 + "$$hashKey": "object:264",
139 + "field": "select field",
140 + "id": "1",
141 + "type": "count"
142 + }
143 + ],
144 + "query": "_exists_:rule_mitre_id AND data_office365_Workload:$workload AND rule_level:$rule_level",
145 + "refId": "A",
146 + "timeField": "timestamp"
147 + },
148 + {
149 + "alias": "ALL EVENTS",
150 + "bucketAggs": [
151 + {
152 + "field": "timestamp",
153 + "id": "2",
154 + "settings": {
155 + "interval": "auto"
156 + },
157 + "type": "date_histogram"
158 + }
159 + ],
160 + "datasource": {
161 + "type": "elasticsearch",
162 + "uid": "replace_datasource_uid"
163 + },
164 + "hide": false,
165 + "metrics": [
166 + {
167 + "id": "1",
168 + "type": "count"
169 + }
170 + ],
171 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
172 + "refId": "B",
173 + "timeField": "timestamp"
174 + }
175 + ],
176 + "title": "MITRE ATT&CK EBRICHMENT",
177 + "type": "stat"
178 + },
179 + {
180 + "datasource": {
181 + "type": "elasticsearch",
182 + "uid": "replace_datasource_uid"
183 + },
184 + "fieldConfig": {
185 + "defaults": {
186 + "mappings": [],
187 + "thresholds": {
188 + "mode": "absolute",
189 + "steps": [
190 + {
191 + "color": "light-red",
192 + "value": null
193 + }
194 + ]
195 + }
196 + },
197 + "overrides": []
198 + },
199 + "gridPos": {
200 + "h": 7,
201 + "w": 4,
202 + "x": 4,
203 + "y": 0
204 + },
205 + "id": 35,
206 + "options": {
207 + "colorMode": "value",
208 + "graphMode": "area",
209 + "justifyMode": "auto",
210 + "orientation": "auto",
211 + "reduceOptions": {
212 + "calcs": [
213 + "sum"
214 + ],
215 + "fields": "",
216 + "values": false
217 + },
218 + "text": {},
219 + "textMode": "auto"
220 + },
221 + "pluginVersion": "9.2.0",
222 + "targets": [
223 + {
224 + "bucketAggs": [
225 + {
226 + "$$hashKey": "object:266",
227 + "field": "timestamp",
228 + "id": "2",
229 + "settings": {
230 + "interval": "auto",
231 + "min_doc_count": 0,
232 + "trimEdges": 0
233 + },
234 + "type": "date_histogram"
235 + }
236 + ],
237 + "datasource": {
238 + "type": "elasticsearch",
239 + "uid": "replace_datasource_uid"
240 + },
241 + "metrics": [
242 + {
243 + "$$hashKey": "object:264",
244 + "field": "select field",
245 + "id": "1",
246 + "type": "count"
247 + }
248 + ],
249 + "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND data_office365_Workload:$workload",
250 + "refId": "A",
251 + "timeField": "timestamp"
252 + }
253 + ],
254 + "title": "MITRE ATT&CK ALERTS",
255 + "type": "stat"
256 + },
257 + {
258 + "datasource": {
259 + "type": "elasticsearch",
260 + "uid": "replace_datasource_uid"
261 + },
262 + "fieldConfig": {
263 + "defaults": {
264 + "mappings": [],
265 + "thresholds": {
266 + "mode": "absolute",
267 + "steps": [
268 + {
269 + "color": "light-red",
270 + "value": null
271 + }
272 + ]
273 + }
274 + },
275 + "overrides": []
276 + },
277 + "gridPos": {
278 + "h": 7,
279 + "w": 4,
280 + "x": 8,
281 + "y": 0
282 + },
283 + "id": 12,
284 + "options": {
285 + "colorMode": "value",
286 + "graphMode": "area",
287 + "justifyMode": "auto",
288 + "orientation": "auto",
289 + "reduceOptions": {
290 + "calcs": [
291 + "sum"
292 + ],
293 + "fields": "",
294 + "values": false
295 + },
296 + "text": {},
297 + "textMode": "auto"
298 + },
299 + "pluginVersion": "9.2.0",
300 + "targets": [
301 + {
302 + "bucketAggs": [
303 + {
304 + "$$hashKey": "object:161",
305 + "field": "data_office365_ActorUserId",
306 + "id": "2",
307 + "settings": {
308 + "min_doc_count": 1,
309 + "order": "desc",
310 + "orderBy": "_term",
311 + "size": "10"
312 + },
313 + "type": "terms"
314 + }
315 + ],
316 + "datasource": {
317 + "type": "elasticsearch",
318 + "uid": "replace_datasource_uid"
319 + },
320 + "metrics": [
321 + {
322 + "$$hashKey": "object:159",
323 + "field": "data_office365_ActorUserId",
324 + "id": "1",
325 + "meta": {},
326 + "settings": {},
327 + "type": "cardinality"
328 + }
329 + ],
330 + "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND data_office365_Workload:$workload",
331 + "refId": "A",
332 + "timeField": "timestamp"
333 + }
334 + ],
335 + "title": "ACCOUNTS AFFECTED",
336 + "type": "stat"
337 + },
338 + {
339 + "datasource": {
340 + "type": "elasticsearch",
341 + "uid": "replace_datasource_uid"
342 + },
343 + "fieldConfig": {
344 + "defaults": {
345 + "color": {
346 + "mode": "thresholds"
347 + },
348 + "custom": {
349 + "align": "auto",
350 + "displayMode": "auto",
351 + "inspect": false
352 + },
353 + "mappings": [],
354 + "thresholds": {
355 + "mode": "absolute",
356 + "steps": [
357 + {
358 + "color": "light-red",
359 + "value": null
360 + }
361 + ]
362 + }
363 + },
364 + "overrides": []
365 + },
366 + "gridPos": {
367 + "h": 7,
368 + "w": 6,
369 + "x": 12,
370 + "y": 0
371 + },
372 + "id": 13,
373 + "options": {
374 + "footer": {
375 + "fields": "",
376 + "reducer": [
377 + "sum"
378 + ],
379 + "show": false
380 + },
381 + "showHeader": true
382 + },
383 + "pluginVersion": "9.2.0",
384 + "targets": [
385 + {
386 + "bucketAggs": [
387 + {
388 + "$$hashKey": "object:228",
389 + "field": "data_office365_ActorUserId",
390 + "id": "2",
391 + "settings": {
392 + "min_doc_count": 1,
393 + "order": "desc",
394 + "orderBy": "_term",
395 + "size": "10"
396 + },
397 + "type": "terms"
398 + }
399 + ],
400 + "datasource": {
401 + "type": "elasticsearch",
402 + "uid": "replace_datasource_uid"
403 + },
404 + "metrics": [
405 + {
406 + "$$hashKey": "object:226",
407 + "field": "data_office365_ActorUserId",
408 + "id": "1",
409 + "meta": {},
410 + "settings": {},
411 + "type": "cardinality"
412 + }
413 + ],
414 + "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND data_office365_Workload:$workload",
415 + "refId": "A",
416 + "timeField": "timestamp"
417 + }
418 + ],
419 + "title": "USERS/ACCOUNTS AFFECTED",
420 + "type": "table"
421 + },
422 + {
423 + "datasource": {
424 + "type": "elasticsearch",
425 + "uid": "replace_datasource_uid"
426 + },
427 + "fieldConfig": {
428 + "defaults": {
429 + "color": {
430 + "mode": "palette-classic"
431 + },
432 + "custom": {
433 + "hideFrom": {
434 + "legend": false,
435 + "tooltip": false,
436 + "viz": false
437 + }
438 + },
439 + "decimals": 0,
440 + "mappings": [],
441 + "unit": "short"
442 + },
443 + "overrides": []
444 + },
445 + "gridPos": {
446 + "h": 7,
447 + "w": 6,
448 + "x": 18,
449 + "y": 0
450 + },
451 + "id": 15,
452 + "links": [],
453 + "maxDataPoints": 3,
454 + "options": {
455 + "displayLabels": [],
456 + "legend": {
457 + "calcs": [],
458 + "displayMode": "table",
459 + "placement": "right",
460 + "showLegend": true,
461 + "values": [
462 + "value"
463 + ]
464 + },
465 + "pieType": "donut",
466 + "reduceOptions": {
467 + "calcs": [
468 + "sum"
469 + ],
470 + "fields": "",
471 + "values": false
472 + },
473 + "text": {},
474 + "tooltip": {
475 + "mode": "single",
476 + "sort": "none"
477 + }
478 + },
479 + "pluginVersion": "6.6.2",
480 + "targets": [
481 + {
482 + "bucketAggs": [
483 + {
484 + "$$hashKey": "object:188",
485 + "fake": true,
486 + "field": "data_office365_Workload",
487 + "id": "3",
488 + "settings": {
489 + "min_doc_count": 1,
490 + "order": "desc",
491 + "orderBy": "_count",
492 + "size": "0"
493 + },
494 + "type": "terms"
495 + },
496 + {
497 + "$$hashKey": "object:189",
498 + "field": "timestamp",
499 + "id": "2",
500 + "settings": {
501 + "interval": "auto",
502 + "min_doc_count": 0,
503 + "trimEdges": 0
504 + },
505 + "type": "date_histogram"
506 + }
507 + ],
508 + "datasource": {
509 + "type": "elasticsearch",
510 + "uid": "replace_datasource_uid"
511 + },
512 + "metrics": [
513 + {
514 + "$$hashKey": "object:186",
515 + "field": "select field",
516 + "id": "1",
517 + "type": "count"
518 + }
519 + ],
520 + "query": "_exists_:rule_mitre_tactic AND data_office365_Workload:$workload AND rule_level:$rule_level",
521 + "refId": "A",
522 + "timeField": "timestamp"
523 + }
524 + ],
525 + "title": "WORKLOADS",
526 + "type": "piechart"
527 + },
528 + {
529 + "datasource": {
530 + "type": "elasticsearch",
531 + "uid": "replace_datasource_uid"
532 + },
533 + "fieldConfig": {
534 + "defaults": {
535 + "color": {
536 + "mode": "palette-classic"
537 + },
538 + "custom": {
539 + "hideFrom": {
540 + "legend": false,
541 + "tooltip": false,
542 + "viz": false
543 + }
544 + },
545 + "decimals": 0,
546 + "mappings": [],
547 + "unit": "short"
548 + },
549 + "overrides": []
550 + },
551 + "gridPos": {
552 + "h": 11,
553 + "w": 5,
554 + "x": 0,
555 + "y": 7
556 + },
557 + "id": 16,
558 + "links": [],
559 + "options": {
560 + "displayLabels": [],
561 + "legend": {
562 + "calcs": [],
563 + "displayMode": "list",
564 + "placement": "right",
565 + "showLegend": false,
566 + "values": [
567 + "value"
568 + ]
569 + },
570 + "pieType": "pie",
571 + "reduceOptions": {
572 + "calcs": [
573 + "sum"
574 + ],
575 + "fields": "",
576 + "values": false
577 + },
578 + "text": {},
579 + "tooltip": {
580 + "mode": "single",
581 + "sort": "none"
582 + }
583 + },
584 + "pluginVersion": "7.1.0",
585 + "targets": [
586 + {
587 + "bucketAggs": [
588 + {
589 + "$$hashKey": "object:82",
590 + "fake": true,
591 + "field": "rule_mitre_tactic",
592 + "id": "3",
593 + "settings": {
594 + "min_doc_count": 1,
595 + "order": "desc",
596 + "orderBy": "_count",
597 + "size": "10"
598 + },
599 + "type": "terms"
600 + },
601 + {
602 + "$$hashKey": "object:83",
603 + "field": "timestamp",
604 + "id": "2",
605 + "settings": {
606 + "interval": "auto",
607 + "min_doc_count": 0,
608 + "trimEdges": 0
609 + },
610 + "type": "date_histogram"
611 + }
612 + ],
613 + "datasource": {
614 + "type": "elasticsearch",
615 + "uid": "replace_datasource_uid"
616 + },
617 + "metrics": [
618 + {
619 + "$$hashKey": "object:80",
620 + "field": "select field",
621 + "id": "1",
622 + "type": "count"
623 + }
624 + ],
625 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
626 + "refId": "A",
627 + "timeField": "timestamp"
628 + }
629 + ],
630 + "title": "MITRE ATT&CK TACTICS (TOP 10)",
631 + "type": "piechart"
632 + },
633 + {
634 + "datasource": {
635 + "type": "elasticsearch",
636 + "uid": "replace_datasource_uid"
637 + },
638 + "fieldConfig": {
639 + "defaults": {
640 + "custom": {
641 + "align": "auto",
642 + "displayMode": "auto",
643 + "filterable": false,
644 + "inspect": false
645 + },
646 + "mappings": [
647 + {
648 + "options": {
649 + "mitre_attack": {
650 + "text": "Total"
651 + }
652 + },
653 + "type": "value"
654 + }
655 + ],
656 + "thresholds": {
657 + "mode": "absolute",
658 + "steps": [
659 + {
660 + "color": "green",
661 + "value": null
662 + },
663 + {
664 + "color": "red",
665 + "value": 80
666 + }
667 + ]
668 + }
669 + },
670 + "overrides": [
671 + {
672 + "matcher": {
673 + "id": "byName",
674 + "options": "rule_mitre_tactic"
675 + },
676 + "properties": [
677 + {
678 + "id": "custom.width",
679 + "value": 441
680 + }
681 + ]
682 + }
683 + ]
684 + },
685 + "gridPos": {
686 + "h": 11,
687 + "w": 8,
688 + "x": 5,
689 + "y": 7
690 + },
691 + "id": 28,
692 + "links": [],
693 + "options": {
694 + "footer": {
695 + "fields": "",
696 + "reducer": [
697 + "sum"
698 + ],
699 + "show": false
700 + },
701 + "showHeader": true,
702 + "sortBy": []
703 + },
704 + "pluginVersion": "9.2.0",
705 + "targets": [
706 + {
707 + "bucketAggs": [
708 + {
709 + "$$hashKey": "object:615",
710 + "fake": true,
711 + "field": "rule_mitre_tactic",
712 + "id": "4",
713 + "settings": {
714 + "min_doc_count": "1",
715 + "order": "desc",
716 + "orderBy": "_count",
717 + "size": "0"
718 + },
719 + "type": "terms"
720 + }
721 + ],
722 + "datasource": {
723 + "type": "elasticsearch",
724 + "uid": "replace_datasource_uid"
725 + },
726 + "metrics": [
727 + {
728 + "$$hashKey": "object:80",
729 + "field": "select field",
730 + "id": "1",
731 + "type": "count"
732 + }
733 + ],
734 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
735 + "refId": "A",
736 + "timeField": "timestamp"
737 + }
738 + ],
739 + "title": "MITRE ATT&CK TACTICS",
740 + "transformations": [
741 + {
742 + "id": "organize",
743 + "options": {
744 + "excludeByName": {},
745 + "indexByName": {},
746 + "renameByName": {
747 + "rule_mitre_tactic": "MITRE TACTIC"
748 + }
749 + }
750 + }
751 + ],
752 + "type": "table"
753 + },
754 + {
755 + "datasource": {
756 + "type": "elasticsearch",
757 + "uid": "replace_datasource_uid"
758 + },
759 + "fieldConfig": {
760 + "defaults": {
761 + "custom": {
762 + "align": "auto",
763 + "displayMode": "auto",
764 + "filterable": false,
765 + "inspect": false
766 + },
767 + "mappings": [
768 + {
769 + "options": {
770 + "mitre_attack": {
771 + "text": "Total"
772 + }
773 + },
774 + "type": "value"
775 + }
776 + ],
777 + "thresholds": {
778 + "mode": "absolute",
779 + "steps": [
780 + {
781 + "color": "green",
782 + "value": null
783 + },
784 + {
785 + "color": "red",
786 + "value": 80
787 + }
788 + ]
789 + }
790 + },
791 + "overrides": []
792 + },
793 + "gridPos": {
794 + "h": 22,
795 + "w": 11,
796 + "x": 13,
797 + "y": 7
798 + },
799 + "id": 33,
800 + "links": [],
801 + "options": {
802 + "footer": {
803 + "fields": "",
804 + "reducer": [
805 + "sum"
806 + ],
807 + "show": false
808 + },
809 + "showHeader": true
810 + },
811 + "pluginVersion": "9.2.0",
812 + "targets": [
813 + {
814 + "bucketAggs": [
815 + {
816 + "$$hashKey": "object:615",
817 + "fake": true,
818 + "field": "rule_mitre_id",
819 + "id": "4",
820 + "settings": {
821 + "min_doc_count": "1",
822 + "order": "desc",
823 + "orderBy": "_count",
824 + "size": "0"
825 + },
826 + "type": "terms"
827 + }
828 + ],
829 + "datasource": {
830 + "type": "elasticsearch",
831 + "uid": "replace_datasource_uid"
832 + },
833 + "metrics": [
834 + {
835 + "$$hashKey": "object:80",
836 + "field": "select field",
837 + "id": "1",
838 + "type": "count"
839 + }
840 + ],
841 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
842 + "refId": "A",
843 + "timeField": "timestamp"
844 + }
845 + ],
846 + "title": "MITRE ATT&CK TECHNIQUES",
847 + "transformations": [
848 + {
849 + "id": "organize",
850 + "options": {
851 + "excludeByName": {},
852 + "indexByName": {},
853 + "renameByName": {
854 + "rule_mitre_id": "MITRE ID"
855 + }
856 + }
857 + }
858 + ],
859 + "transparent": true,
860 + "type": "table"
861 + },
862 + {
863 + "datasource": {
864 + "type": "elasticsearch",
865 + "uid": "replace_datasource_uid"
866 + },
867 + "fieldConfig": {
868 + "defaults": {
869 + "color": {
870 + "mode": "palette-classic"
871 + },
872 + "custom": {
873 + "hideFrom": {
874 + "legend": false,
875 + "tooltip": false,
876 + "viz": false
877 + }
878 + },
879 + "decimals": 0,
880 + "mappings": [],
881 + "unit": "short"
882 + },
883 + "overrides": []
884 + },
885 + "gridPos": {
886 + "h": 11,
887 + "w": 5,
888 + "x": 0,
889 + "y": 18
890 + },
891 + "id": 29,
892 + "links": [],
893 + "options": {
894 + "displayLabels": [],
895 + "legend": {
896 + "calcs": [],
897 + "displayMode": "list",
898 + "placement": "bottom",
899 + "showLegend": false,
900 + "values": [
901 + "value"
902 + ]
903 + },
904 + "pieType": "donut",
905 + "reduceOptions": {
906 + "calcs": [
907 + "sum"
908 + ],
909 + "fields": "",
910 + "values": false
911 + },
912 + "text": {},
913 + "tooltip": {
914 + "mode": "single",
915 + "sort": "none"
916 + }
917 + },
918 + "pluginVersion": "7.1.0",
919 + "targets": [
920 + {
921 + "bucketAggs": [
922 + {
923 + "$$hashKey": "object:82",
924 + "fake": true,
925 + "field": "rule_mitre_technique",
926 + "id": "3",
927 + "settings": {
928 + "min_doc_count": 1,
929 + "order": "desc",
930 + "orderBy": "_count",
931 + "size": "10"
932 + },
933 + "type": "terms"
934 + },
935 + {
936 + "$$hashKey": "object:83",
937 + "field": "timestamp",
938 + "id": "2",
939 + "settings": {
940 + "interval": "auto",
941 + "min_doc_count": 0,
942 + "trimEdges": 0
943 + },
944 + "type": "date_histogram"
945 + }
946 + ],
947 + "datasource": {
948 + "type": "elasticsearch",
949 + "uid": "replace_datasource_uid"
950 + },
951 + "metrics": [
952 + {
953 + "$$hashKey": "object:80",
954 + "field": "select field",
955 + "id": "1",
956 + "type": "count"
957 + }
958 + ],
959 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
960 + "refId": "A",
961 + "timeField": "timestamp"
962 + }
963 + ],
964 + "title": "MITRE ATT&CK TECHNIQUES (TOP 10)",
965 + "type": "piechart"
966 + },
967 + {
968 + "datasource": {
969 + "type": "elasticsearch",
970 + "uid": "replace_datasource_uid"
971 + },
972 + "fieldConfig": {
973 + "defaults": {
974 + "custom": {
975 + "align": "auto",
976 + "displayMode": "auto",
977 + "filterable": false,
978 + "inspect": false
979 + },
980 + "mappings": [
981 + {
982 + "options": {
983 + "mitre_attack": {
984 + "text": "Total"
985 + }
986 + },
987 + "type": "value"
988 + }
989 + ],
990 + "thresholds": {
991 + "mode": "absolute",
992 + "steps": [
993 + {
994 + "color": "green",
995 + "value": null
996 + },
997 + {
998 + "color": "red",
999 + "value": 80
1000 + }
1001 + ]
1002 + }
1003 + },
1004 + "overrides": [
1005 + {
1006 + "matcher": {
1007 + "id": "byName",
1008 + "options": "rule_mitre_technique"
1009 + },
1010 + "properties": [
1011 + {
1012 + "id": "custom.width",
1013 + "value": 381
1014 + }
1015 + ]
1016 + }
1017 + ]
1018 + },
1019 + "gridPos": {
1020 + "h": 11,
1021 + "w": 8,
1022 + "x": 5,
1023 + "y": 18
1024 + },
1025 + "id": 30,
1026 + "links": [],
1027 + "options": {
1028 + "footer": {
1029 + "fields": "",
1030 + "reducer": [
1031 + "sum"
1032 + ],
1033 + "show": false
1034 + },
1035 + "showHeader": true,
1036 + "sortBy": []
1037 + },
1038 + "pluginVersion": "9.2.0",
1039 + "targets": [
1040 + {
1041 + "bucketAggs": [
1042 + {
1043 + "$$hashKey": "object:615",
1044 + "fake": true,
1045 + "field": "rule_mitre_technique",
1046 + "id": "4",
1047 + "settings": {
1048 + "min_doc_count": "1",
1049 + "order": "desc",
1050 + "orderBy": "_count",
1051 + "size": "0"
1052 + },
1053 + "type": "terms"
1054 + }
1055 + ],
1056 + "datasource": {
1057 + "type": "elasticsearch",
1058 + "uid": "replace_datasource_uid"
1059 + },
1060 + "metrics": [
1061 + {
1062 + "$$hashKey": "object:80",
1063 + "field": "select field",
1064 + "id": "1",
1065 + "type": "count"
1066 + }
1067 + ],
1068 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1069 + "refId": "A",
1070 + "timeField": "timestamp"
1071 + }
1072 + ],
1073 + "title": "MITRE ATT&CK TECHNIQUES",
1074 + "transformations": [
1075 + {
1076 + "id": "organize",
1077 + "options": {
1078 + "excludeByName": {},
1079 + "indexByName": {},
1080 + "renameByName": {
1081 + "rule_mitre_technique": "MITRE TECHNIQUE"
1082 + }
1083 + }
1084 + }
1085 + ],
1086 + "type": "table"
1087 + },
1088 + {
1089 + "datasource": {
1090 + "type": "elasticsearch",
1091 + "uid": "replace_datasource_uid"
1092 + },
1093 + "fieldConfig": {
1094 + "defaults": {
1095 + "color": {
1096 + "mode": "thresholds"
1097 + },
1098 + "custom": {
1099 + "align": "auto",
1100 + "displayMode": "auto",
1101 + "inspect": false
1102 + },
1103 + "mappings": [
1104 + {
1105 + "options": {
1106 + "mitre_attack": {
1107 + "text": "Total"
1108 + }
1109 + },
1110 + "type": "value"
1111 + }
1112 + ],
1113 + "thresholds": {
1114 + "mode": "absolute",
1115 + "steps": [
1116 + {
1117 + "color": "green",
1118 + "value": null
1119 + },
1120 + {
1121 + "color": "red",
1122 + "value": 80
1123 + }
1124 + ]
1125 + }
1126 + },
1127 + "overrides": [
1128 + {
1129 + "matcher": {
1130 + "id": "byName",
1131 + "options": "ACCOUNT"
1132 + },
1133 + "properties": [
1134 + {
1135 + "id": "custom.width",
1136 + "value": 511
1137 + }
1138 + ]
1139 + }
1140 + ]
1141 + },
1142 + "gridPos": {
1143 + "h": 13,
1144 + "w": 9,
1145 + "x": 0,
1146 + "y": 29
1147 + },
1148 + "id": 17,
1149 + "options": {
1150 + "footer": {
1151 + "fields": "",
1152 + "reducer": [
1153 + "sum"
1154 + ],
1155 + "show": false
1156 + },
1157 + "showHeader": true,
1158 + "sortBy": []
1159 + },
1160 + "pluginVersion": "9.2.0",
1161 + "targets": [
1162 + {
1163 + "bucketAggs": [
1164 + {
1165 + "$$hashKey": "object:82",
1166 + "fake": true,
1167 + "field": "data_office365_UserId",
1168 + "id": "3",
1169 + "settings": {
1170 + "min_doc_count": 1,
1171 + "order": "desc",
1172 + "orderBy": "_count",
1173 + "size": "10"
1174 + },
1175 + "type": "terms"
1176 + }
1177 + ],
1178 + "datasource": {
1179 + "type": "elasticsearch",
1180 + "uid": "replace_datasource_uid"
1181 + },
1182 + "metrics": [
1183 + {
1184 + "$$hashKey": "object:80",
1185 + "field": "select field",
1186 + "id": "1",
1187 + "type": "count"
1188 + }
1189 + ],
1190 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1191 + "refId": "A",
1192 + "timeField": "timestamp"
1193 + }
1194 + ],
1195 + "title": "MITRE ATT&CK - TOP 10 ACCOUNTS",
1196 + "transformations": [
1197 + {
1198 + "id": "organize",
1199 + "options": {
1200 + "excludeByName": {},
1201 + "indexByName": {},
1202 + "renameByName": {
1203 + "data_office365_UserId": "ACCOUNT"
1204 + }
1205 + }
1206 + }
1207 + ],
1208 + "transparent": true,
1209 + "type": "table"
1210 + },
1211 + {
1212 + "datasource": {
1213 + "type": "elasticsearch",
1214 + "uid": "replace_datasource_uid"
1215 + },
1216 + "fieldConfig": {
1217 + "defaults": {
1218 + "color": {
1219 + "mode": "palette-classic"
1220 + },
1221 + "custom": {
1222 + "axisCenteredZero": false,
1223 + "axisColorMode": "text",
1224 + "axisLabel": "",
1225 + "axisPlacement": "auto",
1226 + "barAlignment": 0,
1227 + "drawStyle": "bars",
1228 + "fillOpacity": 0,
1229 + "gradientMode": "none",
1230 + "hideFrom": {
1231 + "legend": false,
1232 + "tooltip": false,
1233 + "viz": false
1234 + },
1235 + "lineInterpolation": "linear",
1236 + "lineWidth": 1,
1237 + "pointSize": 5,
1238 + "scaleDistribution": {
1239 + "type": "linear"
1240 + },
1241 + "showPoints": "auto",
1242 + "spanNulls": false,
1243 + "stacking": {
1244 + "group": "A",
1245 + "mode": "normal"
1246 + },
1247 + "thresholdsStyle": {
1248 + "mode": "off"
1249 + }
1250 + },
1251 + "mappings": [],
1252 + "thresholds": {
1253 + "mode": "absolute",
1254 + "steps": [
1255 + {
1256 + "color": "green",
1257 + "value": null
1258 + },
1259 + {
1260 + "color": "red",
1261 + "value": 80
1262 + }
1263 + ]
1264 + }
1265 + },
1266 + "overrides": []
1267 + },
1268 + "gridPos": {
1269 + "h": 13,
1270 + "w": 15,
1271 + "x": 9,
1272 + "y": 29
1273 + },
1274 + "id": 39,
1275 + "options": {
1276 + "legend": {
1277 + "calcs": [],
1278 + "displayMode": "table",
1279 + "placement": "right",
1280 + "showLegend": true
1281 + },
1282 + "tooltip": {
1283 + "mode": "single",
1284 + "sort": "none"
1285 + }
1286 + },
1287 + "targets": [
1288 + {
1289 + "alias": "",
1290 + "bucketAggs": [
1291 + {
1292 + "field": "data_office365_Operation",
1293 + "id": "3",
1294 + "settings": {
1295 + "min_doc_count": "1",
1296 + "order": "desc",
1297 + "orderBy": "_count",
1298 + "size": "10"
1299 + },
1300 + "type": "terms"
1301 + },
1302 + {
1303 + "field": "timestamp",
1304 + "id": "2",
1305 + "settings": {
1306 + "interval": "auto"
1307 + },
1308 + "type": "date_histogram"
1309 + }
1310 + ],
1311 + "datasource": {
1312 + "type": "elasticsearch",
1313 + "uid": "replace_datasource_uid"
1314 + },
1315 + "metrics": [
1316 + {
1317 + "id": "1",
1318 + "type": "count"
1319 + }
1320 + ],
1321 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1322 + "refId": "A",
1323 + "timeField": "timestamp"
1324 + }
1325 + ],
1326 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
1327 + "transparent": true,
1328 + "type": "timeseries"
1329 + },
1330 + {
1331 + "datasource": {
1332 + "type": "elasticsearch",
1333 + "uid": "replace_datasource_uid"
1334 + },
1335 + "fieldConfig": {
1336 + "defaults": {
1337 + "color": {
1338 + "mode": "thresholds"
1339 + },
1340 + "custom": {
1341 + "align": "auto",
1342 + "displayMode": "auto",
1343 + "inspect": false
1344 + },
1345 + "mappings": [],
1346 + "thresholds": {
1347 + "mode": "absolute",
1348 + "steps": [
1349 + {
1350 + "color": "green"
1351 + },
1352 + {
1353 + "color": "red",
1354 + "value": 80
1355 + }
1356 + ]
1357 + }
1358 + },
1359 + "overrides": [
1360 + {
1361 + "matcher": {
1362 + "id": "byName",
1363 + "options": "timestamp"
1364 + },
1365 + "properties": [
1366 + {
1367 + "id": "displayName",
1368 + "value": "Date/Time"
1369 + },
1370 + {
1371 + "id": "unit",
1372 + "value": "time: YYYY-MM-DD HH:mm:ss"
1373 + },
1374 + {
1375 + "id": "custom.align"
1376 + }
1377 + ]
1378 + },
1379 + {
1380 + "matcher": {
1381 + "id": "byName",
1382 + "options": "agent_name"
1383 + },
1384 + "properties": [
1385 + {
1386 + "id": "displayName",
1387 + "value": "AGENT"
1388 + },
1389 + {
1390 + "id": "unit",
1391 + "value": "short"
1392 + },
1393 + {
1394 + "id": "decimals",
1395 + "value": 2
1396 + },
1397 + {
1398 + "id": "custom.align"
1399 + }
1400 + ]
1401 + },
1402 + {
1403 + "matcher": {
1404 + "id": "byName",
1405 + "options": "full_log"
1406 + },
1407 + "properties": [
1408 + {
1409 + "id": "displayName",
1410 + "value": "EVENT"
1411 + },
1412 + {
1413 + "id": "unit",
1414 + "value": "short"
1415 + },
1416 + {
1417 + "id": "decimals",
1418 + "value": 2
1419 + }
1420 + ]
1421 + },
1422 + {
1423 + "matcher": {
1424 + "id": "byName",
1425 + "options": "rule_groups"
1426 + },
1427 + "properties": [
1428 + {
1429 + "id": "displayName",
1430 + "value": "RULE GROUPS"
1431 + },
1432 + {
1433 + "id": "unit",
1434 + "value": "short"
1435 + },
1436 + {
1437 + "id": "decimals",
1438 + "value": 2
1439 + },
1440 + {
1441 + "id": "custom.align"
1442 + }
1443 + ]
1444 + },
1445 + {
1446 + "matcher": {
1447 + "id": "byName",
1448 + "options": "rule_level"
1449 + },
1450 + "properties": [
1451 + {
1452 + "id": "displayName",
1453 + "value": "RULE LEVEL"
1454 + },
1455 + {
1456 + "id": "unit",
1457 + "value": "short"
1458 + },
1459 + {
1460 + "id": "decimals",
1461 + "value": -1
1462 + },
1463 + {
1464 + "id": "custom.displayMode",
1465 + "value": "color-background"
1466 + },
1467 + {
1468 + "id": "custom.align"
1469 + },
1470 + {
1471 + "id": "thresholds",
1472 + "value": {
1473 + "mode": "absolute",
1474 + "steps": [
1475 + {
1476 + "color": "#37872D"
1477 + },
1478 + {
1479 + "color": "rgba(237, 129, 40, 0.89)",
1480 + "value": 7
1481 + },
1482 + {
1483 + "color": "rgba(245, 54, 54, 0.9)",
1484 + "value": 12
1485 + }
1486 + ]
1487 + }
1488 + }
1489 + ]
1490 + },
1491 + {
1492 + "matcher": {
1493 + "id": "byName",
1494 + "options": "rule_description"
1495 + },
1496 + "properties": [
1497 + {
1498 + "id": "displayName",
1499 + "value": "RULE DESCRIPTION"
1500 + },
1501 + {
1502 + "id": "unit",
1503 + "value": "short"
1504 + },
1505 + {
1506 + "id": "decimals",
1507 + "value": 2
1508 + },
1509 + {
1510 + "id": "custom.align"
1511 + }
1512 + ]
1513 + },
1514 + {
1515 + "matcher": {
1516 + "id": "byName",
1517 + "options": "EVENT ID"
1518 + },
1519 + "properties": [
1520 + {
1521 + "id": "links",
1522 + "value": [
1523 + {
1524 + "targetBlank": true,
1525 + "title": "VIEW EVENT DETAILS",
1526 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1527 + }
1528 + ]
1529 + }
1530 + ]
1531 + },
1532 + {
1533 + "matcher": {
1534 + "id": "byName",
1535 + "options": "MITRE ID"
1536 + },
1537 + "properties": [
1538 + {
1539 + "id": "custom.width",
1540 + "value": 101
1541 + }
1542 + ]
1543 + },
1544 + {
1545 + "matcher": {
1546 + "id": "byName",
1547 + "options": "SRC IP"
1548 + },
1549 + "properties": [
1550 + {
1551 + "id": "custom.width",
1552 + "value": 140
1553 + }
1554 + ]
1555 + }
1556 + ]
1557 + },
1558 + "gridPos": {
1559 + "h": 16,
1560 + "w": 24,
1561 + "x": 0,
1562 + "y": 42
1563 + },
1564 + "id": 27,
1565 + "options": {
1566 + "footer": {
1567 + "fields": "",
1568 + "reducer": [
1569 + "sum"
1570 + ],
1571 + "show": false
1572 + },
1573 + "showHeader": true,
1574 + "sortBy": []
1575 + },
1576 + "pluginVersion": "9.0.0",
1577 + "targets": [
1578 + {
1579 + "bucketAggs": [],
1580 + "datasource": {
1581 + "type": "elasticsearch",
1582 + "uid": "replace_datasource_uid"
1583 + },
1584 + "metrics": [
1585 + {
1586 + "id": "1",
1587 + "settings": {
1588 + "size": "250"
1589 + },
1590 + "type": "raw_data"
1591 + }
1592 + ],
1593 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1594 + "refId": "A",
1595 + "timeField": "timestamp"
1596 + }
1597 + ],
1598 + "title": "MITRE ATT&CK - TELEMETRY",
1599 + "transformations": [
1600 + {
1601 + "id": "filterFieldsByName",
1602 + "options": {
1603 + "include": {
1604 + "names": [
1605 + "timestamp",
1606 + "_id",
1607 + "rule_description",
1608 + "rule_level",
1609 + "rule_mitre_id",
1610 + "rule_mitre_tactic",
1611 + "rule_mitre_technique",
1612 + "syslog_level",
1613 + "data_office365_Workload",
1614 + "data_office365_CreationTime",
1615 + "data_office365_UserId",
1616 + "data_office365_ClientIP"
1617 + ]
1618 + }
1619 + }
1620 + },
1621 + {
1622 + "id": "organize",
1623 + "options": {
1624 + "excludeByName": {
1625 + "agent_ip": true,
1626 + "timestamp": true
1627 + },
1628 + "indexByName": {
1629 + "_id": 2,
1630 + "data_office365_ClientIP": 4,
1631 + "data_office365_CreationTime": 0,
1632 + "data_office365_UserId": 3,
1633 + "data_office365_Workload": 5,
1634 + "rule_description": 6,
1635 + "rule_level": 7,
1636 + "rule_mitre_id": 8,
1637 + "rule_mitre_tactic": 9,
1638 + "rule_mitre_technique": 10,
1639 + "syslog_level": 11,
1640 + "timestamp": 1
1641 + },
1642 + "renameByName": {
1643 + "_id": "EVENT ID",
1644 + "agent_ip": "",
1645 + "data_office365_ClientIP": "SRC IP",
1646 + "data_office365_CreationTime": "EVENT TIME",
1647 + "data_office365_UserId": "ACCOUNT",
1648 + "data_office365_Workload": "WORKLOAD",
1649 + "rule_description": "",
1650 + "rule_mitre_id": "MITRE ID",
1651 + "rule_mitre_tactic": "TACTIC",
1652 + "rule_mitre_technique": "TECHNIQUE",
1653 + "syslog_level": "LEVEL",
1654 + "timestamp": "DATE/TIME"
1655 + }
1656 + }
1657 + }
1658 + ],
1659 + "type": "table"
1660 + }
1661 + ],
1662 + "refresh": "",
1663 + "schemaVersion": 37,
1664 + "style": "dark",
1665 + "tags": [
1666 + "O365"
1667 + ],
1668 + "templating": {
1669 + "list": [
1670 + {
1671 + "datasource": {
1672 + "type": "elasticsearch",
1673 + "uid": "replace_datasource_uid"
1674 + },
1675 + "filters": [],
1676 + "hide": 0,
1677 + "label": "Filters",
1678 + "name": "Filters",
1679 + "skipUrlSync": false,
1680 + "type": "adhoc"
1681 + },
1682 + {
1683 + "current": {
1684 + "selected": false,
1685 + "text": "All",
1686 + "value": "$__all"
1687 + },
1688 + "datasource": {
1689 + "type": "elasticsearch",
1690 + "uid": "replace_datasource_uid"
1691 + },
1692 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"_exists_:rule_mitre_tactic\"}",
1693 + "hide": 0,
1694 + "includeAll": true,
1695 + "label": "WORKLOAD",
1696 + "multi": false,
1697 + "name": "workload",
1698 + "options": [],
1699 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"_exists_:rule_mitre_tactic\"}",
1700 + "refresh": 2,
1701 + "regex": "",
1702 + "skipUrlSync": false,
1703 + "sort": 0,
1704 + "tagValuesQuery": "",
1705 + "tagsQuery": "",
1706 + "type": "query",
1707 + "useTags": false
1708 + },
1709 + {
1710 + "current": {
1711 + "selected": false,
1712 + "text": "All",
1713 + "value": "$__all"
1714 + },
1715 + "datasource": {
1716 + "type": "elasticsearch",
1717 + "uid": "replace_datasource_uid"
1718 + },
1719 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1720 + "hide": 0,
1721 + "includeAll": true,
1722 + "label": "Rule Level",
1723 + "multi": false,
1724 + "name": "rule_level",
1725 + "options": [],
1726 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1727 + "refresh": 2,
1728 + "regex": "",
1729 + "skipUrlSync": false,
1730 + "sort": 0,
1731 + "type": "query"
1732 + }
1733 + ]
1734 + },
1735 + "time": {
1736 + "from": "now-6h",
1737 + "to": "now"
1738 + },
1739 + "timepicker": {
1740 + "refresh_intervals": [
1741 + "10s",
1742 + "30s",
1743 + "1m",
1744 + "5m",
1745 + "15m",
1746 + "30m",
1747 + "1h",
1748 + "2h",
1749 + "1d"
1750 + ]
1751 + },
1752 + "timezone": "",
1753 + "title": "O365 - MITRE ATT&CK",
1754 + "uid": "Nipjnw37k",
1755 + "version": 1,
1756 + "weekStart": ""
1757 +}
backend/app/connectors/grafana/dashboards/Office365/onedrive.json new
+2260
@@ -0,0 +1,2260 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "10.0.3",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "cellOptions": {
261 + "type": "auto"
262 + },
263 + "inspect": false
264 + },
265 + "mappings": [],
266 + "thresholds": {
267 + "mode": "absolute",
268 + "steps": [
269 + {
270 + "color": "red",
271 + "value": null
272 + }
273 + ]
274 + }
275 + },
276 + "overrides": [
277 + {
278 + "matcher": {
279 + "id": "byName",
280 + "options": "Count"
281 + },
282 + "properties": [
283 + {
284 + "id": "displayName",
285 + "value": "EVENTS"
286 + },
287 + {
288 + "id": "unit",
289 + "value": "short"
290 + },
291 + {
292 + "id": "decimals",
293 + "value": -1
294 + },
295 + {
296 + "id": "custom.align"
297 + },
298 + {
299 + "id": "thresholds",
300 + "value": {
301 + "mode": "absolute",
302 + "steps": [
303 + {
304 + "color": "red",
305 + "value": null
306 + }
307 + ]
308 + }
309 + }
310 + ]
311 + }
312 + ]
313 + },
314 + "gridPos": {
315 + "h": 7,
316 + "w": 6,
317 + "x": 8,
318 + "y": 0
319 + },
320 + "id": 54,
321 + "options": {
322 + "cellHeight": "sm",
323 + "footer": {
324 + "countRows": false,
325 + "fields": "",
326 + "reducer": [
327 + "sum"
328 + ],
329 + "show": false
330 + },
331 + "showHeader": true
332 + },
333 + "pluginVersion": "10.0.3",
334 + "targets": [
335 + {
336 + "bucketAggs": [
337 + {
338 + "fake": true,
339 + "field": "data_office365_Operation",
340 + "id": "4",
341 + "settings": {
342 + "min_doc_count": 1,
343 + "order": "desc",
344 + "orderBy": "_count",
345 + "size": "0"
346 + },
347 + "type": "terms"
348 + }
349 + ],
350 + "datasource": {
351 + "type": "elasticsearch",
352 + "uid": "replace_datasource_uid"
353 + },
354 + "metrics": [
355 + {
356 + "field": "select field",
357 + "id": "1",
358 + "type": "count"
359 + }
360 + ],
361 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
362 + "refId": "A",
363 + "timeField": "timestamp"
364 + }
365 + ],
366 + "title": "EVENTS BY OPERATION",
367 + "transformations": [
368 + {
369 + "id": "merge",
370 + "options": {
371 + "reducers": []
372 + }
373 + },
374 + {
375 + "id": "organize",
376 + "options": {
377 + "excludeByName": {},
378 + "indexByName": {},
379 + "renameByName": {
380 + "Count": "EVENTS",
381 + "data_office365_Operation": "OPERATION"
382 + }
383 + }
384 + }
385 + ],
386 + "type": "table"
387 + },
388 + {
389 + "datasource": {
390 + "type": "elasticsearch",
391 + "uid": "replace_datasource_uid"
392 + },
393 + "fieldConfig": {
394 + "defaults": {
395 + "color": {
396 + "mode": "thresholds"
397 + },
398 + "mappings": [
399 + {
400 + "options": {
401 + "match": "null",
402 + "result": {
403 + "text": "N/A"
404 + }
405 + },
406 + "type": "special"
407 + }
408 + ],
409 + "max": 15,
410 + "min": 0,
411 + "thresholds": {
412 + "mode": "absolute",
413 + "steps": [
414 + {
415 + "color": "#299c46",
416 + "value": null
417 + },
418 + {
419 + "color": "rgba(237, 129, 40, 0.89)",
420 + "value": 8
421 + },
422 + {
423 + "color": "#d44a3a",
424 + "value": 12
425 + }
426 + ]
427 + },
428 + "unit": "none"
429 + },
430 + "overrides": []
431 + },
432 + "gridPos": {
433 + "h": 7,
434 + "w": 4,
435 + "x": 0,
436 + "y": 7
437 + },
438 + "id": 16,
439 + "links": [],
440 + "options": {
441 + "orientation": "horizontal",
442 + "reduceOptions": {
443 + "calcs": [
444 + "max"
445 + ],
446 + "fields": "",
447 + "values": false
448 + },
449 + "showThresholdLabels": false,
450 + "showThresholdMarkers": true,
451 + "text": {}
452 + },
453 + "pluginVersion": "10.0.3",
454 + "targets": [
455 + {
456 + "bucketAggs": [
457 + {
458 + "field": "timestamp",
459 + "id": "2",
460 + "settings": {
461 + "interval": "auto",
462 + "min_doc_count": 0,
463 + "trimEdges": 0
464 + },
465 + "type": "date_histogram"
466 + }
467 + ],
468 + "datasource": {
469 + "type": "elasticsearch",
470 + "uid": "replace_datasource_uid"
471 + },
472 + "metrics": [
473 + {
474 + "field": "rule_level",
475 + "id": "1",
476 + "meta": {},
477 + "settings": {},
478 + "type": "max"
479 + }
480 + ],
481 + "query": "data_office365_Operation:$operation",
482 + "refId": "A",
483 + "timeField": "timestamp"
484 + }
485 + ],
486 + "title": "MAX SEVERITY (0 - 15)",
487 + "type": "gauge"
488 + },
489 + {
490 + "datasource": {
491 + "type": "elasticsearch",
492 + "uid": "replace_datasource_uid"
493 + },
494 + "fieldConfig": {
495 + "defaults": {
496 + "color": {
497 + "mode": "palette-classic"
498 + },
499 + "custom": {
500 + "axisCenteredZero": false,
501 + "axisColorMode": "text",
502 + "axisLabel": "",
503 + "axisPlacement": "auto",
504 + "barAlignment": 0,
505 + "drawStyle": "bars",
506 + "fillOpacity": 0,
507 + "gradientMode": "none",
508 + "hideFrom": {
509 + "legend": false,
510 + "tooltip": false,
511 + "viz": false
512 + },
513 + "lineInterpolation": "linear",
514 + "lineWidth": 1,
515 + "pointSize": 5,
516 + "scaleDistribution": {
517 + "type": "linear"
518 + },
519 + "showPoints": "auto",
520 + "spanNulls": false,
521 + "stacking": {
522 + "group": "A",
523 + "mode": "normal"
524 + },
525 + "thresholdsStyle": {
526 + "mode": "off"
527 + }
528 + },
529 + "mappings": [],
530 + "thresholds": {
531 + "mode": "absolute",
532 + "steps": [
533 + {
534 + "color": "green",
535 + "value": null
536 + },
537 + {
538 + "color": "red",
539 + "value": 80
540 + }
541 + ]
542 + }
543 + },
544 + "overrides": []
545 + },
546 + "gridPos": {
547 + "h": 13,
548 + "w": 20,
549 + "x": 4,
550 + "y": 7
551 + },
552 + "id": 60,
553 + "options": {
554 + "legend": {
555 + "calcs": [],
556 + "displayMode": "table",
557 + "placement": "right",
558 + "showLegend": true
559 + },
560 + "tooltip": {
561 + "mode": "single",
562 + "sort": "none"
563 + }
564 + },
565 + "targets": [
566 + {
567 + "alias": "",
568 + "bucketAggs": [
569 + {
570 + "field": "data_office365_Operation",
571 + "id": "3",
572 + "settings": {
573 + "min_doc_count": "1",
574 + "order": "desc",
575 + "orderBy": "_count",
576 + "size": "10"
577 + },
578 + "type": "terms"
579 + },
580 + {
581 + "field": "timestamp",
582 + "id": "2",
583 + "settings": {
584 + "interval": "auto"
585 + },
586 + "type": "date_histogram"
587 + }
588 + ],
589 + "datasource": {
590 + "type": "elasticsearch",
591 + "uid": "replace_datasource_uid"
592 + },
593 + "metrics": [
594 + {
595 + "id": "1",
596 + "type": "count"
597 + }
598 + ],
599 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
600 + "refId": "A",
601 + "timeField": "timestamp"
602 + }
603 + ],
604 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
605 + "transparent": true,
606 + "type": "timeseries"
607 + },
608 + {
609 + "datasource": {
610 + "type": "elasticsearch",
611 + "uid": "replace_datasource_uid"
612 + },
613 + "fieldConfig": {
614 + "defaults": {
615 + "mappings": [
616 + {
617 + "options": {
618 + "match": "null",
619 + "result": {
620 + "text": "N/A"
621 + }
622 + },
623 + "type": "special"
624 + }
625 + ],
626 + "thresholds": {
627 + "mode": "absolute",
628 + "steps": [
629 + {
630 + "color": "blue",
631 + "value": null
632 + }
633 + ]
634 + },
635 + "unit": "locale"
636 + },
637 + "overrides": []
638 + },
639 + "gridPos": {
640 + "h": 6,
641 + "w": 4,
642 + "x": 0,
643 + "y": 14
644 + },
645 + "id": 51,
646 + "links": [],
647 + "options": {
648 + "colorMode": "value",
649 + "graphMode": "area",
650 + "justifyMode": "auto",
651 + "orientation": "horizontal",
652 + "reduceOptions": {
653 + "calcs": [
654 + "sum"
655 + ],
656 + "fields": "",
657 + "values": false
658 + },
659 + "text": {},
660 + "textMode": "auto"
661 + },
662 + "pluginVersion": "10.0.3",
663 + "targets": [
664 + {
665 + "bucketAggs": [
666 + {
667 + "$$hashKey": "object:331",
668 + "field": "timestamp",
669 + "id": "2",
670 + "settings": {
671 + "interval": "auto",
672 + "min_doc_count": 0,
673 + "trimEdges": 0
674 + },
675 + "type": "date_histogram"
676 + }
677 + ],
678 + "datasource": {
679 + "type": "elasticsearch",
680 + "uid": "replace_datasource_uid"
681 + },
682 + "metrics": [
683 + {
684 + "$$hashKey": "object:329",
685 + "field": "select field",
686 + "id": "1",
687 + "type": "count"
688 + }
689 + ],
690 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
691 + "refId": "A",
692 + "timeField": "timestamp"
693 + }
694 + ],
695 + "title": "EVENTS (Total)",
696 + "type": "stat"
697 + },
698 + {
699 + "datasource": {
700 + "type": "elasticsearch",
701 + "uid": "replace_datasource_uid"
702 + },
703 + "fieldConfig": {
704 + "defaults": {
705 + "mappings": [
706 + {
707 + "options": {
708 + "match": "null",
709 + "result": {
710 + "text": "N/A"
711 + }
712 + },
713 + "type": "special"
714 + }
715 + ],
716 + "thresholds": {
717 + "mode": "absolute",
718 + "steps": [
719 + {
720 + "color": "orange",
721 + "value": null
722 + }
723 + ]
724 + },
725 + "unit": "locale"
726 + },
727 + "overrides": []
728 + },
729 + "gridPos": {
730 + "h": 6,
731 + "w": 4,
732 + "x": 0,
733 + "y": 20
734 + },
735 + "id": 52,
736 + "links": [],
737 + "options": {
738 + "colorMode": "value",
739 + "graphMode": "area",
740 + "justifyMode": "auto",
741 + "orientation": "horizontal",
742 + "reduceOptions": {
743 + "calcs": [
744 + "sum"
745 + ],
746 + "fields": "",
747 + "values": false
748 + },
749 + "text": {},
750 + "textMode": "auto"
751 + },
752 + "pluginVersion": "10.0.3",
753 + "targets": [
754 + {
755 + "bucketAggs": [
756 + {
757 + "$$hashKey": "object:331",
758 + "field": "timestamp",
759 + "id": "2",
760 + "settings": {
761 + "interval": "auto",
762 + "min_doc_count": 0,
763 + "trimEdges": 0
764 + },
765 + "type": "date_histogram"
766 + }
767 + ],
768 + "datasource": {
769 + "type": "elasticsearch",
770 + "uid": "replace_datasource_uid"
771 + },
772 + "metrics": [
773 + {
774 + "$$hashKey": "object:329",
775 + "field": "select field",
776 + "id": "1",
777 + "type": "count"
778 + }
779 + ],
780 + "query": "data_office365_Operation:MessageCreatedHasLink AND rule_level:$rule_level",
781 + "refId": "A",
782 + "timeField": "timestamp"
783 + }
784 + ],
785 + "title": "ONEDRIVE - MESSAGES CONTAINING LINK",
786 + "type": "stat"
787 + },
788 + {
789 + "circleMaxSize": 30,
790 + "circleMinSize": 2,
791 + "colors": [
792 + "rgba(245, 54, 54, 0.9)",
793 + "rgba(237, 129, 40, 0.89)",
794 + "rgba(50, 172, 45, 0.97)"
795 + ],
796 + "datasource": {
797 + "type": "elasticsearch",
798 + "uid": "replace_datasource_uid"
799 + },
800 + "decimals": 0,
801 + "esMetric": "Count",
802 + "gridPos": {
803 + "h": 12,
804 + "w": 10,
805 + "x": 4,
806 + "y": 20
807 + },
808 + "hideEmpty": false,
809 + "hideZero": false,
810 + "id": 50,
811 + "initialZoom": 1,
812 + "locationData": "countries",
813 + "mapCenter": "(0°, 0°)",
814 + "mapCenterLatitude": 0,
815 + "mapCenterLongitude": 0,
816 + "maxDataPoints": 1,
817 + "mouseWheelZoom": false,
818 + "showLegend": true,
819 + "stickyLabels": false,
820 + "tableQueryOptions": {
821 + "geohashField": "geohash",
822 + "latitudeField": "latitude",
823 + "longitudeField": "longitude",
824 + "metricField": "metric",
825 + "queryType": "geohash"
826 + },
827 + "targets": [
828 + {
829 + "bucketAggs": [
830 + {
831 + "fake": true,
832 + "field": "data_office365_ClientIP_country_code",
833 + "id": "3",
834 + "settings": {
835 + "min_doc_count": 1,
836 + "order": "desc",
837 + "orderBy": "_term",
838 + "size": "0"
839 + },
840 + "type": "terms"
841 + },
842 + {
843 + "field": "timestamp",
844 + "id": "2",
845 + "settings": {
846 + "interval": "auto",
847 + "min_doc_count": 0,
848 + "trimEdges": 0
849 + },
850 + "type": "date_histogram"
851 + }
852 + ],
853 + "datasource": {
854 + "type": "elasticsearch",
855 + "uid": "replace_datasource_uid"
856 + },
857 + "metrics": [
858 + {
859 + "field": "select field",
860 + "id": "1",
861 + "type": "count"
862 + }
863 + ],
864 + "query": "data_office365_Workload:OneDrive AND rule_level:$rule_level",
865 + "refId": "A",
866 + "timeField": "timestamp"
867 + }
868 + ],
869 + "thresholds": "0,10",
870 + "title": "ONEDRIVE - ALL EVENTS BY SRC COUNTRY",
871 + "type": "grafana-worldmap-panel",
872 + "unitPlural": "",
873 + "unitSingle": "",
874 + "valueName": "total"
875 + },
876 + {
877 + "datasource": {
878 + "type": "elasticsearch",
879 + "uid": "replace_datasource_uid"
880 + },
881 + "fieldConfig": {
882 + "defaults": {
883 + "color": {
884 + "mode": "thresholds"
885 + },
886 + "custom": {
887 + "align": "auto",
888 + "cellOptions": {
889 + "type": "auto"
890 + },
891 + "inspect": false
892 + },
893 + "mappings": [],
894 + "thresholds": {
895 + "mode": "absolute",
896 + "steps": [
897 + {
898 + "color": "orange",
899 + "value": null
900 + }
901 + ]
902 + }
903 + },
904 + "overrides": [
905 + {
906 + "matcher": {
907 + "id": "byName",
908 + "options": "Count"
909 + },
910 + "properties": [
911 + {
912 + "id": "displayName",
913 + "value": "EVENTS"
914 + },
915 + {
916 + "id": "unit",
917 + "value": "short"
918 + },
919 + {
920 + "id": "decimals",
921 + "value": -1
922 + },
923 + {
924 + "id": "custom.align"
925 + }
926 + ]
927 + },
928 + {
929 + "matcher": {
930 + "id": "byName",
931 + "options": "AD ACCOUNT"
932 + },
933 + "properties": [
934 + {
935 + "id": "custom.width",
936 + "value": 377
937 + }
938 + ]
939 + }
940 + ]
941 + },
942 + "gridPos": {
943 + "h": 12,
944 + "w": 10,
945 + "x": 14,
946 + "y": 20
947 + },
948 + "id": 58,
949 + "options": {
950 + "cellHeight": "sm",
951 + "footer": {
952 + "countRows": false,
953 + "fields": "",
954 + "reducer": [
955 + "sum"
956 + ],
957 + "show": false
958 + },
959 + "showHeader": true,
960 + "sortBy": []
961 + },
962 + "pluginVersion": "10.0.3",
963 + "targets": [
964 + {
965 + "bucketAggs": [
966 + {
967 + "fake": true,
968 + "field": "data_office365_UserId",
969 + "id": "4",
970 + "settings": {
971 + "min_doc_count": 1,
972 + "order": "desc",
973 + "orderBy": "_count",
974 + "size": "0"
975 + },
976 + "type": "terms"
977 + },
978 + {
979 + "field": "data_office365_ClientIP_country_code",
980 + "id": "5",
981 + "settings": {
982 + "min_doc_count": "1",
983 + "order": "desc",
984 + "orderBy": "_term",
985 + "size": "10"
986 + },
987 + "type": "terms"
988 + }
989 + ],
990 + "datasource": {
991 + "type": "elasticsearch",
992 + "uid": "replace_datasource_uid"
993 + },
994 + "metrics": [
995 + {
996 + "field": "select field",
997 + "id": "1",
998 + "type": "count"
999 + }
1000 + ],
1001 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1002 + "refId": "A",
1003 + "timeField": "timestamp"
1004 + }
1005 + ],
1006 + "title": "ONEDRIVE EVENTS BY ACCOUNT",
1007 + "transformations": [
1008 + {
1009 + "id": "merge",
1010 + "options": {
1011 + "reducers": []
1012 + }
1013 + },
1014 + {
1015 + "id": "organize",
1016 + "options": {
1017 + "excludeByName": {},
1018 + "indexByName": {},
1019 + "renameByName": {
1020 + "Count": "EVENTS",
1021 + "data_office365_ClientIP_country_code": "COUNTRY",
1022 + "data_office365_LogonError": "ERROR",
1023 + "data_office365_Operation": "WORKLOAD",
1024 + "data_office365_UserId": "AD ACCOUNT"
1025 + }
1026 + }
1027 + }
1028 + ],
1029 + "type": "table"
1030 + },
1031 + {
1032 + "datasource": {
1033 + "type": "elasticsearch",
1034 + "uid": "replace_datasource_uid"
1035 + },
1036 + "fieldConfig": {
1037 + "defaults": {
1038 + "mappings": [
1039 + {
1040 + "options": {
1041 + "match": "null",
1042 + "result": {
1043 + "text": "N/A"
1044 + }
1045 + },
1046 + "type": "special"
1047 + }
1048 + ],
1049 + "thresholds": {
1050 + "mode": "absolute",
1051 + "steps": [
1052 + {
1053 + "color": "blue",
1054 + "value": null
1055 + }
1056 + ]
1057 + },
1058 + "unit": "locale"
1059 + },
1060 + "overrides": []
1061 + },
1062 + "gridPos": {
1063 + "h": 6,
1064 + "w": 4,
1065 + "x": 0,
1066 + "y": 26
1067 + },
1068 + "id": 18,
1069 + "links": [],
1070 + "options": {
1071 + "colorMode": "value",
1072 + "graphMode": "area",
1073 + "justifyMode": "auto",
1074 + "orientation": "horizontal",
1075 + "reduceOptions": {
1076 + "calcs": [
1077 + "sum"
1078 + ],
1079 + "fields": "",
1080 + "values": false
1081 + },
1082 + "text": {},
1083 + "textMode": "auto"
1084 + },
1085 + "pluginVersion": "10.0.3",
1086 + "targets": [
1087 + {
1088 + "bucketAggs": [
1089 + {
1090 + "$$hashKey": "object:331",
1091 + "field": "timestamp",
1092 + "id": "2",
1093 + "settings": {
1094 + "interval": "auto",
1095 + "min_doc_count": 0,
1096 + "trimEdges": 0
1097 + },
1098 + "type": "date_histogram"
1099 + }
1100 + ],
1101 + "datasource": {
1102 + "type": "elasticsearch",
1103 + "uid": "replace_datasource_uid"
1104 + },
1105 + "metrics": [
1106 + {
1107 + "$$hashKey": "object:329",
1108 + "field": "select field",
1109 + "id": "1",
1110 + "type": "count"
1111 + }
1112 + ],
1113 + "query": "data_office365_Operation:TeamsSessionStarted AND rule_level:$rule_level",
1114 + "refId": "A",
1115 + "timeField": "timestamp"
1116 + }
1117 + ],
1118 + "title": "ONEDRIVE - SESSIONS STARTED",
1119 + "type": "stat"
1120 + },
1121 + {
1122 + "datasource": {
1123 + "type": "elasticsearch",
1124 + "uid": "replace_datasource_uid"
1125 + },
1126 + "fieldConfig": {
1127 + "defaults": {
1128 + "color": {
1129 + "mode": "thresholds"
1130 + },
1131 + "custom": {
1132 + "align": "auto",
1133 + "cellOptions": {
1134 + "type": "auto"
1135 + },
1136 + "filterable": true,
1137 + "inspect": false
1138 + },
1139 + "mappings": [],
1140 + "thresholds": {
1141 + "mode": "absolute",
1142 + "steps": [
1143 + {
1144 + "color": "green",
1145 + "value": null
1146 + },
1147 + {
1148 + "color": "red",
1149 + "value": 80
1150 + }
1151 + ]
1152 + }
1153 + },
1154 + "overrides": [
1155 + {
1156 + "matcher": {
1157 + "id": "byName",
1158 + "options": "rule_level"
1159 + },
1160 + "properties": [
1161 + {
1162 + "id": "displayName",
1163 + "value": "RULE LEVEL"
1164 + },
1165 + {
1166 + "id": "unit",
1167 + "value": "short"
1168 + },
1169 + {
1170 + "id": "decimals",
1171 + "value": -1
1172 + },
1173 + {
1174 + "id": "custom.cellOptions",
1175 + "value": {
1176 + "mode": "gradient",
1177 + "type": "color-background"
1178 + }
1179 + },
1180 + {
1181 + "id": "custom.align"
1182 + },
1183 + {
1184 + "id": "thresholds",
1185 + "value": {
1186 + "mode": "absolute",
1187 + "steps": [
1188 + {
1189 + "color": "#37872D",
1190 + "value": null
1191 + },
1192 + {
1193 + "color": "rgba(237, 129, 40, 0.89)",
1194 + "value": 7
1195 + },
1196 + {
1197 + "color": "rgba(245, 54, 54, 0.9)",
1198 + "value": 12
1199 + }
1200 + ]
1201 + }
1202 + }
1203 + ]
1204 + },
1205 + {
1206 + "matcher": {
1207 + "id": "byName",
1208 + "options": "Date/Time"
1209 + },
1210 + "properties": [
1211 + {
1212 + "id": "custom.width",
1213 + "value": 242
1214 + }
1215 + ]
1216 + },
1217 + {
1218 + "matcher": {
1219 + "id": "byName",
1220 + "options": "MITRE TACTIC"
1221 + },
1222 + "properties": [
1223 + {
1224 + "id": "custom.width",
1225 + "value": 332
1226 + }
1227 + ]
1228 + },
1229 + {
1230 + "matcher": {
1231 + "id": "byName",
1232 + "options": "IP ADDRESS"
1233 + },
1234 + "properties": [
1235 + {
1236 + "id": "custom.width",
1237 + "value": 163
1238 + }
1239 + ]
1240 + },
1241 + {
1242 + "matcher": {
1243 + "id": "byName",
1244 + "options": "MITRE TECHNIQUE"
1245 + },
1246 + "properties": [
1247 + {
1248 + "id": "custom.width",
1249 + "value": 312
1250 + }
1251 + ]
1252 + },
1253 + {
1254 + "matcher": {
1255 + "id": "byName",
1256 + "options": "EVENT ID"
1257 + },
1258 + "properties": [
1259 + {
1260 + "id": "links",
1261 + "value": [
1262 + {
1263 + "targetBlank": true,
1264 + "title": "VIEW EVENT DETAILS",
1265 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1266 + }
1267 + ]
1268 + },
1269 + {
1270 + "id": "custom.width",
1271 + "value": 265
1272 + }
1273 + ]
1274 + },
1275 + {
1276 + "matcher": {
1277 + "id": "byName",
1278 + "options": "RESULT"
1279 + },
1280 + "properties": [
1281 + {
1282 + "id": "custom.width",
1283 + "value": 118
1284 + },
1285 + {
1286 + "id": "mappings",
1287 + "value": [
1288 + {
1289 + "options": {
1290 + "Failed": {
1291 + "color": "orange",
1292 + "index": 1
1293 + },
1294 + "Success": {
1295 + "color": "green",
1296 + "index": 0
1297 + }
1298 + },
1299 + "type": "value"
1300 + }
1301 + ]
1302 + },
1303 + {
1304 + "id": "custom.cellOptions",
1305 + "value": {
1306 + "type": "color-text"
1307 + }
1308 + }
1309 + ]
1310 + },
1311 + {
1312 + "matcher": {
1313 + "id": "byName",
1314 + "options": "SRC IP"
1315 + },
1316 + "properties": [
1317 + {
1318 + "id": "custom.width",
1319 + "value": 265
1320 + }
1321 + ]
1322 + },
1323 + {
1324 + "matcher": {
1325 + "id": "byName",
1326 + "options": "ACCOUNT"
1327 + },
1328 + "properties": [
1329 + {
1330 + "id": "custom.width",
1331 + "value": 227
1332 + }
1333 + ]
1334 + },
1335 + {
1336 + "matcher": {
1337 + "id": "byName",
1338 + "options": "EVENT TIME"
1339 + },
1340 + "properties": [
1341 + {
1342 + "id": "custom.width",
1343 + "value": 195
1344 + }
1345 + ]
1346 + },
1347 + {
1348 + "matcher": {
1349 + "id": "byName",
1350 + "options": "CLIENT IP"
1351 + },
1352 + "properties": [
1353 + {
1354 + "id": "custom.width",
1355 + "value": 191
1356 + }
1357 + ]
1358 + },
1359 + {
1360 + "matcher": {
1361 + "id": "byName",
1362 + "options": "DESCRIPTION"
1363 + },
1364 + "properties": [
1365 + {
1366 + "id": "custom.width",
1367 + "value": 367
1368 + }
1369 + ]
1370 + },
1371 + {
1372 + "matcher": {
1373 + "id": "byName",
1374 + "options": "FILE"
1375 + },
1376 + "properties": [
1377 + {
1378 + "id": "custom.width",
1379 + "value": 282
1380 + }
1381 + ]
1382 + }
1383 + ]
1384 + },
1385 + "gridPos": {
1386 + "h": 16,
1387 + "w": 24,
1388 + "x": 0,
1389 + "y": 32
1390 + },
1391 + "id": 27,
1392 + "options": {
1393 + "cellHeight": "sm",
1394 + "footer": {
1395 + "countRows": false,
1396 + "enablePagination": true,
1397 + "fields": "",
1398 + "reducer": [
1399 + "sum"
1400 + ],
1401 + "show": false
1402 + },
1403 + "showHeader": true,
1404 + "sortBy": []
1405 + },
1406 + "pluginVersion": "10.0.3",
1407 + "targets": [
1408 + {
1409 + "bucketAggs": [],
1410 + "datasource": {
1411 + "type": "elasticsearch",
1412 + "uid": "replace_datasource_uid"
1413 + },
1414 + "metrics": [
1415 + {
1416 + "id": "1",
1417 + "settings": {
1418 + "size": "250"
1419 + },
1420 + "type": "raw_data"
1421 + }
1422 + ],
1423 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1424 + "refId": "A",
1425 + "timeField": "timestamp"
1426 + }
1427 + ],
1428 + "title": "EVENTS",
1429 + "transformations": [
1430 + {
1431 + "id": "organize",
1432 + "options": {
1433 + "excludeByName": {
1434 + "@metadata_beat": true,
1435 + "@metadata_type": true,
1436 + "@metadata_version": true,
1437 + "IMPHASH": true,
1438 + "MD5": true,
1439 + "SHA1": true,
1440 + "SHA256": true,
1441 + "_id": false,
1442 + "_index": true,
1443 + "_type": true,
1444 + "agent_ephemeral_id": true,
1445 + "agent_hostname": true,
1446 + "agent_id": true,
1447 + "agent_ip_city_name": true,
1448 + "agent_ip_country_code": true,
1449 + "agent_ip_geolocation": true,
1450 + "agent_name": true,
1451 + "agent_type": true,
1452 + "agent_version": true,
1453 + "beats_type": true,
1454 + "cluster_name": true,
1455 + "cluster_node": true,
1456 + "collector_node_id": true,
1457 + "data_alert_action": true,
1458 + "data_alert_category": true,
1459 + "data_alert_gid": true,
1460 + "data_alert_rev": true,
1461 + "data_alert_severity": true,
1462 + "data_alert_signature": true,
1463 + "data_alert_signature_id": true,
1464 + "data_app_proto": true,
1465 + "data_audit_auid": true,
1466 + "data_audit_command": true,
1467 + "data_audit_euid": true,
1468 + "data_audit_exe": true,
1469 + "data_audit_gid": true,
1470 + "data_audit_id": true,
1471 + "data_audit_pid": true,
1472 + "data_audit_res": true,
1473 + "data_audit_session": true,
1474 + "data_audit_type": true,
1475 + "data_audit_uid": true,
1476 + "data_dest_ip": true,
1477 + "data_dest_port": true,
1478 + "data_dstuser": true,
1479 + "data_event_type": true,
1480 + "data_extra_data": true,
1481 + "data_file": true,
1482 + "data_flow_bytes_toclient": true,
1483 + "data_flow_bytes_toserver": true,
1484 + "data_flow_id": true,
1485 + "data_flow_pkts_toclient": true,
1486 + "data_flow_pkts_toserver": true,
1487 + "data_flow_start": true,
1488 + "data_http_http_content_type": true,
1489 + "data_http_http_port": true,
1490 + "data_http_length": true,
1491 + "data_http_status": true,
1492 + "data_http_url": true,
1493 + "data_id": true,
1494 + "data_in_iface": true,
1495 + "data_integration": true,
1496 + "data_metadata_flowbits": true,
1497 + "data_metadata_flowints_http_anomaly_count": true,
1498 + "data_metadata_flowints_tcp_retransmission_count": true,
1499 + "data_office365_AADGroupId": true,
1500 + "data_office365_Actor": true,
1501 + "data_office365_ActorContextId": true,
1502 + "data_office365_ActorIpAddress": false,
1503 + "data_office365_ActorIpAddress_city_name": true,
1504 + "data_office365_ActorIpAddress_country_code": true,
1505 + "data_office365_ActorIpAddress_geolocation": true,
1506 + "data_office365_AppAccessContext_AADSessionId": true,
1507 + "data_office365_AppAccessContext_APIId": true,
1508 + "data_office365_AppAccessContext_ClientAppId": true,
1509 + "data_office365_AppAccessContext_ClientAppName": true,
1510 + "data_office365_AppAccessContext_CorrelationId": true,
1511 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1512 + "data_office365_AppAccessContext_UniqueTokenId": true,
1513 + "data_office365_AppId": true,
1514 + "data_office365_ApplicationDisplayName": true,
1515 + "data_office365_ApplicationId": true,
1516 + "data_office365_ArtifactsShared": true,
1517 + "data_office365_Attendees": true,
1518 + "data_office365_AuthenticationType": true,
1519 + "data_office365_AzureActiveDirectoryEventType": true,
1520 + "data_office365_BrowserVersion": true,
1521 + "data_office365_BrowserVersion_city_name": true,
1522 + "data_office365_BrowserVersion_country_code": true,
1523 + "data_office365_BrowserVersion_geolocation": true,
1524 + "data_office365_ChannelGuid": true,
1525 + "data_office365_ChannelName": true,
1526 + "data_office365_ChatName": true,
1527 + "data_office365_ChatThreadId": true,
1528 + "data_office365_ClientAppId": true,
1529 + "data_office365_ClientIP": false,
1530 + "data_office365_ClientIPAddress": true,
1531 + "data_office365_ClientIPAddress_city_name": true,
1532 + "data_office365_ClientIPAddress_country_code": true,
1533 + "data_office365_ClientIPAddress_geolocation": true,
1534 + "data_office365_ClientIP_city_name": true,
1535 + "data_office365_ClientIP_country_code": true,
1536 + "data_office365_ClientIP_geolocation": true,
1537 + "data_office365_ClientInfoString": true,
1538 + "data_office365_ClientProcessName": true,
1539 + "data_office365_ClientRequestId": true,
1540 + "data_office365_ClientVersion": true,
1541 + "data_office365_CommunicationSubType": true,
1542 + "data_office365_CommunicationType": true,
1543 + "data_office365_CorrelationId": true,
1544 + "data_office365_CreationTime": false,
1545 + "data_office365_CrossMailboxOperation": true,
1546 + "data_office365_CustomUniqueId": true,
1547 + "data_office365_DestFolder_Id": true,
1548 + "data_office365_DestFolder_Path": true,
1549 + "data_office365_DeviceDisplayName": true,
1550 + "data_office365_DeviceDisplayName_city_name": true,
1551 + "data_office365_DeviceDisplayName_country_code": true,
1552 + "data_office365_DeviceDisplayName_geolocation": true,
1553 + "data_office365_DeviceId": true,
1554 + "data_office365_DeviceInformation": true,
1555 + "data_office365_DeviceProperties": true,
1556 + "data_office365_DoNotDistributeEvent": true,
1557 + "data_office365_EndTime": true,
1558 + "data_office365_ErrorNumber": true,
1559 + "data_office365_EventData": true,
1560 + "data_office365_EventSource": true,
1561 + "data_office365_ExchangeId": true,
1562 + "data_office365_ExtendedProperties": true,
1563 + "data_office365_ExternalAccess": true,
1564 + "data_office365_ExtraProperties": true,
1565 + "data_office365_FileSizeBytes": true,
1566 + "data_office365_FileSyncBytesCommitted": true,
1567 + "data_office365_Folder_Id": true,
1568 + "data_office365_Folder_Path": true,
1569 + "data_office365_HighPriorityMediaProcessing": true,
1570 + "data_office365_HostedContents": true,
1571 + "data_office365_ICalUid": true,
1572 + "data_office365_Id": true,
1573 + "data_office365_ImplicitShare": true,
1574 + "data_office365_InterSystemsId": true,
1575 + "data_office365_InternalLogonType": true,
1576 + "data_office365_IntraSystemId": true,
1577 + "data_office365_IsManagedDevice": true,
1578 + "data_office365_ItemName": true,
1579 + "data_office365_ItemType": true,
1580 + "data_office365_Item_Id": true,
1581 + "data_office365_Item_InternetMessageId": true,
1582 + "data_office365_Item_IsRecord": true,
1583 + "data_office365_Item_ParentFolder_Id": true,
1584 + "data_office365_Item_SizeInBytes": true,
1585 + "data_office365_JoinTime": true,
1586 + "data_office365_LeaveTime": true,
1587 + "data_office365_ListBaseType": true,
1588 + "data_office365_ListId": true,
1589 + "data_office365_ListItemUniqueId": true,
1590 + "data_office365_ListServerTemplate": true,
1591 + "data_office365_LogonError": true,
1592 + "data_office365_LogonType": true,
1593 + "data_office365_LogonUserSid": true,
1594 + "data_office365_MachineId": true,
1595 + "data_office365_MailboxGuid": true,
1596 + "data_office365_MailboxOwnerSid": true,
1597 + "data_office365_MailboxOwnerUPN": true,
1598 + "data_office365_MeetingDetailId": true,
1599 + "data_office365_MeetingURL": true,
1600 + "data_office365_Members": true,
1601 + "data_office365_MessageId": true,
1602 + "data_office365_MessageSizeInBytes": true,
1603 + "data_office365_MessageURLs": true,
1604 + "data_office365_MessageVersion": true,
1605 + "data_office365_Modalities": true,
1606 + "data_office365_ModifiedProperties": true,
1607 + "data_office365_Name": true,
1608 + "data_office365_NewValue": true,
1609 + "data_office365_ObjectId": true,
1610 + "data_office365_Operation": true,
1611 + "data_office365_OperationScope": true,
1612 + "data_office365_OrganizationId": true,
1613 + "data_office365_OrganizationName": true,
1614 + "data_office365_Organizer_OrganizationId": true,
1615 + "data_office365_Organizer_RecipientType": true,
1616 + "data_office365_Organizer_Role": true,
1617 + "data_office365_Organizer_UserObjectId": true,
1618 + "data_office365_OriginatingServer": true,
1619 + "data_office365_Parameters": true,
1620 + "data_office365_ParentMessageId": true,
1621 + "data_office365_Platform": true,
1622 + "data_office365_ProviderTypes": true,
1623 + "data_office365_RecordType": true,
1624 + "data_office365_ResultStatus": true,
1625 + "data_office365_SessionId": true,
1626 + "data_office365_Site": true,
1627 + "data_office365_SiteUrl": true,
1628 + "data_office365_SourceFileExtension": true,
1629 + "data_office365_SourceRelativeUrl": true,
1630 + "data_office365_StartTime": true,
1631 + "data_office365_Subscription": true,
1632 + "data_office365_SubscriptionId": true,
1633 + "data_office365_Target": true,
1634 + "data_office365_TargetContextId": true,
1635 + "data_office365_TargetUserOrGroupName": true,
1636 + "data_office365_TargetUserOrGroupType": true,
1637 + "data_office365_TeamGuid": true,
1638 + "data_office365_TeamName": true,
1639 + "data_office365_UniqueSharingId": true,
1640 + "data_office365_UserAgent": true,
1641 + "data_office365_UserId": false,
1642 + "data_office365_UserKey": true,
1643 + "data_office365_UserType": true,
1644 + "data_office365_Version": true,
1645 + "data_office365_WebId": true,
1646 + "data_office365_Workload": true,
1647 + "data_osquery_action": true,
1648 + "data_osquery_calendarTime": true,
1649 + "data_osquery_columns_address": true,
1650 + "data_osquery_columns_address_city_name": true,
1651 + "data_osquery_columns_address_country_code": true,
1652 + "data_osquery_columns_address_geolocation": true,
1653 + "data_osquery_columns_cmdline": true,
1654 + "data_osquery_columns_cwd": true,
1655 + "data_osquery_columns_description": true,
1656 + "data_osquery_columns_directory": true,
1657 + "data_osquery_columns_disk_bytes_read": true,
1658 + "data_osquery_columns_disk_bytes_written": true,
1659 + "data_osquery_columns_egid": true,
1660 + "data_osquery_columns_euid": true,
1661 + "data_osquery_columns_family": true,
1662 + "data_osquery_columns_fd": true,
1663 + "data_osquery_columns_gid": true,
1664 + "data_osquery_columns_gid_signed": true,
1665 + "data_osquery_columns_host": true,
1666 + "data_osquery_columns_interface": true,
1667 + "data_osquery_columns_local_address": true,
1668 + "data_osquery_columns_local_address_city_name": true,
1669 + "data_osquery_columns_local_address_country_code": true,
1670 + "data_osquery_columns_local_address_geolocation": true,
1671 + "data_osquery_columns_local_port": true,
1672 + "data_osquery_columns_mac": true,
1673 + "data_osquery_columns_name": true,
1674 + "data_osquery_columns_net_namespace": true,
1675 + "data_osquery_columns_nice": true,
1676 + "data_osquery_columns_on_disk": true,
1677 + "data_osquery_columns_parent": true,
1678 + "data_osquery_columns_path": true,
1679 + "data_osquery_columns_pgroup": true,
1680 + "data_osquery_columns_pid": true,
1681 + "data_osquery_columns_port": true,
1682 + "data_osquery_columns_protocol": true,
1683 + "data_osquery_columns_remote_address": true,
1684 + "data_osquery_columns_remote_address_city_name": true,
1685 + "data_osquery_columns_remote_address_country_code": true,
1686 + "data_osquery_columns_remote_address_geolocation": true,
1687 + "data_osquery_columns_remote_port": true,
1688 + "data_osquery_columns_resident_size": true,
1689 + "data_osquery_columns_root": true,
1690 + "data_osquery_columns_sgid": true,
1691 + "data_osquery_columns_shell": true,
1692 + "data_osquery_columns_socket": true,
1693 + "data_osquery_columns_start_time": true,
1694 + "data_osquery_columns_state": true,
1695 + "data_osquery_columns_suid": true,
1696 + "data_osquery_columns_system_time": true,
1697 + "data_osquery_columns_threads": true,
1698 + "data_osquery_columns_time_utc": true,
1699 + "data_osquery_columns_total_size": true,
1700 + "data_osquery_columns_tty": true,
1701 + "data_osquery_columns_type": true,
1702 + "data_osquery_columns_uid": true,
1703 + "data_osquery_columns_uid_signed": true,
1704 + "data_osquery_columns_user": true,
1705 + "data_osquery_columns_user_time": true,
1706 + "data_osquery_columns_username": true,
1707 + "data_osquery_columns_wired_size": true,
1708 + "data_osquery_counter": true,
1709 + "data_osquery_decorations_host_uuid": true,
1710 + "data_osquery_decorations_hostname": true,
1711 + "data_osquery_epoch": true,
1712 + "data_osquery_hostIdentifier": true,
1713 + "data_osquery_name": true,
1714 + "data_osquery_numerics": true,
1715 + "data_osquery_unixTime": true,
1716 + "data_proto": true,
1717 + "data_sca_check_command": true,
1718 + "data_sca_check_compliance_cis": true,
1719 + "data_sca_check_compliance_cis_csc": true,
1720 + "data_sca_check_compliance_gdpr_IV": true,
1721 + "data_sca_check_compliance_gpg_13": true,
1722 + "data_sca_check_compliance_hipaa": true,
1723 + "data_sca_check_compliance_nist_800_53": true,
1724 + "data_sca_check_compliance_pci_dss": true,
1725 + "data_sca_check_compliance_tsc": true,
1726 + "data_sca_check_description": true,
1727 + "data_sca_check_id": true,
1728 + "data_sca_check_previous_result": true,
1729 + "data_sca_check_rationale": true,
1730 + "data_sca_check_remediation": true,
1731 + "data_sca_check_result": true,
1732 + "data_sca_check_title": true,
1733 + "data_sca_description": true,
1734 + "data_sca_failed": true,
1735 + "data_sca_file": true,
1736 + "data_sca_invalid": true,
1737 + "data_sca_passed": true,
1738 + "data_sca_policy": true,
1739 + "data_sca_policy_id": true,
1740 + "data_sca_scan_id": true,
1741 + "data_sca_score": true,
1742 + "data_sca_total_checks": true,
1743 + "data_sca_type": true,
1744 + "data_script": true,
1745 + "data_src_ip": true,
1746 + "data_src_ip_city_name": true,
1747 + "data_src_ip_country_code": true,
1748 + "data_src_ip_geolocation": true,
1749 + "data_src_port": true,
1750 + "data_srcip": true,
1751 + "data_srcip_city_name": true,
1752 + "data_srcip_country_code": true,
1753 + "data_srcip_geolocation": true,
1754 + "data_srcuser": true,
1755 + "data_timestamp": true,
1756 + "data_title": true,
1757 + "data_tls_session_resumed": true,
1758 + "data_tls_version": true,
1759 + "data_tx_id": true,
1760 + "data_type": true,
1761 + "data_win_eventXML_binaryData": true,
1762 + "data_win_eventXML_binaryDataSize": true,
1763 + "data_win_eventXML_param1": true,
1764 + "data_win_eventdata_authenticationPackageName": true,
1765 + "data_win_eventdata_callTrace": true,
1766 + "data_win_eventdata_commandLine": true,
1767 + "data_win_eventdata_company": true,
1768 + "data_win_eventdata_creationUtcTime": true,
1769 + "data_win_eventdata_currentDirectory": true,
1770 + "data_win_eventdata_description": true,
1771 + "data_win_eventdata_destinationHostname": true,
1772 + "data_win_eventdata_destinationIp": true,
1773 + "data_win_eventdata_destinationIp_city_name": true,
1774 + "data_win_eventdata_destinationIp_country_code": true,
1775 + "data_win_eventdata_destinationIp_geolocation": true,
1776 + "data_win_eventdata_destinationIsIpv6": true,
1777 + "data_win_eventdata_destinationPort": true,
1778 + "data_win_eventdata_destinationPortName": true,
1779 + "data_win_eventdata_details": true,
1780 + "data_win_eventdata_elevatedToken": true,
1781 + "data_win_eventdata_eventType": true,
1782 + "data_win_eventdata_fileVersion": true,
1783 + "data_win_eventdata_fileVersion_city_name": true,
1784 + "data_win_eventdata_fileVersion_country_code": true,
1785 + "data_win_eventdata_fileVersion_geolocation": true,
1786 + "data_win_eventdata_grantedAccess": true,
1787 + "data_win_eventdata_hashes": true,
1788 + "data_win_eventdata_image": true,
1789 + "data_win_eventdata_imageLoaded": true,
1790 + "data_win_eventdata_impersonationLevel": true,
1791 + "data_win_eventdata_initiated": true,
1792 + "data_win_eventdata_integrityLevel": true,
1793 + "data_win_eventdata_ipAddress": true,
1794 + "data_win_eventdata_ipPort": true,
1795 + "data_win_eventdata_keyLength": true,
1796 + "data_win_eventdata_logonGuid": true,
1797 + "data_win_eventdata_logonId": true,
1798 + "data_win_eventdata_logonProcessName": true,
1799 + "data_win_eventdata_logonType": true,
1800 + "data_win_eventdata_originalFileName": true,
1801 + "data_win_eventdata_param1": true,
1802 + "data_win_eventdata_param2": true,
1803 + "data_win_eventdata_param3": true,
1804 + "data_win_eventdata_param4": true,
1805 + "data_win_eventdata_parentCommandLine": true,
1806 + "data_win_eventdata_parentImage": true,
1807 + "data_win_eventdata_parentProcessGuid": true,
1808 + "data_win_eventdata_parentProcessId": true,
1809 + "data_win_eventdata_processGuid": true,
1810 + "data_win_eventdata_processId": true,
1811 + "data_win_eventdata_processName": true,
1812 + "data_win_eventdata_product": true,
1813 + "data_win_eventdata_protocol": true,
1814 + "data_win_eventdata_queryName": true,
1815 + "data_win_eventdata_queryResults": true,
1816 + "data_win_eventdata_queryStatus": true,
1817 + "data_win_eventdata_ruleName": true,
1818 + "data_win_eventdata_serviceName": true,
1819 + "data_win_eventdata_serviceSid": true,
1820 + "data_win_eventdata_signature": true,
1821 + "data_win_eventdata_signatureStatus": true,
1822 + "data_win_eventdata_signed": true,
1823 + "data_win_eventdata_sourceHostname": true,
1824 + "data_win_eventdata_sourceImage": true,
1825 + "data_win_eventdata_sourceIp": true,
1826 + "data_win_eventdata_sourceIp_city_name": true,
1827 + "data_win_eventdata_sourceIp_country_code": true,
1828 + "data_win_eventdata_sourceIp_geolocation": true,
1829 + "data_win_eventdata_sourceIsIpv6": true,
1830 + "data_win_eventdata_sourcePort": true,
1831 + "data_win_eventdata_sourceProcessGUID": true,
1832 + "data_win_eventdata_sourceProcessId": true,
1833 + "data_win_eventdata_sourceThreadId": true,
1834 + "data_win_eventdata_status": true,
1835 + "data_win_eventdata_subjectDomainName": true,
1836 + "data_win_eventdata_subjectLogonId": true,
1837 + "data_win_eventdata_subjectUserName": true,
1838 + "data_win_eventdata_subjectUserSid": true,
1839 + "data_win_eventdata_targetDomainName": true,
1840 + "data_win_eventdata_targetFilename": true,
1841 + "data_win_eventdata_targetImage": true,
1842 + "data_win_eventdata_targetLinkedLogonId": true,
1843 + "data_win_eventdata_targetLogonId": true,
1844 + "data_win_eventdata_targetObject": true,
1845 + "data_win_eventdata_targetProcessGUID": true,
1846 + "data_win_eventdata_targetProcessId": true,
1847 + "data_win_eventdata_targetUserName": true,
1848 + "data_win_eventdata_targetUserSid": true,
1849 + "data_win_eventdata_terminalSessionId": true,
1850 + "data_win_eventdata_ticketEncryptionType": true,
1851 + "data_win_eventdata_ticketOptions": true,
1852 + "data_win_eventdata_user": true,
1853 + "data_win_eventdata_utcTime": true,
1854 + "data_win_eventdata_virtualAccount": true,
1855 + "data_win_system_channel": true,
1856 + "data_win_system_computer": true,
1857 + "data_win_system_eventID": true,
1858 + "data_win_system_eventRecordID": true,
1859 + "data_win_system_eventSourceName": true,
1860 + "data_win_system_keywords": true,
1861 + "data_win_system_level": true,
1862 + "data_win_system_message": true,
1863 + "data_win_system_opcode": true,
1864 + "data_win_system_processID": true,
1865 + "data_win_system_providerGuid": true,
1866 + "data_win_system_providerName": true,
1867 + "data_win_system_severityValue": true,
1868 + "data_win_system_systemTime": true,
1869 + "data_win_system_task": true,
1870 + "data_win_system_threadID": true,
1871 + "data_win_system_version": true,
1872 + "decoder_name": true,
1873 + "decoder_parent": true,
1874 + "dns_query": true,
1875 + "dns_query_threat_indicated": true,
1876 + "dst_ip": true,
1877 + "dst_ip_city_name": true,
1878 + "dst_ip_country_code": true,
1879 + "dst_ip_geolocation": true,
1880 + "dst_ip_threat_indicated": true,
1881 + "dst_port": true,
1882 + "ecs_version": true,
1883 + "error": true,
1884 + "event_hash": true,
1885 + "file_path": true,
1886 + "firewall_rule_name": true,
1887 + "full_log": false,
1888 + "gl2_accounted_message_size": true,
1889 + "gl2_message_id": true,
1890 + "gl2_processing_error": true,
1891 + "gl2_remote_ip": true,
1892 + "gl2_remote_port": true,
1893 + "gl2_source_collector": true,
1894 + "gl2_source_input": true,
1895 + "gl2_source_node": true,
1896 + "hash_md5": true,
1897 + "hash_sha1": true,
1898 + "hash_sha256": true,
1899 + "highlight": true,
1900 + "host_architecture": true,
1901 + "host_containerized": true,
1902 + "host_hostname": true,
1903 + "host_id": true,
1904 + "host_ip": true,
1905 + "host_mac": true,
1906 + "host_name": true,
1907 + "host_os_codename": true,
1908 + "host_os_kernel": true,
1909 + "host_os_name": true,
1910 + "host_os_platform": true,
1911 + "host_os_version": true,
1912 + "hostname": true,
1913 + "id": true,
1914 + "input_type": true,
1915 + "level": true,
1916 + "location": true,
1917 + "log_file_path": true,
1918 + "log_offset": true,
1919 + "manager_name": true,
1920 + "message": true,
1921 + "module": true,
1922 + "msg_timestamp": true,
1923 + "parent_process_cmd_line": true,
1924 + "parent_process_id": true,
1925 + "parent_process_image": true,
1926 + "pid": true,
1927 + "predecoder_hostname": true,
1928 + "predecoder_program_name": true,
1929 + "predecoder_timestamp": true,
1930 + "previous_log": true,
1931 + "previous_output": true,
1932 + "process_cmd_line": true,
1933 + "process_id": true,
1934 + "process_image": true,
1935 + "process_name": true,
1936 + "protocol": true,
1937 + "rule_cis": true,
1938 + "rule_cis_csc": true,
1939 + "rule_firedtimes": true,
1940 + "rule_gdpr": true,
1941 + "rule_gdpr_IV": true,
1942 + "rule_gpg13": true,
1943 + "rule_gpg_13": true,
1944 + "rule_group1": true,
1945 + "rule_group2": true,
1946 + "rule_group3": true,
1947 + "rule_groups": true,
1948 + "rule_hipaa": true,
1949 + "rule_id": true,
1950 + "rule_info": true,
1951 + "rule_mail": true,
1952 + "rule_mitre_id": true,
1953 + "rule_mitre_tactic": false,
1954 + "rule_nist_800_53": true,
1955 + "rule_pci_dss": true,
1956 + "rule_tsc": true,
1957 + "scanid": true,
1958 + "service": true,
1959 + "software_package": true,
1960 + "software_vendor": true,
1961 + "sort": true,
1962 + "source": true,
1963 + "source_reserved_ip": true,
1964 + "src_ip": true,
1965 + "src_ip_city_name": true,
1966 + "src_ip_country_code": true,
1967 + "src_ip_geolocation": true,
1968 + "src_port": true,
1969 + "streams": true,
1970 + "syscheck_attrs_after": true,
1971 + "syscheck_audit_effective_user_id": true,
1972 + "syscheck_audit_effective_user_name": true,
1973 + "syscheck_audit_group_id": true,
1974 + "syscheck_audit_group_name": true,
1975 + "syscheck_audit_login_user_id": true,
1976 + "syscheck_audit_login_user_name": true,
1977 + "syscheck_audit_process_cwd": true,
1978 + "syscheck_audit_process_id": true,
1979 + "syscheck_audit_process_name": true,
1980 + "syscheck_audit_process_parent_cwd": true,
1981 + "syscheck_audit_process_parent_name": true,
1982 + "syscheck_audit_process_ppid": true,
1983 + "syscheck_audit_user_id": true,
1984 + "syscheck_audit_user_name": true,
1985 + "syscheck_changed_attributes": true,
1986 + "syscheck_event": true,
1987 + "syscheck_gid_after": true,
1988 + "syscheck_gname_after": true,
1989 + "syscheck_hard_links": true,
1990 + "syscheck_inode_after": true,
1991 + "syscheck_inode_before": true,
1992 + "syscheck_md5_after": true,
1993 + "syscheck_md5_before": true,
1994 + "syscheck_mode": true,
1995 + "syscheck_mtime_after": true,
1996 + "syscheck_mtime_before": true,
1997 + "syscheck_path": true,
1998 + "syscheck_perm_after": true,
1999 + "syscheck_perm_before": true,
2000 + "syscheck_sha1_after": true,
2001 + "syscheck_sha1_before": true,
2002 + "syscheck_sha256_after": true,
2003 + "syscheck_sha256_before": true,
2004 + "syscheck_size_after": true,
2005 + "syscheck_size_before": true,
2006 + "syscheck_uid_after": true,
2007 + "syscheck_uname_after": true,
2008 + "syscheck_win_perm_after": true,
2009 + "syscheck_win_perm_after_0_allowed": true,
2010 + "syscheck_win_perm_after_0_name": true,
2011 + "syscheck_win_perm_after_1_allowed": true,
2012 + "syscheck_win_perm_after_1_name": true,
2013 + "syscheck_win_perm_after_2_allowed": true,
2014 + "syscheck_win_perm_after_2_name": true,
2015 + "syscheck_win_perm_after_3_allowed": true,
2016 + "syscheck_win_perm_after_3_name": true,
2017 + "syslog_customer": true,
2018 + "syslog_level": true,
2019 + "syslog_tag": true,
2020 + "syslog_type": true,
2021 + "sysmon_event_description": true,
2022 + "threat_ids": true,
2023 + "threat_indicated": true,
2024 + "threat_names": true,
2025 + "time": true,
2026 + "timestamp": true,
2027 + "true": true,
2028 + "user_name": true,
2029 + "win_registry_key": true,
2030 + "win_system_eventID": true,
2031 + "windows_auth_package": true,
2032 + "windows_domain": true,
2033 + "windows_event_id": true,
2034 + "windows_event_severity": true,
2035 + "windows_logon_type": true
2036 + },
2037 + "indexByName": {
2038 + "_id": 2,
2039 + "_index": 9,
2040 + "_type": 10,
2041 + "agent_id": 11,
2042 + "agent_name": 5,
2043 + "cluster_name": 12,
2044 + "cluster_node": 13,
2045 + "data_office365_AppAccessContext_APIId": 49,
2046 + "data_office365_AppAccessContext_ClientAppId": 50,
2047 + "data_office365_AppAccessContext_ClientAppName": 51,
2048 + "data_office365_AppAccessContext_CorrelationId": 52,
2049 + "data_office365_ArtifactsShared": 53,
2050 + "data_office365_Attendees": 54,
2051 + "data_office365_ChatName": 55,
2052 + "data_office365_ChatThreadId": 56,
2053 + "data_office365_ClientIP": 4,
2054 + "data_office365_ClientIP_city_name": 14,
2055 + "data_office365_ClientIP_country_code": 15,
2056 + "data_office365_ClientIP_geolocation": 16,
2057 + "data_office365_CommunicationSubType": 57,
2058 + "data_office365_CommunicationType": 58,
2059 + "data_office365_CreationTime": 0,
2060 + "data_office365_DeviceId": 59,
2061 + "data_office365_DeviceInformation": 60,
2062 + "data_office365_EndTime": 61,
2063 + "data_office365_ExchangeId": 62,
2064 + "data_office365_ExtraProperties": 63,
2065 + "data_office365_ICalUid": 64,
2066 + "data_office365_Id": 17,
2067 + "data_office365_ItemName": 65,
2068 + "data_office365_JoinTime": 66,
2069 + "data_office365_LeaveTime": 67,
2070 + "data_office365_MeetingDetailId": 68,
2071 + "data_office365_MeetingURL": 69,
2072 + "data_office365_Members": 70,
2073 + "data_office365_MessageId": 71,
2074 + "data_office365_MessageSizeInBytes": 72,
2075 + "data_office365_MessageURLs": 73,
2076 + "data_office365_MessageVersion": 74,
2077 + "data_office365_Modalities": 75,
2078 + "data_office365_Name": 76,
2079 + "data_office365_NewValue": 77,
2080 + "data_office365_ObjectId": 18,
2081 + "data_office365_Operation": 24,
2082 + "data_office365_OperationScope": 78,
2083 + "data_office365_OrganizationId": 19,
2084 + "data_office365_Organizer_OrganizationId": 79,
2085 + "data_office365_Organizer_RecipientType": 80,
2086 + "data_office365_Organizer_Role": 81,
2087 + "data_office365_Organizer_UserObjectId": 82,
2088 + "data_office365_ProviderTypes": 83,
2089 + "data_office365_RecordType": 20,
2090 + "data_office365_StartTime": 84,
2091 + "data_office365_SubscriptionId": 85,
2092 + "data_office365_TeamGuid": 86,
2093 + "data_office365_UserId": 3,
2094 + "data_office365_UserKey": 21,
2095 + "data_office365_UserType": 22,
2096 + "data_office365_Version": 23,
2097 + "data_office365_Workload": 48,
2098 + "decoder_name": 25,
2099 + "gl2_accounted_message_size": 26,
2100 + "gl2_message_id": 27,
2101 + "gl2_processing_error": 28,
2102 + "gl2_remote_ip": 29,
2103 + "gl2_remote_port": 30,
2104 + "gl2_source_input": 31,
2105 + "gl2_source_node": 32,
2106 + "highlight": 33,
2107 + "id": 34,
2108 + "location": 35,
2109 + "manager_name": 36,
2110 + "message": 37,
2111 + "rule_description": 6,
2112 + "rule_firedtimes": 38,
2113 + "rule_group1": 39,
2114 + "rule_groups": 40,
2115 + "rule_id": 8,
2116 + "rule_level": 7,
2117 + "rule_mail": 41,
2118 + "sort": 42,
2119 + "source": 43,
2120 + "streams": 44,
2121 + "syslog_level": 45,
2122 + "syslog_type": 46,
2123 + "timestamp": 1,
2124 + "true": 47
2125 + },
2126 + "renameByName": {
2127 + "_id": "EVENT ID",
2128 + "agent_name": "",
2129 + "data_office365_ActorIpAddress": "SRC IP",
2130 + "data_office365_AffectedItems": "ITEMS",
2131 + "data_office365_BrowserName": "BROWSER",
2132 + "data_office365_ClientIP": "CLIENT IP",
2133 + "data_office365_ClientIP_city_name": "",
2134 + "data_office365_CreationTime": "EVENT TIME",
2135 + "data_office365_Item_Attachments": "ATTACHMENT",
2136 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2137 + "data_office365_Item_Subject": "SUBJECT",
2138 + "data_office365_ResultStatus": "RESULT",
2139 + "data_office365_SourceFileName": "FILE",
2140 + "data_office365_UserId": "ACCOUNT",
2141 + "rule_description": "DESCRIPTION",
2142 + "rule_id": "RULE ID",
2143 + "rule_level": "",
2144 + "rule_mitre_tactic": "MITRE TACTIC",
2145 + "rule_mitre_technique": "MITRE TECHNIQUE",
2146 + "timestamp": "Date/Time"
2147 + }
2148 + }
2149 + }
2150 + ],
2151 + "transparent": true,
2152 + "type": "table"
2153 + }
2154 + ],
2155 + "refresh": "",
2156 + "schemaVersion": 38,
2157 + "style": "dark",
2158 + "tags": [
2159 + "O365"
2160 + ],
2161 + "templating": {
2162 + "list": [
2163 + {
2164 + "datasource": {
2165 + "type": "elasticsearch",
2166 + "uid": "replace_datasource_uid"
2167 + },
2168 + "filters": [],
2169 + "hide": 0,
2170 + "label": "",
2171 + "name": "Filters",
2172 + "skipUrlSync": false,
2173 + "type": "adhoc"
2174 + },
2175 + {
2176 + "current": {
2177 + "selected": false,
2178 + "text": "All",
2179 + "value": "$__all"
2180 + },
2181 + "datasource": {
2182 + "type": "elasticsearch",
2183 + "uid": "replace_datasource_uid"
2184 + },
2185 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:OneDrive\"}",
2186 + "hide": 0,
2187 + "includeAll": true,
2188 + "label": "Operation",
2189 + "multi": false,
2190 + "name": "operation",
2191 + "options": [],
2192 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:OneDrive\"}",
2193 + "refresh": 2,
2194 + "regex": "",
2195 + "skipUrlSync": false,
2196 + "sort": 1,
2197 + "tagValuesQuery": "",
2198 + "tagsQuery": "",
2199 + "type": "query",
2200 + "useTags": false
2201 + },
2202 + {
2203 + "current": {
2204 + "selected": false,
2205 + "text": "All",
2206 + "value": "$__all"
2207 + },
2208 + "datasource": {
2209 + "type": "elasticsearch",
2210 + "uid": "replace_datasource_uid"
2211 + },
2212 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2213 + "hide": 0,
2214 + "includeAll": true,
2215 + "label": "Rule Level",
2216 + "multi": false,
2217 + "name": "rule_level",
2218 + "options": [],
2219 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2220 + "refresh": 2,
2221 + "regex": "",
2222 + "skipUrlSync": false,
2223 + "sort": 0,
2224 + "type": "query"
2225 + }
2226 + ]
2227 + },
2228 + "time": {
2229 + "from": "now-12h",
2230 + "to": "now"
2231 + },
2232 + "timepicker": {
2233 + "refresh_intervals": [
2234 + "5s",
2235 + "10s",
2236 + "30s",
2237 + "1m",
2238 + "5m",
2239 + "15m",
2240 + "30m",
2241 + "1h",
2242 + "2h",
2243 + "1d"
2244 + ],
2245 + "time_options": [
2246 + "5m",
2247 + "15m",
2248 + "1h",
2249 + "6h",
2250 + "12h",
2251 + "24h",
2252 + "2d",
2253 + "7d",
2254 + "30d"
2255 + ]
2256 + },
2257 + "timezone": "",
2258 + "title": "O365 - ONEDRIVE",
2259 + "weekStart": ""
2260 +}
backend/app/connectors/grafana/dashboards/Office365/powerbi.json new
+2426
@@ -0,0 +1,2426 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "10.0.3",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:PowerBI",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "cellOptions": {
261 + "type": "auto"
262 + },
263 + "inspect": false
264 + },
265 + "mappings": [],
266 + "thresholds": {
267 + "mode": "absolute",
268 + "steps": [
269 + {
270 + "color": "red",
271 + "value": null
272 + }
273 + ]
274 + }
275 + },
276 + "overrides": [
277 + {
278 + "matcher": {
279 + "id": "byName",
280 + "options": "Count"
281 + },
282 + "properties": [
283 + {
284 + "id": "displayName",
285 + "value": "EVENTS"
286 + },
287 + {
288 + "id": "unit",
289 + "value": "short"
290 + },
291 + {
292 + "id": "decimals",
293 + "value": -1
294 + },
295 + {
296 + "id": "custom.align"
297 + },
298 + {
299 + "id": "thresholds",
300 + "value": {
301 + "mode": "absolute",
302 + "steps": [
303 + {
304 + "color": "red",
305 + "value": null
306 + }
307 + ]
308 + }
309 + }
310 + ]
311 + }
312 + ]
313 + },
314 + "gridPos": {
315 + "h": 7,
316 + "w": 6,
317 + "x": 8,
318 + "y": 0
319 + },
320 + "id": 54,
321 + "options": {
322 + "cellHeight": "sm",
323 + "footer": {
324 + "countRows": false,
325 + "fields": "",
326 + "reducer": [
327 + "sum"
328 + ],
329 + "show": false
330 + },
331 + "showHeader": true
332 + },
333 + "pluginVersion": "10.0.3",
334 + "targets": [
335 + {
336 + "bucketAggs": [
337 + {
338 + "fake": true,
339 + "field": "data_office365_Operation",
340 + "id": "4",
341 + "settings": {
342 + "min_doc_count": 1,
343 + "order": "desc",
344 + "orderBy": "_count",
345 + "size": "0"
346 + },
347 + "type": "terms"
348 + }
349 + ],
350 + "datasource": {
351 + "type": "elasticsearch",
352 + "uid": "replace_datasource_uid"
353 + },
354 + "metrics": [
355 + {
356 + "field": "select field",
357 + "id": "1",
358 + "type": "count"
359 + }
360 + ],
361 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
362 + "refId": "A",
363 + "timeField": "timestamp"
364 + }
365 + ],
366 + "title": "EVENTS BY OPERATION",
367 + "transformations": [
368 + {
369 + "id": "merge",
370 + "options": {
371 + "reducers": []
372 + }
373 + },
374 + {
375 + "id": "organize",
376 + "options": {
377 + "excludeByName": {},
378 + "indexByName": {},
379 + "renameByName": {
380 + "Count": "EVENTS",
381 + "data_office365_Operation": "OPERATION"
382 + }
383 + }
384 + }
385 + ],
386 + "type": "table"
387 + },
388 + {
389 + "datasource": {
390 + "type": "elasticsearch",
391 + "uid": "replace_datasource_uid"
392 + },
393 + "fieldConfig": {
394 + "defaults": {
395 + "color": {
396 + "mode": "thresholds"
397 + },
398 + "custom": {
399 + "align": "auto",
400 + "cellOptions": {
401 + "type": "auto"
402 + },
403 + "inspect": false
404 + },
405 + "mappings": [],
406 + "thresholds": {
407 + "mode": "absolute",
408 + "steps": [
409 + {
410 + "color": "red",
411 + "value": null
412 + }
413 + ]
414 + }
415 + },
416 + "overrides": [
417 + {
418 + "matcher": {
419 + "id": "byName",
420 + "options": "Count"
421 + },
422 + "properties": [
423 + {
424 + "id": "displayName",
425 + "value": "EVENTS"
426 + },
427 + {
428 + "id": "unit",
429 + "value": "short"
430 + },
431 + {
432 + "id": "decimals",
433 + "value": -1
434 + },
435 + {
436 + "id": "custom.align"
437 + },
438 + {
439 + "id": "thresholds",
440 + "value": {
441 + "mode": "absolute",
442 + "steps": [
443 + {
444 + "color": "red",
445 + "value": null
446 + }
447 + ]
448 + }
449 + }
450 + ]
451 + }
452 + ]
453 + },
454 + "gridPos": {
455 + "h": 7,
456 + "w": 6,
457 + "x": 14,
458 + "y": 0
459 + },
460 + "id": 62,
461 + "options": {
462 + "cellHeight": "sm",
463 + "footer": {
464 + "countRows": false,
465 + "fields": "",
466 + "reducer": [
467 + "sum"
468 + ],
469 + "show": false
470 + },
471 + "showHeader": true
472 + },
473 + "pluginVersion": "10.0.3",
474 + "targets": [
475 + {
476 + "bucketAggs": [
477 + {
478 + "fake": true,
479 + "field": "data_office365_Activity",
480 + "id": "4",
481 + "settings": {
482 + "min_doc_count": 1,
483 + "order": "desc",
484 + "orderBy": "_count",
485 + "size": "0"
486 + },
487 + "type": "terms"
488 + }
489 + ],
490 + "datasource": {
491 + "type": "elasticsearch",
492 + "uid": "replace_datasource_uid"
493 + },
494 + "metrics": [
495 + {
496 + "field": "select field",
497 + "id": "1",
498 + "type": "count"
499 + }
500 + ],
501 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
502 + "refId": "A",
503 + "timeField": "timestamp"
504 + }
505 + ],
506 + "title": "EVENTS BY ACTIVITY",
507 + "transformations": [
508 + {
509 + "id": "merge",
510 + "options": {
511 + "reducers": []
512 + }
513 + },
514 + {
515 + "id": "organize",
516 + "options": {
517 + "excludeByName": {},
518 + "indexByName": {},
519 + "renameByName": {
520 + "Count": "EVENTS",
521 + "data_office365_Activity": "ACTIVITY",
522 + "data_office365_Operation": "OPERATION",
523 + "data_office365_SourceApp": "SOURCE APP",
524 + "data_office365_UserAgent": "USER AGENT"
525 + }
526 + }
527 + }
528 + ],
529 + "type": "table"
530 + },
531 + {
532 + "datasource": {
533 + "type": "elasticsearch",
534 + "uid": "replace_datasource_uid"
535 + },
536 + "fieldConfig": {
537 + "defaults": {
538 + "color": {
539 + "mode": "thresholds"
540 + },
541 + "mappings": [
542 + {
543 + "options": {
544 + "match": "null",
545 + "result": {
546 + "text": "N/A"
547 + }
548 + },
549 + "type": "special"
550 + }
551 + ],
552 + "max": 15,
553 + "min": 0,
554 + "thresholds": {
555 + "mode": "absolute",
556 + "steps": [
557 + {
558 + "color": "#299c46",
559 + "value": null
560 + },
561 + {
562 + "color": "rgba(237, 129, 40, 0.89)",
563 + "value": 8
564 + },
565 + {
566 + "color": "#d44a3a",
567 + "value": 12
568 + }
569 + ]
570 + },
571 + "unit": "none"
572 + },
573 + "overrides": []
574 + },
575 + "gridPos": {
576 + "h": 7,
577 + "w": 4,
578 + "x": 0,
579 + "y": 7
580 + },
581 + "id": 16,
582 + "links": [],
583 + "options": {
584 + "orientation": "horizontal",
585 + "reduceOptions": {
586 + "calcs": [
587 + "max"
588 + ],
589 + "fields": "",
590 + "values": false
591 + },
592 + "showThresholdLabels": false,
593 + "showThresholdMarkers": true,
594 + "text": {}
595 + },
596 + "pluginVersion": "10.0.3",
597 + "targets": [
598 + {
599 + "bucketAggs": [
600 + {
601 + "field": "timestamp",
602 + "id": "2",
603 + "settings": {
604 + "interval": "auto",
605 + "min_doc_count": 0,
606 + "trimEdges": 0
607 + },
608 + "type": "date_histogram"
609 + }
610 + ],
611 + "datasource": {
612 + "type": "elasticsearch",
613 + "uid": "replace_datasource_uid"
614 + },
615 + "metrics": [
616 + {
617 + "field": "rule_level",
618 + "id": "1",
619 + "meta": {},
620 + "settings": {},
621 + "type": "max"
622 + }
623 + ],
624 + "query": "data_office365_Operation:$operation AND data_office365_Workload:PowerBI",
625 + "refId": "A",
626 + "timeField": "timestamp"
627 + }
628 + ],
629 + "title": "MAX SEVERITY (0 - 15)",
630 + "type": "gauge"
631 + },
632 + {
633 + "datasource": {
634 + "type": "elasticsearch",
635 + "uid": "replace_datasource_uid"
636 + },
637 + "fieldConfig": {
638 + "defaults": {
639 + "color": {
640 + "mode": "palette-classic"
641 + },
642 + "custom": {
643 + "axisCenteredZero": false,
644 + "axisColorMode": "text",
645 + "axisLabel": "",
646 + "axisPlacement": "auto",
647 + "barAlignment": 0,
648 + "drawStyle": "bars",
649 + "fillOpacity": 0,
650 + "gradientMode": "none",
651 + "hideFrom": {
652 + "legend": false,
653 + "tooltip": false,
654 + "viz": false
655 + },
656 + "lineInterpolation": "linear",
657 + "lineWidth": 1,
658 + "pointSize": 5,
659 + "scaleDistribution": {
660 + "type": "linear"
661 + },
662 + "showPoints": "auto",
663 + "spanNulls": false,
664 + "stacking": {
665 + "group": "A",
666 + "mode": "normal"
667 + },
668 + "thresholdsStyle": {
669 + "mode": "off"
670 + }
671 + },
672 + "mappings": [],
673 + "thresholds": {
674 + "mode": "absolute",
675 + "steps": [
676 + {
677 + "color": "green",
678 + "value": null
679 + },
680 + {
681 + "color": "red",
682 + "value": 80
683 + }
684 + ]
685 + }
686 + },
687 + "overrides": []
688 + },
689 + "gridPos": {
690 + "h": 13,
691 + "w": 20,
692 + "x": 4,
693 + "y": 7
694 + },
695 + "id": 60,
696 + "options": {
697 + "legend": {
698 + "calcs": [],
699 + "displayMode": "table",
700 + "placement": "right",
701 + "showLegend": true
702 + },
703 + "tooltip": {
704 + "mode": "single",
705 + "sort": "none"
706 + }
707 + },
708 + "targets": [
709 + {
710 + "alias": "",
711 + "bucketAggs": [
712 + {
713 + "field": "data_office365_Operation",
714 + "id": "3",
715 + "settings": {
716 + "min_doc_count": "1",
717 + "order": "desc",
718 + "orderBy": "_count",
719 + "size": "10"
720 + },
721 + "type": "terms"
722 + },
723 + {
724 + "field": "timestamp",
725 + "id": "2",
726 + "settings": {
727 + "interval": "auto"
728 + },
729 + "type": "date_histogram"
730 + }
731 + ],
732 + "datasource": {
733 + "type": "elasticsearch",
734 + "uid": "replace_datasource_uid"
735 + },
736 + "metrics": [
737 + {
738 + "id": "1",
739 + "type": "count"
740 + }
741 + ],
742 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
743 + "refId": "A",
744 + "timeField": "timestamp"
745 + }
746 + ],
747 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
748 + "transparent": true,
749 + "type": "timeseries"
750 + },
751 + {
752 + "datasource": {
753 + "type": "elasticsearch",
754 + "uid": "replace_datasource_uid"
755 + },
756 + "fieldConfig": {
757 + "defaults": {
758 + "mappings": [
759 + {
760 + "options": {
761 + "match": "null",
762 + "result": {
763 + "text": "N/A"
764 + }
765 + },
766 + "type": "special"
767 + }
768 + ],
769 + "thresholds": {
770 + "mode": "absolute",
771 + "steps": [
772 + {
773 + "color": "blue",
774 + "value": null
775 + }
776 + ]
777 + },
778 + "unit": "locale"
779 + },
780 + "overrides": []
781 + },
782 + "gridPos": {
783 + "h": 6,
784 + "w": 4,
785 + "x": 0,
786 + "y": 14
787 + },
788 + "id": 51,
789 + "links": [],
790 + "options": {
791 + "colorMode": "value",
792 + "graphMode": "area",
793 + "justifyMode": "auto",
794 + "orientation": "horizontal",
795 + "reduceOptions": {
796 + "calcs": [
797 + "sum"
798 + ],
799 + "fields": "",
800 + "values": false
801 + },
802 + "text": {},
803 + "textMode": "auto"
804 + },
805 + "pluginVersion": "10.0.3",
806 + "targets": [
807 + {
808 + "bucketAggs": [
809 + {
810 + "$$hashKey": "object:331",
811 + "field": "timestamp",
812 + "id": "2",
813 + "settings": {
814 + "interval": "auto",
815 + "min_doc_count": 0,
816 + "trimEdges": 0
817 + },
818 + "type": "date_histogram"
819 + }
820 + ],
821 + "datasource": {
822 + "type": "elasticsearch",
823 + "uid": "replace_datasource_uid"
824 + },
825 + "metrics": [
826 + {
827 + "$$hashKey": "object:329",
828 + "field": "select field",
829 + "id": "1",
830 + "type": "count"
831 + }
832 + ],
833 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
834 + "refId": "A",
835 + "timeField": "timestamp"
836 + }
837 + ],
838 + "title": "EVENTS (Total)",
839 + "type": "stat"
840 + },
841 + {
842 + "datasource": {
843 + "type": "elasticsearch",
844 + "uid": "replace_datasource_uid"
845 + },
846 + "fieldConfig": {
847 + "defaults": {
848 + "color": {
849 + "mode": "thresholds"
850 + },
851 + "custom": {
852 + "align": "auto",
853 + "cellOptions": {
854 + "type": "auto"
855 + },
856 + "inspect": false
857 + },
858 + "mappings": [],
859 + "thresholds": {
860 + "mode": "absolute",
861 + "steps": [
862 + {
863 + "color": "orange",
864 + "value": null
865 + }
866 + ]
867 + }
868 + },
869 + "overrides": [
870 + {
871 + "matcher": {
872 + "id": "byName",
873 + "options": "Count"
874 + },
875 + "properties": [
876 + {
877 + "id": "displayName",
878 + "value": "EVENTS"
879 + },
880 + {
881 + "id": "unit",
882 + "value": "short"
883 + },
884 + {
885 + "id": "decimals",
886 + "value": -1
887 + },
888 + {
889 + "id": "custom.align"
890 + }
891 + ]
892 + },
893 + {
894 + "matcher": {
895 + "id": "byName",
896 + "options": "AD ACCOUNT"
897 + },
898 + "properties": [
899 + {
900 + "id": "custom.width",
901 + "value": 377
902 + }
903 + ]
904 + }
905 + ]
906 + },
907 + "gridPos": {
908 + "h": 12,
909 + "w": 8,
910 + "x": 0,
911 + "y": 20
912 + },
913 + "id": 61,
914 + "options": {
915 + "cellHeight": "sm",
916 + "footer": {
917 + "countRows": false,
918 + "fields": "",
919 + "reducer": [
920 + "sum"
921 + ],
922 + "show": false
923 + },
924 + "showHeader": true,
925 + "sortBy": []
926 + },
927 + "pluginVersion": "10.0.3",
928 + "targets": [
929 + {
930 + "bucketAggs": [
931 + {
932 + "fake": true,
933 + "field": "data_office365_ArtifactName",
934 + "id": "4",
935 + "settings": {
936 + "min_doc_count": 1,
937 + "order": "desc",
938 + "orderBy": "_count",
939 + "size": "0"
940 + },
941 + "type": "terms"
942 + }
943 + ],
944 + "datasource": {
945 + "type": "elasticsearch",
946 + "uid": "replace_datasource_uid"
947 + },
948 + "metrics": [
949 + {
950 + "field": "select field",
951 + "id": "1",
952 + "type": "count"
953 + }
954 + ],
955 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
956 + "refId": "A",
957 + "timeField": "timestamp"
958 + }
959 + ],
960 + "title": "MS-PowerBI EVENTS BY ARTIFACT",
961 + "transformations": [
962 + {
963 + "id": "merge",
964 + "options": {
965 + "reducers": []
966 + }
967 + },
968 + {
969 + "id": "organize",
970 + "options": {
971 + "excludeByName": {},
972 + "indexByName": {},
973 + "renameByName": {
974 + "Count": "EVENTS",
975 + "data_office365_ArtifactName": "ARTIFACT",
976 + "data_office365_AuthenticationType": "AUTH TYPE",
977 + "data_office365_ClientIP_country_code": "COUNTRY",
978 + "data_office365_FormName": "FORM NAME",
979 + "data_office365_LogonError": "ERROR",
980 + "data_office365_Operation": "WORKLOAD",
981 + "data_office365_UserId": "AD ACCOUNT"
982 + }
983 + }
984 + }
985 + ],
986 + "type": "table"
987 + },
988 + {
989 + "circleMaxSize": 30,
990 + "circleMinSize": 2,
991 + "colors": [
992 + "rgba(245, 54, 54, 0.9)",
993 + "rgba(237, 129, 40, 0.89)",
994 + "rgba(50, 172, 45, 0.97)"
995 + ],
996 + "datasource": {
997 + "type": "elasticsearch",
998 + "uid": "replace_datasource_uid"
999 + },
1000 + "decimals": 0,
1001 + "esMetric": "Count",
1002 + "gridPos": {
1003 + "h": 12,
1004 + "w": 8,
1005 + "x": 8,
1006 + "y": 20
1007 + },
1008 + "hideEmpty": false,
1009 + "hideZero": false,
1010 + "id": 50,
1011 + "initialZoom": 1,
1012 + "locationData": "countries",
1013 + "mapCenter": "(0°, 0°)",
1014 + "mapCenterLatitude": 0,
1015 + "mapCenterLongitude": 0,
1016 + "maxDataPoints": 1,
1017 + "mouseWheelZoom": false,
1018 + "showLegend": true,
1019 + "stickyLabels": false,
1020 + "tableQueryOptions": {
1021 + "geohashField": "geohash",
1022 + "latitudeField": "latitude",
1023 + "longitudeField": "longitude",
1024 + "metricField": "metric",
1025 + "queryType": "geohash"
1026 + },
1027 + "targets": [
1028 + {
1029 + "bucketAggs": [
1030 + {
1031 + "fake": true,
1032 + "field": "data_office365_ClientIP_country_code",
1033 + "id": "3",
1034 + "settings": {
1035 + "min_doc_count": 1,
1036 + "order": "desc",
1037 + "orderBy": "_term",
1038 + "size": "0"
1039 + },
1040 + "type": "terms"
1041 + },
1042 + {
1043 + "field": "timestamp",
1044 + "id": "2",
1045 + "settings": {
1046 + "interval": "auto",
1047 + "min_doc_count": 0,
1048 + "trimEdges": 0
1049 + },
1050 + "type": "date_histogram"
1051 + }
1052 + ],
1053 + "datasource": {
1054 + "type": "elasticsearch",
1055 + "uid": "replace_datasource_uid"
1056 + },
1057 + "metrics": [
1058 + {
1059 + "field": "select field",
1060 + "id": "1",
1061 + "type": "count"
1062 + }
1063 + ],
1064 + "query": "data_office365_Workload:PowerBI AND rule_level:$rule_level",
1065 + "refId": "A",
1066 + "timeField": "timestamp"
1067 + }
1068 + ],
1069 + "thresholds": "0,10",
1070 + "title": "MS-PowerBI - ALL EVENTS BY SRC COUNTRY",
1071 + "type": "grafana-worldmap-panel",
1072 + "unitPlural": "",
1073 + "unitSingle": "",
1074 + "valueName": "total"
1075 + },
1076 + {
1077 + "datasource": {
1078 + "type": "elasticsearch",
1079 + "uid": "replace_datasource_uid"
1080 + },
1081 + "fieldConfig": {
1082 + "defaults": {
1083 + "color": {
1084 + "mode": "thresholds"
1085 + },
1086 + "custom": {
1087 + "align": "auto",
1088 + "cellOptions": {
1089 + "type": "auto"
1090 + },
1091 + "inspect": false
1092 + },
1093 + "mappings": [],
1094 + "thresholds": {
1095 + "mode": "absolute",
1096 + "steps": [
1097 + {
1098 + "color": "orange",
1099 + "value": null
1100 + }
1101 + ]
1102 + }
1103 + },
1104 + "overrides": [
1105 + {
1106 + "matcher": {
1107 + "id": "byName",
1108 + "options": "Count"
1109 + },
1110 + "properties": [
1111 + {
1112 + "id": "displayName",
1113 + "value": "EVENTS"
1114 + },
1115 + {
1116 + "id": "unit",
1117 + "value": "short"
1118 + },
1119 + {
1120 + "id": "decimals",
1121 + "value": -1
1122 + },
1123 + {
1124 + "id": "custom.align"
1125 + }
1126 + ]
1127 + },
1128 + {
1129 + "matcher": {
1130 + "id": "byName",
1131 + "options": "AD ACCOUNT"
1132 + },
1133 + "properties": [
1134 + {
1135 + "id": "custom.width",
1136 + "value": 377
1137 + }
1138 + ]
1139 + }
1140 + ]
1141 + },
1142 + "gridPos": {
1143 + "h": 12,
1144 + "w": 8,
1145 + "x": 16,
1146 + "y": 20
1147 + },
1148 + "id": 58,
1149 + "options": {
1150 + "cellHeight": "sm",
1151 + "footer": {
1152 + "countRows": false,
1153 + "fields": "",
1154 + "reducer": [
1155 + "sum"
1156 + ],
1157 + "show": false
1158 + },
1159 + "showHeader": true,
1160 + "sortBy": []
1161 + },
1162 + "pluginVersion": "10.0.3",
1163 + "targets": [
1164 + {
1165 + "bucketAggs": [
1166 + {
1167 + "fake": true,
1168 + "field": "data_office365_UserId",
1169 + "id": "4",
1170 + "settings": {
1171 + "min_doc_count": 1,
1172 + "order": "desc",
1173 + "orderBy": "_count",
1174 + "size": "0"
1175 + },
1176 + "type": "terms"
1177 + },
1178 + {
1179 + "field": "data_office365_ClientIP_country_code",
1180 + "id": "5",
1181 + "settings": {
1182 + "min_doc_count": "1",
1183 + "order": "desc",
1184 + "orderBy": "_term",
1185 + "size": "10"
1186 + },
1187 + "type": "terms"
1188 + }
1189 + ],
1190 + "datasource": {
1191 + "type": "elasticsearch",
1192 + "uid": "replace_datasource_uid"
1193 + },
1194 + "metrics": [
1195 + {
1196 + "field": "select field",
1197 + "id": "1",
1198 + "type": "count"
1199 + }
1200 + ],
1201 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
1202 + "refId": "A",
1203 + "timeField": "timestamp"
1204 + }
1205 + ],
1206 + "title": "MS-PowerBI EVENTS BY ACCOUNT",
1207 + "transformations": [
1208 + {
1209 + "id": "merge",
1210 + "options": {
1211 + "reducers": []
1212 + }
1213 + },
1214 + {
1215 + "id": "organize",
1216 + "options": {
1217 + "excludeByName": {},
1218 + "indexByName": {},
1219 + "renameByName": {
1220 + "Count": "EVENTS",
1221 + "data_office365_ClientIP_country_code": "COUNTRY",
1222 + "data_office365_LogonError": "ERROR",
1223 + "data_office365_Operation": "WORKLOAD",
1224 + "data_office365_UserId": "AD ACCOUNT"
1225 + }
1226 + }
1227 + }
1228 + ],
1229 + "type": "table"
1230 + },
1231 + {
1232 + "datasource": {
1233 + "type": "elasticsearch",
1234 + "uid": "replace_datasource_uid"
1235 + },
1236 + "fieldConfig": {
1237 + "defaults": {
1238 + "color": {
1239 + "mode": "thresholds"
1240 + },
1241 + "custom": {
1242 + "align": "auto",
1243 + "cellOptions": {
1244 + "type": "auto"
1245 + },
1246 + "filterable": true,
1247 + "inspect": false
1248 + },
1249 + "mappings": [],
1250 + "thresholds": {
1251 + "mode": "absolute",
1252 + "steps": [
1253 + {
1254 + "color": "green",
1255 + "value": null
1256 + },
1257 + {
1258 + "color": "red",
1259 + "value": 80
1260 + }
1261 + ]
1262 + }
1263 + },
1264 + "overrides": [
1265 + {
1266 + "matcher": {
1267 + "id": "byName",
1268 + "options": "rule_level"
1269 + },
1270 + "properties": [
1271 + {
1272 + "id": "displayName",
1273 + "value": "RULE LEVEL"
1274 + },
1275 + {
1276 + "id": "unit",
1277 + "value": "short"
1278 + },
1279 + {
1280 + "id": "decimals",
1281 + "value": -1
1282 + },
1283 + {
1284 + "id": "custom.cellOptions",
1285 + "value": {
1286 + "mode": "gradient",
1287 + "type": "color-background"
1288 + }
1289 + },
1290 + {
1291 + "id": "custom.align"
1292 + },
1293 + {
1294 + "id": "thresholds",
1295 + "value": {
1296 + "mode": "absolute",
1297 + "steps": [
1298 + {
1299 + "color": "#37872D",
1300 + "value": null
1301 + },
1302 + {
1303 + "color": "rgba(237, 129, 40, 0.89)",
1304 + "value": 7
1305 + },
1306 + {
1307 + "color": "rgba(245, 54, 54, 0.9)",
1308 + "value": 12
1309 + }
1310 + ]
1311 + }
1312 + }
1313 + ]
1314 + },
1315 + {
1316 + "matcher": {
1317 + "id": "byName",
1318 + "options": "Date/Time"
1319 + },
1320 + "properties": [
1321 + {
1322 + "id": "custom.width",
1323 + "value": 242
1324 + }
1325 + ]
1326 + },
1327 + {
1328 + "matcher": {
1329 + "id": "byName",
1330 + "options": "MITRE TACTIC"
1331 + },
1332 + "properties": [
1333 + {
1334 + "id": "custom.width",
1335 + "value": 332
1336 + }
1337 + ]
1338 + },
1339 + {
1340 + "matcher": {
1341 + "id": "byName",
1342 + "options": "IP ADDRESS"
1343 + },
1344 + "properties": [
1345 + {
1346 + "id": "custom.width",
1347 + "value": 163
1348 + }
1349 + ]
1350 + },
1351 + {
1352 + "matcher": {
1353 + "id": "byName",
1354 + "options": "MITRE TECHNIQUE"
1355 + },
1356 + "properties": [
1357 + {
1358 + "id": "custom.width",
1359 + "value": 312
1360 + }
1361 + ]
1362 + },
1363 + {
1364 + "matcher": {
1365 + "id": "byName",
1366 + "options": "EVENT ID"
1367 + },
1368 + "properties": [
1369 + {
1370 + "id": "links",
1371 + "value": [
1372 + {
1373 + "targetBlank": true,
1374 + "title": "VIEW EVENT DETAILS",
1375 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1376 + }
1377 + ]
1378 + },
1379 + {
1380 + "id": "custom.width",
1381 + "value": 265
1382 + }
1383 + ]
1384 + },
1385 + {
1386 + "matcher": {
1387 + "id": "byName",
1388 + "options": "RESULT"
1389 + },
1390 + "properties": [
1391 + {
1392 + "id": "custom.width",
1393 + "value": 118
1394 + },
1395 + {
1396 + "id": "mappings",
1397 + "value": [
1398 + {
1399 + "options": {
1400 + "Failed": {
1401 + "color": "orange",
1402 + "index": 1
1403 + },
1404 + "Success": {
1405 + "color": "green",
1406 + "index": 0
1407 + }
1408 + },
1409 + "type": "value"
1410 + }
1411 + ]
1412 + },
1413 + {
1414 + "id": "custom.cellOptions",
1415 + "value": {
1416 + "type": "color-text"
1417 + }
1418 + }
1419 + ]
1420 + },
1421 + {
1422 + "matcher": {
1423 + "id": "byName",
1424 + "options": "SRC IP"
1425 + },
1426 + "properties": [
1427 + {
1428 + "id": "custom.width",
1429 + "value": 265
1430 + }
1431 + ]
1432 + },
1433 + {
1434 + "matcher": {
1435 + "id": "byName",
1436 + "options": "ACCOUNT"
1437 + },
1438 + "properties": [
1439 + {
1440 + "id": "custom.width",
1441 + "value": 227
1442 + }
1443 + ]
1444 + },
1445 + {
1446 + "matcher": {
1447 + "id": "byName",
1448 + "options": "EVENT TIME"
1449 + },
1450 + "properties": [
1451 + {
1452 + "id": "custom.width",
1453 + "value": 195
1454 + }
1455 + ]
1456 + },
1457 + {
1458 + "matcher": {
1459 + "id": "byName",
1460 + "options": "CLIENT IP"
1461 + },
1462 + "properties": [
1463 + {
1464 + "id": "custom.width",
1465 + "value": 191
1466 + }
1467 + ]
1468 + },
1469 + {
1470 + "matcher": {
1471 + "id": "byName",
1472 + "options": "DESCRIPTION"
1473 + },
1474 + "properties": [
1475 + {
1476 + "id": "custom.width",
1477 + "value": 367
1478 + }
1479 + ]
1480 + },
1481 + {
1482 + "matcher": {
1483 + "id": "byName",
1484 + "options": "FILE"
1485 + },
1486 + "properties": [
1487 + {
1488 + "id": "custom.width",
1489 + "value": 855
1490 + }
1491 + ]
1492 + },
1493 + {
1494 + "matcher": {
1495 + "id": "byName",
1496 + "options": "BROWSER"
1497 + },
1498 + "properties": [
1499 + {
1500 + "id": "custom.width",
1501 + "value": 205
1502 + }
1503 + ]
1504 + },
1505 + {
1506 + "matcher": {
1507 + "id": "byName",
1508 + "options": "RULE LEVEL"
1509 + },
1510 + "properties": [
1511 + {
1512 + "id": "custom.width",
1513 + "value": 197
1514 + }
1515 + ]
1516 + }
1517 + ]
1518 + },
1519 + "gridPos": {
1520 + "h": 16,
1521 + "w": 24,
1522 + "x": 0,
1523 + "y": 32
1524 + },
1525 + "id": 27,
1526 + "options": {
1527 + "cellHeight": "sm",
1528 + "footer": {
1529 + "countRows": false,
1530 + "enablePagination": true,
1531 + "fields": "",
1532 + "reducer": [
1533 + "sum"
1534 + ],
1535 + "show": false
1536 + },
1537 + "showHeader": true,
1538 + "sortBy": []
1539 + },
1540 + "pluginVersion": "10.0.3",
1541 + "targets": [
1542 + {
1543 + "bucketAggs": [],
1544 + "datasource": {
1545 + "type": "elasticsearch",
1546 + "uid": "replace_datasource_uid"
1547 + },
1548 + "metrics": [
1549 + {
1550 + "id": "1",
1551 + "settings": {
1552 + "size": "250"
1553 + },
1554 + "type": "raw_data"
1555 + }
1556 + ],
1557 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
1558 + "refId": "A",
1559 + "timeField": "timestamp"
1560 + }
1561 + ],
1562 + "title": "EVENTS",
1563 + "transformations": [
1564 + {
1565 + "id": "organize",
1566 + "options": {
1567 + "excludeByName": {
1568 + "@metadata_beat": true,
1569 + "@metadata_type": true,
1570 + "@metadata_version": true,
1571 + "IMPHASH": true,
1572 + "MD5": true,
1573 + "SHA1": true,
1574 + "SHA256": true,
1575 + "_id": false,
1576 + "_index": true,
1577 + "_type": true,
1578 + "agent_ephemeral_id": true,
1579 + "agent_hostname": true,
1580 + "agent_id": true,
1581 + "agent_ip_city_name": true,
1582 + "agent_ip_country_code": true,
1583 + "agent_ip_geolocation": true,
1584 + "agent_name": true,
1585 + "agent_type": true,
1586 + "agent_version": true,
1587 + "beats_type": true,
1588 + "cluster_name": true,
1589 + "cluster_node": true,
1590 + "collector_node_id": true,
1591 + "data_alert_action": true,
1592 + "data_alert_category": true,
1593 + "data_alert_gid": true,
1594 + "data_alert_rev": true,
1595 + "data_alert_severity": true,
1596 + "data_alert_signature": true,
1597 + "data_alert_signature_id": true,
1598 + "data_app_proto": true,
1599 + "data_audit_auid": true,
1600 + "data_audit_command": true,
1601 + "data_audit_euid": true,
1602 + "data_audit_exe": true,
1603 + "data_audit_gid": true,
1604 + "data_audit_id": true,
1605 + "data_audit_pid": true,
1606 + "data_audit_res": true,
1607 + "data_audit_session": true,
1608 + "data_audit_type": true,
1609 + "data_audit_uid": true,
1610 + "data_dest_ip": true,
1611 + "data_dest_port": true,
1612 + "data_dstuser": true,
1613 + "data_event_type": true,
1614 + "data_extra_data": true,
1615 + "data_file": true,
1616 + "data_flow_bytes_toclient": true,
1617 + "data_flow_bytes_toserver": true,
1618 + "data_flow_id": true,
1619 + "data_flow_pkts_toclient": true,
1620 + "data_flow_pkts_toserver": true,
1621 + "data_flow_start": true,
1622 + "data_http_http_content_type": true,
1623 + "data_http_http_port": true,
1624 + "data_http_length": true,
1625 + "data_http_status": true,
1626 + "data_http_url": true,
1627 + "data_id": true,
1628 + "data_in_iface": true,
1629 + "data_integration": true,
1630 + "data_metadata_flowbits": true,
1631 + "data_metadata_flowints_http_anomaly_count": true,
1632 + "data_metadata_flowints_tcp_retransmission_count": true,
1633 + "data_office365_AADGroupId": true,
1634 + "data_office365_ActivityId": true,
1635 + "data_office365_ActivityParameters": true,
1636 + "data_office365_Actor": true,
1637 + "data_office365_ActorContextId": true,
1638 + "data_office365_ActorIpAddress": false,
1639 + "data_office365_ActorIpAddress_city_name": true,
1640 + "data_office365_ActorIpAddress_country_code": true,
1641 + "data_office365_ActorIpAddress_geolocation": true,
1642 + "data_office365_AppAccessContext_AADSessionId": true,
1643 + "data_office365_AppAccessContext_APIId": true,
1644 + "data_office365_AppAccessContext_ClientAppId": true,
1645 + "data_office365_AppAccessContext_ClientAppName": true,
1646 + "data_office365_AppAccessContext_CorrelationId": true,
1647 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1648 + "data_office365_AppAccessContext_UniqueTokenId": true,
1649 + "data_office365_AppId": true,
1650 + "data_office365_ApplicationDisplayName": true,
1651 + "data_office365_ApplicationId": true,
1652 + "data_office365_ArtifactId": true,
1653 + "data_office365_ArtifactKind": true,
1654 + "data_office365_ArtifactsShared": true,
1655 + "data_office365_AssertingApplicationId": true,
1656 + "data_office365_Attendees": true,
1657 + "data_office365_AuthenticationType": true,
1658 + "data_office365_AzureActiveDirectoryEventType": true,
1659 + "data_office365_BrowserVersion": true,
1660 + "data_office365_BrowserVersion_city_name": true,
1661 + "data_office365_BrowserVersion_country_code": true,
1662 + "data_office365_BrowserVersion_geolocation": true,
1663 + "data_office365_CapacityId": true,
1664 + "data_office365_CapacityName": true,
1665 + "data_office365_ChannelGuid": true,
1666 + "data_office365_ChannelName": true,
1667 + "data_office365_ChatName": true,
1668 + "data_office365_ChatThreadId": true,
1669 + "data_office365_ClientAppId": true,
1670 + "data_office365_ClientIP": false,
1671 + "data_office365_ClientIPAddress": true,
1672 + "data_office365_ClientIPAddress_city_name": true,
1673 + "data_office365_ClientIPAddress_country_code": true,
1674 + "data_office365_ClientIPAddress_geolocation": true,
1675 + "data_office365_ClientIP_city_name": true,
1676 + "data_office365_ClientIP_country_code": true,
1677 + "data_office365_ClientIP_geolocation": true,
1678 + "data_office365_ClientIP_reserved_ip": true,
1679 + "data_office365_ClientInfoString": true,
1680 + "data_office365_ClientProcessName": true,
1681 + "data_office365_ClientRequestId": true,
1682 + "data_office365_ClientVersion": true,
1683 + "data_office365_CommunicationSubType": true,
1684 + "data_office365_CommunicationType": true,
1685 + "data_office365_ConsumptionMethod": true,
1686 + "data_office365_CorrelationId": true,
1687 + "data_office365_CreationTime": false,
1688 + "data_office365_CrossMailboxOperation": true,
1689 + "data_office365_CustomUniqueId": true,
1690 + "data_office365_CustomizedDoclib": true,
1691 + "data_office365_DashboardId": true,
1692 + "data_office365_DashboardName": true,
1693 + "data_office365_DatasetId": true,
1694 + "data_office365_DatasetName": true,
1695 + "data_office365_Datasets": true,
1696 + "data_office365_DestFolder_Id": true,
1697 + "data_office365_DestFolder_Path": true,
1698 + "data_office365_DestinationFileExtension": true,
1699 + "data_office365_DestinationFileName": true,
1700 + "data_office365_DestinationRelativeUrl": true,
1701 + "data_office365_DeviceDisplayName": true,
1702 + "data_office365_DeviceDisplayName_city_name": true,
1703 + "data_office365_DeviceDisplayName_country_code": true,
1704 + "data_office365_DeviceDisplayName_geolocation": true,
1705 + "data_office365_DeviceId": true,
1706 + "data_office365_DeviceInformation": true,
1707 + "data_office365_DeviceProperties": true,
1708 + "data_office365_DistributionMethod": true,
1709 + "data_office365_DoNotDistributeEvent": true,
1710 + "data_office365_EndTime": true,
1711 + "data_office365_ErrorNumber": true,
1712 + "data_office365_EventData": true,
1713 + "data_office365_EventSource": true,
1714 + "data_office365_ExchangeId": true,
1715 + "data_office365_ExtendedProperties": true,
1716 + "data_office365_ExternalAccess": true,
1717 + "data_office365_ExtraProperties": true,
1718 + "data_office365_FileSizeBytes": true,
1719 + "data_office365_FileSyncBytesCommitted": true,
1720 + "data_office365_Folder_Id": true,
1721 + "data_office365_Folder_Path": true,
1722 + "data_office365_FormId": true,
1723 + "data_office365_FormsUserType": true,
1724 + "data_office365_FromApp": true,
1725 + "data_office365_HighPriorityMediaProcessing": true,
1726 + "data_office365_HostedContents": true,
1727 + "data_office365_ICalUid": true,
1728 + "data_office365_Id": true,
1729 + "data_office365_ImplicitShare": true,
1730 + "data_office365_InterSystemsId": true,
1731 + "data_office365_InternalLogonType": true,
1732 + "data_office365_IntraSystemId": true,
1733 + "data_office365_IsManagedDevice": true,
1734 + "data_office365_IsSuccess": true,
1735 + "data_office365_ItemCount": true,
1736 + "data_office365_ItemName": true,
1737 + "data_office365_ItemType": true,
1738 + "data_office365_Item_Id": true,
1739 + "data_office365_Item_InternetMessageId": true,
1740 + "data_office365_Item_IsRecord": true,
1741 + "data_office365_Item_ParentFolder_Id": true,
1742 + "data_office365_Item_SizeInBytes": true,
1743 + "data_office365_JoinTime": true,
1744 + "data_office365_LeaveTime": true,
1745 + "data_office365_ListBaseTemplateType": true,
1746 + "data_office365_ListBaseType": true,
1747 + "data_office365_ListId": true,
1748 + "data_office365_ListItemUniqueId": true,
1749 + "data_office365_ListServerTemplate": true,
1750 + "data_office365_ListTitle": true,
1751 + "data_office365_LogonError": true,
1752 + "data_office365_LogonType": true,
1753 + "data_office365_LogonUserSid": true,
1754 + "data_office365_MachineId": true,
1755 + "data_office365_MailboxGuid": true,
1756 + "data_office365_MailboxOwnerSid": true,
1757 + "data_office365_MailboxOwnerUPN": true,
1758 + "data_office365_MeetingDetailId": true,
1759 + "data_office365_MeetingURL": true,
1760 + "data_office365_Members": true,
1761 + "data_office365_MessageId": true,
1762 + "data_office365_MessageSizeInBytes": true,
1763 + "data_office365_MessageURLs": true,
1764 + "data_office365_MessageVersion": true,
1765 + "data_office365_Modalities": true,
1766 + "data_office365_ModifiedProperties": true,
1767 + "data_office365_Name": true,
1768 + "data_office365_NewValue": true,
1769 + "data_office365_ObjectId": true,
1770 + "data_office365_Operation": true,
1771 + "data_office365_OperationScope": true,
1772 + "data_office365_OrganizationId": true,
1773 + "data_office365_OrganizationName": true,
1774 + "data_office365_Organizer_OrganizationId": true,
1775 + "data_office365_Organizer_RecipientType": true,
1776 + "data_office365_Organizer_Role": true,
1777 + "data_office365_Organizer_UserObjectId": true,
1778 + "data_office365_OriginatingServer": true,
1779 + "data_office365_Parameters": true,
1780 + "data_office365_ParentMessageId": true,
1781 + "data_office365_Platform": true,
1782 + "data_office365_ProviderTypes": true,
1783 + "data_office365_RecordType": true,
1784 + "data_office365_RefreshEnforcementPolicy": true,
1785 + "data_office365_ReportId": true,
1786 + "data_office365_ReportName": true,
1787 + "data_office365_ReportType": true,
1788 + "data_office365_RequestId": true,
1789 + "data_office365_ResultStatus": false,
1790 + "data_office365_SearchQueryText": true,
1791 + "data_office365_SessionId": true,
1792 + "data_office365_Site": true,
1793 + "data_office365_SiteUrl": true,
1794 + "data_office365_SkipForServiceWorker": true,
1795 + "data_office365_Source": true,
1796 + "data_office365_SourceFileExtension": true,
1797 + "data_office365_SourceRelativeUrl": true,
1798 + "data_office365_StartTime": true,
1799 + "data_office365_Subscription": true,
1800 + "data_office365_SubscriptionId": true,
1801 + "data_office365_Target": true,
1802 + "data_office365_TargetContextId": true,
1803 + "data_office365_TargetUserOrGroupName": true,
1804 + "data_office365_TargetUserOrGroupType": true,
1805 + "data_office365_TeamGuid": true,
1806 + "data_office365_TeamName": true,
1807 + "data_office365_UniqueSharingId": true,
1808 + "data_office365_UserAgent": false,
1809 + "data_office365_UserId": false,
1810 + "data_office365_UserKey": true,
1811 + "data_office365_UserType": true,
1812 + "data_office365_Version": true,
1813 + "data_office365_WebId": true,
1814 + "data_office365_WorkSpaceName": true,
1815 + "data_office365_Workload": true,
1816 + "data_office365_WorkspaceId": true,
1817 + "data_osquery_action": true,
1818 + "data_osquery_calendarTime": true,
1819 + "data_osquery_columns_address": true,
1820 + "data_osquery_columns_address_city_name": true,
1821 + "data_osquery_columns_address_country_code": true,
1822 + "data_osquery_columns_address_geolocation": true,
1823 + "data_osquery_columns_cmdline": true,
1824 + "data_osquery_columns_cwd": true,
1825 + "data_osquery_columns_description": true,
1826 + "data_osquery_columns_directory": true,
1827 + "data_osquery_columns_disk_bytes_read": true,
1828 + "data_osquery_columns_disk_bytes_written": true,
1829 + "data_osquery_columns_egid": true,
1830 + "data_osquery_columns_euid": true,
1831 + "data_osquery_columns_family": true,
1832 + "data_osquery_columns_fd": true,
1833 + "data_osquery_columns_gid": true,
1834 + "data_osquery_columns_gid_signed": true,
1835 + "data_osquery_columns_host": true,
1836 + "data_osquery_columns_interface": true,
1837 + "data_osquery_columns_local_address": true,
1838 + "data_osquery_columns_local_address_city_name": true,
1839 + "data_osquery_columns_local_address_country_code": true,
1840 + "data_osquery_columns_local_address_geolocation": true,
1841 + "data_osquery_columns_local_port": true,
1842 + "data_osquery_columns_mac": true,
1843 + "data_osquery_columns_name": true,
1844 + "data_osquery_columns_net_namespace": true,
1845 + "data_osquery_columns_nice": true,
1846 + "data_osquery_columns_on_disk": true,
1847 + "data_osquery_columns_parent": true,
1848 + "data_osquery_columns_path": true,
1849 + "data_osquery_columns_pgroup": true,
1850 + "data_osquery_columns_pid": true,
1851 + "data_osquery_columns_port": true,
1852 + "data_osquery_columns_protocol": true,
1853 + "data_osquery_columns_remote_address": true,
1854 + "data_osquery_columns_remote_address_city_name": true,
1855 + "data_osquery_columns_remote_address_country_code": true,
1856 + "data_osquery_columns_remote_address_geolocation": true,
1857 + "data_osquery_columns_remote_port": true,
1858 + "data_osquery_columns_resident_size": true,
1859 + "data_osquery_columns_root": true,
1860 + "data_osquery_columns_sgid": true,
1861 + "data_osquery_columns_shell": true,
1862 + "data_osquery_columns_socket": true,
1863 + "data_osquery_columns_start_time": true,
1864 + "data_osquery_columns_state": true,
1865 + "data_osquery_columns_suid": true,
1866 + "data_osquery_columns_system_time": true,
1867 + "data_osquery_columns_threads": true,
1868 + "data_osquery_columns_time_utc": true,
1869 + "data_osquery_columns_total_size": true,
1870 + "data_osquery_columns_tty": true,
1871 + "data_osquery_columns_type": true,
1872 + "data_osquery_columns_uid": true,
1873 + "data_osquery_columns_uid_signed": true,
1874 + "data_osquery_columns_user": true,
1875 + "data_osquery_columns_user_time": true,
1876 + "data_osquery_columns_username": true,
1877 + "data_osquery_columns_wired_size": true,
1878 + "data_osquery_counter": true,
1879 + "data_osquery_decorations_host_uuid": true,
1880 + "data_osquery_decorations_hostname": true,
1881 + "data_osquery_epoch": true,
1882 + "data_osquery_hostIdentifier": true,
1883 + "data_osquery_name": true,
1884 + "data_osquery_numerics": true,
1885 + "data_osquery_unixTime": true,
1886 + "data_proto": true,
1887 + "data_sca_check_command": true,
1888 + "data_sca_check_compliance_cis": true,
1889 + "data_sca_check_compliance_cis_csc": true,
1890 + "data_sca_check_compliance_gdpr_IV": true,
1891 + "data_sca_check_compliance_gpg_13": true,
1892 + "data_sca_check_compliance_hipaa": true,
1893 + "data_sca_check_compliance_nist_800_53": true,
1894 + "data_sca_check_compliance_pci_dss": true,
1895 + "data_sca_check_compliance_tsc": true,
1896 + "data_sca_check_description": true,
1897 + "data_sca_check_id": true,
1898 + "data_sca_check_previous_result": true,
1899 + "data_sca_check_rationale": true,
1900 + "data_sca_check_remediation": true,
1901 + "data_sca_check_result": true,
1902 + "data_sca_check_title": true,
1903 + "data_sca_description": true,
1904 + "data_sca_failed": true,
1905 + "data_sca_file": true,
1906 + "data_sca_invalid": true,
1907 + "data_sca_passed": true,
1908 + "data_sca_policy": true,
1909 + "data_sca_policy_id": true,
1910 + "data_sca_scan_id": true,
1911 + "data_sca_score": true,
1912 + "data_sca_total_checks": true,
1913 + "data_sca_type": true,
1914 + "data_script": true,
1915 + "data_src_ip": true,
1916 + "data_src_ip_city_name": true,
1917 + "data_src_ip_country_code": true,
1918 + "data_src_ip_geolocation": true,
1919 + "data_src_port": true,
1920 + "data_srcip": true,
1921 + "data_srcip_city_name": true,
1922 + "data_srcip_country_code": true,
1923 + "data_srcip_geolocation": true,
1924 + "data_srcuser": true,
1925 + "data_timestamp": true,
1926 + "data_title": true,
1927 + "data_tls_session_resumed": true,
1928 + "data_tls_version": true,
1929 + "data_tx_id": true,
1930 + "data_type": true,
1931 + "data_win_eventXML_binaryData": true,
1932 + "data_win_eventXML_binaryDataSize": true,
1933 + "data_win_eventXML_param1": true,
1934 + "data_win_eventdata_authenticationPackageName": true,
1935 + "data_win_eventdata_callTrace": true,
1936 + "data_win_eventdata_commandLine": true,
1937 + "data_win_eventdata_company": true,
1938 + "data_win_eventdata_creationUtcTime": true,
1939 + "data_win_eventdata_currentDirectory": true,
1940 + "data_win_eventdata_description": true,
1941 + "data_win_eventdata_destinationHostname": true,
1942 + "data_win_eventdata_destinationIp": true,
1943 + "data_win_eventdata_destinationIp_city_name": true,
1944 + "data_win_eventdata_destinationIp_country_code": true,
1945 + "data_win_eventdata_destinationIp_geolocation": true,
1946 + "data_win_eventdata_destinationIsIpv6": true,
1947 + "data_win_eventdata_destinationPort": true,
1948 + "data_win_eventdata_destinationPortName": true,
1949 + "data_win_eventdata_details": true,
1950 + "data_win_eventdata_elevatedToken": true,
1951 + "data_win_eventdata_eventType": true,
1952 + "data_win_eventdata_fileVersion": true,
1953 + "data_win_eventdata_fileVersion_city_name": true,
1954 + "data_win_eventdata_fileVersion_country_code": true,
1955 + "data_win_eventdata_fileVersion_geolocation": true,
1956 + "data_win_eventdata_grantedAccess": true,
1957 + "data_win_eventdata_hashes": true,
1958 + "data_win_eventdata_image": true,
1959 + "data_win_eventdata_imageLoaded": true,
1960 + "data_win_eventdata_impersonationLevel": true,
1961 + "data_win_eventdata_initiated": true,
1962 + "data_win_eventdata_integrityLevel": true,
1963 + "data_win_eventdata_ipAddress": true,
1964 + "data_win_eventdata_ipPort": true,
1965 + "data_win_eventdata_keyLength": true,
1966 + "data_win_eventdata_logonGuid": true,
1967 + "data_win_eventdata_logonId": true,
1968 + "data_win_eventdata_logonProcessName": true,
1969 + "data_win_eventdata_logonType": true,
1970 + "data_win_eventdata_originalFileName": true,
1971 + "data_win_eventdata_param1": true,
1972 + "data_win_eventdata_param2": true,
1973 + "data_win_eventdata_param3": true,
1974 + "data_win_eventdata_param4": true,
1975 + "data_win_eventdata_parentCommandLine": true,
1976 + "data_win_eventdata_parentImage": true,
1977 + "data_win_eventdata_parentProcessGuid": true,
1978 + "data_win_eventdata_parentProcessId": true,
1979 + "data_win_eventdata_processGuid": true,
1980 + "data_win_eventdata_processId": true,
1981 + "data_win_eventdata_processName": true,
1982 + "data_win_eventdata_product": true,
1983 + "data_win_eventdata_protocol": true,
1984 + "data_win_eventdata_queryName": true,
1985 + "data_win_eventdata_queryResults": true,
1986 + "data_win_eventdata_queryStatus": true,
1987 + "data_win_eventdata_ruleName": true,
1988 + "data_win_eventdata_serviceName": true,
1989 + "data_win_eventdata_serviceSid": true,
1990 + "data_win_eventdata_signature": true,
1991 + "data_win_eventdata_signatureStatus": true,
1992 + "data_win_eventdata_signed": true,
1993 + "data_win_eventdata_sourceHostname": true,
1994 + "data_win_eventdata_sourceImage": true,
1995 + "data_win_eventdata_sourceIp": true,
1996 + "data_win_eventdata_sourceIp_city_name": true,
1997 + "data_win_eventdata_sourceIp_country_code": true,
1998 + "data_win_eventdata_sourceIp_geolocation": true,
1999 + "data_win_eventdata_sourceIsIpv6": true,
2000 + "data_win_eventdata_sourcePort": true,
2001 + "data_win_eventdata_sourceProcessGUID": true,
2002 + "data_win_eventdata_sourceProcessId": true,
2003 + "data_win_eventdata_sourceThreadId": true,
2004 + "data_win_eventdata_status": true,
2005 + "data_win_eventdata_subjectDomainName": true,
2006 + "data_win_eventdata_subjectLogonId": true,
2007 + "data_win_eventdata_subjectUserName": true,
2008 + "data_win_eventdata_subjectUserSid": true,
2009 + "data_win_eventdata_targetDomainName": true,
2010 + "data_win_eventdata_targetFilename": true,
2011 + "data_win_eventdata_targetImage": true,
2012 + "data_win_eventdata_targetLinkedLogonId": true,
2013 + "data_win_eventdata_targetLogonId": true,
2014 + "data_win_eventdata_targetObject": true,
2015 + "data_win_eventdata_targetProcessGUID": true,
2016 + "data_win_eventdata_targetProcessId": true,
2017 + "data_win_eventdata_targetUserName": true,
2018 + "data_win_eventdata_targetUserSid": true,
2019 + "data_win_eventdata_terminalSessionId": true,
2020 + "data_win_eventdata_ticketEncryptionType": true,
2021 + "data_win_eventdata_ticketOptions": true,
2022 + "data_win_eventdata_user": true,
2023 + "data_win_eventdata_utcTime": true,
2024 + "data_win_eventdata_virtualAccount": true,
2025 + "data_win_system_channel": true,
2026 + "data_win_system_computer": true,
2027 + "data_win_system_eventID": true,
2028 + "data_win_system_eventRecordID": true,
2029 + "data_win_system_eventSourceName": true,
2030 + "data_win_system_keywords": true,
2031 + "data_win_system_level": true,
2032 + "data_win_system_message": true,
2033 + "data_win_system_opcode": true,
2034 + "data_win_system_processID": true,
2035 + "data_win_system_providerGuid": true,
2036 + "data_win_system_providerName": true,
2037 + "data_win_system_severityValue": true,
2038 + "data_win_system_systemTime": true,
2039 + "data_win_system_task": true,
2040 + "data_win_system_threadID": true,
2041 + "data_win_system_version": true,
2042 + "decoder_name": true,
2043 + "decoder_parent": true,
2044 + "dns_query": true,
2045 + "dns_query_threat_indicated": true,
2046 + "dst_ip": true,
2047 + "dst_ip_city_name": true,
2048 + "dst_ip_country_code": true,
2049 + "dst_ip_geolocation": true,
2050 + "dst_ip_threat_indicated": true,
2051 + "dst_port": true,
2052 + "ecs_version": true,
2053 + "error": true,
2054 + "event_hash": true,
2055 + "file_path": true,
2056 + "firewall_rule_name": true,
2057 + "full_log": false,
2058 + "gl2_accounted_message_size": true,
2059 + "gl2_message_id": true,
2060 + "gl2_processing_error": true,
2061 + "gl2_remote_ip": true,
2062 + "gl2_remote_port": true,
2063 + "gl2_source_collector": true,
2064 + "gl2_source_input": true,
2065 + "gl2_source_node": true,
2066 + "hash_md5": true,
2067 + "hash_sha1": true,
2068 + "hash_sha256": true,
2069 + "highlight": true,
2070 + "host_architecture": true,
2071 + "host_containerized": true,
2072 + "host_hostname": true,
2073 + "host_id": true,
2074 + "host_ip": true,
2075 + "host_mac": true,
2076 + "host_name": true,
2077 + "host_os_codename": true,
2078 + "host_os_kernel": true,
2079 + "host_os_name": true,
2080 + "host_os_platform": true,
2081 + "host_os_version": true,
2082 + "hostname": true,
2083 + "id": true,
2084 + "input_type": true,
2085 + "level": true,
2086 + "location": true,
2087 + "log_file_path": true,
2088 + "log_offset": true,
2089 + "manager_name": true,
2090 + "message": true,
2091 + "module": true,
2092 + "msg_timestamp": true,
2093 + "parent_process_cmd_line": true,
2094 + "parent_process_id": true,
2095 + "parent_process_image": true,
2096 + "pid": true,
2097 + "predecoder_hostname": true,
2098 + "predecoder_program_name": true,
2099 + "predecoder_timestamp": true,
2100 + "previous_log": true,
2101 + "previous_output": true,
2102 + "process_cmd_line": true,
2103 + "process_id": true,
2104 + "process_image": true,
2105 + "process_name": true,
2106 + "protocol": true,
2107 + "rule_cis": true,
2108 + "rule_cis_csc": true,
2109 + "rule_firedtimes": true,
2110 + "rule_gdpr": true,
2111 + "rule_gdpr_IV": true,
2112 + "rule_gpg13": true,
2113 + "rule_gpg_13": true,
2114 + "rule_group1": true,
2115 + "rule_group2": true,
2116 + "rule_group3": true,
2117 + "rule_groups": true,
2118 + "rule_hipaa": true,
2119 + "rule_id": true,
2120 + "rule_info": true,
2121 + "rule_mail": true,
2122 + "rule_mitre_id": true,
2123 + "rule_mitre_tactic": false,
2124 + "rule_nist_800_53": true,
2125 + "rule_pci_dss": true,
2126 + "rule_tsc": true,
2127 + "scanid": true,
2128 + "service": true,
2129 + "software_package": true,
2130 + "software_vendor": true,
2131 + "sort": true,
2132 + "source": true,
2133 + "source_reserved_ip": true,
2134 + "src_ip": true,
2135 + "src_ip_city_name": true,
2136 + "src_ip_country_code": true,
2137 + "src_ip_geolocation": true,
2138 + "src_port": true,
2139 + "streams": true,
2140 + "syscheck_attrs_after": true,
2141 + "syscheck_audit_effective_user_id": true,
2142 + "syscheck_audit_effective_user_name": true,
2143 + "syscheck_audit_group_id": true,
2144 + "syscheck_audit_group_name": true,
2145 + "syscheck_audit_login_user_id": true,
2146 + "syscheck_audit_login_user_name": true,
2147 + "syscheck_audit_process_cwd": true,
2148 + "syscheck_audit_process_id": true,
2149 + "syscheck_audit_process_name": true,
2150 + "syscheck_audit_process_parent_cwd": true,
2151 + "syscheck_audit_process_parent_name": true,
2152 + "syscheck_audit_process_ppid": true,
2153 + "syscheck_audit_user_id": true,
2154 + "syscheck_audit_user_name": true,
2155 + "syscheck_changed_attributes": true,
2156 + "syscheck_event": true,
2157 + "syscheck_gid_after": true,
2158 + "syscheck_gname_after": true,
2159 + "syscheck_hard_links": true,
2160 + "syscheck_inode_after": true,
2161 + "syscheck_inode_before": true,
2162 + "syscheck_md5_after": true,
2163 + "syscheck_md5_before": true,
2164 + "syscheck_mode": true,
2165 + "syscheck_mtime_after": true,
2166 + "syscheck_mtime_before": true,
2167 + "syscheck_path": true,
2168 + "syscheck_perm_after": true,
2169 + "syscheck_perm_before": true,
2170 + "syscheck_sha1_after": true,
2171 + "syscheck_sha1_before": true,
2172 + "syscheck_sha256_after": true,
2173 + "syscheck_sha256_before": true,
2174 + "syscheck_size_after": true,
2175 + "syscheck_size_before": true,
2176 + "syscheck_uid_after": true,
2177 + "syscheck_uname_after": true,
2178 + "syscheck_win_perm_after": true,
2179 + "syscheck_win_perm_after_0_allowed": true,
2180 + "syscheck_win_perm_after_0_name": true,
2181 + "syscheck_win_perm_after_1_allowed": true,
2182 + "syscheck_win_perm_after_1_name": true,
2183 + "syscheck_win_perm_after_2_allowed": true,
2184 + "syscheck_win_perm_after_2_name": true,
2185 + "syscheck_win_perm_after_3_allowed": true,
2186 + "syscheck_win_perm_after_3_name": true,
2187 + "syslog_customer": true,
2188 + "syslog_level": true,
2189 + "syslog_tag": true,
2190 + "syslog_type": true,
2191 + "sysmon_event_description": true,
2192 + "threat_ids": true,
2193 + "threat_indicated": true,
2194 + "threat_names": true,
2195 + "time": true,
2196 + "timestamp": true,
2197 + "true": true,
2198 + "user_name": true,
2199 + "win_registry_key": true,
2200 + "win_system_eventID": true,
2201 + "windows_auth_package": true,
2202 + "windows_domain": true,
2203 + "windows_event_id": true,
2204 + "windows_event_severity": true,
2205 + "windows_logon_type": true
2206 + },
2207 + "indexByName": {
2208 + "_id": 2,
2209 + "_index": 10,
2210 + "_type": 11,
2211 + "agent_id": 12,
2212 + "agent_name": 6,
2213 + "cluster_name": 13,
2214 + "cluster_node": 14,
2215 + "data_integration": 49,
2216 + "data_office365_Activity": 50,
2217 + "data_office365_ActivityId": 51,
2218 + "data_office365_ArtifactId": 52,
2219 + "data_office365_ArtifactKind": 53,
2220 + "data_office365_ArtifactName": 54,
2221 + "data_office365_CapacityId": 55,
2222 + "data_office365_CapacityName": 56,
2223 + "data_office365_ClientIP": 5,
2224 + "data_office365_ClientIP_city_name": 15,
2225 + "data_office365_ClientIP_country_code": 16,
2226 + "data_office365_ClientIP_geolocation": 17,
2227 + "data_office365_ConsumptionMethod": 57,
2228 + "data_office365_CreationTime": 0,
2229 + "data_office365_DashboardId": 58,
2230 + "data_office365_DashboardName": 59,
2231 + "data_office365_DatasetId": 60,
2232 + "data_office365_DatasetName": 61,
2233 + "data_office365_Datasets": 62,
2234 + "data_office365_DistributionMethod": 63,
2235 + "data_office365_Id": 18,
2236 + "data_office365_IsSuccess": 64,
2237 + "data_office365_ItemName": 48,
2238 + "data_office365_ObjectId": 19,
2239 + "data_office365_Operation": 24,
2240 + "data_office365_OrganizationId": 20,
2241 + "data_office365_RecordType": 21,
2242 + "data_office365_RefreshEnforcementPolicy": 65,
2243 + "data_office365_ReportId": 66,
2244 + "data_office365_ReportName": 67,
2245 + "data_office365_ReportType": 68,
2246 + "data_office365_RequestId": 69,
2247 + "data_office365_Subscription": 70,
2248 + "data_office365_UserAgent": 4,
2249 + "data_office365_UserId": 3,
2250 + "data_office365_UserKey": 22,
2251 + "data_office365_UserType": 23,
2252 + "data_office365_WorkSpaceName": 71,
2253 + "data_office365_Workload": 47,
2254 + "data_office365_WorkspaceId": 72,
2255 + "decoder_name": 25,
2256 + "gl2_accounted_message_size": 26,
2257 + "gl2_message_id": 27,
2258 + "gl2_processing_error": 28,
2259 + "gl2_remote_ip": 29,
2260 + "gl2_remote_port": 30,
2261 + "gl2_source_input": 31,
2262 + "gl2_source_node": 32,
2263 + "highlight": 33,
2264 + "id": 34,
2265 + "location": 35,
2266 + "manager_name": 36,
2267 + "message": 37,
2268 + "msg_timestamp": 73,
2269 + "rule_description": 7,
2270 + "rule_firedtimes": 38,
2271 + "rule_group1": 39,
2272 + "rule_group2": 74,
2273 + "rule_groups": 40,
2274 + "rule_hipaa": 75,
2275 + "rule_id": 9,
2276 + "rule_level": 8,
2277 + "rule_mail": 41,
2278 + "rule_pci_dss": 76,
2279 + "sort": 42,
2280 + "source": 43,
2281 + "source_reserved_ip": 77,
2282 + "streams": 44,
2283 + "syslog_type": 45,
2284 + "timestamp": 1,
2285 + "true": 46
2286 + },
2287 + "renameByName": {
2288 + "_id": "EVENT ID",
2289 + "agent_name": "",
2290 + "data_office365_Activity": "ACTIVITY",
2291 + "data_office365_ActorIpAddress": "SRC IP",
2292 + "data_office365_AffectedItems": "ITEMS",
2293 + "data_office365_ArtifactName": "ARTIFACT",
2294 + "data_office365_BrowserName": "BROWSER",
2295 + "data_office365_ClientIP": "CLIENT IP",
2296 + "data_office365_ClientIP_city_name": "",
2297 + "data_office365_CreationTime": "EVENT TIME",
2298 + "data_office365_FormName": "FORM",
2299 + "data_office365_Item_Attachments": "ATTACHMENT",
2300 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2301 + "data_office365_Item_Subject": "SUBJECT",
2302 + "data_office365_ResultStatus": "RESULT",
2303 + "data_office365_SourceApp": "SRC APP",
2304 + "data_office365_SourceFileName": "FILE",
2305 + "data_office365_UserAgent": "USER AGENT",
2306 + "data_office365_UserId": "ACCOUNT",
2307 + "rule_description": "DESCRIPTION",
2308 + "rule_id": "RULE ID",
2309 + "rule_level": "",
2310 + "rule_mitre_tactic": "MITRE TACTIC",
2311 + "rule_mitre_technique": "MITRE TECHNIQUE",
2312 + "timestamp": "Date/Time"
2313 + }
2314 + }
2315 + }
2316 + ],
2317 + "transparent": true,
2318 + "type": "table"
2319 + }
2320 + ],
2321 + "refresh": "",
2322 + "schemaVersion": 38,
2323 + "style": "dark",
2324 + "tags": [
2325 + "O365"
2326 + ],
2327 + "templating": {
2328 + "list": [
2329 + {
2330 + "datasource": {
2331 + "type": "elasticsearch",
2332 + "uid": "replace_datasource_uid"
2333 + },
2334 + "filters": [],
2335 + "hide": 0,
2336 + "label": "",
2337 + "name": "Filters",
2338 + "skipUrlSync": false,
2339 + "type": "adhoc"
2340 + },
2341 + {
2342 + "current": {
2343 + "selected": false,
2344 + "text": "All",
2345 + "value": "$__all"
2346 + },
2347 + "datasource": {
2348 + "type": "elasticsearch",
2349 + "uid": "replace_datasource_uid"
2350 + },
2351 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:PowerBI\"}",
2352 + "hide": 0,
2353 + "includeAll": true,
2354 + "label": "Operation",
2355 + "multi": false,
2356 + "name": "operation",
2357 + "options": [],
2358 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:PowerBI\"}",
2359 + "refresh": 2,
2360 + "regex": "",
2361 + "skipUrlSync": false,
2362 + "sort": 1,
2363 + "tagValuesQuery": "",
2364 + "tagsQuery": "",
2365 + "type": "query",
2366 + "useTags": false
2367 + },
2368 + {
2369 + "current": {
2370 + "selected": false,
2371 + "text": "All",
2372 + "value": "$__all"
2373 + },
2374 + "datasource": {
2375 + "type": "elasticsearch",
2376 + "uid": "replace_datasource_uid"
2377 + },
2378 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:PowerBI\"}",
2379 + "hide": 0,
2380 + "includeAll": true,
2381 + "label": "Rule Level",
2382 + "multi": false,
2383 + "name": "rule_level",
2384 + "options": [],
2385 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:PowerBI\"}",
2386 + "refresh": 2,
2387 + "regex": "",
2388 + "skipUrlSync": false,
2389 + "sort": 0,
2390 + "type": "query"
2391 + }
2392 + ]
2393 + },
2394 + "time": {
2395 + "from": "now-6h",
2396 + "to": "now"
2397 + },
2398 + "timepicker": {
2399 + "refresh_intervals": [
2400 + "5s",
2401 + "10s",
2402 + "30s",
2403 + "1m",
2404 + "5m",
2405 + "15m",
2406 + "30m",
2407 + "1h",
2408 + "2h",
2409 + "1d"
2410 + ],
2411 + "time_options": [
2412 + "5m",
2413 + "15m",
2414 + "1h",
2415 + "6h",
2416 + "12h",
2417 + "24h",
2418 + "2d",
2419 + "7d",
2420 + "30d"
2421 + ]
2422 + },
2423 + "timezone": "",
2424 + "title": "O365 - MICROSOFT PowerBI",
2425 + "weekStart": ""
2426 +}
backend/app/connectors/grafana/dashboards/Office365/sharepoint.json new
+2413
@@ -0,0 +1,2413 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "10.0.3",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:SharePoint",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "cellOptions": {
261 + "type": "auto"
262 + },
263 + "inspect": false
264 + },
265 + "mappings": [],
266 + "thresholds": {
267 + "mode": "absolute",
268 + "steps": [
269 + {
270 + "color": "red",
271 + "value": null
272 + }
273 + ]
274 + }
275 + },
276 + "overrides": [
277 + {
278 + "matcher": {
279 + "id": "byName",
280 + "options": "Count"
281 + },
282 + "properties": [
283 + {
284 + "id": "displayName",
285 + "value": "EVENTS"
286 + },
287 + {
288 + "id": "unit",
289 + "value": "short"
290 + },
291 + {
292 + "id": "decimals",
293 + "value": -1
294 + },
295 + {
296 + "id": "custom.align"
297 + },
298 + {
299 + "id": "thresholds",
300 + "value": {
301 + "mode": "absolute",
302 + "steps": [
303 + {
304 + "color": "red",
305 + "value": null
306 + }
307 + ]
308 + }
309 + }
310 + ]
311 + }
312 + ]
313 + },
314 + "gridPos": {
315 + "h": 7,
316 + "w": 6,
317 + "x": 8,
318 + "y": 0
319 + },
320 + "id": 54,
321 + "options": {
322 + "cellHeight": "sm",
323 + "footer": {
324 + "countRows": false,
325 + "fields": "",
326 + "reducer": [
327 + "sum"
328 + ],
329 + "show": false
330 + },
331 + "showHeader": true
332 + },
333 + "pluginVersion": "10.0.3",
334 + "targets": [
335 + {
336 + "bucketAggs": [
337 + {
338 + "fake": true,
339 + "field": "data_office365_Operation",
340 + "id": "4",
341 + "settings": {
342 + "min_doc_count": 1,
343 + "order": "desc",
344 + "orderBy": "_count",
345 + "size": "0"
346 + },
347 + "type": "terms"
348 + }
349 + ],
350 + "datasource": {
351 + "type": "elasticsearch",
352 + "uid": "replace_datasource_uid"
353 + },
354 + "metrics": [
355 + {
356 + "field": "select field",
357 + "id": "1",
358 + "type": "count"
359 + }
360 + ],
361 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
362 + "refId": "A",
363 + "timeField": "timestamp"
364 + }
365 + ],
366 + "title": "EVENTS BY OPERATION",
367 + "transformations": [
368 + {
369 + "id": "merge",
370 + "options": {
371 + "reducers": []
372 + }
373 + },
374 + {
375 + "id": "organize",
376 + "options": {
377 + "excludeByName": {},
378 + "indexByName": {},
379 + "renameByName": {
380 + "Count": "EVENTS",
381 + "data_office365_Operation": "OPERATION"
382 + }
383 + }
384 + }
385 + ],
386 + "type": "table"
387 + },
388 + {
389 + "datasource": {
390 + "type": "elasticsearch",
391 + "uid": "replace_datasource_uid"
392 + },
393 + "fieldConfig": {
394 + "defaults": {
395 + "color": {
396 + "mode": "thresholds"
397 + },
398 + "custom": {
399 + "align": "auto",
400 + "cellOptions": {
401 + "type": "auto"
402 + },
403 + "inspect": false
404 + },
405 + "mappings": [],
406 + "thresholds": {
407 + "mode": "absolute",
408 + "steps": [
409 + {
410 + "color": "red",
411 + "value": null
412 + }
413 + ]
414 + }
415 + },
416 + "overrides": [
417 + {
418 + "matcher": {
419 + "id": "byName",
420 + "options": "Count"
421 + },
422 + "properties": [
423 + {
424 + "id": "displayName",
425 + "value": "EVENTS"
426 + },
427 + {
428 + "id": "unit",
429 + "value": "short"
430 + },
431 + {
432 + "id": "decimals",
433 + "value": -1
434 + },
435 + {
436 + "id": "custom.align"
437 + },
438 + {
439 + "id": "thresholds",
440 + "value": {
441 + "mode": "absolute",
442 + "steps": [
443 + {
444 + "color": "red",
445 + "value": null
446 + }
447 + ]
448 + }
449 + }
450 + ]
451 + }
452 + ]
453 + },
454 + "gridPos": {
455 + "h": 7,
456 + "w": 6,
457 + "x": 14,
458 + "y": 0
459 + },
460 + "id": 62,
461 + "options": {
462 + "cellHeight": "sm",
463 + "footer": {
464 + "countRows": false,
465 + "fields": "",
466 + "reducer": [
467 + "sum"
468 + ],
469 + "show": false
470 + },
471 + "showHeader": true
472 + },
473 + "pluginVersion": "10.0.3",
474 + "targets": [
475 + {
476 + "bucketAggs": [
477 + {
478 + "fake": true,
479 + "field": "data_office365_UserAgent",
480 + "id": "4",
481 + "settings": {
482 + "min_doc_count": 1,
483 + "order": "desc",
484 + "orderBy": "_count",
485 + "size": "0"
486 + },
487 + "type": "terms"
488 + }
489 + ],
490 + "datasource": {
491 + "type": "elasticsearch",
492 + "uid": "replace_datasource_uid"
493 + },
494 + "metrics": [
495 + {
496 + "field": "select field",
497 + "id": "1",
498 + "type": "count"
499 + }
500 + ],
501 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
502 + "refId": "A",
503 + "timeField": "timestamp"
504 + }
505 + ],
506 + "title": "EVENTS BY USER AGENT",
507 + "transformations": [
508 + {
509 + "id": "merge",
510 + "options": {
511 + "reducers": []
512 + }
513 + },
514 + {
515 + "id": "organize",
516 + "options": {
517 + "excludeByName": {},
518 + "indexByName": {},
519 + "renameByName": {
520 + "Count": "EVENTS",
521 + "data_office365_Operation": "OPERATION",
522 + "data_office365_UserAgent": "USER AGENT"
523 + }
524 + }
525 + }
526 + ],
527 + "type": "table"
528 + },
529 + {
530 + "datasource": {
531 + "type": "elasticsearch",
532 + "uid": "replace_datasource_uid"
533 + },
534 + "fieldConfig": {
535 + "defaults": {
536 + "color": {
537 + "mode": "thresholds"
538 + },
539 + "mappings": [
540 + {
541 + "options": {
542 + "match": "null",
543 + "result": {
544 + "text": "N/A"
545 + }
546 + },
547 + "type": "special"
548 + }
549 + ],
550 + "max": 15,
551 + "min": 0,
552 + "thresholds": {
553 + "mode": "absolute",
554 + "steps": [
555 + {
556 + "color": "#299c46",
557 + "value": null
558 + },
559 + {
560 + "color": "rgba(237, 129, 40, 0.89)",
561 + "value": 8
562 + },
563 + {
564 + "color": "#d44a3a",
565 + "value": 12
566 + }
567 + ]
568 + },
569 + "unit": "none"
570 + },
571 + "overrides": []
572 + },
573 + "gridPos": {
574 + "h": 7,
575 + "w": 4,
576 + "x": 0,
577 + "y": 7
578 + },
579 + "id": 16,
580 + "links": [],
581 + "options": {
582 + "orientation": "horizontal",
583 + "reduceOptions": {
584 + "calcs": [
585 + "max"
586 + ],
587 + "fields": "",
588 + "values": false
589 + },
590 + "showThresholdLabels": false,
591 + "showThresholdMarkers": true,
592 + "text": {}
593 + },
594 + "pluginVersion": "10.0.3",
595 + "targets": [
596 + {
597 + "bucketAggs": [
598 + {
599 + "field": "timestamp",
600 + "id": "2",
601 + "settings": {
602 + "interval": "auto",
603 + "min_doc_count": 0,
604 + "trimEdges": 0
605 + },
606 + "type": "date_histogram"
607 + }
608 + ],
609 + "datasource": {
610 + "type": "elasticsearch",
611 + "uid": "replace_datasource_uid"
612 + },
613 + "metrics": [
614 + {
615 + "field": "rule_level",
616 + "id": "1",
617 + "meta": {},
618 + "settings": {},
619 + "type": "max"
620 + }
621 + ],
622 + "query": "data_office365_Operation:$operation AND data_office365_Workload:SharePoint",
623 + "refId": "A",
624 + "timeField": "timestamp"
625 + }
626 + ],
627 + "title": "MAX SEVERITY (0 - 15)",
628 + "type": "gauge"
629 + },
630 + {
631 + "datasource": {
632 + "type": "elasticsearch",
633 + "uid": "replace_datasource_uid"
634 + },
635 + "fieldConfig": {
636 + "defaults": {
637 + "color": {
638 + "mode": "palette-classic"
639 + },
640 + "custom": {
641 + "axisCenteredZero": false,
642 + "axisColorMode": "text",
643 + "axisLabel": "",
644 + "axisPlacement": "auto",
645 + "barAlignment": 0,
646 + "drawStyle": "bars",
647 + "fillOpacity": 0,
648 + "gradientMode": "none",
649 + "hideFrom": {
650 + "legend": false,
651 + "tooltip": false,
652 + "viz": false
653 + },
654 + "lineInterpolation": "linear",
655 + "lineWidth": 1,
656 + "pointSize": 5,
657 + "scaleDistribution": {
658 + "type": "linear"
659 + },
660 + "showPoints": "auto",
661 + "spanNulls": false,
662 + "stacking": {
663 + "group": "A",
664 + "mode": "normal"
665 + },
666 + "thresholdsStyle": {
667 + "mode": "off"
668 + }
669 + },
670 + "mappings": [],
671 + "thresholds": {
672 + "mode": "absolute",
673 + "steps": [
674 + {
675 + "color": "green",
676 + "value": null
677 + },
678 + {
679 + "color": "red",
680 + "value": 80
681 + }
682 + ]
683 + }
684 + },
685 + "overrides": []
686 + },
687 + "gridPos": {
688 + "h": 13,
689 + "w": 20,
690 + "x": 4,
691 + "y": 7
692 + },
693 + "id": 60,
694 + "options": {
695 + "legend": {
696 + "calcs": [],
697 + "displayMode": "table",
698 + "placement": "right",
699 + "showLegend": true
700 + },
701 + "tooltip": {
702 + "mode": "single",
703 + "sort": "none"
704 + }
705 + },
706 + "targets": [
707 + {
708 + "alias": "",
709 + "bucketAggs": [
710 + {
711 + "field": "data_office365_Operation",
712 + "id": "3",
713 + "settings": {
714 + "min_doc_count": "1",
715 + "order": "desc",
716 + "orderBy": "_count",
717 + "size": "10"
718 + },
719 + "type": "terms"
720 + },
721 + {
722 + "field": "timestamp",
723 + "id": "2",
724 + "settings": {
725 + "interval": "auto"
726 + },
727 + "type": "date_histogram"
728 + }
729 + ],
730 + "datasource": {
731 + "type": "elasticsearch",
732 + "uid": "replace_datasource_uid"
733 + },
734 + "metrics": [
735 + {
736 + "id": "1",
737 + "type": "count"
738 + }
739 + ],
740 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
741 + "refId": "A",
742 + "timeField": "timestamp"
743 + }
744 + ],
745 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
746 + "transparent": true,
747 + "type": "timeseries"
748 + },
749 + {
750 + "datasource": {
751 + "type": "elasticsearch",
752 + "uid": "replace_datasource_uid"
753 + },
754 + "fieldConfig": {
755 + "defaults": {
756 + "mappings": [
757 + {
758 + "options": {
759 + "match": "null",
760 + "result": {
761 + "text": "N/A"
762 + }
763 + },
764 + "type": "special"
765 + }
766 + ],
767 + "thresholds": {
768 + "mode": "absolute",
769 + "steps": [
770 + {
771 + "color": "blue",
772 + "value": null
773 + }
774 + ]
775 + },
776 + "unit": "locale"
777 + },
778 + "overrides": []
779 + },
780 + "gridPos": {
781 + "h": 6,
782 + "w": 4,
783 + "x": 0,
784 + "y": 14
785 + },
786 + "id": 51,
787 + "links": [],
788 + "options": {
789 + "colorMode": "value",
790 + "graphMode": "area",
791 + "justifyMode": "auto",
792 + "orientation": "horizontal",
793 + "reduceOptions": {
794 + "calcs": [
795 + "sum"
796 + ],
797 + "fields": "",
798 + "values": false
799 + },
800 + "text": {},
801 + "textMode": "auto"
802 + },
803 + "pluginVersion": "10.0.3",
804 + "targets": [
805 + {
806 + "bucketAggs": [
807 + {
808 + "$$hashKey": "object:331",
809 + "field": "timestamp",
810 + "id": "2",
811 + "settings": {
812 + "interval": "auto",
813 + "min_doc_count": 0,
814 + "trimEdges": 0
815 + },
816 + "type": "date_histogram"
817 + }
818 + ],
819 + "datasource": {
820 + "type": "elasticsearch",
821 + "uid": "replace_datasource_uid"
822 + },
823 + "metrics": [
824 + {
825 + "$$hashKey": "object:329",
826 + "field": "select field",
827 + "id": "1",
828 + "type": "count"
829 + }
830 + ],
831 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
832 + "refId": "A",
833 + "timeField": "timestamp"
834 + }
835 + ],
836 + "title": "EVENTS (Total)",
837 + "type": "stat"
838 + },
839 + {
840 + "datasource": {
841 + "type": "elasticsearch",
842 + "uid": "replace_datasource_uid"
843 + },
844 + "fieldConfig": {
845 + "defaults": {
846 + "color": {
847 + "mode": "thresholds"
848 + },
849 + "custom": {
850 + "align": "auto",
851 + "cellOptions": {
852 + "type": "auto"
853 + },
854 + "inspect": false
855 + },
856 + "mappings": [],
857 + "thresholds": {
858 + "mode": "absolute",
859 + "steps": [
860 + {
861 + "color": "orange",
862 + "value": null
863 + }
864 + ]
865 + }
866 + },
867 + "overrides": [
868 + {
869 + "matcher": {
870 + "id": "byName",
871 + "options": "Count"
872 + },
873 + "properties": [
874 + {
875 + "id": "displayName",
876 + "value": "EVENTS"
877 + },
878 + {
879 + "id": "unit",
880 + "value": "short"
881 + },
882 + {
883 + "id": "decimals",
884 + "value": -1
885 + },
886 + {
887 + "id": "custom.align"
888 + }
889 + ]
890 + },
891 + {
892 + "matcher": {
893 + "id": "byName",
894 + "options": "AD ACCOUNT"
895 + },
896 + "properties": [
897 + {
898 + "id": "custom.width",
899 + "value": 377
900 + }
901 + ]
902 + }
903 + ]
904 + },
905 + "gridPos": {
906 + "h": 12,
907 + "w": 8,
908 + "x": 0,
909 + "y": 20
910 + },
911 + "id": 61,
912 + "options": {
913 + "cellHeight": "sm",
914 + "footer": {
915 + "countRows": false,
916 + "fields": "",
917 + "reducer": [
918 + "sum"
919 + ],
920 + "show": false
921 + },
922 + "showHeader": true,
923 + "sortBy": []
924 + },
925 + "pluginVersion": "10.0.3",
926 + "targets": [
927 + {
928 + "bucketAggs": [
929 + {
930 + "fake": true,
931 + "field": "data_office365_AuthenticationType",
932 + "id": "4",
933 + "settings": {
934 + "min_doc_count": 1,
935 + "order": "desc",
936 + "orderBy": "_count",
937 + "size": "0"
938 + },
939 + "type": "terms"
940 + },
941 + {
942 + "field": "data_office365_ClientIP_country_code",
943 + "id": "5",
944 + "settings": {
945 + "min_doc_count": "1",
946 + "order": "desc",
947 + "orderBy": "_term",
948 + "size": "10"
949 + },
950 + "type": "terms"
951 + }
952 + ],
953 + "datasource": {
954 + "type": "elasticsearch",
955 + "uid": "replace_datasource_uid"
956 + },
957 + "metrics": [
958 + {
959 + "field": "select field",
960 + "id": "1",
961 + "type": "count"
962 + }
963 + ],
964 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
965 + "refId": "A",
966 + "timeField": "timestamp"
967 + }
968 + ],
969 + "title": "SHAREPOINT EVENTS BY AUTH TYPE",
970 + "transformations": [
971 + {
972 + "id": "merge",
973 + "options": {
974 + "reducers": []
975 + }
976 + },
977 + {
978 + "id": "organize",
979 + "options": {
980 + "excludeByName": {},
981 + "indexByName": {},
982 + "renameByName": {
983 + "Count": "EVENTS",
984 + "data_office365_AuthenticationType": "AUTH TYPE",
985 + "data_office365_ClientIP_country_code": "COUNTRY",
986 + "data_office365_LogonError": "ERROR",
987 + "data_office365_Operation": "WORKLOAD",
988 + "data_office365_UserId": "AD ACCOUNT"
989 + }
990 + }
991 + }
992 + ],
993 + "type": "table"
994 + },
995 + {
996 + "circleMaxSize": 30,
997 + "circleMinSize": 2,
998 + "colors": [
999 + "rgba(245, 54, 54, 0.9)",
1000 + "rgba(237, 129, 40, 0.89)",
1001 + "rgba(50, 172, 45, 0.97)"
1002 + ],
1003 + "datasource": {
1004 + "type": "elasticsearch",
1005 + "uid": "replace_datasource_uid"
1006 + },
1007 + "decimals": 0,
1008 + "esMetric": "Count",
1009 + "gridPos": {
1010 + "h": 12,
1011 + "w": 8,
1012 + "x": 8,
1013 + "y": 20
1014 + },
1015 + "hideEmpty": false,
1016 + "hideZero": false,
1017 + "id": 50,
1018 + "initialZoom": 1,
1019 + "locationData": "countries",
1020 + "mapCenter": "(0°, 0°)",
1021 + "mapCenterLatitude": 0,
1022 + "mapCenterLongitude": 0,
1023 + "maxDataPoints": 1,
1024 + "mouseWheelZoom": false,
1025 + "showLegend": true,
1026 + "stickyLabels": false,
1027 + "tableQueryOptions": {
1028 + "geohashField": "geohash",
1029 + "latitudeField": "latitude",
1030 + "longitudeField": "longitude",
1031 + "metricField": "metric",
1032 + "queryType": "geohash"
1033 + },
1034 + "targets": [
1035 + {
1036 + "bucketAggs": [
1037 + {
1038 + "fake": true,
1039 + "field": "data_office365_ClientIP_country_code",
1040 + "id": "3",
1041 + "settings": {
1042 + "min_doc_count": 1,
1043 + "order": "desc",
1044 + "orderBy": "_term",
1045 + "size": "0"
1046 + },
1047 + "type": "terms"
1048 + },
1049 + {
1050 + "field": "timestamp",
1051 + "id": "2",
1052 + "settings": {
1053 + "interval": "auto",
1054 + "min_doc_count": 0,
1055 + "trimEdges": 0
1056 + },
1057 + "type": "date_histogram"
1058 + }
1059 + ],
1060 + "datasource": {
1061 + "type": "elasticsearch",
1062 + "uid": "replace_datasource_uid"
1063 + },
1064 + "metrics": [
1065 + {
1066 + "field": "select field",
1067 + "id": "1",
1068 + "type": "count"
1069 + }
1070 + ],
1071 + "query": "data_office365_Workload:SharePoint AND rule_level:$rule_level",
1072 + "refId": "A",
1073 + "timeField": "timestamp"
1074 + }
1075 + ],
1076 + "thresholds": "0,10",
1077 + "title": "SHAREPOINT - ALL EVENTS BY SRC COUNTRY",
1078 + "type": "grafana-worldmap-panel",
1079 + "unitPlural": "",
1080 + "unitSingle": "",
1081 + "valueName": "total"
1082 + },
1083 + {
1084 + "datasource": {
1085 + "type": "elasticsearch",
1086 + "uid": "replace_datasource_uid"
1087 + },
1088 + "fieldConfig": {
1089 + "defaults": {
1090 + "color": {
1091 + "mode": "thresholds"
1092 + },
1093 + "custom": {
1094 + "align": "auto",
1095 + "cellOptions": {
1096 + "type": "auto"
1097 + },
1098 + "inspect": false
1099 + },
1100 + "mappings": [],
1101 + "thresholds": {
1102 + "mode": "absolute",
1103 + "steps": [
1104 + {
1105 + "color": "orange",
1106 + "value": null
1107 + }
1108 + ]
1109 + }
1110 + },
1111 + "overrides": [
1112 + {
1113 + "matcher": {
1114 + "id": "byName",
1115 + "options": "Count"
1116 + },
1117 + "properties": [
1118 + {
1119 + "id": "displayName",
1120 + "value": "EVENTS"
1121 + },
1122 + {
1123 + "id": "unit",
1124 + "value": "short"
1125 + },
1126 + {
1127 + "id": "decimals",
1128 + "value": -1
1129 + },
1130 + {
1131 + "id": "custom.align"
1132 + }
1133 + ]
1134 + },
1135 + {
1136 + "matcher": {
1137 + "id": "byName",
1138 + "options": "AD ACCOUNT"
1139 + },
1140 + "properties": [
1141 + {
1142 + "id": "custom.width",
1143 + "value": 377
1144 + }
1145 + ]
1146 + }
1147 + ]
1148 + },
1149 + "gridPos": {
1150 + "h": 12,
1151 + "w": 8,
1152 + "x": 16,
1153 + "y": 20
1154 + },
1155 + "id": 58,
1156 + "options": {
1157 + "cellHeight": "sm",
1158 + "footer": {
1159 + "countRows": false,
1160 + "fields": "",
1161 + "reducer": [
1162 + "sum"
1163 + ],
1164 + "show": false
1165 + },
1166 + "showHeader": true,
1167 + "sortBy": []
1168 + },
1169 + "pluginVersion": "10.0.3",
1170 + "targets": [
1171 + {
1172 + "bucketAggs": [
1173 + {
1174 + "fake": true,
1175 + "field": "data_office365_UserId",
1176 + "id": "4",
1177 + "settings": {
1178 + "min_doc_count": 1,
1179 + "order": "desc",
1180 + "orderBy": "_count",
1181 + "size": "0"
1182 + },
1183 + "type": "terms"
1184 + },
1185 + {
1186 + "field": "data_office365_ClientIP_country_code",
1187 + "id": "5",
1188 + "settings": {
1189 + "min_doc_count": "1",
1190 + "order": "desc",
1191 + "orderBy": "_term",
1192 + "size": "10"
1193 + },
1194 + "type": "terms"
1195 + }
1196 + ],
1197 + "datasource": {
1198 + "type": "elasticsearch",
1199 + "uid": "replace_datasource_uid"
1200 + },
1201 + "metrics": [
1202 + {
1203 + "field": "select field",
1204 + "id": "1",
1205 + "type": "count"
1206 + }
1207 + ],
1208 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
1209 + "refId": "A",
1210 + "timeField": "timestamp"
1211 + }
1212 + ],
1213 + "title": "SHAREPOINT EVENTS BY ACCOUNT",
1214 + "transformations": [
1215 + {
1216 + "id": "merge",
1217 + "options": {
1218 + "reducers": []
1219 + }
1220 + },
1221 + {
1222 + "id": "organize",
1223 + "options": {
1224 + "excludeByName": {},
1225 + "indexByName": {},
1226 + "renameByName": {
1227 + "Count": "EVENTS",
1228 + "data_office365_ClientIP_country_code": "COUNTRY",
1229 + "data_office365_LogonError": "ERROR",
1230 + "data_office365_Operation": "WORKLOAD",
1231 + "data_office365_UserId": "AD ACCOUNT"
1232 + }
1233 + }
1234 + }
1235 + ],
1236 + "type": "table"
1237 + },
1238 + {
1239 + "datasource": {
1240 + "type": "elasticsearch",
1241 + "uid": "replace_datasource_uid"
1242 + },
1243 + "fieldConfig": {
1244 + "defaults": {
1245 + "color": {
1246 + "mode": "thresholds"
1247 + },
1248 + "custom": {
1249 + "align": "auto",
1250 + "cellOptions": {
1251 + "type": "auto"
1252 + },
1253 + "filterable": true,
1254 + "inspect": false
1255 + },
1256 + "mappings": [],
1257 + "thresholds": {
1258 + "mode": "absolute",
1259 + "steps": [
1260 + {
1261 + "color": "green",
1262 + "value": null
1263 + },
1264 + {
1265 + "color": "red",
1266 + "value": 80
1267 + }
1268 + ]
1269 + }
1270 + },
1271 + "overrides": [
1272 + {
1273 + "matcher": {
1274 + "id": "byName",
1275 + "options": "rule_level"
1276 + },
1277 + "properties": [
1278 + {
1279 + "id": "displayName",
1280 + "value": "RULE LEVEL"
1281 + },
1282 + {
1283 + "id": "unit",
1284 + "value": "short"
1285 + },
1286 + {
1287 + "id": "decimals",
1288 + "value": -1
1289 + },
1290 + {
1291 + "id": "custom.cellOptions",
1292 + "value": {
1293 + "mode": "gradient",
1294 + "type": "color-background"
1295 + }
1296 + },
1297 + {
1298 + "id": "custom.align"
1299 + },
1300 + {
1301 + "id": "thresholds",
1302 + "value": {
1303 + "mode": "absolute",
1304 + "steps": [
1305 + {
1306 + "color": "#37872D",
1307 + "value": null
1308 + },
1309 + {
1310 + "color": "rgba(237, 129, 40, 0.89)",
1311 + "value": 7
1312 + },
1313 + {
1314 + "color": "rgba(245, 54, 54, 0.9)",
1315 + "value": 12
1316 + }
1317 + ]
1318 + }
1319 + }
1320 + ]
1321 + },
1322 + {
1323 + "matcher": {
1324 + "id": "byName",
1325 + "options": "Date/Time"
1326 + },
1327 + "properties": [
1328 + {
1329 + "id": "custom.width",
1330 + "value": 242
1331 + }
1332 + ]
1333 + },
1334 + {
1335 + "matcher": {
1336 + "id": "byName",
1337 + "options": "MITRE TACTIC"
1338 + },
1339 + "properties": [
1340 + {
1341 + "id": "custom.width",
1342 + "value": 332
1343 + }
1344 + ]
1345 + },
1346 + {
1347 + "matcher": {
1348 + "id": "byName",
1349 + "options": "IP ADDRESS"
1350 + },
1351 + "properties": [
1352 + {
1353 + "id": "custom.width",
1354 + "value": 163
1355 + }
1356 + ]
1357 + },
1358 + {
1359 + "matcher": {
1360 + "id": "byName",
1361 + "options": "MITRE TECHNIQUE"
1362 + },
1363 + "properties": [
1364 + {
1365 + "id": "custom.width",
1366 + "value": 312
1367 + }
1368 + ]
1369 + },
1370 + {
1371 + "matcher": {
1372 + "id": "byName",
1373 + "options": "EVENT ID"
1374 + },
1375 + "properties": [
1376 + {
1377 + "id": "links",
1378 + "value": [
1379 + {
1380 + "targetBlank": true,
1381 + "title": "VIEW EVENT DETAILS",
1382 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1383 + }
1384 + ]
1385 + },
1386 + {
1387 + "id": "custom.width",
1388 + "value": 265
1389 + }
1390 + ]
1391 + },
1392 + {
1393 + "matcher": {
1394 + "id": "byName",
1395 + "options": "RESULT"
1396 + },
1397 + "properties": [
1398 + {
1399 + "id": "custom.width",
1400 + "value": 118
1401 + },
1402 + {
1403 + "id": "mappings",
1404 + "value": [
1405 + {
1406 + "options": {
1407 + "Failed": {
1408 + "color": "orange",
1409 + "index": 1
1410 + },
1411 + "Success": {
1412 + "color": "green",
1413 + "index": 0
1414 + }
1415 + },
1416 + "type": "value"
1417 + }
1418 + ]
1419 + },
1420 + {
1421 + "id": "custom.cellOptions",
1422 + "value": {
1423 + "type": "color-text"
1424 + }
1425 + }
1426 + ]
1427 + },
1428 + {
1429 + "matcher": {
1430 + "id": "byName",
1431 + "options": "SRC IP"
1432 + },
1433 + "properties": [
1434 + {
1435 + "id": "custom.width",
1436 + "value": 265
1437 + }
1438 + ]
1439 + },
1440 + {
1441 + "matcher": {
1442 + "id": "byName",
1443 + "options": "ACCOUNT"
1444 + },
1445 + "properties": [
1446 + {
1447 + "id": "custom.width",
1448 + "value": 227
1449 + }
1450 + ]
1451 + },
1452 + {
1453 + "matcher": {
1454 + "id": "byName",
1455 + "options": "EVENT TIME"
1456 + },
1457 + "properties": [
1458 + {
1459 + "id": "custom.width",
1460 + "value": 195
1461 + }
1462 + ]
1463 + },
1464 + {
1465 + "matcher": {
1466 + "id": "byName",
1467 + "options": "CLIENT IP"
1468 + },
1469 + "properties": [
1470 + {
1471 + "id": "custom.width",
1472 + "value": 191
1473 + }
1474 + ]
1475 + },
1476 + {
1477 + "matcher": {
1478 + "id": "byName",
1479 + "options": "DESCRIPTION"
1480 + },
1481 + "properties": [
1482 + {
1483 + "id": "custom.width",
1484 + "value": 367
1485 + }
1486 + ]
1487 + },
1488 + {
1489 + "matcher": {
1490 + "id": "byName",
1491 + "options": "FILE"
1492 + },
1493 + "properties": [
1494 + {
1495 + "id": "custom.width",
1496 + "value": 855
1497 + }
1498 + ]
1499 + },
1500 + {
1501 + "matcher": {
1502 + "id": "byName",
1503 + "options": "BROWSER"
1504 + },
1505 + "properties": [
1506 + {
1507 + "id": "custom.width",
1508 + "value": 205
1509 + }
1510 + ]
1511 + },
1512 + {
1513 + "matcher": {
1514 + "id": "byName",
1515 + "options": "RULE LEVEL"
1516 + },
1517 + "properties": [
1518 + {
1519 + "id": "custom.width",
1520 + "value": 197
1521 + }
1522 + ]
1523 + }
1524 + ]
1525 + },
1526 + "gridPos": {
1527 + "h": 16,
1528 + "w": 24,
1529 + "x": 0,
1530 + "y": 32
1531 + },
1532 + "id": 27,
1533 + "options": {
1534 + "cellHeight": "sm",
1535 + "footer": {
1536 + "countRows": false,
1537 + "enablePagination": true,
1538 + "fields": "",
1539 + "reducer": [
1540 + "sum"
1541 + ],
1542 + "show": false
1543 + },
1544 + "showHeader": true,
1545 + "sortBy": []
1546 + },
1547 + "pluginVersion": "10.0.3",
1548 + "targets": [
1549 + {
1550 + "bucketAggs": [],
1551 + "datasource": {
1552 + "type": "elasticsearch",
1553 + "uid": "replace_datasource_uid"
1554 + },
1555 + "metrics": [
1556 + {
1557 + "id": "1",
1558 + "settings": {
1559 + "size": "250"
1560 + },
1561 + "type": "raw_data"
1562 + }
1563 + ],
1564 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
1565 + "refId": "A",
1566 + "timeField": "timestamp"
1567 + }
1568 + ],
1569 + "title": "EVENTS",
1570 + "transformations": [
1571 + {
1572 + "id": "organize",
1573 + "options": {
1574 + "excludeByName": {
1575 + "@metadata_beat": true,
1576 + "@metadata_type": true,
1577 + "@metadata_version": true,
1578 + "IMPHASH": true,
1579 + "MD5": true,
1580 + "SHA1": true,
1581 + "SHA256": true,
1582 + "_id": false,
1583 + "_index": true,
1584 + "_type": true,
1585 + "agent_ephemeral_id": true,
1586 + "agent_hostname": true,
1587 + "agent_id": true,
1588 + "agent_ip_city_name": true,
1589 + "agent_ip_country_code": true,
1590 + "agent_ip_geolocation": true,
1591 + "agent_name": true,
1592 + "agent_type": true,
1593 + "agent_version": true,
1594 + "beats_type": true,
1595 + "cluster_name": true,
1596 + "cluster_node": true,
1597 + "collector_node_id": true,
1598 + "data_alert_action": true,
1599 + "data_alert_category": true,
1600 + "data_alert_gid": true,
1601 + "data_alert_rev": true,
1602 + "data_alert_severity": true,
1603 + "data_alert_signature": true,
1604 + "data_alert_signature_id": true,
1605 + "data_app_proto": true,
1606 + "data_audit_auid": true,
1607 + "data_audit_command": true,
1608 + "data_audit_euid": true,
1609 + "data_audit_exe": true,
1610 + "data_audit_gid": true,
1611 + "data_audit_id": true,
1612 + "data_audit_pid": true,
1613 + "data_audit_res": true,
1614 + "data_audit_session": true,
1615 + "data_audit_type": true,
1616 + "data_audit_uid": true,
1617 + "data_dest_ip": true,
1618 + "data_dest_port": true,
1619 + "data_dstuser": true,
1620 + "data_event_type": true,
1621 + "data_extra_data": true,
1622 + "data_file": true,
1623 + "data_flow_bytes_toclient": true,
1624 + "data_flow_bytes_toserver": true,
1625 + "data_flow_id": true,
1626 + "data_flow_pkts_toclient": true,
1627 + "data_flow_pkts_toserver": true,
1628 + "data_flow_start": true,
1629 + "data_http_http_content_type": true,
1630 + "data_http_http_port": true,
1631 + "data_http_length": true,
1632 + "data_http_status": true,
1633 + "data_http_url": true,
1634 + "data_id": true,
1635 + "data_in_iface": true,
1636 + "data_integration": true,
1637 + "data_metadata_flowbits": true,
1638 + "data_metadata_flowints_http_anomaly_count": true,
1639 + "data_metadata_flowints_tcp_retransmission_count": true,
1640 + "data_office365_AADGroupId": true,
1641 + "data_office365_Actor": true,
1642 + "data_office365_ActorContextId": true,
1643 + "data_office365_ActorIpAddress": false,
1644 + "data_office365_ActorIpAddress_city_name": true,
1645 + "data_office365_ActorIpAddress_country_code": true,
1646 + "data_office365_ActorIpAddress_geolocation": true,
1647 + "data_office365_AppAccessContext_AADSessionId": true,
1648 + "data_office365_AppAccessContext_APIId": true,
1649 + "data_office365_AppAccessContext_ClientAppId": true,
1650 + "data_office365_AppAccessContext_ClientAppName": true,
1651 + "data_office365_AppAccessContext_CorrelationId": true,
1652 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1653 + "data_office365_AppAccessContext_UniqueTokenId": true,
1654 + "data_office365_AppId": true,
1655 + "data_office365_ApplicationDisplayName": true,
1656 + "data_office365_ApplicationId": true,
1657 + "data_office365_ArtifactsShared": true,
1658 + "data_office365_AssertingApplicationId": true,
1659 + "data_office365_Attendees": true,
1660 + "data_office365_AuthenticationType": true,
1661 + "data_office365_AzureActiveDirectoryEventType": true,
1662 + "data_office365_BrowserVersion": true,
1663 + "data_office365_BrowserVersion_city_name": true,
1664 + "data_office365_BrowserVersion_country_code": true,
1665 + "data_office365_BrowserVersion_geolocation": true,
1666 + "data_office365_ChannelGuid": true,
1667 + "data_office365_ChannelName": true,
1668 + "data_office365_ChatName": true,
1669 + "data_office365_ChatThreadId": true,
1670 + "data_office365_ClientAppId": true,
1671 + "data_office365_ClientIP": false,
1672 + "data_office365_ClientIPAddress": true,
1673 + "data_office365_ClientIPAddress_city_name": true,
1674 + "data_office365_ClientIPAddress_country_code": true,
1675 + "data_office365_ClientIPAddress_geolocation": true,
1676 + "data_office365_ClientIP_city_name": true,
1677 + "data_office365_ClientIP_country_code": true,
1678 + "data_office365_ClientIP_geolocation": true,
1679 + "data_office365_ClientInfoString": true,
1680 + "data_office365_ClientProcessName": true,
1681 + "data_office365_ClientRequestId": true,
1682 + "data_office365_ClientVersion": true,
1683 + "data_office365_CommunicationSubType": true,
1684 + "data_office365_CommunicationType": true,
1685 + "data_office365_CorrelationId": true,
1686 + "data_office365_CreationTime": false,
1687 + "data_office365_CrossMailboxOperation": true,
1688 + "data_office365_CustomUniqueId": true,
1689 + "data_office365_CustomizedDoclib": true,
1690 + "data_office365_DestFolder_Id": true,
1691 + "data_office365_DestFolder_Path": true,
1692 + "data_office365_DestinationFileExtension": true,
1693 + "data_office365_DestinationFileName": true,
1694 + "data_office365_DestinationRelativeUrl": true,
1695 + "data_office365_DeviceDisplayName": true,
1696 + "data_office365_DeviceDisplayName_city_name": true,
1697 + "data_office365_DeviceDisplayName_country_code": true,
1698 + "data_office365_DeviceDisplayName_geolocation": true,
1699 + "data_office365_DeviceId": true,
1700 + "data_office365_DeviceInformation": true,
1701 + "data_office365_DeviceProperties": true,
1702 + "data_office365_DoNotDistributeEvent": true,
1703 + "data_office365_EndTime": true,
1704 + "data_office365_ErrorNumber": true,
1705 + "data_office365_EventData": true,
1706 + "data_office365_EventSource": true,
1707 + "data_office365_ExchangeId": true,
1708 + "data_office365_ExtendedProperties": true,
1709 + "data_office365_ExternalAccess": true,
1710 + "data_office365_ExtraProperties": true,
1711 + "data_office365_FileSizeBytes": true,
1712 + "data_office365_FileSyncBytesCommitted": true,
1713 + "data_office365_Folder_Id": true,
1714 + "data_office365_Folder_Path": true,
1715 + "data_office365_FromApp": true,
1716 + "data_office365_HighPriorityMediaProcessing": true,
1717 + "data_office365_HostedContents": true,
1718 + "data_office365_ICalUid": true,
1719 + "data_office365_Id": true,
1720 + "data_office365_ImplicitShare": true,
1721 + "data_office365_InterSystemsId": true,
1722 + "data_office365_InternalLogonType": true,
1723 + "data_office365_IntraSystemId": true,
1724 + "data_office365_IsManagedDevice": true,
1725 + "data_office365_ItemCount": true,
1726 + "data_office365_ItemName": true,
1727 + "data_office365_ItemType": true,
1728 + "data_office365_Item_Id": true,
1729 + "data_office365_Item_InternetMessageId": true,
1730 + "data_office365_Item_IsRecord": true,
1731 + "data_office365_Item_ParentFolder_Id": true,
1732 + "data_office365_Item_SizeInBytes": true,
1733 + "data_office365_JoinTime": true,
1734 + "data_office365_LeaveTime": true,
1735 + "data_office365_ListBaseTemplateType": true,
1736 + "data_office365_ListBaseType": true,
1737 + "data_office365_ListId": true,
1738 + "data_office365_ListItemUniqueId": true,
1739 + "data_office365_ListServerTemplate": true,
1740 + "data_office365_ListTitle": true,
1741 + "data_office365_LogonError": true,
1742 + "data_office365_LogonType": true,
1743 + "data_office365_LogonUserSid": true,
1744 + "data_office365_MachineId": true,
1745 + "data_office365_MailboxGuid": true,
1746 + "data_office365_MailboxOwnerSid": true,
1747 + "data_office365_MailboxOwnerUPN": true,
1748 + "data_office365_MeetingDetailId": true,
1749 + "data_office365_MeetingURL": true,
1750 + "data_office365_Members": true,
1751 + "data_office365_MessageId": true,
1752 + "data_office365_MessageSizeInBytes": true,
1753 + "data_office365_MessageURLs": true,
1754 + "data_office365_MessageVersion": true,
1755 + "data_office365_Modalities": true,
1756 + "data_office365_ModifiedProperties": true,
1757 + "data_office365_Name": true,
1758 + "data_office365_NewValue": true,
1759 + "data_office365_ObjectId": true,
1760 + "data_office365_Operation": true,
1761 + "data_office365_OperationScope": true,
1762 + "data_office365_OrganizationId": true,
1763 + "data_office365_OrganizationName": true,
1764 + "data_office365_Organizer_OrganizationId": true,
1765 + "data_office365_Organizer_RecipientType": true,
1766 + "data_office365_Organizer_Role": true,
1767 + "data_office365_Organizer_UserObjectId": true,
1768 + "data_office365_OriginatingServer": true,
1769 + "data_office365_Parameters": true,
1770 + "data_office365_ParentMessageId": true,
1771 + "data_office365_Platform": true,
1772 + "data_office365_ProviderTypes": true,
1773 + "data_office365_RecordType": true,
1774 + "data_office365_ResultStatus": true,
1775 + "data_office365_SearchQueryText": true,
1776 + "data_office365_SessionId": true,
1777 + "data_office365_Site": true,
1778 + "data_office365_SiteUrl": true,
1779 + "data_office365_SkipForServiceWorker": true,
1780 + "data_office365_Source": true,
1781 + "data_office365_SourceFileExtension": true,
1782 + "data_office365_SourceRelativeUrl": true,
1783 + "data_office365_StartTime": true,
1784 + "data_office365_Subscription": true,
1785 + "data_office365_SubscriptionId": true,
1786 + "data_office365_Target": true,
1787 + "data_office365_TargetContextId": true,
1788 + "data_office365_TargetUserOrGroupName": true,
1789 + "data_office365_TargetUserOrGroupType": true,
1790 + "data_office365_TeamGuid": true,
1791 + "data_office365_TeamName": true,
1792 + "data_office365_UniqueSharingId": true,
1793 + "data_office365_UserAgent": true,
1794 + "data_office365_UserId": false,
1795 + "data_office365_UserKey": true,
1796 + "data_office365_UserType": true,
1797 + "data_office365_Version": true,
1798 + "data_office365_WebId": true,
1799 + "data_office365_Workload": true,
1800 + "data_osquery_action": true,
1801 + "data_osquery_calendarTime": true,
1802 + "data_osquery_columns_address": true,
1803 + "data_osquery_columns_address_city_name": true,
1804 + "data_osquery_columns_address_country_code": true,
1805 + "data_osquery_columns_address_geolocation": true,
1806 + "data_osquery_columns_cmdline": true,
1807 + "data_osquery_columns_cwd": true,
1808 + "data_osquery_columns_description": true,
1809 + "data_osquery_columns_directory": true,
1810 + "data_osquery_columns_disk_bytes_read": true,
1811 + "data_osquery_columns_disk_bytes_written": true,
1812 + "data_osquery_columns_egid": true,
1813 + "data_osquery_columns_euid": true,
1814 + "data_osquery_columns_family": true,
1815 + "data_osquery_columns_fd": true,
1816 + "data_osquery_columns_gid": true,
1817 + "data_osquery_columns_gid_signed": true,
1818 + "data_osquery_columns_host": true,
1819 + "data_osquery_columns_interface": true,
1820 + "data_osquery_columns_local_address": true,
1821 + "data_osquery_columns_local_address_city_name": true,
1822 + "data_osquery_columns_local_address_country_code": true,
1823 + "data_osquery_columns_local_address_geolocation": true,
1824 + "data_osquery_columns_local_port": true,
1825 + "data_osquery_columns_mac": true,
1826 + "data_osquery_columns_name": true,
1827 + "data_osquery_columns_net_namespace": true,
1828 + "data_osquery_columns_nice": true,
1829 + "data_osquery_columns_on_disk": true,
1830 + "data_osquery_columns_parent": true,
1831 + "data_osquery_columns_path": true,
1832 + "data_osquery_columns_pgroup": true,
1833 + "data_osquery_columns_pid": true,
1834 + "data_osquery_columns_port": true,
1835 + "data_osquery_columns_protocol": true,
1836 + "data_osquery_columns_remote_address": true,
1837 + "data_osquery_columns_remote_address_city_name": true,
1838 + "data_osquery_columns_remote_address_country_code": true,
1839 + "data_osquery_columns_remote_address_geolocation": true,
1840 + "data_osquery_columns_remote_port": true,
1841 + "data_osquery_columns_resident_size": true,
1842 + "data_osquery_columns_root": true,
1843 + "data_osquery_columns_sgid": true,
1844 + "data_osquery_columns_shell": true,
1845 + "data_osquery_columns_socket": true,
1846 + "data_osquery_columns_start_time": true,
1847 + "data_osquery_columns_state": true,
1848 + "data_osquery_columns_suid": true,
1849 + "data_osquery_columns_system_time": true,
1850 + "data_osquery_columns_threads": true,
1851 + "data_osquery_columns_time_utc": true,
1852 + "data_osquery_columns_total_size": true,
1853 + "data_osquery_columns_tty": true,
1854 + "data_osquery_columns_type": true,
1855 + "data_osquery_columns_uid": true,
1856 + "data_osquery_columns_uid_signed": true,
1857 + "data_osquery_columns_user": true,
1858 + "data_osquery_columns_user_time": true,
1859 + "data_osquery_columns_username": true,
1860 + "data_osquery_columns_wired_size": true,
1861 + "data_osquery_counter": true,
1862 + "data_osquery_decorations_host_uuid": true,
1863 + "data_osquery_decorations_hostname": true,
1864 + "data_osquery_epoch": true,
1865 + "data_osquery_hostIdentifier": true,
1866 + "data_osquery_name": true,
1867 + "data_osquery_numerics": true,
1868 + "data_osquery_unixTime": true,
1869 + "data_proto": true,
1870 + "data_sca_check_command": true,
1871 + "data_sca_check_compliance_cis": true,
1872 + "data_sca_check_compliance_cis_csc": true,
1873 + "data_sca_check_compliance_gdpr_IV": true,
1874 + "data_sca_check_compliance_gpg_13": true,
1875 + "data_sca_check_compliance_hipaa": true,
1876 + "data_sca_check_compliance_nist_800_53": true,
1877 + "data_sca_check_compliance_pci_dss": true,
1878 + "data_sca_check_compliance_tsc": true,
1879 + "data_sca_check_description": true,
1880 + "data_sca_check_id": true,
1881 + "data_sca_check_previous_result": true,
1882 + "data_sca_check_rationale": true,
1883 + "data_sca_check_remediation": true,
1884 + "data_sca_check_result": true,
1885 + "data_sca_check_title": true,
1886 + "data_sca_description": true,
1887 + "data_sca_failed": true,
1888 + "data_sca_file": true,
1889 + "data_sca_invalid": true,
1890 + "data_sca_passed": true,
1891 + "data_sca_policy": true,
1892 + "data_sca_policy_id": true,
1893 + "data_sca_scan_id": true,
1894 + "data_sca_score": true,
1895 + "data_sca_total_checks": true,
1896 + "data_sca_type": true,
1897 + "data_script": true,
1898 + "data_src_ip": true,
1899 + "data_src_ip_city_name": true,
1900 + "data_src_ip_country_code": true,
1901 + "data_src_ip_geolocation": true,
1902 + "data_src_port": true,
1903 + "data_srcip": true,
1904 + "data_srcip_city_name": true,
1905 + "data_srcip_country_code": true,
1906 + "data_srcip_geolocation": true,
1907 + "data_srcuser": true,
1908 + "data_timestamp": true,
1909 + "data_title": true,
1910 + "data_tls_session_resumed": true,
1911 + "data_tls_version": true,
1912 + "data_tx_id": true,
1913 + "data_type": true,
1914 + "data_win_eventXML_binaryData": true,
1915 + "data_win_eventXML_binaryDataSize": true,
1916 + "data_win_eventXML_param1": true,
1917 + "data_win_eventdata_authenticationPackageName": true,
1918 + "data_win_eventdata_callTrace": true,
1919 + "data_win_eventdata_commandLine": true,
1920 + "data_win_eventdata_company": true,
1921 + "data_win_eventdata_creationUtcTime": true,
1922 + "data_win_eventdata_currentDirectory": true,
1923 + "data_win_eventdata_description": true,
1924 + "data_win_eventdata_destinationHostname": true,
1925 + "data_win_eventdata_destinationIp": true,
1926 + "data_win_eventdata_destinationIp_city_name": true,
1927 + "data_win_eventdata_destinationIp_country_code": true,
1928 + "data_win_eventdata_destinationIp_geolocation": true,
1929 + "data_win_eventdata_destinationIsIpv6": true,
1930 + "data_win_eventdata_destinationPort": true,
1931 + "data_win_eventdata_destinationPortName": true,
1932 + "data_win_eventdata_details": true,
1933 + "data_win_eventdata_elevatedToken": true,
1934 + "data_win_eventdata_eventType": true,
1935 + "data_win_eventdata_fileVersion": true,
1936 + "data_win_eventdata_fileVersion_city_name": true,
1937 + "data_win_eventdata_fileVersion_country_code": true,
1938 + "data_win_eventdata_fileVersion_geolocation": true,
1939 + "data_win_eventdata_grantedAccess": true,
1940 + "data_win_eventdata_hashes": true,
1941 + "data_win_eventdata_image": true,
1942 + "data_win_eventdata_imageLoaded": true,
1943 + "data_win_eventdata_impersonationLevel": true,
1944 + "data_win_eventdata_initiated": true,
1945 + "data_win_eventdata_integrityLevel": true,
1946 + "data_win_eventdata_ipAddress": true,
1947 + "data_win_eventdata_ipPort": true,
1948 + "data_win_eventdata_keyLength": true,
1949 + "data_win_eventdata_logonGuid": true,
1950 + "data_win_eventdata_logonId": true,
1951 + "data_win_eventdata_logonProcessName": true,
1952 + "data_win_eventdata_logonType": true,
1953 + "data_win_eventdata_originalFileName": true,
1954 + "data_win_eventdata_param1": true,
1955 + "data_win_eventdata_param2": true,
1956 + "data_win_eventdata_param3": true,
1957 + "data_win_eventdata_param4": true,
1958 + "data_win_eventdata_parentCommandLine": true,
1959 + "data_win_eventdata_parentImage": true,
1960 + "data_win_eventdata_parentProcessGuid": true,
1961 + "data_win_eventdata_parentProcessId": true,
1962 + "data_win_eventdata_processGuid": true,
1963 + "data_win_eventdata_processId": true,
1964 + "data_win_eventdata_processName": true,
1965 + "data_win_eventdata_product": true,
1966 + "data_win_eventdata_protocol": true,
1967 + "data_win_eventdata_queryName": true,
1968 + "data_win_eventdata_queryResults": true,
1969 + "data_win_eventdata_queryStatus": true,
1970 + "data_win_eventdata_ruleName": true,
1971 + "data_win_eventdata_serviceName": true,
1972 + "data_win_eventdata_serviceSid": true,
1973 + "data_win_eventdata_signature": true,
1974 + "data_win_eventdata_signatureStatus": true,
1975 + "data_win_eventdata_signed": true,
1976 + "data_win_eventdata_sourceHostname": true,
1977 + "data_win_eventdata_sourceImage": true,
1978 + "data_win_eventdata_sourceIp": true,
1979 + "data_win_eventdata_sourceIp_city_name": true,
1980 + "data_win_eventdata_sourceIp_country_code": true,
1981 + "data_win_eventdata_sourceIp_geolocation": true,
1982 + "data_win_eventdata_sourceIsIpv6": true,
1983 + "data_win_eventdata_sourcePort": true,
1984 + "data_win_eventdata_sourceProcessGUID": true,
1985 + "data_win_eventdata_sourceProcessId": true,
1986 + "data_win_eventdata_sourceThreadId": true,
1987 + "data_win_eventdata_status": true,
1988 + "data_win_eventdata_subjectDomainName": true,
1989 + "data_win_eventdata_subjectLogonId": true,
1990 + "data_win_eventdata_subjectUserName": true,
1991 + "data_win_eventdata_subjectUserSid": true,
1992 + "data_win_eventdata_targetDomainName": true,
1993 + "data_win_eventdata_targetFilename": true,
1994 + "data_win_eventdata_targetImage": true,
1995 + "data_win_eventdata_targetLinkedLogonId": true,
1996 + "data_win_eventdata_targetLogonId": true,
1997 + "data_win_eventdata_targetObject": true,
1998 + "data_win_eventdata_targetProcessGUID": true,
1999 + "data_win_eventdata_targetProcessId": true,
2000 + "data_win_eventdata_targetUserName": true,
2001 + "data_win_eventdata_targetUserSid": true,
2002 + "data_win_eventdata_terminalSessionId": true,
2003 + "data_win_eventdata_ticketEncryptionType": true,
2004 + "data_win_eventdata_ticketOptions": true,
2005 + "data_win_eventdata_user": true,
2006 + "data_win_eventdata_utcTime": true,
2007 + "data_win_eventdata_virtualAccount": true,
2008 + "data_win_system_channel": true,
2009 + "data_win_system_computer": true,
2010 + "data_win_system_eventID": true,
2011 + "data_win_system_eventRecordID": true,
2012 + "data_win_system_eventSourceName": true,
2013 + "data_win_system_keywords": true,
2014 + "data_win_system_level": true,
2015 + "data_win_system_message": true,
2016 + "data_win_system_opcode": true,
2017 + "data_win_system_processID": true,
2018 + "data_win_system_providerGuid": true,
2019 + "data_win_system_providerName": true,
2020 + "data_win_system_severityValue": true,
2021 + "data_win_system_systemTime": true,
2022 + "data_win_system_task": true,
2023 + "data_win_system_threadID": true,
2024 + "data_win_system_version": true,
2025 + "decoder_name": true,
2026 + "decoder_parent": true,
2027 + "dns_query": true,
2028 + "dns_query_threat_indicated": true,
2029 + "dst_ip": true,
2030 + "dst_ip_city_name": true,
2031 + "dst_ip_country_code": true,
2032 + "dst_ip_geolocation": true,
2033 + "dst_ip_threat_indicated": true,
2034 + "dst_port": true,
2035 + "ecs_version": true,
2036 + "error": true,
2037 + "event_hash": true,
2038 + "file_path": true,
2039 + "firewall_rule_name": true,
2040 + "full_log": false,
2041 + "gl2_accounted_message_size": true,
2042 + "gl2_message_id": true,
2043 + "gl2_processing_error": true,
2044 + "gl2_remote_ip": true,
2045 + "gl2_remote_port": true,
2046 + "gl2_source_collector": true,
2047 + "gl2_source_input": true,
2048 + "gl2_source_node": true,
2049 + "hash_md5": true,
2050 + "hash_sha1": true,
2051 + "hash_sha256": true,
2052 + "highlight": true,
2053 + "host_architecture": true,
2054 + "host_containerized": true,
2055 + "host_hostname": true,
2056 + "host_id": true,
2057 + "host_ip": true,
2058 + "host_mac": true,
2059 + "host_name": true,
2060 + "host_os_codename": true,
2061 + "host_os_kernel": true,
2062 + "host_os_name": true,
2063 + "host_os_platform": true,
2064 + "host_os_version": true,
2065 + "hostname": true,
2066 + "id": true,
2067 + "input_type": true,
2068 + "level": true,
2069 + "location": true,
2070 + "log_file_path": true,
2071 + "log_offset": true,
2072 + "manager_name": true,
2073 + "message": true,
2074 + "module": true,
2075 + "msg_timestamp": true,
2076 + "parent_process_cmd_line": true,
2077 + "parent_process_id": true,
2078 + "parent_process_image": true,
2079 + "pid": true,
2080 + "predecoder_hostname": true,
2081 + "predecoder_program_name": true,
2082 + "predecoder_timestamp": true,
2083 + "previous_log": true,
2084 + "previous_output": true,
2085 + "process_cmd_line": true,
2086 + "process_id": true,
2087 + "process_image": true,
2088 + "process_name": true,
2089 + "protocol": true,
2090 + "rule_cis": true,
2091 + "rule_cis_csc": true,
2092 + "rule_firedtimes": true,
2093 + "rule_gdpr": true,
2094 + "rule_gdpr_IV": true,
2095 + "rule_gpg13": true,
2096 + "rule_gpg_13": true,
2097 + "rule_group1": true,
2098 + "rule_group2": true,
2099 + "rule_group3": true,
2100 + "rule_groups": true,
2101 + "rule_hipaa": true,
2102 + "rule_id": true,
2103 + "rule_info": true,
2104 + "rule_mail": true,
2105 + "rule_mitre_id": true,
2106 + "rule_mitre_tactic": false,
2107 + "rule_nist_800_53": true,
2108 + "rule_pci_dss": true,
2109 + "rule_tsc": true,
2110 + "scanid": true,
2111 + "service": true,
2112 + "software_package": true,
2113 + "software_vendor": true,
2114 + "sort": true,
2115 + "source": true,
2116 + "source_reserved_ip": true,
2117 + "src_ip": true,
2118 + "src_ip_city_name": true,
2119 + "src_ip_country_code": true,
2120 + "src_ip_geolocation": true,
2121 + "src_port": true,
2122 + "streams": true,
2123 + "syscheck_attrs_after": true,
2124 + "syscheck_audit_effective_user_id": true,
2125 + "syscheck_audit_effective_user_name": true,
2126 + "syscheck_audit_group_id": true,
2127 + "syscheck_audit_group_name": true,
2128 + "syscheck_audit_login_user_id": true,
2129 + "syscheck_audit_login_user_name": true,
2130 + "syscheck_audit_process_cwd": true,
2131 + "syscheck_audit_process_id": true,
2132 + "syscheck_audit_process_name": true,
2133 + "syscheck_audit_process_parent_cwd": true,
2134 + "syscheck_audit_process_parent_name": true,
2135 + "syscheck_audit_process_ppid": true,
2136 + "syscheck_audit_user_id": true,
2137 + "syscheck_audit_user_name": true,
2138 + "syscheck_changed_attributes": true,
2139 + "syscheck_event": true,
2140 + "syscheck_gid_after": true,
2141 + "syscheck_gname_after": true,
2142 + "syscheck_hard_links": true,
2143 + "syscheck_inode_after": true,
2144 + "syscheck_inode_before": true,
2145 + "syscheck_md5_after": true,
2146 + "syscheck_md5_before": true,
2147 + "syscheck_mode": true,
2148 + "syscheck_mtime_after": true,
2149 + "syscheck_mtime_before": true,
2150 + "syscheck_path": true,
2151 + "syscheck_perm_after": true,
2152 + "syscheck_perm_before": true,
2153 + "syscheck_sha1_after": true,
2154 + "syscheck_sha1_before": true,
2155 + "syscheck_sha256_after": true,
2156 + "syscheck_sha256_before": true,
2157 + "syscheck_size_after": true,
2158 + "syscheck_size_before": true,
2159 + "syscheck_uid_after": true,
2160 + "syscheck_uname_after": true,
2161 + "syscheck_win_perm_after": true,
2162 + "syscheck_win_perm_after_0_allowed": true,
2163 + "syscheck_win_perm_after_0_name": true,
2164 + "syscheck_win_perm_after_1_allowed": true,
2165 + "syscheck_win_perm_after_1_name": true,
2166 + "syscheck_win_perm_after_2_allowed": true,
2167 + "syscheck_win_perm_after_2_name": true,
2168 + "syscheck_win_perm_after_3_allowed": true,
2169 + "syscheck_win_perm_after_3_name": true,
2170 + "syslog_customer": true,
2171 + "syslog_level": true,
2172 + "syslog_tag": true,
2173 + "syslog_type": true,
2174 + "sysmon_event_description": true,
2175 + "threat_ids": true,
2176 + "threat_indicated": true,
2177 + "threat_names": true,
2178 + "time": true,
2179 + "timestamp": true,
2180 + "true": true,
2181 + "user_name": true,
2182 + "win_registry_key": true,
2183 + "win_system_eventID": true,
2184 + "windows_auth_package": true,
2185 + "windows_domain": true,
2186 + "windows_event_id": true,
2187 + "windows_event_severity": true,
2188 + "windows_logon_type": true
2189 + },
2190 + "indexByName": {
2191 + "_id": 2,
2192 + "_index": 9,
2193 + "_type": 10,
2194 + "agent_id": 11,
2195 + "agent_name": 5,
2196 + "cluster_name": 12,
2197 + "cluster_node": 13,
2198 + "data_office365_AppAccessContext_APIId": 49,
2199 + "data_office365_AppAccessContext_ClientAppId": 50,
2200 + "data_office365_AppAccessContext_ClientAppName": 51,
2201 + "data_office365_AppAccessContext_CorrelationId": 52,
2202 + "data_office365_ArtifactsShared": 53,
2203 + "data_office365_Attendees": 54,
2204 + "data_office365_ChatName": 55,
2205 + "data_office365_ChatThreadId": 56,
2206 + "data_office365_ClientIP": 4,
2207 + "data_office365_ClientIP_city_name": 14,
2208 + "data_office365_ClientIP_country_code": 15,
2209 + "data_office365_ClientIP_geolocation": 16,
2210 + "data_office365_CommunicationSubType": 57,
2211 + "data_office365_CommunicationType": 58,
2212 + "data_office365_CreationTime": 0,
2213 + "data_office365_DeviceId": 59,
2214 + "data_office365_DeviceInformation": 60,
2215 + "data_office365_EndTime": 61,
2216 + "data_office365_ExchangeId": 62,
2217 + "data_office365_ExtraProperties": 63,
2218 + "data_office365_ICalUid": 64,
2219 + "data_office365_Id": 17,
2220 + "data_office365_ItemName": 65,
2221 + "data_office365_JoinTime": 66,
2222 + "data_office365_LeaveTime": 67,
2223 + "data_office365_MeetingDetailId": 68,
2224 + "data_office365_MeetingURL": 69,
2225 + "data_office365_Members": 70,
2226 + "data_office365_MessageId": 71,
2227 + "data_office365_MessageSizeInBytes": 72,
2228 + "data_office365_MessageURLs": 73,
2229 + "data_office365_MessageVersion": 74,
2230 + "data_office365_Modalities": 75,
2231 + "data_office365_Name": 76,
2232 + "data_office365_NewValue": 77,
2233 + "data_office365_ObjectId": 18,
2234 + "data_office365_Operation": 24,
2235 + "data_office365_OperationScope": 78,
2236 + "data_office365_OrganizationId": 19,
2237 + "data_office365_Organizer_OrganizationId": 79,
2238 + "data_office365_Organizer_RecipientType": 80,
2239 + "data_office365_Organizer_Role": 81,
2240 + "data_office365_Organizer_UserObjectId": 82,
2241 + "data_office365_ProviderTypes": 83,
2242 + "data_office365_RecordType": 20,
2243 + "data_office365_StartTime": 84,
2244 + "data_office365_SubscriptionId": 85,
2245 + "data_office365_TeamGuid": 86,
2246 + "data_office365_UserId": 3,
2247 + "data_office365_UserKey": 21,
2248 + "data_office365_UserType": 22,
2249 + "data_office365_Version": 23,
2250 + "data_office365_Workload": 48,
2251 + "decoder_name": 25,
2252 + "gl2_accounted_message_size": 26,
2253 + "gl2_message_id": 27,
2254 + "gl2_processing_error": 28,
2255 + "gl2_remote_ip": 29,
2256 + "gl2_remote_port": 30,
2257 + "gl2_source_input": 31,
2258 + "gl2_source_node": 32,
2259 + "highlight": 33,
2260 + "id": 34,
2261 + "location": 35,
2262 + "manager_name": 36,
2263 + "message": 37,
2264 + "rule_description": 6,
2265 + "rule_firedtimes": 38,
2266 + "rule_group1": 39,
2267 + "rule_groups": 40,
2268 + "rule_id": 8,
2269 + "rule_level": 7,
2270 + "rule_mail": 41,
2271 + "sort": 42,
2272 + "source": 43,
2273 + "streams": 44,
2274 + "syslog_level": 45,
2275 + "syslog_type": 46,
2276 + "timestamp": 1,
2277 + "true": 47
2278 + },
2279 + "renameByName": {
2280 + "_id": "EVENT ID",
2281 + "agent_name": "",
2282 + "data_office365_ActorIpAddress": "SRC IP",
2283 + "data_office365_AffectedItems": "ITEMS",
2284 + "data_office365_BrowserName": "BROWSER",
2285 + "data_office365_ClientIP": "CLIENT IP",
2286 + "data_office365_ClientIP_city_name": "",
2287 + "data_office365_CreationTime": "EVENT TIME",
2288 + "data_office365_Item_Attachments": "ATTACHMENT",
2289 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2290 + "data_office365_Item_Subject": "SUBJECT",
2291 + "data_office365_ResultStatus": "RESULT",
2292 + "data_office365_SourceFileName": "FILE",
2293 + "data_office365_UserId": "ACCOUNT",
2294 + "rule_description": "DESCRIPTION",
2295 + "rule_id": "RULE ID",
2296 + "rule_level": "",
2297 + "rule_mitre_tactic": "MITRE TACTIC",
2298 + "rule_mitre_technique": "MITRE TECHNIQUE",
2299 + "timestamp": "Date/Time"
2300 + }
2301 + }
2302 + }
2303 + ],
2304 + "transparent": true,
2305 + "type": "table"
2306 + }
2307 + ],
2308 + "refresh": "",
2309 + "schemaVersion": 38,
2310 + "style": "dark",
2311 + "tags": [
2312 + "O365"
2313 + ],
2314 + "templating": {
2315 + "list": [
2316 + {
2317 + "datasource": {
2318 + "type": "elasticsearch",
2319 + "uid": "replace_datasource_uid"
2320 + },
2321 + "filters": [],
2322 + "hide": 0,
2323 + "label": "",
2324 + "name": "Filters",
2325 + "skipUrlSync": false,
2326 + "type": "adhoc"
2327 + },
2328 + {
2329 + "current": {
2330 + "selected": false,
2331 + "text": "All",
2332 + "value": "$__all"
2333 + },
2334 + "datasource": {
2335 + "type": "elasticsearch",
2336 + "uid": "replace_datasource_uid"
2337 + },
2338 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SharePoint\"}",
2339 + "hide": 0,
2340 + "includeAll": true,
2341 + "label": "Operation",
2342 + "multi": false,
2343 + "name": "operation",
2344 + "options": [],
2345 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SharePoint\"}",
2346 + "refresh": 2,
2347 + "regex": "",
2348 + "skipUrlSync": false,
2349 + "sort": 1,
2350 + "tagValuesQuery": "",
2351 + "tagsQuery": "",
2352 + "type": "query",
2353 + "useTags": false
2354 + },
2355 + {
2356 + "current": {
2357 + "selected": false,
2358 + "text": "All",
2359 + "value": "$__all"
2360 + },
2361 + "datasource": {
2362 + "type": "elasticsearch",
2363 + "uid": "replace_datasource_uid"
2364 + },
2365 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:SharePoint\"}",
2366 + "hide": 0,
2367 + "includeAll": true,
2368 + "label": "Rule Level",
2369 + "multi": false,
2370 + "name": "rule_level",
2371 + "options": [],
2372 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:SharePoint\"}",
2373 + "refresh": 2,
2374 + "regex": "",
2375 + "skipUrlSync": false,
2376 + "sort": 0,
2377 + "type": "query"
2378 + }
2379 + ]
2380 + },
2381 + "time": {
2382 + "from": "now-6h",
2383 + "to": "now"
2384 + },
2385 + "timepicker": {
2386 + "refresh_intervals": [
2387 + "5s",
2388 + "10s",
2389 + "30s",
2390 + "1m",
2391 + "5m",
2392 + "15m",
2393 + "30m",
2394 + "1h",
2395 + "2h",
2396 + "1d"
2397 + ],
2398 + "time_options": [
2399 + "5m",
2400 + "15m",
2401 + "1h",
2402 + "6h",
2403 + "12h",
2404 + "24h",
2405 + "2d",
2406 + "7d",
2407 + "30d"
2408 + ]
2409 + },
2410 + "timezone": "",
2411 + "title": "O365 - SHAREPOINT",
2412 + "weekStart": ""
2413 +}
backend/app/connectors/grafana/dashboards/Office365/summary.json new
+2729
@@ -0,0 +1,2729 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "10.2.0",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Workload:$workload",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + },
172 + {
173 + "matcher": {
174 + "id": "byName",
175 + "options": "Count"
176 + },
177 + "properties": [
178 + {
179 + "id": "displayName",
180 + "value": "ALERTS"
181 + },
182 + {
183 + "id": "unit",
184 + "value": "short"
185 + },
186 + {
187 + "id": "decimals",
188 + "value": 0
189 + }
190 + ]
191 + }
192 + ]
193 + },
194 + "gridPos": {
195 + "h": 7,
196 + "w": 4,
197 + "x": 4,
198 + "y": 0
199 + },
200 + "id": 48,
201 + "options": {
202 + "legend": {
203 + "displayMode": "list",
204 + "placement": "bottom",
205 + "showLegend": false
206 + },
207 + "pieType": "pie",
208 + "reduceOptions": {
209 + "calcs": [
210 + "sum"
211 + ],
212 + "fields": "",
213 + "values": false
214 + },
215 + "tooltip": {
216 + "mode": "single",
217 + "sort": "none"
218 + }
219 + },
220 + "pluginVersion": "8.5.1",
221 + "targets": [
222 + {
223 + "bucketAggs": [
224 + {
225 + "fake": true,
226 + "field": "data_office365_Workload",
227 + "id": "4",
228 + "settings": {
229 + "min_doc_count": 1,
230 + "order": "desc",
231 + "orderBy": "_count",
232 + "size": "10"
233 + },
234 + "type": "terms"
235 + },
236 + {
237 + "field": "data_office365_CreationTime",
238 + "id": "5",
239 + "settings": {
240 + "interval": "auto",
241 + "min_doc_count": "0",
242 + "timeZone": "utc",
243 + "trimEdges": "0"
244 + },
245 + "type": "date_histogram"
246 + }
247 + ],
248 + "datasource": {
249 + "type": "elasticsearch",
250 + "uid": "replace_datasource_uid"
251 + },
252 + "metrics": [
253 + {
254 + "field": "select field",
255 + "id": "1",
256 + "type": "count"
257 + }
258 + ],
259 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
260 + "refId": "A",
261 + "timeField": "timestamp"
262 + }
263 + ],
264 + "title": "EVENTS BY WORKLOAD (Top 10)",
265 + "transformations": [],
266 + "type": "piechart"
267 + },
268 + {
269 + "datasource": {
270 + "type": "grafana-opensearch-datasource",
271 + "uid": "replace_datasource_uid"
272 + },
273 + "fieldConfig": {
274 + "defaults": {
275 + "color": {
276 + "mode": "thresholds"
277 + },
278 + "custom": {
279 + "align": "auto",
280 + "cellOptions": {
281 + "type": "auto"
282 + },
283 + "inspect": false
284 + },
285 + "mappings": [],
286 + "thresholds": {
287 + "mode": "absolute",
288 + "steps": [
289 + {
290 + "color": "red",
291 + "value": null
292 + }
293 + ]
294 + }
295 + },
296 + "overrides": [
297 + {
298 + "matcher": {
299 + "id": "byName",
300 + "options": "Count"
301 + },
302 + "properties": [
303 + {
304 + "id": "displayName",
305 + "value": "EVENTS"
306 + },
307 + {
308 + "id": "unit",
309 + "value": "short"
310 + },
311 + {
312 + "id": "decimals",
313 + "value": -1
314 + },
315 + {
316 + "id": "custom.align"
317 + },
318 + {
319 + "id": "thresholds",
320 + "value": {
321 + "mode": "absolute",
322 + "steps": [
323 + {
324 + "color": "red",
325 + "value": null
326 + }
327 + ]
328 + }
329 + }
330 + ]
331 + }
332 + ]
333 + },
334 + "gridPos": {
335 + "h": 7,
336 + "w": 6,
337 + "x": 8,
338 + "y": 0
339 + },
340 + "id": 31,
341 + "options": {
342 + "cellHeight": "sm",
343 + "footer": {
344 + "countRows": false,
345 + "fields": "",
346 + "reducer": [
347 + "sum"
348 + ],
349 + "show": false
350 + },
351 + "showHeader": true
352 + },
353 + "pluginVersion": "10.2.0",
354 + "targets": [
355 + {
356 + "bucketAggs": [
357 + {
358 + "fake": true,
359 + "field": "data_office365_Workload",
360 + "id": "4",
361 + "settings": {
362 + "min_doc_count": 1,
363 + "order": "desc",
364 + "orderBy": "_count",
365 + "size": "0"
366 + },
367 + "type": "terms"
368 + }
369 + ],
370 + "datasource": {
371 + "type": "elasticsearch",
372 + "uid": "replace_datasource_uid"
373 + },
374 + "metrics": [
375 + {
376 + "field": "select field",
377 + "id": "1",
378 + "type": "count"
379 + }
380 + ],
381 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
382 + "refId": "A",
383 + "timeField": "timestamp"
384 + }
385 + ],
386 + "title": "EVENTS BY WORKLOAD",
387 + "transformations": [
388 + {
389 + "id": "merge",
390 + "options": {
391 + "reducers": []
392 + }
393 + },
394 + {
395 + "id": "organize",
396 + "options": {
397 + "excludeByName": {},
398 + "indexByName": {},
399 + "renameByName": {
400 + "Count": "EVENTS",
401 + "data_office365_Workload": "WORKLOAD"
402 + }
403 + }
404 + }
405 + ],
406 + "type": "table"
407 + },
408 + {
409 + "datasource": {
410 + "type": "elasticsearch",
411 + "uid": "replace_datasource_uid"
412 + },
413 + "fieldConfig": {
414 + "defaults": {
415 + "color": {
416 + "mode": "palette-classic"
417 + },
418 + "custom": {
419 + "hideFrom": {
420 + "legend": false,
421 + "tooltip": false,
422 + "viz": false
423 + }
424 + },
425 + "mappings": []
426 + },
427 + "overrides": [
428 + {
429 + "matcher": {
430 + "id": "byName",
431 + "options": "Count"
432 + },
433 + "properties": [
434 + {
435 + "id": "displayName",
436 + "value": "EVENTS"
437 + },
438 + {
439 + "id": "unit",
440 + "value": "short"
441 + },
442 + {
443 + "id": "decimals",
444 + "value": -1
445 + }
446 + ]
447 + }
448 + ]
449 + },
450 + "gridPos": {
451 + "h": 7,
452 + "w": 4,
453 + "x": 14,
454 + "y": 0
455 + },
456 + "id": 53,
457 + "options": {
458 + "legend": {
459 + "displayMode": "list",
460 + "placement": "bottom",
461 + "showLegend": false
462 + },
463 + "pieType": "donut",
464 + "reduceOptions": {
465 + "calcs": [
466 + "sum"
467 + ],
468 + "fields": "",
469 + "values": false
470 + },
471 + "tooltip": {
472 + "mode": "single",
473 + "sort": "none"
474 + }
475 + },
476 + "pluginVersion": "8.5.1",
477 + "targets": [
478 + {
479 + "bucketAggs": [
480 + {
481 + "fake": true,
482 + "field": "data_office365_Operation",
483 + "id": "4",
484 + "settings": {
485 + "min_doc_count": 1,
486 + "order": "desc",
487 + "orderBy": "_count",
488 + "size": "10"
489 + },
490 + "type": "terms"
491 + },
492 + {
493 + "field": "data_office365_CreationTime",
494 + "id": "5",
495 + "settings": {
496 + "interval": "auto",
497 + "min_doc_count": "0",
498 + "timeZone": "utc",
499 + "trimEdges": "0"
500 + },
501 + "type": "date_histogram"
502 + }
503 + ],
504 + "datasource": {
505 + "type": "elasticsearch",
506 + "uid": "replace_datasource_uid"
507 + },
508 + "metrics": [
509 + {
510 + "field": "select field",
511 + "id": "1",
512 + "type": "count"
513 + }
514 + ],
515 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
516 + "refId": "A",
517 + "timeField": "timestamp"
518 + }
519 + ],
520 + "title": "EVENTS BY OPERATION (Top 10)",
521 + "transformations": [],
522 + "type": "piechart"
523 + },
524 + {
525 + "datasource": {
526 + "type": "elasticsearch",
527 + "uid": "replace_datasource_uid"
528 + },
529 + "fieldConfig": {
530 + "defaults": {
531 + "color": {
532 + "mode": "thresholds"
533 + },
534 + "custom": {
535 + "align": "auto",
536 + "cellOptions": {
537 + "type": "auto"
538 + },
539 + "inspect": false
540 + },
541 + "mappings": [],
542 + "thresholds": {
543 + "mode": "absolute",
544 + "steps": [
545 + {
546 + "color": "red",
547 + "value": null
548 + }
549 + ]
550 + }
551 + },
552 + "overrides": [
553 + {
554 + "matcher": {
555 + "id": "byName",
556 + "options": "Count"
557 + },
558 + "properties": [
559 + {
560 + "id": "displayName",
561 + "value": "EVENTS"
562 + },
563 + {
564 + "id": "unit",
565 + "value": "short"
566 + },
567 + {
568 + "id": "decimals",
569 + "value": -1
570 + },
571 + {
572 + "id": "custom.align"
573 + },
574 + {
575 + "id": "thresholds",
576 + "value": {
577 + "mode": "absolute",
578 + "steps": [
579 + {
580 + "color": "red",
581 + "value": null
582 + }
583 + ]
584 + }
585 + }
586 + ]
587 + }
588 + ]
589 + },
590 + "gridPos": {
591 + "h": 7,
592 + "w": 6,
593 + "x": 18,
594 + "y": 0
595 + },
596 + "id": 54,
597 + "options": {
598 + "cellHeight": "sm",
599 + "footer": {
600 + "countRows": false,
601 + "fields": "",
602 + "reducer": [
603 + "sum"
604 + ],
605 + "show": false
606 + },
607 + "showHeader": true
608 + },
609 + "pluginVersion": "10.2.0",
610 + "targets": [
611 + {
612 + "bucketAggs": [
613 + {
614 + "fake": true,
615 + "field": "data_office365_Operation",
616 + "id": "4",
617 + "settings": {
618 + "min_doc_count": 1,
619 + "order": "desc",
620 + "orderBy": "_count",
621 + "size": "0"
622 + },
623 + "type": "terms"
624 + }
625 + ],
626 + "datasource": {
627 + "type": "elasticsearch",
628 + "uid": "replace_datasource_uid"
629 + },
630 + "metrics": [
631 + {
632 + "field": "select field",
633 + "id": "1",
634 + "type": "count"
635 + }
636 + ],
637 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
638 + "refId": "A",
639 + "timeField": "timestamp"
640 + }
641 + ],
642 + "title": "EVENTS BY OPERATION",
643 + "transformations": [
644 + {
645 + "id": "merge",
646 + "options": {
647 + "reducers": []
648 + }
649 + },
650 + {
651 + "id": "organize",
652 + "options": {
653 + "excludeByName": {},
654 + "indexByName": {},
655 + "renameByName": {
656 + "Count": "EVENTS",
657 + "data_office365_Operation": "OPERATION",
658 + "data_office365_Workload": "WORKLOAD"
659 + }
660 + }
661 + }
662 + ],
663 + "type": "table"
664 + },
665 + {
666 + "datasource": {
667 + "type": "elasticsearch",
668 + "uid": "replace_datasource_uid"
669 + },
670 + "fieldConfig": {
671 + "defaults": {
672 + "color": {
673 + "mode": "thresholds"
674 + },
675 + "mappings": [
676 + {
677 + "options": {
678 + "match": "null",
679 + "result": {
680 + "text": "N/A"
681 + }
682 + },
683 + "type": "special"
684 + }
685 + ],
686 + "max": 15,
687 + "min": 0,
688 + "thresholds": {
689 + "mode": "absolute",
690 + "steps": [
691 + {
692 + "color": "#299c46",
693 + "value": null
694 + },
695 + {
696 + "color": "rgba(237, 129, 40, 0.89)",
697 + "value": 8
698 + },
699 + {
700 + "color": "#d44a3a",
701 + "value": 12
702 + }
703 + ]
704 + },
705 + "unit": "none"
706 + },
707 + "overrides": []
708 + },
709 + "gridPos": {
710 + "h": 7,
711 + "w": 4,
712 + "x": 0,
713 + "y": 7
714 + },
715 + "id": 16,
716 + "links": [],
717 + "options": {
718 + "minVizHeight": 75,
719 + "minVizWidth": 75,
720 + "orientation": "horizontal",
721 + "reduceOptions": {
722 + "calcs": [
723 + "max"
724 + ],
725 + "fields": "",
726 + "values": false
727 + },
728 + "showThresholdLabels": false,
729 + "showThresholdMarkers": true,
730 + "text": {}
731 + },
732 + "pluginVersion": "10.2.0",
733 + "targets": [
734 + {
735 + "bucketAggs": [
736 + {
737 + "field": "timestamp",
738 + "id": "2",
739 + "settings": {
740 + "interval": "auto",
741 + "min_doc_count": 0,
742 + "trimEdges": 0
743 + },
744 + "type": "date_histogram"
745 + }
746 + ],
747 + "datasource": {
748 + "type": "elasticsearch",
749 + "uid": "replace_datasource_uid"
750 + },
751 + "metrics": [
752 + {
753 + "field": "rule_level",
754 + "id": "1",
755 + "meta": {},
756 + "settings": {},
757 + "type": "max"
758 + }
759 + ],
760 + "query": "data_office365_Workload:$workload",
761 + "refId": "A",
762 + "timeField": "timestamp"
763 + }
764 + ],
765 + "title": "MAX SEVERITY (0 - 15)",
766 + "type": "gauge"
767 + },
768 + {
769 + "datasource": {
770 + "type": "grafana-opensearch-datasource",
771 + "uid": "replace_datasource_uid"
772 + },
773 + "fieldConfig": {
774 + "defaults": {
775 + "color": {
776 + "mode": "palette-classic"
777 + },
778 + "custom": {
779 + "axisBorderShow": false,
780 + "axisCenteredZero": false,
781 + "axisColorMode": "text",
782 + "axisLabel": "",
783 + "axisPlacement": "auto",
784 + "barAlignment": 0,
785 + "drawStyle": "line",
786 + "fillOpacity": 0,
787 + "gradientMode": "none",
788 + "hideFrom": {
789 + "legend": false,
790 + "tooltip": false,
791 + "viz": false
792 + },
793 + "insertNulls": false,
794 + "lineInterpolation": "linear",
795 + "lineWidth": 1,
796 + "pointSize": 5,
797 + "scaleDistribution": {
798 + "type": "linear"
799 + },
800 + "showPoints": "auto",
801 + "spanNulls": false,
802 + "stacking": {
803 + "group": "A",
804 + "mode": "none"
805 + },
806 + "thresholdsStyle": {
807 + "mode": "off"
808 + }
809 + },
810 + "mappings": [],
811 + "thresholds": {
812 + "mode": "absolute",
813 + "steps": [
814 + {
815 + "color": "green",
816 + "value": null
817 + },
818 + {
819 + "color": "red",
820 + "value": 80
821 + }
822 + ]
823 + }
824 + },
825 + "overrides": []
826 + },
827 + "gridPos": {
828 + "h": 13,
829 + "w": 20,
830 + "x": 4,
831 + "y": 7
832 + },
833 + "id": 58,
834 + "options": {
835 + "legend": {
836 + "calcs": [],
837 + "displayMode": "table",
838 + "placement": "right",
839 + "showLegend": true
840 + },
841 + "tooltip": {
842 + "mode": "single",
843 + "sort": "none"
844 + }
845 + },
846 + "targets": [
847 + {
848 + "alias": "",
849 + "bucketAggs": [
850 + {
851 + "field": "data_office365_Workload",
852 + "id": "3",
853 + "settings": {
854 + "min_doc_count": "1",
855 + "order": "desc",
856 + "orderBy": "_count",
857 + "size": "10"
858 + },
859 + "type": "terms"
860 + },
861 + {
862 + "field": "timestamp",
863 + "id": "2",
864 + "settings": {
865 + "interval": "auto"
866 + },
867 + "type": "date_histogram"
868 + }
869 + ],
870 + "datasource": {
871 + "type": "grafana-opensearch-datasource",
872 + "uid": "replace_datasource_uid"
873 + },
874 + "format": "table",
875 + "metrics": [
876 + {
877 + "id": "1",
878 + "type": "count"
879 + }
880 + ],
881 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
882 + "queryType": "lucene",
883 + "refId": "A",
884 + "timeField": "timestamp"
885 + }
886 + ],
887 + "title": "TOP 10 WORKLOADS - HISTOGRAM",
888 + "type": "timeseries"
889 + },
890 + {
891 + "datasource": {
892 + "type": "elasticsearch",
893 + "uid": "replace_datasource_uid"
894 + },
895 + "fieldConfig": {
896 + "defaults": {
897 + "mappings": [
898 + {
899 + "options": {
900 + "match": "null",
901 + "result": {
902 + "text": "N/A"
903 + }
904 + },
905 + "type": "special"
906 + }
907 + ],
908 + "thresholds": {
909 + "mode": "absolute",
910 + "steps": [
911 + {
912 + "color": "blue",
913 + "value": null
914 + }
915 + ]
916 + },
917 + "unit": "locale"
918 + },
919 + "overrides": []
920 + },
921 + "gridPos": {
922 + "h": 6,
923 + "w": 4,
924 + "x": 0,
925 + "y": 14
926 + },
927 + "id": 51,
928 + "links": [],
929 + "options": {
930 + "colorMode": "value",
931 + "graphMode": "area",
932 + "justifyMode": "auto",
933 + "orientation": "horizontal",
934 + "reduceOptions": {
935 + "calcs": [
936 + "sum"
937 + ],
938 + "fields": "",
939 + "values": false
940 + },
941 + "text": {},
942 + "textMode": "auto"
943 + },
944 + "pluginVersion": "10.2.0",
945 + "targets": [
946 + {
947 + "bucketAggs": [
948 + {
949 + "$$hashKey": "object:331",
950 + "field": "timestamp",
951 + "id": "2",
952 + "settings": {
953 + "interval": "auto",
954 + "min_doc_count": 0,
955 + "trimEdges": 0
956 + },
957 + "type": "date_histogram"
958 + }
959 + ],
960 + "datasource": {
961 + "type": "elasticsearch",
962 + "uid": "replace_datasource_uid"
963 + },
964 + "metrics": [
965 + {
966 + "$$hashKey": "object:329",
967 + "field": "select field",
968 + "id": "1",
969 + "type": "count"
970 + }
971 + ],
972 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
973 + "refId": "A",
974 + "timeField": "timestamp"
975 + }
976 + ],
977 + "title": "EVENTS (Total)",
978 + "type": "stat"
979 + },
980 + {
981 + "datasource": {
982 + "type": "elasticsearch",
983 + "uid": "replace_datasource_uid"
984 + },
985 + "fieldConfig": {
986 + "defaults": {
987 + "mappings": [
988 + {
989 + "options": {
990 + "match": "null",
991 + "result": {
992 + "text": "N/A"
993 + }
994 + },
995 + "type": "special"
996 + }
997 + ],
998 + "thresholds": {
999 + "mode": "absolute",
1000 + "steps": [
1001 + {
1002 + "color": "red",
1003 + "value": null
1004 + }
1005 + ]
1006 + },
1007 + "unit": "locale"
1008 + },
1009 + "overrides": []
1010 + },
1011 + "gridPos": {
1012 + "h": 6,
1013 + "w": 4,
1014 + "x": 0,
1015 + "y": 20
1016 + },
1017 + "id": 52,
1018 + "links": [],
1019 + "options": {
1020 + "colorMode": "value",
1021 + "graphMode": "area",
1022 + "justifyMode": "auto",
1023 + "orientation": "horizontal",
1024 + "reduceOptions": {
1025 + "calcs": [
1026 + "sum"
1027 + ],
1028 + "fields": "",
1029 + "values": false
1030 + },
1031 + "text": {},
1032 + "textMode": "auto"
1033 + },
1034 + "pluginVersion": "10.2.0",
1035 + "targets": [
1036 + {
1037 + "bucketAggs": [
1038 + {
1039 + "$$hashKey": "object:331",
1040 + "field": "timestamp",
1041 + "id": "2",
1042 + "settings": {
1043 + "interval": "auto",
1044 + "min_doc_count": 0,
1045 + "trimEdges": 0
1046 + },
1047 + "type": "date_histogram"
1048 + }
1049 + ],
1050 + "datasource": {
1051 + "type": "elasticsearch",
1052 + "uid": "replace_datasource_uid"
1053 + },
1054 + "metrics": [
1055 + {
1056 + "$$hashKey": "object:329",
1057 + "field": "select field",
1058 + "id": "1",
1059 + "type": "count"
1060 + }
1061 + ],
1062 + "query": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
1063 + "refId": "A",
1064 + "timeField": "timestamp"
1065 + }
1066 + ],
1067 + "title": "AZURE AD - FAILED AUTHS",
1068 + "type": "stat"
1069 + },
1070 + {
1071 + "circleMaxSize": 30,
1072 + "circleMinSize": 2,
1073 + "colors": [
1074 + "rgba(245, 54, 54, 0.9)",
1075 + "rgba(237, 129, 40, 0.89)",
1076 + "rgba(50, 172, 45, 0.97)"
1077 + ],
1078 + "datasource": {
1079 + "type": "elasticsearch",
1080 + "uid": "replace_datasource_uid"
1081 + },
1082 + "decimals": 0,
1083 + "esMetric": "Count",
1084 + "gridPos": {
1085 + "h": 12,
1086 + "w": 10,
1087 + "x": 4,
1088 + "y": 20
1089 + },
1090 + "hideEmpty": false,
1091 + "hideZero": false,
1092 + "id": 50,
1093 + "initialZoom": 1,
1094 + "locationData": "countries",
1095 + "mapCenter": "(0°, 0°)",
1096 + "mapCenterLatitude": 0,
1097 + "mapCenterLongitude": 0,
1098 + "maxDataPoints": 1,
1099 + "mouseWheelZoom": false,
1100 + "showLegend": true,
1101 + "stickyLabels": false,
1102 + "tableQueryOptions": {
1103 + "geohashField": "geohash",
1104 + "latitudeField": "latitude",
1105 + "longitudeField": "longitude",
1106 + "metricField": "metric",
1107 + "queryType": "geohash"
1108 + },
1109 + "targets": [
1110 + {
1111 + "bucketAggs": [
1112 + {
1113 + "fake": true,
1114 + "field": "data_office365_ActorIpAddress_country_code",
1115 + "id": "3",
1116 + "settings": {
1117 + "min_doc_count": 1,
1118 + "order": "desc",
1119 + "orderBy": "_term",
1120 + "size": "0"
1121 + },
1122 + "type": "terms"
1123 + },
1124 + {
1125 + "field": "timestamp",
1126 + "id": "2",
1127 + "settings": {
1128 + "interval": "auto",
1129 + "min_doc_count": 0,
1130 + "trimEdges": 0
1131 + },
1132 + "type": "date_histogram"
1133 + }
1134 + ],
1135 + "datasource": {
1136 + "type": "elasticsearch",
1137 + "uid": "replace_datasource_uid"
1138 + },
1139 + "metrics": [
1140 + {
1141 + "field": "select field",
1142 + "id": "1",
1143 + "type": "count"
1144 + }
1145 + ],
1146 + "query": "data_office365_Workload:AzureActiveDirectory AND rule_level:$rule_level",
1147 + "refId": "A",
1148 + "timeField": "timestamp"
1149 + }
1150 + ],
1151 + "thresholds": "0,10",
1152 + "title": "AZURE AD - ALL AUTH EVENTS BY COUNTRY",
1153 + "type": "grafana-worldmap-panel",
1154 + "unitPlural": "",
1155 + "unitSingle": "",
1156 + "valueName": "total"
1157 + },
1158 + {
1159 + "datasource": {
1160 + "type": "elasticsearch",
1161 + "uid": "replace_datasource_uid"
1162 + },
1163 + "fieldConfig": {
1164 + "defaults": {
1165 + "color": {
1166 + "mode": "thresholds"
1167 + },
1168 + "custom": {
1169 + "align": "auto",
1170 + "cellOptions": {
1171 + "type": "auto"
1172 + },
1173 + "inspect": false
1174 + },
1175 + "mappings": [],
1176 + "thresholds": {
1177 + "mode": "absolute",
1178 + "steps": [
1179 + {
1180 + "color": "orange",
1181 + "value": null
1182 + }
1183 + ]
1184 + }
1185 + },
1186 + "overrides": [
1187 + {
1188 + "matcher": {
1189 + "id": "byName",
1190 + "options": "Count"
1191 + },
1192 + "properties": [
1193 + {
1194 + "id": "displayName",
1195 + "value": "EVENTS"
1196 + },
1197 + {
1198 + "id": "unit",
1199 + "value": "short"
1200 + },
1201 + {
1202 + "id": "decimals",
1203 + "value": -1
1204 + },
1205 + {
1206 + "id": "custom.align"
1207 + },
1208 + {
1209 + "id": "custom.cellOptions",
1210 + "value": {
1211 + "type": "color-text"
1212 + }
1213 + }
1214 + ]
1215 + },
1216 + {
1217 + "matcher": {
1218 + "id": "byName",
1219 + "options": "AD ACCOUNT"
1220 + },
1221 + "properties": [
1222 + {
1223 + "id": "custom.width",
1224 + "value": 489
1225 + },
1226 + {
1227 + "id": "custom.cellOptions",
1228 + "value": {
1229 + "type": "color-text"
1230 + }
1231 + }
1232 + ]
1233 + }
1234 + ]
1235 + },
1236 + "gridPos": {
1237 + "h": 12,
1238 + "w": 10,
1239 + "x": 14,
1240 + "y": 20
1241 + },
1242 + "id": 55,
1243 + "options": {
1244 + "cellHeight": "sm",
1245 + "footer": {
1246 + "countRows": false,
1247 + "fields": "",
1248 + "reducer": [
1249 + "sum"
1250 + ],
1251 + "show": false
1252 + },
1253 + "showHeader": true,
1254 + "sortBy": []
1255 + },
1256 + "pluginVersion": "10.2.0",
1257 + "targets": [
1258 + {
1259 + "bucketAggs": [
1260 + {
1261 + "fake": true,
1262 + "field": "data_office365_UserId",
1263 + "id": "4",
1264 + "settings": {
1265 + "min_doc_count": 1,
1266 + "order": "desc",
1267 + "orderBy": "_count",
1268 + "size": "0"
1269 + },
1270 + "type": "terms"
1271 + }
1272 + ],
1273 + "datasource": {
1274 + "type": "elasticsearch",
1275 + "uid": "replace_datasource_uid"
1276 + },
1277 + "metrics": [
1278 + {
1279 + "field": "select field",
1280 + "id": "1",
1281 + "type": "count"
1282 + }
1283 + ],
1284 + "query": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
1285 + "refId": "A",
1286 + "timeField": "timestamp"
1287 + }
1288 + ],
1289 + "title": "FAILED AUTHS BY ACCOUNT",
1290 + "transformations": [
1291 + {
1292 + "id": "merge",
1293 + "options": {
1294 + "reducers": []
1295 + }
1296 + },
1297 + {
1298 + "id": "organize",
1299 + "options": {
1300 + "excludeByName": {},
1301 + "indexByName": {},
1302 + "renameByName": {
1303 + "Count": "EVENTS",
1304 + "data_office365_Operation": "OPERATION",
1305 + "data_office365_UserId": "AD ACCOUNT",
1306 + "data_office365_Workload": "WORKLOAD"
1307 + }
1308 + }
1309 + }
1310 + ],
1311 + "type": "table"
1312 + },
1313 + {
1314 + "datasource": {
1315 + "type": "elasticsearch",
1316 + "uid": "replace_datasource_uid"
1317 + },
1318 + "fieldConfig": {
1319 + "defaults": {
1320 + "mappings": [
1321 + {
1322 + "options": {
1323 + "match": "null",
1324 + "result": {
1325 + "text": "N/A"
1326 + }
1327 + },
1328 + "type": "special"
1329 + }
1330 + ],
1331 + "thresholds": {
1332 + "mode": "absolute",
1333 + "steps": [
1334 + {
1335 + "color": "blue",
1336 + "value": null
1337 + }
1338 + ]
1339 + },
1340 + "unit": "locale"
1341 + },
1342 + "overrides": []
1343 + },
1344 + "gridPos": {
1345 + "h": 6,
1346 + "w": 4,
1347 + "x": 0,
1348 + "y": 26
1349 + },
1350 + "id": 18,
1351 + "links": [],
1352 + "options": {
1353 + "colorMode": "value",
1354 + "graphMode": "area",
1355 + "justifyMode": "auto",
1356 + "orientation": "horizontal",
1357 + "reduceOptions": {
1358 + "calcs": [
1359 + "sum"
1360 + ],
1361 + "fields": "",
1362 + "values": false
1363 + },
1364 + "text": {},
1365 + "textMode": "auto"
1366 + },
1367 + "pluginVersion": "10.2.0",
1368 + "targets": [
1369 + {
1370 + "bucketAggs": [
1371 + {
1372 + "$$hashKey": "object:331",
1373 + "field": "timestamp",
1374 + "id": "2",
1375 + "settings": {
1376 + "interval": "auto",
1377 + "min_doc_count": 0,
1378 + "trimEdges": 0
1379 + },
1380 + "type": "date_histogram"
1381 + }
1382 + ],
1383 + "datasource": {
1384 + "type": "elasticsearch",
1385 + "uid": "replace_datasource_uid"
1386 + },
1387 + "metrics": [
1388 + {
1389 + "$$hashKey": "object:329",
1390 + "field": "select field",
1391 + "id": "1",
1392 + "type": "count"
1393 + }
1394 + ],
1395 + "query": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoggedIn AND rule_level:$rule_level",
1396 + "refId": "A",
1397 + "timeField": "timestamp"
1398 + }
1399 + ],
1400 + "title": "AZURE AD - TOTAL AUTHS",
1401 + "type": "stat"
1402 + },
1403 + {
1404 + "datasource": {
1405 + "type": "elasticsearch",
1406 + "uid": "replace_datasource_uid"
1407 + },
1408 + "fieldConfig": {
1409 + "defaults": {
1410 + "color": {
1411 + "mode": "thresholds"
1412 + },
1413 + "custom": {
1414 + "align": "auto",
1415 + "cellOptions": {
1416 + "type": "auto"
1417 + },
1418 + "filterable": true,
1419 + "inspect": false
1420 + },
1421 + "mappings": [],
1422 + "thresholds": {
1423 + "mode": "absolute",
1424 + "steps": [
1425 + {
1426 + "color": "green",
1427 + "value": null
1428 + },
1429 + {
1430 + "color": "red",
1431 + "value": 80
1432 + }
1433 + ]
1434 + }
1435 + },
1436 + "overrides": [
1437 + {
1438 + "matcher": {
1439 + "id": "byName",
1440 + "options": "timestamp"
1441 + },
1442 + "properties": [
1443 + {
1444 + "id": "displayName",
1445 + "value": "Date/Time"
1446 + },
1447 + {
1448 + "id": "unit",
1449 + "value": "time: YYYY-MM-DD HH:mm:ss"
1450 + },
1451 + {
1452 + "id": "custom.align"
1453 + }
1454 + ]
1455 + },
1456 + {
1457 + "matcher": {
1458 + "id": "byName",
1459 + "options": "agent_name"
1460 + },
1461 + "properties": [
1462 + {
1463 + "id": "displayName",
1464 + "value": "AGENT"
1465 + },
1466 + {
1467 + "id": "unit",
1468 + "value": "short"
1469 + },
1470 + {
1471 + "id": "decimals",
1472 + "value": 2
1473 + },
1474 + {
1475 + "id": "custom.align"
1476 + }
1477 + ]
1478 + },
1479 + {
1480 + "matcher": {
1481 + "id": "byName",
1482 + "options": "agent_ip"
1483 + },
1484 + "properties": [
1485 + {
1486 + "id": "displayName",
1487 + "value": "IP ADDRESS"
1488 + },
1489 + {
1490 + "id": "unit",
1491 + "value": "short"
1492 + },
1493 + {
1494 + "id": "decimals",
1495 + "value": 2
1496 + },
1497 + {
1498 + "id": "custom.align"
1499 + }
1500 + ]
1501 + },
1502 + {
1503 + "matcher": {
1504 + "id": "byName",
1505 + "options": "rule_level"
1506 + },
1507 + "properties": [
1508 + {
1509 + "id": "displayName",
1510 + "value": "RULE LEVEL"
1511 + },
1512 + {
1513 + "id": "unit",
1514 + "value": "short"
1515 + },
1516 + {
1517 + "id": "decimals",
1518 + "value": -1
1519 + },
1520 + {
1521 + "id": "custom.cellOptions",
1522 + "value": {
1523 + "mode": "gradient",
1524 + "type": "color-background"
1525 + }
1526 + },
1527 + {
1528 + "id": "custom.align"
1529 + },
1530 + {
1531 + "id": "thresholds",
1532 + "value": {
1533 + "mode": "absolute",
1534 + "steps": [
1535 + {
1536 + "color": "#37872D",
1537 + "value": null
1538 + },
1539 + {
1540 + "color": "rgba(237, 129, 40, 0.89)",
1541 + "value": 7
1542 + },
1543 + {
1544 + "color": "rgba(245, 54, 54, 0.9)",
1545 + "value": 12
1546 + }
1547 + ]
1548 + }
1549 + }
1550 + ]
1551 + },
1552 + {
1553 + "matcher": {
1554 + "id": "byName",
1555 + "options": "rule_description"
1556 + },
1557 + "properties": [
1558 + {
1559 + "id": "displayName",
1560 + "value": "RULE DESCRIPTION"
1561 + },
1562 + {
1563 + "id": "unit",
1564 + "value": "short"
1565 + },
1566 + {
1567 + "id": "decimals",
1568 + "value": 2
1569 + },
1570 + {
1571 + "id": "custom.align"
1572 + }
1573 + ]
1574 + },
1575 + {
1576 + "matcher": {
1577 + "id": "byName",
1578 + "options": "Date/Time"
1579 + },
1580 + "properties": [
1581 + {
1582 + "id": "custom.width",
1583 + "value": 242
1584 + }
1585 + ]
1586 + },
1587 + {
1588 + "matcher": {
1589 + "id": "byName",
1590 + "options": "AGENT"
1591 + },
1592 + "properties": [
1593 + {
1594 + "id": "custom.width",
1595 + "value": 160
1596 + }
1597 + ]
1598 + },
1599 + {
1600 + "matcher": {
1601 + "id": "byName",
1602 + "options": "MITRE TACTIC"
1603 + },
1604 + "properties": [
1605 + {
1606 + "id": "custom.width",
1607 + "value": 206
1608 + }
1609 + ]
1610 + },
1611 + {
1612 + "matcher": {
1613 + "id": "byName",
1614 + "options": "RULE LEVEL"
1615 + },
1616 + "properties": [
1617 + {
1618 + "id": "custom.width",
1619 + "value": 122
1620 + }
1621 + ]
1622 + },
1623 + {
1624 + "matcher": {
1625 + "id": "byName",
1626 + "options": "IP ADDRESS"
1627 + },
1628 + "properties": [
1629 + {
1630 + "id": "custom.width",
1631 + "value": 163
1632 + }
1633 + ]
1634 + },
1635 + {
1636 + "matcher": {
1637 + "id": "byName",
1638 + "options": "MITRE TECHNIQUE"
1639 + },
1640 + "properties": [
1641 + {
1642 + "id": "custom.width",
1643 + "value": 312
1644 + }
1645 + ]
1646 + },
1647 + {
1648 + "matcher": {
1649 + "id": "byName",
1650 + "options": "rule_id"
1651 + },
1652 + "properties": [
1653 + {
1654 + "id": "custom.width",
1655 + "value": 96
1656 + }
1657 + ]
1658 + },
1659 + {
1660 + "matcher": {
1661 + "id": "byName",
1662 + "options": "EVENT ID"
1663 + },
1664 + "properties": [
1665 + {
1666 + "id": "links",
1667 + "value": [
1668 + {
1669 + "targetBlank": true,
1670 + "title": "VIEW EVENT DETAILS",
1671 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1672 + }
1673 + ]
1674 + },
1675 + {
1676 + "id": "custom.width",
1677 + "value": 317
1678 + }
1679 + ]
1680 + },
1681 + {
1682 + "matcher": {
1683 + "id": "byName",
1684 + "options": "MITRE ID"
1685 + },
1686 + "properties": [
1687 + {
1688 + "id": "custom.width",
1689 + "value": 146
1690 + }
1691 + ]
1692 + },
1693 + {
1694 + "matcher": {
1695 + "id": "byName",
1696 + "options": "RULE DESCRIPTION"
1697 + },
1698 + "properties": [
1699 + {
1700 + "id": "custom.width",
1701 + "value": 1105
1702 + }
1703 + ]
1704 + },
1705 + {
1706 + "matcher": {
1707 + "id": "byName",
1708 + "options": "LEVEL"
1709 + },
1710 + "properties": [
1711 + {
1712 + "id": "custom.width",
1713 + "value": 112
1714 + }
1715 + ]
1716 + }
1717 + ]
1718 + },
1719 + "gridPos": {
1720 + "h": 16,
1721 + "w": 24,
1722 + "x": 0,
1723 + "y": 32
1724 + },
1725 + "id": 27,
1726 + "options": {
1727 + "cellHeight": "sm",
1728 + "footer": {
1729 + "countRows": false,
1730 + "enablePagination": true,
1731 + "fields": "",
1732 + "reducer": [
1733 + "sum"
1734 + ],
1735 + "show": false
1736 + },
1737 + "showHeader": true,
1738 + "sortBy": []
1739 + },
1740 + "pluginVersion": "10.2.0",
1741 + "targets": [
1742 + {
1743 + "bucketAggs": [],
1744 + "datasource": {
1745 + "type": "elasticsearch",
1746 + "uid": "replace_datasource_uid"
1747 + },
1748 + "metrics": [
1749 + {
1750 + "id": "1",
1751 + "settings": {
1752 + "size": "250"
1753 + },
1754 + "type": "raw_data"
1755 + }
1756 + ],
1757 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1758 + "refId": "A",
1759 + "timeField": "timestamp"
1760 + }
1761 + ],
1762 + "title": "EVENTS",
1763 + "transformations": [
1764 + {
1765 + "id": "filterFieldsByName",
1766 + "options": {
1767 + "include": {
1768 + "names": [
1769 + "timestamp",
1770 + "_id",
1771 + "data_office365_Operation",
1772 + "data_office365_Workload",
1773 + "rule_description",
1774 + "rule_mitre_id",
1775 + "rule_mitre_tactic",
1776 + "rule_mitre_technique",
1777 + "syslog_level"
1778 + ]
1779 + }
1780 + }
1781 + },
1782 + {
1783 + "id": "organize",
1784 + "options": {
1785 + "excludeByName": {
1786 + "@metadata_beat": true,
1787 + "@metadata_type": true,
1788 + "@metadata_version": true,
1789 + "IMPHASH": true,
1790 + "MD5": true,
1791 + "SHA1": true,
1792 + "SHA256": true,
1793 + "_id": false,
1794 + "_index": true,
1795 + "_type": true,
1796 + "agent_ephemeral_id": true,
1797 + "agent_hostname": true,
1798 + "agent_id": true,
1799 + "agent_ip_city_name": true,
1800 + "agent_ip_country_code": true,
1801 + "agent_ip_geolocation": true,
1802 + "agent_name": true,
1803 + "agent_type": true,
1804 + "agent_version": true,
1805 + "beats_type": true,
1806 + "cluster_name": true,
1807 + "cluster_node": true,
1808 + "collector_node_id": true,
1809 + "data_alert_action": true,
1810 + "data_alert_category": true,
1811 + "data_alert_gid": true,
1812 + "data_alert_rev": true,
1813 + "data_alert_severity": true,
1814 + "data_alert_signature": true,
1815 + "data_alert_signature_id": true,
1816 + "data_app_proto": true,
1817 + "data_audit_auid": true,
1818 + "data_audit_command": true,
1819 + "data_audit_euid": true,
1820 + "data_audit_exe": true,
1821 + "data_audit_gid": true,
1822 + "data_audit_id": true,
1823 + "data_audit_pid": true,
1824 + "data_audit_res": true,
1825 + "data_audit_session": true,
1826 + "data_audit_type": true,
1827 + "data_audit_uid": true,
1828 + "data_dest_ip": true,
1829 + "data_dest_port": true,
1830 + "data_dstuser": true,
1831 + "data_event_type": true,
1832 + "data_extra_data": true,
1833 + "data_file": true,
1834 + "data_flow_bytes_toclient": true,
1835 + "data_flow_bytes_toserver": true,
1836 + "data_flow_id": true,
1837 + "data_flow_pkts_toclient": true,
1838 + "data_flow_pkts_toserver": true,
1839 + "data_flow_start": true,
1840 + "data_http_http_content_type": true,
1841 + "data_http_http_port": true,
1842 + "data_http_length": true,
1843 + "data_http_status": true,
1844 + "data_http_url": true,
1845 + "data_id": true,
1846 + "data_in_iface": true,
1847 + "data_metadata_flowbits": true,
1848 + "data_metadata_flowints_http_anomaly_count": true,
1849 + "data_metadata_flowints_tcp_retransmission_count": true,
1850 + "data_office365_AADGroupId": true,
1851 + "data_office365_AadAppId": true,
1852 + "data_office365_Action": true,
1853 + "data_office365_Activity": true,
1854 + "data_office365_ActivityId": true,
1855 + "data_office365_ActivityParameters": true,
1856 + "data_office365_Actor": true,
1857 + "data_office365_ActorContextId": true,
1858 + "data_office365_ActorIpAddress": true,
1859 + "data_office365_ActorIpAddress_city_name": true,
1860 + "data_office365_ActorIpAddress_country_code": true,
1861 + "data_office365_ActorIpAddress_geolocation": true,
1862 + "data_office365_ActorUserId": true,
1863 + "data_office365_ActorYammerUserId": true,
1864 + "data_office365_AddOnGuid": true,
1865 + "data_office365_AddOnName": true,
1866 + "data_office365_AddOnType": true,
1867 + "data_office365_AdditionalActionsAndResults": true,
1868 + "data_office365_AdditionalData": true,
1869 + "data_office365_AdditionalInfo": true,
1870 + "data_office365_AffectedItems": true,
1871 + "data_office365_AggregatedWorkspaceInformation_WorkspaceCount": true,
1872 + "data_office365_AggregatedWorkspaceInformation_WorkspacesByCapacitySku": true,
1873 + "data_office365_AggregatedWorkspaceInformation_WorkspacesByType": true,
1874 + "data_office365_AlertEntityId": true,
1875 + "data_office365_AlertId": true,
1876 + "data_office365_AlertLinks": true,
1877 + "data_office365_AlertType": true,
1878 + "data_office365_AppAccessContext_AADSessionId": true,
1879 + "data_office365_AppAccessContext_APIId": true,
1880 + "data_office365_AppAccessContext_ClientAppId": true,
1881 + "data_office365_AppAccessContext_ClientAppName": true,
1882 + "data_office365_AppAccessContext_CorrelationId": true,
1883 + "data_office365_AppAccessContext_UniqueTokenId": true,
1884 + "data_office365_AppDistributionMode": true,
1885 + "data_office365_AppId": true,
1886 + "data_office365_AppName": true,
1887 + "data_office365_AppReportId": true,
1888 + "data_office365_ApplicationDisplayName": true,
1889 + "data_office365_ApplicationId": true,
1890 + "data_office365_ArtifactsShared": true,
1891 + "data_office365_AssertingApplicationId": true,
1892 + "data_office365_Attendees": true,
1893 + "data_office365_AuthDetails": true,
1894 + "data_office365_AzureADAppId": true,
1895 + "data_office365_AzureActiveDirectoryEventType": true,
1896 + "data_office365_BCLValue": true,
1897 + "data_office365_CapacityId": true,
1898 + "data_office365_CapacityName": true,
1899 + "data_office365_Category": true,
1900 + "data_office365_ChannelGuid": true,
1901 + "data_office365_ChannelName": true,
1902 + "data_office365_ChatName": true,
1903 + "data_office365_ChatThreadId": true,
1904 + "data_office365_ClientAppId": true,
1905 + "data_office365_ClientApplication": true,
1906 + "data_office365_ClientApplicationId": true,
1907 + "data_office365_ClientIP": true,
1908 + "data_office365_ClientIPAddress": true,
1909 + "data_office365_ClientIPAddress_city_name": true,
1910 + "data_office365_ClientIPAddress_country_code": true,
1911 + "data_office365_ClientIPAddress_geolocation": true,
1912 + "data_office365_ClientIP_city_name": true,
1913 + "data_office365_ClientIP_country_code": true,
1914 + "data_office365_ClientIP_geolocation": true,
1915 + "data_office365_ClientInfoString": true,
1916 + "data_office365_ClientProcessName": true,
1917 + "data_office365_ClientRequestId": true,
1918 + "data_office365_ClientVersion": true,
1919 + "data_office365_CmdletVersion": true,
1920 + "data_office365_Comments": true,
1921 + "data_office365_Common_ApplicationId": true,
1922 + "data_office365_Common_ApplicationName": true,
1923 + "data_office365_Common_DeviceName": true,
1924 + "data_office365_Common_Platform": true,
1925 + "data_office365_Common_ProcessName": true,
1926 + "data_office365_Common_ProductVersion": true,
1927 + "data_office365_CommunicationSubType": true,
1928 + "data_office365_CommunicationType": true,
1929 + "data_office365_ConsumptionMethod": true,
1930 + "data_office365_CorrelationId": true,
1931 + "data_office365_CreationTime": false,
1932 + "data_office365_CrossMailboxOperation": true,
1933 + "data_office365_CrossScopeSyncDelete": true,
1934 + "data_office365_CustomData": true,
1935 + "data_office365_CustomUniqueId": true,
1936 + "data_office365_CustomizedDoclib": true,
1937 + "data_office365_DashboardId": true,
1938 + "data_office365_DashboardName": true,
1939 + "data_office365_Data": true,
1940 + "data_office365_DataConnectivityMode": true,
1941 + "data_office365_DataType": true,
1942 + "data_office365_DatabaseType": true,
1943 + "data_office365_DataflowAccessTokenRequestParameters_entityName": true,
1944 + "data_office365_DataflowAccessTokenRequestParameters_partitionUri": true,
1945 + "data_office365_DataflowAccessTokenRequestParameters_permissions": true,
1946 + "data_office365_DataflowAccessTokenRequestParameters_tokenLifetimeInMinutes": true,
1947 + "data_office365_DataflowId": true,
1948 + "data_office365_DataflowName": true,
1949 + "data_office365_DataflowType": true,
1950 + "data_office365_DatasetId": true,
1951 + "data_office365_DatasetName": true,
1952 + "data_office365_Datasets": true,
1953 + "data_office365_DatasourceId": true,
1954 + "data_office365_DeliveryAction": true,
1955 + "data_office365_Description": true,
1956 + "data_office365_DestFolder_Id": true,
1957 + "data_office365_DestFolder_Path": true,
1958 + "data_office365_DestinationFileExtension": true,
1959 + "data_office365_DestinationFileName": true,
1960 + "data_office365_DestinationRelativeUrl": true,
1961 + "data_office365_DetectionMethod": true,
1962 + "data_office365_DetectionType": true,
1963 + "data_office365_DeviceId": true,
1964 + "data_office365_DeviceInformation": true,
1965 + "data_office365_DeviceProperties": true,
1966 + "data_office365_Directionality": true,
1967 + "data_office365_DistributionMethod": true,
1968 + "data_office365_DoNotDistributeEvent": true,
1969 + "data_office365_EffectiveOrganization": true,
1970 + "data_office365_EndTime": true,
1971 + "data_office365_Entity": true,
1972 + "data_office365_EntityPath": true,
1973 + "data_office365_EntityType": true,
1974 + "data_office365_ErrorNumber": true,
1975 + "data_office365_EventData": true,
1976 + "data_office365_EventDeepLink": true,
1977 + "data_office365_EventSource": true,
1978 + "data_office365_ExceptionInfo_Reason": true,
1979 + "data_office365_ExchangeId": true,
1980 + "data_office365_ExchangeLocations": true,
1981 + "data_office365_ExchangeMetaData_BCC": true,
1982 + "data_office365_ExchangeMetaData_CC": true,
1983 + "data_office365_ExchangeMetaData_FileSize": true,
1984 + "data_office365_ExchangeMetaData_From": true,
1985 + "data_office365_ExchangeMetaData_MessageID": true,
1986 + "data_office365_ExchangeMetaData_RecipientCount": true,
1987 + "data_office365_ExchangeMetaData_Sent": true,
1988 + "data_office365_ExchangeMetaData_Subject": true,
1989 + "data_office365_ExchangeMetaData_To": true,
1990 + "data_office365_ExchangeMetaData_UniqueID": true,
1991 + "data_office365_ExportedArtifactInfo_ArtifactId": true,
1992 + "data_office365_ExportedArtifactInfo_ArtifactType": true,
1993 + "data_office365_ExportedArtifactInfo_ExportType": true,
1994 + "data_office365_ExtendedProperties": true,
1995 + "data_office365_ExternalAccess": true,
1996 + "data_office365_ExtraProperties": true,
1997 + "data_office365_FileId": true,
1998 + "data_office365_FileName": true,
1999 + "data_office365_FileSizeBytes": true,
2000 + "data_office365_FileSyncBytesCommitted": true,
2001 + "data_office365_FilteringDate": true,
2002 + "data_office365_FlowConnectorNames": true,
2003 + "data_office365_FlowDetailsUrl": true,
2004 + "data_office365_Folder_Id": true,
2005 + "data_office365_Folder_Path": true,
2006 + "data_office365_FormId": true,
2007 + "data_office365_FormName": true,
2008 + "data_office365_FormsUserType": true,
2009 + "data_office365_FromApp": true,
2010 + "data_office365_GatewayClusterDatasources": true,
2011 + "data_office365_GatewayClusterId": true,
2012 + "data_office365_GatewayClusters": true,
2013 + "data_office365_GatewayStatus": true,
2014 + "data_office365_GradingResult_FirstTriagedBy": true,
2015 + "data_office365_GradingResult_Id": true,
2016 + "data_office365_GradingResult_LastUpdatedBy": true,
2017 + "data_office365_GradingResult_Timestamp": true,
2018 + "data_office365_GradingResult_TriageCategory": true,
2019 + "data_office365_GradingResult_TriageVerdict": true,
2020 + "data_office365_HighPriorityMediaProcessing": true,
2021 + "data_office365_HostedContents": true,
2022 + "data_office365_ICalUid": true,
2023 + "data_office365_Id": true,
2024 + "data_office365_ImplicitShare": true,
2025 + "data_office365_ImportDisplayName": true,
2026 + "data_office365_ImportId": true,
2027 + "data_office365_ImportSource": true,
2028 + "data_office365_ImportType": true,
2029 + "data_office365_IncidentId": true,
2030 + "data_office365_InsightData": true,
2031 + "data_office365_InsightId": true,
2032 + "data_office365_InterSystemsId": true,
2033 + "data_office365_InternalLogonType": true,
2034 + "data_office365_InternetMessageId": true,
2035 + "data_office365_IntraSystemId": true,
2036 + "data_office365_IsManagedDevice": true,
2037 + "data_office365_IsSuccess": true,
2038 + "data_office365_IsTenantAdminApi": true,
2039 + "data_office365_ItemCount": true,
2040 + "data_office365_ItemName": true,
2041 + "data_office365_ItemType": true,
2042 + "data_office365_Item_Attachments": true,
2043 + "data_office365_Item_Id": true,
2044 + "data_office365_Item_InternetMessageId": true,
2045 + "data_office365_Item_IsRecord": true,
2046 + "data_office365_Item_ParentFolder_Id": true,
2047 + "data_office365_Item_ParentFolder_Path": true,
2048 + "data_office365_Item_SizeInBytes": true,
2049 + "data_office365_Item_Subject": true,
2050 + "data_office365_JoinTime": true,
2051 + "data_office365_KesMailId": true,
2052 + "data_office365_Language": true,
2053 + "data_office365_LastRefreshTime": true,
2054 + "data_office365_LatestDeliveryLocation": true,
2055 + "data_office365_LeaveTime": true,
2056 + "data_office365_ListBaseTemplateType": true,
2057 + "data_office365_ListBaseType": true,
2058 + "data_office365_ListId": true,
2059 + "data_office365_ListItemUniqueId": true,
2060 + "data_office365_ListTitle": true,
2061 + "data_office365_LogonError": true,
2062 + "data_office365_LogonType": true,
2063 + "data_office365_LogonUserSid": true,
2064 + "data_office365_MachineDomainInfo": true,
2065 + "data_office365_MachineId": true,
2066 + "data_office365_MailboxGuid": true,
2067 + "data_office365_MailboxOwnerSid": true,
2068 + "data_office365_MailboxOwnerUPN": true,
2069 + "data_office365_MeetingDetailId": true,
2070 + "data_office365_MeetingURL": true,
2071 + "data_office365_Members": true,
2072 + "data_office365_MessageDate": true,
2073 + "data_office365_MessageDeleteType": true,
2074 + "data_office365_MessageId": true,
2075 + "data_office365_MessageSizeInBytes": true,
2076 + "data_office365_MessageTime": true,
2077 + "data_office365_MessageURLs": true,
2078 + "data_office365_MessageVersion": true,
2079 + "data_office365_Modalities": true,
2080 + "data_office365_ModelsSnapshots": true,
2081 + "data_office365_ModifiedProperties": true,
2082 + "data_office365_Name": true,
2083 + "data_office365_NetworkMessageId": true,
2084 + "data_office365_NewValue": true,
2085 + "data_office365_NonPIIParameters": true,
2086 + "data_office365_ObjectId": true,
2087 + "data_office365_ObjectName": true,
2088 + "data_office365_ObjectType": true,
2089 + "data_office365_Operation": false,
2090 + "data_office365_OperationDetails": true,
2091 + "data_office365_OperationScope": true,
2092 + "data_office365_OrgAppPermission_permissions": true,
2093 + "data_office365_OrgAppPermission_recipients": true,
2094 + "data_office365_OrganizationId": true,
2095 + "data_office365_OrganizationName": true,
2096 + "data_office365_Organizer_OrganizationId": true,
2097 + "data_office365_Organizer_RecipientType": true,
2098 + "data_office365_Organizer_Role": true,
2099 + "data_office365_Organizer_UserObjectId": true,
2100 + "data_office365_OriginalDeliveryLocation": true,
2101 + "data_office365_OriginatingServer": true,
2102 + "data_office365_P1Sender": true,
2103 + "data_office365_P1SenderDomain": true,
2104 + "data_office365_P2Sender": true,
2105 + "data_office365_P2SenderDomain": true,
2106 + "data_office365_Parameters": true,
2107 + "data_office365_ParentMessageId": true,
2108 + "data_office365_PhishConfidenceLevel": true,
2109 + "data_office365_Policy": true,
2110 + "data_office365_PolicyAction": true,
2111 + "data_office365_PolicyDetails": true,
2112 + "data_office365_PolicyId": true,
2113 + "data_office365_ProviderTypes": true,
2114 + "data_office365_Query": true,
2115 + "data_office365_Recipients": true,
2116 + "data_office365_RecordType": true,
2117 + "data_office365_RefreshType": true,
2118 + "data_office365_RelativeUrl": true,
2119 + "data_office365_ReportId": true,
2120 + "data_office365_ReportName": true,
2121 + "data_office365_ReportType": true,
2122 + "data_office365_RequestId": true,
2123 + "data_office365_RequestSource": true,
2124 + "data_office365_RequestType": true,
2125 + "data_office365_RescanResult_Id": true,
2126 + "data_office365_RescanResult_RescanVerdict": true,
2127 + "data_office365_RescanResult_Timestamp": true,
2128 + "data_office365_ResourceTitle": true,
2129 + "data_office365_ResourceUrl": true,
2130 + "data_office365_ResultCount": true,
2131 + "data_office365_ResultStatus": true,
2132 + "data_office365_Schedules_Days": true,
2133 + "data_office365_Schedules_RefreshFrequency": true,
2134 + "data_office365_Schedules_Time": true,
2135 + "data_office365_Schedules_TimeZone": true,
2136 + "data_office365_Scope": true,
2137 + "data_office365_SecurityComplianceCenterEventType": true,
2138 + "data_office365_SendAsUserMailboxGuid": true,
2139 + "data_office365_SendAsUserSmtp": true,
2140 + "data_office365_SenderIP": true,
2141 + "data_office365_SenderIP_city_name": true,
2142 + "data_office365_SenderIP_country_code": true,
2143 + "data_office365_SenderIP_geolocation": true,
2144 + "data_office365_SenderIp": true,
2145 + "data_office365_SenderIp_city_name": true,
2146 + "data_office365_SenderIp_country_code": true,
2147 + "data_office365_SenderIp_geolocation": true,
2148 + "data_office365_SensitiveInfoDetectionIsIncluded": true,
2149 + "data_office365_SessionId": true,
2150 + "data_office365_Severity": true,
2151 + "data_office365_SharePointMetaData_FileID": true,
2152 + "data_office365_SharePointMetaData_FileName": true,
2153 + "data_office365_SharePointMetaData_FileOwner": true,
2154 + "data_office365_SharePointMetaData_FilePathUrl": true,
2155 + "data_office365_SharePointMetaData_FileSize": true,
2156 + "data_office365_SharePointMetaData_From": true,
2157 + "data_office365_SharePointMetaData_IsViewableByExternalUsers": true,
2158 + "data_office365_SharePointMetaData_IsVisibleOnlyToOdbOwner": true,
2159 + "data_office365_SharePointMetaData_ItemCreationTime": true,
2160 + "data_office365_SharePointMetaData_ItemLastModifiedTime": true,
2161 + "data_office365_SharePointMetaData_ItemLastSharedTime": true,
2162 + "data_office365_SharePointMetaData_SiteCollectionGuid": true,
2163 + "data_office365_SharePointMetaData_SiteCollectionUrl": true,
2164 + "data_office365_SharePointMetaData_UniqueID": true,
2165 + "data_office365_SharingPermission": true,
2166 + "data_office365_Site": true,
2167 + "data_office365_SiteUrl": true,
2168 + "data_office365_SkypeForBusinessEventType": true,
2169 + "data_office365_Source": true,
2170 + "data_office365_SourceApp": true,
2171 + "data_office365_SourceFileExtension": true,
2172 + "data_office365_SourceFileName": true,
2173 + "data_office365_SourceRelativeUrl": true,
2174 + "data_office365_StartTime": true,
2175 + "data_office365_Status": true,
2176 + "data_office365_Subject": true,
2177 + "data_office365_SubmissionId": true,
2178 + "data_office365_SubmissionState": true,
2179 + "data_office365_SubmissionType": true,
2180 + "data_office365_SubscriptionId": true,
2181 + "data_office365_TabType": true,
2182 + "data_office365_Target": true,
2183 + "data_office365_TargetContextId": true,
2184 + "data_office365_TargetUserId": true,
2185 + "data_office365_TargetUserOrGroupName": true,
2186 + "data_office365_TargetUserOrGroupType": true,
2187 + "data_office365_TeamGuid": true,
2188 + "data_office365_TeamName": true,
2189 + "data_office365_TenantName": true,
2190 + "data_office365_ThreadID": true,
2191 + "data_office365_ThreatsAndDetectionTech": true,
2192 + "data_office365_UniqueSharingId": true,
2193 + "data_office365_UserAgent": true,
2194 + "data_office365_UserId": true,
2195 + "data_office365_UserKey": true,
2196 + "data_office365_UserType": true,
2197 + "data_office365_UserTypeInitiated": true,
2198 + "data_office365_UserUPN": true,
2199 + "data_office365_Verdict": true,
2200 + "data_office365_Version": true,
2201 + "data_office365_VersionId": true,
2202 + "data_office365_WebId": true,
2203 + "data_office365_WorkSpaceName": true,
2204 + "data_office365_Workload": false,
2205 + "data_office365_WorkspaceId": true,
2206 + "data_office365_YammerNetworkId": true,
2207 + "data_osquery_action": true,
2208 + "data_osquery_calendarTime": true,
2209 + "data_osquery_columns_address": true,
2210 + "data_osquery_columns_address_city_name": true,
2211 + "data_osquery_columns_address_country_code": true,
2212 + "data_osquery_columns_address_geolocation": true,
2213 + "data_osquery_columns_cmdline": true,
2214 + "data_osquery_columns_cwd": true,
2215 + "data_osquery_columns_description": true,
2216 + "data_osquery_columns_directory": true,
2217 + "data_osquery_columns_disk_bytes_read": true,
2218 + "data_osquery_columns_disk_bytes_written": true,
2219 + "data_osquery_columns_egid": true,
2220 + "data_osquery_columns_euid": true,
2221 + "data_osquery_columns_family": true,
2222 + "data_osquery_columns_fd": true,
2223 + "data_osquery_columns_gid": true,
2224 + "data_osquery_columns_gid_signed": true,
2225 + "data_osquery_columns_host": true,
2226 + "data_osquery_columns_interface": true,
2227 + "data_osquery_columns_local_address": true,
2228 + "data_osquery_columns_local_address_city_name": true,
2229 + "data_osquery_columns_local_address_country_code": true,
2230 + "data_osquery_columns_local_address_geolocation": true,
2231 + "data_osquery_columns_local_port": true,
2232 + "data_osquery_columns_mac": true,
2233 + "data_osquery_columns_name": true,
2234 + "data_osquery_columns_net_namespace": true,
2235 + "data_osquery_columns_nice": true,
2236 + "data_osquery_columns_on_disk": true,
2237 + "data_osquery_columns_parent": true,
2238 + "data_osquery_columns_path": true,
2239 + "data_osquery_columns_pgroup": true,
2240 + "data_osquery_columns_pid": true,
2241 + "data_osquery_columns_port": true,
2242 + "data_osquery_columns_protocol": true,
2243 + "data_osquery_columns_remote_address": true,
2244 + "data_osquery_columns_remote_address_city_name": true,
2245 + "data_osquery_columns_remote_address_country_code": true,
2246 + "data_osquery_columns_remote_address_geolocation": true,
2247 + "data_osquery_columns_remote_port": true,
2248 + "data_osquery_columns_resident_size": true,
2249 + "data_osquery_columns_root": true,
2250 + "data_osquery_columns_sgid": true,
2251 + "data_osquery_columns_shell": true,
2252 + "data_osquery_columns_socket": true,
2253 + "data_osquery_columns_start_time": true,
2254 + "data_osquery_columns_state": true,
2255 + "data_osquery_columns_suid": true,
2256 + "data_osquery_columns_system_time": true,
2257 + "data_osquery_columns_threads": true,
2258 + "data_osquery_columns_time_utc": true,
2259 + "data_osquery_columns_total_size": true,
2260 + "data_osquery_columns_tty": true,
2261 + "data_osquery_columns_type": true,
2262 + "data_osquery_columns_uid": true,
2263 + "data_osquery_columns_uid_signed": true,
2264 + "data_osquery_columns_user": true,
2265 + "data_osquery_columns_user_time": true,
2266 + "data_osquery_columns_username": true,
2267 + "data_osquery_columns_wired_size": true,
2268 + "data_osquery_counter": true,
2269 + "data_osquery_decorations_host_uuid": true,
2270 + "data_osquery_decorations_hostname": true,
2271 + "data_osquery_epoch": true,
2272 + "data_osquery_hostIdentifier": true,
2273 + "data_osquery_name": true,
2274 + "data_osquery_numerics": true,
2275 + "data_osquery_unixTime": true,
2276 + "data_proto": true,
2277 + "data_sca_check_command": true,
2278 + "data_sca_check_compliance_cis": true,
2279 + "data_sca_check_compliance_cis_csc": true,
2280 + "data_sca_check_compliance_gdpr_IV": true,
2281 + "data_sca_check_compliance_gpg_13": true,
2282 + "data_sca_check_compliance_hipaa": true,
2283 + "data_sca_check_compliance_nist_800_53": true,
2284 + "data_sca_check_compliance_pci_dss": true,
2285 + "data_sca_check_compliance_tsc": true,
2286 + "data_sca_check_description": true,
2287 + "data_sca_check_id": true,
2288 + "data_sca_check_previous_result": true,
2289 + "data_sca_check_rationale": true,
2290 + "data_sca_check_remediation": true,
2291 + "data_sca_check_result": true,
2292 + "data_sca_check_title": true,
2293 + "data_sca_description": true,
2294 + "data_sca_failed": true,
2295 + "data_sca_file": true,
2296 + "data_sca_invalid": true,
2297 + "data_sca_passed": true,
2298 + "data_sca_policy": true,
2299 + "data_sca_policy_id": true,
2300 + "data_sca_scan_id": true,
2301 + "data_sca_score": true,
2302 + "data_sca_total_checks": true,
2303 + "data_sca_type": true,
2304 + "data_script": true,
2305 + "data_src_ip": true,
2306 + "data_src_ip_city_name": true,
2307 + "data_src_ip_country_code": true,
2308 + "data_src_ip_geolocation": true,
2309 + "data_src_port": true,
2310 + "data_srcip": true,
2311 + "data_srcip_city_name": true,
2312 + "data_srcip_country_code": true,
2313 + "data_srcip_geolocation": true,
2314 + "data_srcuser": true,
2315 + "data_timestamp": true,
2316 + "data_title": true,
2317 + "data_tls_session_resumed": true,
2318 + "data_tls_version": true,
2319 + "data_tx_id": true,
2320 + "data_type": true,
2321 + "data_win_eventXML_binaryData": true,
2322 + "data_win_eventXML_binaryDataSize": true,
2323 + "data_win_eventXML_param1": true,
2324 + "data_win_eventdata_authenticationPackageName": true,
2325 + "data_win_eventdata_callTrace": true,
2326 + "data_win_eventdata_commandLine": true,
2327 + "data_win_eventdata_company": true,
2328 + "data_win_eventdata_creationUtcTime": true,
2329 + "data_win_eventdata_currentDirectory": true,
2330 + "data_win_eventdata_description": true,
2331 + "data_win_eventdata_destinationHostname": true,
2332 + "data_win_eventdata_destinationIp": true,
2333 + "data_win_eventdata_destinationIp_city_name": true,
2334 + "data_win_eventdata_destinationIp_country_code": true,
2335 + "data_win_eventdata_destinationIp_geolocation": true,
2336 + "data_win_eventdata_destinationIsIpv6": true,
2337 + "data_win_eventdata_destinationPort": true,
2338 + "data_win_eventdata_destinationPortName": true,
2339 + "data_win_eventdata_details": true,
2340 + "data_win_eventdata_elevatedToken": true,
2341 + "data_win_eventdata_eventType": true,
2342 + "data_win_eventdata_fileVersion": true,
2343 + "data_win_eventdata_fileVersion_city_name": true,
2344 + "data_win_eventdata_fileVersion_country_code": true,
2345 + "data_win_eventdata_fileVersion_geolocation": true,
2346 + "data_win_eventdata_grantedAccess": true,
2347 + "data_win_eventdata_hashes": true,
2348 + "data_win_eventdata_image": true,
2349 + "data_win_eventdata_imageLoaded": true,
2350 + "data_win_eventdata_impersonationLevel": true,
2351 + "data_win_eventdata_initiated": true,
2352 + "data_win_eventdata_integrityLevel": true,
2353 + "data_win_eventdata_ipAddress": true,
2354 + "data_win_eventdata_ipPort": true,
2355 + "data_win_eventdata_keyLength": true,
2356 + "data_win_eventdata_logonGuid": true,
2357 + "data_win_eventdata_logonId": true,
2358 + "data_win_eventdata_logonProcessName": true,
2359 + "data_win_eventdata_logonType": true,
2360 + "data_win_eventdata_originalFileName": true,
2361 + "data_win_eventdata_param1": true,
2362 + "data_win_eventdata_param2": true,
2363 + "data_win_eventdata_param3": true,
2364 + "data_win_eventdata_param4": true,
2365 + "data_win_eventdata_parentCommandLine": true,
2366 + "data_win_eventdata_parentImage": true,
2367 + "data_win_eventdata_parentProcessGuid": true,
2368 + "data_win_eventdata_parentProcessId": true,
2369 + "data_win_eventdata_processGuid": true,
2370 + "data_win_eventdata_processId": true,
2371 + "data_win_eventdata_processName": true,
2372 + "data_win_eventdata_product": true,
2373 + "data_win_eventdata_protocol": true,
2374 + "data_win_eventdata_queryName": true,
2375 + "data_win_eventdata_queryResults": true,
2376 + "data_win_eventdata_queryStatus": true,
2377 + "data_win_eventdata_ruleName": true,
2378 + "data_win_eventdata_serviceName": true,
2379 + "data_win_eventdata_serviceSid": true,
2380 + "data_win_eventdata_signature": true,
2381 + "data_win_eventdata_signatureStatus": true,
2382 + "data_win_eventdata_signed": true,
2383 + "data_win_eventdata_sourceHostname": true,
2384 + "data_win_eventdata_sourceImage": true,
2385 + "data_win_eventdata_sourceIp": true,
2386 + "data_win_eventdata_sourceIp_city_name": true,
2387 + "data_win_eventdata_sourceIp_country_code": true,
2388 + "data_win_eventdata_sourceIp_geolocation": true,
2389 + "data_win_eventdata_sourceIsIpv6": true,
2390 + "data_win_eventdata_sourcePort": true,
2391 + "data_win_eventdata_sourceProcessGUID": true,
2392 + "data_win_eventdata_sourceProcessId": true,
2393 + "data_win_eventdata_sourceThreadId": true,
2394 + "data_win_eventdata_status": true,
2395 + "data_win_eventdata_subjectDomainName": true,
2396 + "data_win_eventdata_subjectLogonId": true,
2397 + "data_win_eventdata_subjectUserName": true,
2398 + "data_win_eventdata_subjectUserSid": true,
2399 + "data_win_eventdata_targetDomainName": true,
2400 + "data_win_eventdata_targetFilename": true,
2401 + "data_win_eventdata_targetImage": true,
2402 + "data_win_eventdata_targetLinkedLogonId": true,
2403 + "data_win_eventdata_targetLogonId": true,
2404 + "data_win_eventdata_targetObject": true,
2405 + "data_win_eventdata_targetProcessGUID": true,
2406 + "data_win_eventdata_targetProcessId": true,
2407 + "data_win_eventdata_targetUserName": true,
2408 + "data_win_eventdata_targetUserSid": true,
2409 + "data_win_eventdata_terminalSessionId": true,
2410 + "data_win_eventdata_ticketEncryptionType": true,
2411 + "data_win_eventdata_ticketOptions": true,
2412 + "data_win_eventdata_user": true,
2413 + "data_win_eventdata_utcTime": true,
2414 + "data_win_eventdata_virtualAccount": true,
2415 + "data_win_system_channel": true,
2416 + "data_win_system_computer": true,
2417 + "data_win_system_eventID": true,
2418 + "data_win_system_eventRecordID": true,
2419 + "data_win_system_eventSourceName": true,
2420 + "data_win_system_keywords": true,
2421 + "data_win_system_level": true,
2422 + "data_win_system_message": true,
2423 + "data_win_system_opcode": true,
2424 + "data_win_system_processID": true,
2425 + "data_win_system_providerGuid": true,
2426 + "data_win_system_providerName": true,
2427 + "data_win_system_severityValue": true,
2428 + "data_win_system_systemTime": true,
2429 + "data_win_system_task": true,
2430 + "data_win_system_threadID": true,
2431 + "data_win_system_version": true,
2432 + "decoder_name": true,
2433 + "decoder_parent": true,
2434 + "dns_query": true,
2435 + "dns_query_threat_indicated": true,
2436 + "dst_ip": true,
2437 + "dst_ip_city_name": true,
2438 + "dst_ip_country_code": true,
2439 + "dst_ip_geolocation": true,
2440 + "dst_ip_threat_indicated": true,
2441 + "dst_port": true,
2442 + "ecs_version": true,
2443 + "error": true,
2444 + "event_hash": true,
2445 + "file_path": true,
2446 + "firewall_rule_name": true,
2447 + "full_log": false,
2448 + "gl2_accounted_message_size": true,
2449 + "gl2_message_id": true,
2450 + "gl2_processing_error": true,
2451 + "gl2_remote_ip": true,
2452 + "gl2_remote_port": true,
2453 + "gl2_source_collector": true,
2454 + "gl2_source_input": true,
2455 + "gl2_source_node": true,
2456 + "hash_md5": true,
2457 + "hash_sha1": true,
2458 + "hash_sha256": true,
2459 + "highlight": true,
2460 + "host_architecture": true,
2461 + "host_containerized": true,
2462 + "host_hostname": true,
2463 + "host_id": true,
2464 + "host_ip": true,
2465 + "host_mac": true,
2466 + "host_name": true,
2467 + "host_os_codename": true,
2468 + "host_os_kernel": true,
2469 + "host_os_name": true,
2470 + "host_os_platform": true,
2471 + "host_os_version": true,
2472 + "hostname": true,
2473 + "id": true,
2474 + "input_type": true,
2475 + "level": true,
2476 + "location": true,
2477 + "log_file_path": true,
2478 + "log_offset": true,
2479 + "manager_name": true,
2480 + "message": true,
2481 + "module": true,
2482 + "office_365_login_origin": true,
2483 + "parent_process_cmd_line": true,
2484 + "parent_process_id": true,
2485 + "parent_process_image": true,
2486 + "pid": true,
2487 + "predecoder_hostname": true,
2488 + "predecoder_program_name": true,
2489 + "predecoder_timestamp": true,
2490 + "previous_log": true,
2491 + "previous_output": true,
2492 + "process_cmd_line": true,
2493 + "process_id": true,
2494 + "process_image": true,
2495 + "process_name": true,
2496 + "protocol": true,
2497 + "rule_cis": true,
2498 + "rule_cis_csc": true,
2499 + "rule_firedtimes": true,
2500 + "rule_gdpr": true,
2501 + "rule_gdpr_IV": true,
2502 + "rule_gpg13": true,
2503 + "rule_gpg_13": true,
2504 + "rule_group1": true,
2505 + "rule_groups": true,
2506 + "rule_hipaa": true,
2507 + "rule_id": true,
2508 + "rule_info": true,
2509 + "rule_mail": true,
2510 + "rule_mitre_id": false,
2511 + "rule_mitre_tactic": false,
2512 + "rule_nist_800_53": true,
2513 + "rule_pci_dss": true,
2514 + "rule_tsc": true,
2515 + "scanid": true,
2516 + "service": true,
2517 + "software_package": true,
2518 + "software_vendor": true,
2519 + "sort": true,
2520 + "source": true,
2521 + "src_ip": true,
2522 + "src_ip_city_name": true,
2523 + "src_ip_country_code": true,
2524 + "src_ip_geolocation": true,
2525 + "src_port": true,
2526 + "streams": true,
2527 + "syscheck_attrs_after": true,
2528 + "syscheck_audit_effective_user_id": true,
2529 + "syscheck_audit_effective_user_name": true,
2530 + "syscheck_audit_group_id": true,
2531 + "syscheck_audit_group_name": true,
2532 + "syscheck_audit_login_user_id": true,
2533 + "syscheck_audit_login_user_name": true,
2534 + "syscheck_audit_process_cwd": true,
2535 + "syscheck_audit_process_id": true,
2536 + "syscheck_audit_process_name": true,
2537 + "syscheck_audit_process_parent_cwd": true,
2538 + "syscheck_audit_process_parent_name": true,
2539 + "syscheck_audit_process_ppid": true,
2540 + "syscheck_audit_user_id": true,
2541 + "syscheck_audit_user_name": true,
2542 + "syscheck_changed_attributes": true,
2543 + "syscheck_event": true,
2544 + "syscheck_gid_after": true,
2545 + "syscheck_gname_after": true,
2546 + "syscheck_hard_links": true,
2547 + "syscheck_inode_after": true,
2548 + "syscheck_inode_before": true,
2549 + "syscheck_md5_after": true,
2550 + "syscheck_md5_before": true,
2551 + "syscheck_mode": true,
2552 + "syscheck_mtime_after": true,
2553 + "syscheck_mtime_before": true,
2554 + "syscheck_path": true,
2555 + "syscheck_perm_after": true,
2556 + "syscheck_perm_before": true,
2557 + "syscheck_sha1_after": true,
2558 + "syscheck_sha1_before": true,
2559 + "syscheck_sha256_after": true,
2560 + "syscheck_sha256_before": true,
2561 + "syscheck_size_after": true,
2562 + "syscheck_size_before": true,
2563 + "syscheck_uid_after": true,
2564 + "syscheck_uname_after": true,
2565 + "syscheck_win_perm_after": true,
2566 + "syscheck_win_perm_after_0_allowed": true,
2567 + "syscheck_win_perm_after_0_name": true,
2568 + "syscheck_win_perm_after_1_allowed": true,
2569 + "syscheck_win_perm_after_1_name": true,
2570 + "syscheck_win_perm_after_2_allowed": true,
2571 + "syscheck_win_perm_after_2_name": true,
2572 + "syscheck_win_perm_after_3_allowed": true,
2573 + "syscheck_win_perm_after_3_name": true,
2574 + "syslog_customer": true,
2575 + "syslog_level": false,
2576 + "syslog_tag": true,
2577 + "syslog_type": true,
2578 + "sysmon_event_description": true,
2579 + "threat_ids": true,
2580 + "threat_indicated": true,
2581 + "threat_names": true,
2582 + "time": true,
2583 + "timestamp": true,
2584 + "true": true,
2585 + "user_name": true,
2586 + "win_registry_key": true,
2587 + "win_system_eventID": true,
2588 + "windows_auth_package": true,
2589 + "windows_domain": true,
2590 + "windows_event_id": true,
2591 + "windows_event_severity": true,
2592 + "windows_logon_type": true
2593 + },
2594 + "indexByName": {
2595 + "_id": 1,
2596 + "data_office365_Operation": 4,
2597 + "data_office365_Workload": 3,
2598 + "rule_description": 2,
2599 + "rule_mitre_id": 6,
2600 + "rule_mitre_tactic": 7,
2601 + "rule_mitre_technique": 8,
2602 + "syslog_level": 5,
2603 + "timestamp": 0
2604 + },
2605 + "renameByName": {
2606 + "_id": "EVENT ID",
2607 + "data_office365_CreationTime": "EVENT TIME",
2608 + "data_office365_Operation": "OPERATION",
2609 + "data_office365_Workload": "WORKLOAD",
2610 + "rule_description": "DESCRIPTION",
2611 + "rule_id": "RULE ID",
2612 + "rule_mitre_id": "MITRE ID",
2613 + "rule_mitre_tactic": "MITRE TACTIC",
2614 + "rule_mitre_technique": "MITRE TECHNIQUE",
2615 + "syslog_level": "LEVEL",
2616 + "timestamp": "Date/Time"
2617 + }
2618 + }
2619 + }
2620 + ],
2621 + "transparent": true,
2622 + "type": "table"
2623 + }
2624 + ],
2625 + "refresh": "",
2626 + "schemaVersion": 38,
2627 + "tags": [
2628 + "O365"
2629 + ],
2630 + "templating": {
2631 + "list": [
2632 + {
2633 + "datasource": {
2634 + "type": "elasticsearch",
2635 + "uid": "replace_datasource_uid"
2636 + },
2637 + "filters": [],
2638 + "hide": 0,
2639 + "label": "",
2640 + "name": "Filters",
2641 + "skipUrlSync": false,
2642 + "type": "adhoc"
2643 + },
2644 + {
2645 + "current": {
2646 + "selected": false,
2647 + "text": "All",
2648 + "value": "$__all"
2649 + },
2650 + "datasource": {
2651 + "type": "elasticsearch",
2652 + "uid": "replace_datasource_uid"
2653 + },
2654 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"\"}",
2655 + "hide": 0,
2656 + "includeAll": true,
2657 + "label": "Workload",
2658 + "multi": false,
2659 + "name": "workload",
2660 + "options": [],
2661 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"\"}",
2662 + "refresh": 2,
2663 + "regex": "",
2664 + "skipUrlSync": false,
2665 + "sort": 1,
2666 + "tagValuesQuery": "",
2667 + "tagsQuery": "",
2668 + "type": "query",
2669 + "useTags": false
2670 + },
2671 + {
2672 + "current": {
2673 + "selected": false,
2674 + "text": "All",
2675 + "value": "$__all"
2676 + },
2677 + "datasource": {
2678 + "type": "elasticsearch",
2679 + "uid": "replace_datasource_uid"
2680 + },
2681 + "definition": "{\"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2682 + "hide": 0,
2683 + "includeAll": true,
2684 + "label": "Rule Level",
2685 + "multi": false,
2686 + "name": "rule_level",
2687 + "options": [],
2688 + "query": "{\"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2689 + "refresh": 2,
2690 + "regex": "",
2691 + "skipUrlSync": false,
2692 + "sort": 0,
2693 + "type": "query"
2694 + }
2695 + ]
2696 + },
2697 + "time": {
2698 + "from": "now-6h",
2699 + "to": "now"
2700 + },
2701 + "timepicker": {
2702 + "refresh_intervals": [
2703 + "5s",
2704 + "10s",
2705 + "30s",
2706 + "1m",
2707 + "5m",
2708 + "15m",
2709 + "30m",
2710 + "1h",
2711 + "2h",
2712 + "1d"
2713 + ],
2714 + "time_options": [
2715 + "5m",
2716 + "15m",
2717 + "1h",
2718 + "6h",
2719 + "12h",
2720 + "24h",
2721 + "2d",
2722 + "7d",
2723 + "30d"
2724 + ]
2725 + },
2726 + "timezone": "",
2727 + "title": "O365 - _SUMMARY",
2728 + "weekStart": ""
2729 +}
backend/app/connectors/grafana/dashboards/Office365/teams.json new
+2132
@@ -0,0 +1,2132 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto"
97 + },
98 + "pluginVersion": "9.2.0",
99 + "targets": [
100 + {
101 + "bucketAggs": [
102 + {
103 + "field": "timestamp",
104 + "id": "2",
105 + "settings": {
106 + "interval": "auto",
107 + "min_doc_count": 0,
108 + "trimEdges": 0
109 + },
110 + "type": "date_histogram"
111 + }
112 + ],
113 + "datasource": {
114 + "type": "elasticsearch",
115 + "uid": "replace_datasource_uid"
116 + },
117 + "metrics": [
118 + {
119 + "field": "select field",
120 + "id": "1",
121 + "type": "count"
122 + }
123 + ],
124 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 + "refId": "A",
126 + "timeField": "timestamp"
127 + }
128 + ],
129 + "title": "ALERTS",
130 + "type": "stat"
131 + },
132 + {
133 + "datasource": {
134 + "type": "elasticsearch",
135 + "uid": "replace_datasource_uid"
136 + },
137 + "fieldConfig": {
138 + "defaults": {
139 + "color": {
140 + "mode": "palette-classic"
141 + },
142 + "custom": {
143 + "hideFrom": {
144 + "legend": false,
145 + "tooltip": false,
146 + "viz": false
147 + }
148 + },
149 + "mappings": []
150 + },
151 + "overrides": [
152 + {
153 + "matcher": {
154 + "id": "byName",
155 + "options": "Count"
156 + },
157 + "properties": [
158 + {
159 + "id": "displayName",
160 + "value": "EVENTS"
161 + },
162 + {
163 + "id": "unit",
164 + "value": "short"
165 + },
166 + {
167 + "id": "decimals",
168 + "value": -1
169 + }
170 + ]
171 + }
172 + ]
173 + },
174 + "gridPos": {
175 + "h": 7,
176 + "w": 4,
177 + "x": 4,
178 + "y": 0
179 + },
180 + "id": 53,
181 + "options": {
182 + "legend": {
183 + "displayMode": "list",
184 + "placement": "bottom",
185 + "showLegend": false
186 + },
187 + "pieType": "donut",
188 + "reduceOptions": {
189 + "calcs": [
190 + "sum"
191 + ],
192 + "fields": "",
193 + "values": false
194 + },
195 + "tooltip": {
196 + "mode": "single",
197 + "sort": "none"
198 + }
199 + },
200 + "pluginVersion": "8.5.1",
201 + "targets": [
202 + {
203 + "bucketAggs": [
204 + {
205 + "fake": true,
206 + "field": "data_office365_Operation",
207 + "id": "4",
208 + "settings": {
209 + "min_doc_count": 1,
210 + "order": "desc",
211 + "orderBy": "_count",
212 + "size": "10"
213 + },
214 + "type": "terms"
215 + },
216 + {
217 + "field": "data_office365_CreationTime",
218 + "id": "5",
219 + "settings": {
220 + "interval": "auto",
221 + "min_doc_count": "0",
222 + "timeZone": "utc",
223 + "trimEdges": "0"
224 + },
225 + "type": "date_histogram"
226 + }
227 + ],
228 + "datasource": {
229 + "type": "elasticsearch",
230 + "uid": "replace_datasource_uid"
231 + },
232 + "metrics": [
233 + {
234 + "field": "select field",
235 + "id": "1",
236 + "type": "count"
237 + }
238 + ],
239 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 + "refId": "A",
241 + "timeField": "timestamp"
242 + }
243 + ],
244 + "title": "EVENTS BY OPERATION (Top 10)",
245 + "transformations": [],
246 + "type": "piechart"
247 + },
248 + {
249 + "datasource": {
250 + "type": "elasticsearch",
251 + "uid": "replace_datasource_uid"
252 + },
253 + "fieldConfig": {
254 + "defaults": {
255 + "color": {
256 + "mode": "thresholds"
257 + },
258 + "custom": {
259 + "align": "auto",
260 + "displayMode": "auto",
261 + "inspect": false
262 + },
263 + "mappings": [],
264 + "thresholds": {
265 + "mode": "absolute",
266 + "steps": [
267 + {
268 + "color": "red",
269 + "value": null
270 + }
271 + ]
272 + }
273 + },
274 + "overrides": [
275 + {
276 + "matcher": {
277 + "id": "byName",
278 + "options": "Count"
279 + },
280 + "properties": [
281 + {
282 + "id": "displayName",
283 + "value": "EVENTS"
284 + },
285 + {
286 + "id": "unit",
287 + "value": "short"
288 + },
289 + {
290 + "id": "decimals",
291 + "value": -1
292 + },
293 + {
294 + "id": "custom.align"
295 + },
296 + {
297 + "id": "thresholds",
298 + "value": {
299 + "mode": "absolute",
300 + "steps": [
301 + {
302 + "color": "red",
303 + "value": null
304 + }
305 + ]
306 + }
307 + }
308 + ]
309 + }
310 + ]
311 + },
312 + "gridPos": {
313 + "h": 7,
314 + "w": 6,
315 + "x": 8,
316 + "y": 0
317 + },
318 + "id": 54,
319 + "options": {
320 + "footer": {
321 + "fields": "",
322 + "reducer": [
323 + "sum"
324 + ],
325 + "show": false
326 + },
327 + "showHeader": true
328 + },
329 + "pluginVersion": "9.2.0",
330 + "targets": [
331 + {
332 + "bucketAggs": [
333 + {
334 + "fake": true,
335 + "field": "data_office365_Operation",
336 + "id": "4",
337 + "settings": {
338 + "min_doc_count": 1,
339 + "order": "desc",
340 + "orderBy": "_count",
341 + "size": "0"
342 + },
343 + "type": "terms"
344 + }
345 + ],
346 + "datasource": {
347 + "type": "elasticsearch",
348 + "uid": "replace_datasource_uid"
349 + },
350 + "metrics": [
351 + {
352 + "field": "select field",
353 + "id": "1",
354 + "type": "count"
355 + }
356 + ],
357 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
358 + "refId": "A",
359 + "timeField": "timestamp"
360 + }
361 + ],
362 + "title": "EVENTS BY OPERATION",
363 + "transformations": [
364 + {
365 + "id": "merge",
366 + "options": {
367 + "reducers": []
368 + }
369 + },
370 + {
371 + "id": "organize",
372 + "options": {
373 + "excludeByName": {},
374 + "indexByName": {},
375 + "renameByName": {
376 + "Count": "EVENTS",
377 + "data_office365_Operation": "OPERATION"
378 + }
379 + }
380 + }
381 + ],
382 + "type": "table"
383 + },
384 + {
385 + "datasource": {
386 + "type": "elasticsearch",
387 + "uid": "replace_datasource_uid"
388 + },
389 + "fieldConfig": {
390 + "defaults": {
391 + "color": {
392 + "mode": "thresholds"
393 + },
394 + "mappings": [
395 + {
396 + "options": {
397 + "match": "null",
398 + "result": {
399 + "text": "N/A"
400 + }
401 + },
402 + "type": "special"
403 + }
404 + ],
405 + "max": 15,
406 + "min": 0,
407 + "thresholds": {
408 + "mode": "absolute",
409 + "steps": [
410 + {
411 + "color": "#299c46",
412 + "value": null
413 + },
414 + {
415 + "color": "rgba(237, 129, 40, 0.89)",
416 + "value": 8
417 + },
418 + {
419 + "color": "#d44a3a",
420 + "value": 12
421 + }
422 + ]
423 + },
424 + "unit": "none"
425 + },
426 + "overrides": []
427 + },
428 + "gridPos": {
429 + "h": 7,
430 + "w": 4,
431 + "x": 0,
432 + "y": 7
433 + },
434 + "id": 16,
435 + "links": [],
436 + "options": {
437 + "orientation": "horizontal",
438 + "reduceOptions": {
439 + "calcs": [
440 + "max"
441 + ],
442 + "fields": "",
443 + "values": false
444 + },
445 + "showThresholdLabels": false,
446 + "showThresholdMarkers": true,
447 + "text": {}
448 + },
449 + "pluginVersion": "9.2.0",
450 + "targets": [
451 + {
452 + "bucketAggs": [
453 + {
454 + "field": "timestamp",
455 + "id": "2",
456 + "settings": {
457 + "interval": "auto",
458 + "min_doc_count": 0,
459 + "trimEdges": 0
460 + },
461 + "type": "date_histogram"
462 + }
463 + ],
464 + "datasource": {
465 + "type": "elasticsearch",
466 + "uid": "replace_datasource_uid"
467 + },
468 + "metrics": [
469 + {
470 + "field": "rule_level",
471 + "id": "1",
472 + "meta": {},
473 + "settings": {},
474 + "type": "max"
475 + }
476 + ],
477 + "query": "data_office365_Operation:$operation",
478 + "refId": "A",
479 + "timeField": "timestamp"
480 + }
481 + ],
482 + "title": "MAX SEVERITY (0 - 15)",
483 + "type": "gauge"
484 + },
485 + {
486 + "datasource": {
487 + "type": "elasticsearch",
488 + "uid": "replace_datasource_uid"
489 + },
490 + "fieldConfig": {
491 + "defaults": {
492 + "color": {
493 + "mode": "palette-classic"
494 + },
495 + "custom": {
496 + "axisCenteredZero": false,
497 + "axisColorMode": "text",
498 + "axisLabel": "",
499 + "axisPlacement": "auto",
500 + "barAlignment": 0,
501 + "drawStyle": "bars",
502 + "fillOpacity": 0,
503 + "gradientMode": "none",
504 + "hideFrom": {
505 + "legend": false,
506 + "tooltip": false,
507 + "viz": false
508 + },
509 + "lineInterpolation": "linear",
510 + "lineWidth": 1,
511 + "pointSize": 5,
512 + "scaleDistribution": {
513 + "type": "linear"
514 + },
515 + "showPoints": "auto",
516 + "spanNulls": false,
517 + "stacking": {
518 + "group": "A",
519 + "mode": "normal"
520 + },
521 + "thresholdsStyle": {
522 + "mode": "off"
523 + }
524 + },
525 + "mappings": [],
526 + "thresholds": {
527 + "mode": "absolute",
528 + "steps": [
529 + {
530 + "color": "green",
531 + "value": null
532 + },
533 + {
534 + "color": "red",
535 + "value": 80
536 + }
537 + ]
538 + }
539 + },
540 + "overrides": []
541 + },
542 + "gridPos": {
543 + "h": 13,
544 + "w": 20,
545 + "x": 4,
546 + "y": 7
547 + },
548 + "id": 60,
549 + "options": {
550 + "legend": {
551 + "calcs": [],
552 + "displayMode": "table",
553 + "placement": "right",
554 + "showLegend": true
555 + },
556 + "tooltip": {
557 + "mode": "single",
558 + "sort": "none"
559 + }
560 + },
561 + "targets": [
562 + {
563 + "alias": "",
564 + "bucketAggs": [
565 + {
566 + "field": "data_office365_Operation",
567 + "id": "3",
568 + "settings": {
569 + "min_doc_count": "1",
570 + "order": "desc",
571 + "orderBy": "_count",
572 + "size": "10"
573 + },
574 + "type": "terms"
575 + },
576 + {
577 + "field": "timestamp",
578 + "id": "2",
579 + "settings": {
580 + "interval": "auto"
581 + },
582 + "type": "date_histogram"
583 + }
584 + ],
585 + "datasource": {
586 + "type": "elasticsearch",
587 + "uid": "replace_datasource_uid"
588 + },
589 + "metrics": [
590 + {
591 + "id": "1",
592 + "type": "count"
593 + }
594 + ],
595 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
596 + "refId": "A",
597 + "timeField": "timestamp"
598 + }
599 + ],
600 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
601 + "transparent": true,
602 + "type": "timeseries"
603 + },
604 + {
605 + "datasource": {
606 + "type": "elasticsearch",
607 + "uid": "replace_datasource_uid"
608 + },
609 + "fieldConfig": {
610 + "defaults": {
611 + "mappings": [
612 + {
613 + "options": {
614 + "match": "null",
615 + "result": {
616 + "text": "N/A"
617 + }
618 + },
619 + "type": "special"
620 + }
621 + ],
622 + "thresholds": {
623 + "mode": "absolute",
624 + "steps": [
625 + {
626 + "color": "blue",
627 + "value": null
628 + }
629 + ]
630 + },
631 + "unit": "locale"
632 + },
633 + "overrides": []
634 + },
635 + "gridPos": {
636 + "h": 6,
637 + "w": 4,
638 + "x": 0,
639 + "y": 14
640 + },
641 + "id": 51,
642 + "links": [],
643 + "options": {
644 + "colorMode": "value",
645 + "graphMode": "area",
646 + "justifyMode": "auto",
647 + "orientation": "horizontal",
648 + "reduceOptions": {
649 + "calcs": [
650 + "sum"
651 + ],
652 + "fields": "",
653 + "values": false
654 + },
655 + "text": {},
656 + "textMode": "auto"
657 + },
658 + "pluginVersion": "9.2.0",
659 + "targets": [
660 + {
661 + "bucketAggs": [
662 + {
663 + "$$hashKey": "object:331",
664 + "field": "timestamp",
665 + "id": "2",
666 + "settings": {
667 + "interval": "auto",
668 + "min_doc_count": 0,
669 + "trimEdges": 0
670 + },
671 + "type": "date_histogram"
672 + }
673 + ],
674 + "datasource": {
675 + "type": "elasticsearch",
676 + "uid": "replace_datasource_uid"
677 + },
678 + "metrics": [
679 + {
680 + "$$hashKey": "object:329",
681 + "field": "select field",
682 + "id": "1",
683 + "type": "count"
684 + }
685 + ],
686 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
687 + "refId": "A",
688 + "timeField": "timestamp"
689 + }
690 + ],
691 + "title": "EVENTS (Total)",
692 + "type": "stat"
693 + },
694 + {
695 + "datasource": {
696 + "type": "elasticsearch",
697 + "uid": "replace_datasource_uid"
698 + },
699 + "fieldConfig": {
700 + "defaults": {
701 + "mappings": [
702 + {
703 + "options": {
704 + "match": "null",
705 + "result": {
706 + "text": "N/A"
707 + }
708 + },
709 + "type": "special"
710 + }
711 + ],
712 + "thresholds": {
713 + "mode": "absolute",
714 + "steps": [
715 + {
716 + "color": "orange",
717 + "value": null
718 + }
719 + ]
720 + },
721 + "unit": "locale"
722 + },
723 + "overrides": []
724 + },
725 + "gridPos": {
726 + "h": 6,
727 + "w": 4,
728 + "x": 0,
729 + "y": 20
730 + },
731 + "id": 52,
732 + "links": [],
733 + "options": {
734 + "colorMode": "value",
735 + "graphMode": "area",
736 + "justifyMode": "auto",
737 + "orientation": "horizontal",
738 + "reduceOptions": {
739 + "calcs": [
740 + "sum"
741 + ],
742 + "fields": "",
743 + "values": false
744 + },
745 + "text": {},
746 + "textMode": "auto"
747 + },
748 + "pluginVersion": "9.2.0",
749 + "targets": [
750 + {
751 + "bucketAggs": [
752 + {
753 + "$$hashKey": "object:331",
754 + "field": "timestamp",
755 + "id": "2",
756 + "settings": {
757 + "interval": "auto",
758 + "min_doc_count": 0,
759 + "trimEdges": 0
760 + },
761 + "type": "date_histogram"
762 + }
763 + ],
764 + "datasource": {
765 + "type": "elasticsearch",
766 + "uid": "replace_datasource_uid"
767 + },
768 + "metrics": [
769 + {
770 + "$$hashKey": "object:329",
771 + "field": "select field",
772 + "id": "1",
773 + "type": "count"
774 + }
775 + ],
776 + "query": "data_office365_Operation:MessageCreatedHasLink AND rule_level:$rule_level",
777 + "refId": "A",
778 + "timeField": "timestamp"
779 + }
780 + ],
781 + "title": "TEAMS - MESSAGES CONTAINING LINK",
782 + "type": "stat"
783 + },
784 + {
785 + "circleMaxSize": 30,
786 + "circleMinSize": 2,
787 + "colors": [
788 + "rgba(245, 54, 54, 0.9)",
789 + "rgba(237, 129, 40, 0.89)",
790 + "rgba(50, 172, 45, 0.97)"
791 + ],
792 + "datasource": {
793 + "type": "elasticsearch",
794 + "uid": "replace_datasource_uid"
795 + },
796 + "decimals": 0,
797 + "esMetric": "Count",
798 + "gridPos": {
799 + "h": 12,
800 + "w": 10,
801 + "x": 4,
802 + "y": 20
803 + },
804 + "hideEmpty": false,
805 + "hideZero": false,
806 + "id": 50,
807 + "initialZoom": 1,
808 + "locationData": "countries",
809 + "mapCenter": "(0°, 0°)",
810 + "mapCenterLatitude": 0,
811 + "mapCenterLongitude": 0,
812 + "maxDataPoints": 1,
813 + "mouseWheelZoom": false,
814 + "showLegend": true,
815 + "stickyLabels": false,
816 + "tableQueryOptions": {
817 + "geohashField": "geohash",
818 + "latitudeField": "latitude",
819 + "longitudeField": "longitude",
820 + "metricField": "metric",
821 + "queryType": "geohash"
822 + },
823 + "targets": [
824 + {
825 + "bucketAggs": [
826 + {
827 + "fake": true,
828 + "field": "data_office365_ClientIP_country_code",
829 + "id": "3",
830 + "settings": {
831 + "min_doc_count": 1,
832 + "order": "desc",
833 + "orderBy": "_term",
834 + "size": "0"
835 + },
836 + "type": "terms"
837 + },
838 + {
839 + "field": "timestamp",
840 + "id": "2",
841 + "settings": {
842 + "interval": "auto",
843 + "min_doc_count": 0,
844 + "trimEdges": 0
845 + },
846 + "type": "date_histogram"
847 + }
848 + ],
849 + "datasource": {
850 + "type": "elasticsearch",
851 + "uid": "replace_datasource_uid"
852 + },
853 + "metrics": [
854 + {
855 + "field": "select field",
856 + "id": "1",
857 + "type": "count"
858 + }
859 + ],
860 + "query": "data_office365_Workload:MicrosoftTeams AND rule_level:$rule_level",
861 + "refId": "A",
862 + "timeField": "timestamp"
863 + }
864 + ],
865 + "thresholds": "0,10",
866 + "title": "TEAMS - ALL EVENTS BY SRC COUNTRY",
867 + "type": "grafana-worldmap-panel",
868 + "unitPlural": "",
869 + "unitSingle": "",
870 + "valueName": "total"
871 + },
872 + {
873 + "datasource": {
874 + "type": "elasticsearch",
875 + "uid": "replace_datasource_uid"
876 + },
877 + "fieldConfig": {
878 + "defaults": {
879 + "color": {
880 + "mode": "thresholds"
881 + },
882 + "custom": {
883 + "align": "auto",
884 + "displayMode": "auto",
885 + "inspect": false
886 + },
887 + "mappings": [],
888 + "thresholds": {
889 + "mode": "absolute",
890 + "steps": [
891 + {
892 + "color": "orange",
893 + "value": null
894 + }
895 + ]
896 + }
897 + },
898 + "overrides": [
899 + {
900 + "matcher": {
901 + "id": "byName",
902 + "options": "Count"
903 + },
904 + "properties": [
905 + {
906 + "id": "displayName",
907 + "value": "EVENTS"
908 + },
909 + {
910 + "id": "unit",
911 + "value": "short"
912 + },
913 + {
914 + "id": "decimals",
915 + "value": -1
916 + },
917 + {
918 + "id": "custom.align"
919 + }
920 + ]
921 + },
922 + {
923 + "matcher": {
924 + "id": "byName",
925 + "options": "AD ACCOUNT"
926 + },
927 + "properties": [
928 + {
929 + "id": "custom.width",
930 + "value": 377
931 + }
932 + ]
933 + }
934 + ]
935 + },
936 + "gridPos": {
937 + "h": 12,
938 + "w": 10,
939 + "x": 14,
940 + "y": 20
941 + },
942 + "id": 58,
943 + "options": {
944 + "footer": {
945 + "fields": "",
946 + "reducer": [
947 + "sum"
948 + ],
949 + "show": false
950 + },
951 + "showHeader": true,
952 + "sortBy": []
953 + },
954 + "pluginVersion": "9.2.0",
955 + "targets": [
956 + {
957 + "bucketAggs": [
958 + {
959 + "fake": true,
960 + "field": "data_office365_UserId",
961 + "id": "4",
962 + "settings": {
963 + "min_doc_count": 1,
964 + "order": "desc",
965 + "orderBy": "_count",
966 + "size": "0"
967 + },
968 + "type": "terms"
969 + },
970 + {
971 + "field": "data_office365_ClientIP_country_code",
972 + "id": "5",
973 + "settings": {
974 + "min_doc_count": "1",
975 + "order": "desc",
976 + "orderBy": "_term",
977 + "size": "10"
978 + },
979 + "type": "terms"
980 + }
981 + ],
982 + "datasource": {
983 + "type": "elasticsearch",
984 + "uid": "replace_datasource_uid"
985 + },
986 + "metrics": [
987 + {
988 + "field": "select field",
989 + "id": "1",
990 + "type": "count"
991 + }
992 + ],
993 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
994 + "refId": "A",
995 + "timeField": "timestamp"
996 + }
997 + ],
998 + "title": "TEAMS EVENTS BY ACCOUNT",
999 + "transformations": [
1000 + {
1001 + "id": "merge",
1002 + "options": {
1003 + "reducers": []
1004 + }
1005 + },
1006 + {
1007 + "id": "organize",
1008 + "options": {
1009 + "excludeByName": {},
1010 + "indexByName": {},
1011 + "renameByName": {
1012 + "Count": "EVENTS",
1013 + "data_office365_ClientIP_country_code": "COUNTRY",
1014 + "data_office365_LogonError": "ERROR",
1015 + "data_office365_Operation": "WORKLOAD",
1016 + "data_office365_UserId": "AD ACCOUNT"
1017 + }
1018 + }
1019 + }
1020 + ],
1021 + "type": "table"
1022 + },
1023 + {
1024 + "datasource": {
1025 + "type": "elasticsearch",
1026 + "uid": "replace_datasource_uid"
1027 + },
1028 + "fieldConfig": {
1029 + "defaults": {
1030 + "mappings": [
1031 + {
1032 + "options": {
1033 + "match": "null",
1034 + "result": {
1035 + "text": "N/A"
1036 + }
1037 + },
1038 + "type": "special"
1039 + }
1040 + ],
1041 + "thresholds": {
1042 + "mode": "absolute",
1043 + "steps": [
1044 + {
1045 + "color": "blue",
1046 + "value": null
1047 + }
1048 + ]
1049 + },
1050 + "unit": "locale"
1051 + },
1052 + "overrides": []
1053 + },
1054 + "gridPos": {
1055 + "h": 6,
1056 + "w": 4,
1057 + "x": 0,
1058 + "y": 26
1059 + },
1060 + "id": 18,
1061 + "links": [],
1062 + "options": {
1063 + "colorMode": "value",
1064 + "graphMode": "area",
1065 + "justifyMode": "auto",
1066 + "orientation": "horizontal",
1067 + "reduceOptions": {
1068 + "calcs": [
1069 + "sum"
1070 + ],
1071 + "fields": "",
1072 + "values": false
1073 + },
1074 + "text": {},
1075 + "textMode": "auto"
1076 + },
1077 + "pluginVersion": "9.2.0",
1078 + "targets": [
1079 + {
1080 + "bucketAggs": [
1081 + {
1082 + "$$hashKey": "object:331",
1083 + "field": "timestamp",
1084 + "id": "2",
1085 + "settings": {
1086 + "interval": "auto",
1087 + "min_doc_count": 0,
1088 + "trimEdges": 0
1089 + },
1090 + "type": "date_histogram"
1091 + }
1092 + ],
1093 + "datasource": {
1094 + "type": "elasticsearch",
1095 + "uid": "replace_datasource_uid"
1096 + },
1097 + "metrics": [
1098 + {
1099 + "$$hashKey": "object:329",
1100 + "field": "select field",
1101 + "id": "1",
1102 + "type": "count"
1103 + }
1104 + ],
1105 + "query": "data_office365_Operation:TeamsSessionStarted AND rule_level:$rule_level",
1106 + "refId": "A",
1107 + "timeField": "timestamp"
1108 + }
1109 + ],
1110 + "title": "TEAMS - SESSIONS STARTED",
1111 + "type": "stat"
1112 + },
1113 + {
1114 + "datasource": {
1115 + "type": "elasticsearch",
1116 + "uid": "replace_datasource_uid"
1117 + },
1118 + "fieldConfig": {
1119 + "defaults": {
1120 + "color": {
1121 + "mode": "thresholds"
1122 + },
1123 + "custom": {
1124 + "align": "auto",
1125 + "displayMode": "auto",
1126 + "filterable": true,
1127 + "inspect": false
1128 + },
1129 + "mappings": [],
1130 + "thresholds": {
1131 + "mode": "absolute",
1132 + "steps": [
1133 + {
1134 + "color": "green",
1135 + "value": null
1136 + },
1137 + {
1138 + "color": "red",
1139 + "value": 80
1140 + }
1141 + ]
1142 + }
1143 + },
1144 + "overrides": [
1145 + {
1146 + "matcher": {
1147 + "id": "byName",
1148 + "options": "rule_level"
1149 + },
1150 + "properties": [
1151 + {
1152 + "id": "displayName",
1153 + "value": "RULE LEVEL"
1154 + },
1155 + {
1156 + "id": "unit",
1157 + "value": "short"
1158 + },
1159 + {
1160 + "id": "decimals",
1161 + "value": -1
1162 + },
1163 + {
1164 + "id": "custom.displayMode",
1165 + "value": "color-background"
1166 + },
1167 + {
1168 + "id": "custom.align"
1169 + },
1170 + {
1171 + "id": "thresholds",
1172 + "value": {
1173 + "mode": "absolute",
1174 + "steps": [
1175 + {
1176 + "color": "#37872D",
1177 + "value": null
1178 + },
1179 + {
1180 + "color": "rgba(237, 129, 40, 0.89)",
1181 + "value": 7
1182 + },
1183 + {
1184 + "color": "rgba(245, 54, 54, 0.9)",
1185 + "value": 12
1186 + }
1187 + ]
1188 + }
1189 + }
1190 + ]
1191 + },
1192 + {
1193 + "matcher": {
1194 + "id": "byName",
1195 + "options": "Date/Time"
1196 + },
1197 + "properties": [
1198 + {
1199 + "id": "custom.width",
1200 + "value": 242
1201 + }
1202 + ]
1203 + },
1204 + {
1205 + "matcher": {
1206 + "id": "byName",
1207 + "options": "MITRE TACTIC"
1208 + },
1209 + "properties": [
1210 + {
1211 + "id": "custom.width",
1212 + "value": 332
1213 + }
1214 + ]
1215 + },
1216 + {
1217 + "matcher": {
1218 + "id": "byName",
1219 + "options": "IP ADDRESS"
1220 + },
1221 + "properties": [
1222 + {
1223 + "id": "custom.width",
1224 + "value": 163
1225 + }
1226 + ]
1227 + },
1228 + {
1229 + "matcher": {
1230 + "id": "byName",
1231 + "options": "MITRE TECHNIQUE"
1232 + },
1233 + "properties": [
1234 + {
1235 + "id": "custom.width",
1236 + "value": 312
1237 + }
1238 + ]
1239 + },
1240 + {
1241 + "matcher": {
1242 + "id": "byName",
1243 + "options": "EVENT ID"
1244 + },
1245 + "properties": [
1246 + {
1247 + "id": "links",
1248 + "value": [
1249 + {
1250 + "targetBlank": true,
1251 + "title": "VIEW EVENT DETAILS",
1252 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1253 + }
1254 + ]
1255 + },
1256 + {
1257 + "id": "custom.width",
1258 + "value": 336
1259 + }
1260 + ]
1261 + },
1262 + {
1263 + "matcher": {
1264 + "id": "byName",
1265 + "options": "RESULT"
1266 + },
1267 + "properties": [
1268 + {
1269 + "id": "custom.width",
1270 + "value": 118
1271 + },
1272 + {
1273 + "id": "mappings",
1274 + "value": [
1275 + {
1276 + "options": {
1277 + "Failed": {
1278 + "color": "orange",
1279 + "index": 1
1280 + },
1281 + "Success": {
1282 + "color": "green",
1283 + "index": 0
1284 + }
1285 + },
1286 + "type": "value"
1287 + }
1288 + ]
1289 + },
1290 + {
1291 + "id": "custom.displayMode",
1292 + "value": "color-text"
1293 + }
1294 + ]
1295 + },
1296 + {
1297 + "matcher": {
1298 + "id": "byName",
1299 + "options": "SRC IP"
1300 + },
1301 + "properties": [
1302 + {
1303 + "id": "custom.width",
1304 + "value": 265
1305 + }
1306 + ]
1307 + },
1308 + {
1309 + "matcher": {
1310 + "id": "byName",
1311 + "options": "ACCOUNT"
1312 + },
1313 + "properties": [
1314 + {
1315 + "id": "custom.width",
1316 + "value": 343
1317 + }
1318 + ]
1319 + },
1320 + {
1321 + "matcher": {
1322 + "id": "byName",
1323 + "options": "EVENT TIME"
1324 + },
1325 + "properties": [
1326 + {
1327 + "id": "custom.width",
1328 + "value": 195
1329 + }
1330 + ]
1331 + }
1332 + ]
1333 + },
1334 + "gridPos": {
1335 + "h": 16,
1336 + "w": 24,
1337 + "x": 0,
1338 + "y": 32
1339 + },
1340 + "id": 27,
1341 + "options": {
1342 + "footer": {
1343 + "fields": "",
1344 + "reducer": [
1345 + "sum"
1346 + ],
1347 + "show": false
1348 + },
1349 + "showHeader": true,
1350 + "sortBy": []
1351 + },
1352 + "pluginVersion": "9.2.0",
1353 + "targets": [
1354 + {
1355 + "bucketAggs": [],
1356 + "datasource": {
1357 + "type": "elasticsearch",
1358 + "uid": "replace_datasource_uid"
1359 + },
1360 + "metrics": [
1361 + {
1362 + "id": "1",
1363 + "settings": {
1364 + "size": "250"
1365 + },
1366 + "type": "raw_data"
1367 + }
1368 + ],
1369 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1370 + "refId": "A",
1371 + "timeField": "timestamp"
1372 + }
1373 + ],
1374 + "title": "EVENTS",
1375 + "transformations": [
1376 + {
1377 + "id": "merge",
1378 + "options": {
1379 + "reducers": []
1380 + }
1381 + },
1382 + {
1383 + "id": "organize",
1384 + "options": {
1385 + "excludeByName": {
1386 + "@metadata_beat": true,
1387 + "@metadata_type": true,
1388 + "@metadata_version": true,
1389 + "IMPHASH": true,
1390 + "MD5": true,
1391 + "SHA1": true,
1392 + "SHA256": true,
1393 + "_id": false,
1394 + "_index": true,
1395 + "_type": true,
1396 + "agent_ephemeral_id": true,
1397 + "agent_hostname": true,
1398 + "agent_id": true,
1399 + "agent_ip_city_name": true,
1400 + "agent_ip_country_code": true,
1401 + "agent_ip_geolocation": true,
1402 + "agent_name": true,
1403 + "agent_type": true,
1404 + "agent_version": true,
1405 + "beats_type": true,
1406 + "cluster_name": true,
1407 + "cluster_node": true,
1408 + "collector_node_id": true,
1409 + "data_alert_action": true,
1410 + "data_alert_category": true,
1411 + "data_alert_gid": true,
1412 + "data_alert_rev": true,
1413 + "data_alert_severity": true,
1414 + "data_alert_signature": true,
1415 + "data_alert_signature_id": true,
1416 + "data_app_proto": true,
1417 + "data_audit_auid": true,
1418 + "data_audit_command": true,
1419 + "data_audit_euid": true,
1420 + "data_audit_exe": true,
1421 + "data_audit_gid": true,
1422 + "data_audit_id": true,
1423 + "data_audit_pid": true,
1424 + "data_audit_res": true,
1425 + "data_audit_session": true,
1426 + "data_audit_type": true,
1427 + "data_audit_uid": true,
1428 + "data_dest_ip": true,
1429 + "data_dest_port": true,
1430 + "data_dstuser": true,
1431 + "data_event_type": true,
1432 + "data_extra_data": true,
1433 + "data_file": true,
1434 + "data_flow_bytes_toclient": true,
1435 + "data_flow_bytes_toserver": true,
1436 + "data_flow_id": true,
1437 + "data_flow_pkts_toclient": true,
1438 + "data_flow_pkts_toserver": true,
1439 + "data_flow_start": true,
1440 + "data_http_http_content_type": true,
1441 + "data_http_http_port": true,
1442 + "data_http_length": true,
1443 + "data_http_status": true,
1444 + "data_http_url": true,
1445 + "data_id": true,
1446 + "data_in_iface": true,
1447 + "data_metadata_flowbits": true,
1448 + "data_metadata_flowints_http_anomaly_count": true,
1449 + "data_metadata_flowints_tcp_retransmission_count": true,
1450 + "data_office365_AADGroupId": true,
1451 + "data_office365_Actor": true,
1452 + "data_office365_ActorContextId": true,
1453 + "data_office365_ActorIpAddress": false,
1454 + "data_office365_ActorIpAddress_city_name": true,
1455 + "data_office365_ActorIpAddress_country_code": true,
1456 + "data_office365_ActorIpAddress_geolocation": true,
1457 + "data_office365_AppAccessContext_APIId": true,
1458 + "data_office365_AppAccessContext_ClientAppId": true,
1459 + "data_office365_AppAccessContext_ClientAppName": true,
1460 + "data_office365_AppAccessContext_CorrelationId": true,
1461 + "data_office365_ApplicationId": true,
1462 + "data_office365_ArtifactsShared": true,
1463 + "data_office365_Attendees": true,
1464 + "data_office365_AzureActiveDirectoryEventType": true,
1465 + "data_office365_ChannelGuid": true,
1466 + "data_office365_ChannelName": true,
1467 + "data_office365_ChatName": true,
1468 + "data_office365_ChatThreadId": true,
1469 + "data_office365_ClientIP": false,
1470 + "data_office365_ClientIP_city_name": true,
1471 + "data_office365_ClientIP_country_code": true,
1472 + "data_office365_ClientIP_geolocation": true,
1473 + "data_office365_CommunicationSubType": true,
1474 + "data_office365_CommunicationType": true,
1475 + "data_office365_CreationTime": false,
1476 + "data_office365_DeviceId": true,
1477 + "data_office365_DeviceInformation": true,
1478 + "data_office365_DeviceProperties": true,
1479 + "data_office365_EndTime": true,
1480 + "data_office365_ErrorNumber": true,
1481 + "data_office365_ExchangeId": true,
1482 + "data_office365_ExtendedProperties": true,
1483 + "data_office365_ExtraProperties": true,
1484 + "data_office365_HostedContents": true,
1485 + "data_office365_ICalUid": true,
1486 + "data_office365_Id": true,
1487 + "data_office365_InterSystemsId": true,
1488 + "data_office365_IntraSystemId": true,
1489 + "data_office365_ItemName": true,
1490 + "data_office365_JoinTime": true,
1491 + "data_office365_LeaveTime": true,
1492 + "data_office365_LogonError": true,
1493 + "data_office365_MeetingDetailId": true,
1494 + "data_office365_MeetingURL": true,
1495 + "data_office365_Members": true,
1496 + "data_office365_MessageId": true,
1497 + "data_office365_MessageSizeInBytes": true,
1498 + "data_office365_MessageURLs": true,
1499 + "data_office365_MessageVersion": true,
1500 + "data_office365_Modalities": true,
1501 + "data_office365_ModifiedProperties": true,
1502 + "data_office365_Name": true,
1503 + "data_office365_NewValue": true,
1504 + "data_office365_ObjectId": true,
1505 + "data_office365_Operation": true,
1506 + "data_office365_OperationScope": true,
1507 + "data_office365_OrganizationId": true,
1508 + "data_office365_Organizer_OrganizationId": true,
1509 + "data_office365_Organizer_RecipientType": true,
1510 + "data_office365_Organizer_Role": true,
1511 + "data_office365_Organizer_UserObjectId": true,
1512 + "data_office365_ParentMessageId": true,
1513 + "data_office365_ProviderTypes": true,
1514 + "data_office365_RecordType": true,
1515 + "data_office365_ResultStatus": false,
1516 + "data_office365_StartTime": true,
1517 + "data_office365_SubscriptionId": true,
1518 + "data_office365_Target": true,
1519 + "data_office365_TargetContextId": true,
1520 + "data_office365_TeamGuid": true,
1521 + "data_office365_TeamName": true,
1522 + "data_office365_UserId": false,
1523 + "data_office365_UserKey": true,
1524 + "data_office365_UserType": true,
1525 + "data_office365_Version": true,
1526 + "data_office365_Workload": true,
1527 + "data_osquery_action": true,
1528 + "data_osquery_calendarTime": true,
1529 + "data_osquery_columns_address": true,
1530 + "data_osquery_columns_address_city_name": true,
1531 + "data_osquery_columns_address_country_code": true,
1532 + "data_osquery_columns_address_geolocation": true,
1533 + "data_osquery_columns_cmdline": true,
1534 + "data_osquery_columns_cwd": true,
1535 + "data_osquery_columns_description": true,
1536 + "data_osquery_columns_directory": true,
1537 + "data_osquery_columns_disk_bytes_read": true,
1538 + "data_osquery_columns_disk_bytes_written": true,
1539 + "data_osquery_columns_egid": true,
1540 + "data_osquery_columns_euid": true,
1541 + "data_osquery_columns_family": true,
1542 + "data_osquery_columns_fd": true,
1543 + "data_osquery_columns_gid": true,
1544 + "data_osquery_columns_gid_signed": true,
1545 + "data_osquery_columns_host": true,
1546 + "data_osquery_columns_interface": true,
1547 + "data_osquery_columns_local_address": true,
1548 + "data_osquery_columns_local_address_city_name": true,
1549 + "data_osquery_columns_local_address_country_code": true,
1550 + "data_osquery_columns_local_address_geolocation": true,
1551 + "data_osquery_columns_local_port": true,
1552 + "data_osquery_columns_mac": true,
1553 + "data_osquery_columns_name": true,
1554 + "data_osquery_columns_net_namespace": true,
1555 + "data_osquery_columns_nice": true,
1556 + "data_osquery_columns_on_disk": true,
1557 + "data_osquery_columns_parent": true,
1558 + "data_osquery_columns_path": true,
1559 + "data_osquery_columns_pgroup": true,
1560 + "data_osquery_columns_pid": true,
1561 + "data_osquery_columns_port": true,
1562 + "data_osquery_columns_protocol": true,
1563 + "data_osquery_columns_remote_address": true,
1564 + "data_osquery_columns_remote_address_city_name": true,
1565 + "data_osquery_columns_remote_address_country_code": true,
1566 + "data_osquery_columns_remote_address_geolocation": true,
1567 + "data_osquery_columns_remote_port": true,
1568 + "data_osquery_columns_resident_size": true,
1569 + "data_osquery_columns_root": true,
1570 + "data_osquery_columns_sgid": true,
1571 + "data_osquery_columns_shell": true,
1572 + "data_osquery_columns_socket": true,
1573 + "data_osquery_columns_start_time": true,
1574 + "data_osquery_columns_state": true,
1575 + "data_osquery_columns_suid": true,
1576 + "data_osquery_columns_system_time": true,
1577 + "data_osquery_columns_threads": true,
1578 + "data_osquery_columns_time_utc": true,
1579 + "data_osquery_columns_total_size": true,
1580 + "data_osquery_columns_tty": true,
1581 + "data_osquery_columns_type": true,
1582 + "data_osquery_columns_uid": true,
1583 + "data_osquery_columns_uid_signed": true,
1584 + "data_osquery_columns_user": true,
1585 + "data_osquery_columns_user_time": true,
1586 + "data_osquery_columns_username": true,
1587 + "data_osquery_columns_wired_size": true,
1588 + "data_osquery_counter": true,
1589 + "data_osquery_decorations_host_uuid": true,
1590 + "data_osquery_decorations_hostname": true,
1591 + "data_osquery_epoch": true,
1592 + "data_osquery_hostIdentifier": true,
1593 + "data_osquery_name": true,
1594 + "data_osquery_numerics": true,
1595 + "data_osquery_unixTime": true,
1596 + "data_proto": true,
1597 + "data_sca_check_command": true,
1598 + "data_sca_check_compliance_cis": true,
1599 + "data_sca_check_compliance_cis_csc": true,
1600 + "data_sca_check_compliance_gdpr_IV": true,
1601 + "data_sca_check_compliance_gpg_13": true,
1602 + "data_sca_check_compliance_hipaa": true,
1603 + "data_sca_check_compliance_nist_800_53": true,
1604 + "data_sca_check_compliance_pci_dss": true,
1605 + "data_sca_check_compliance_tsc": true,
1606 + "data_sca_check_description": true,
1607 + "data_sca_check_id": true,
1608 + "data_sca_check_previous_result": true,
1609 + "data_sca_check_rationale": true,
1610 + "data_sca_check_remediation": true,
1611 + "data_sca_check_result": true,
1612 + "data_sca_check_title": true,
1613 + "data_sca_description": true,
1614 + "data_sca_failed": true,
1615 + "data_sca_file": true,
1616 + "data_sca_invalid": true,
1617 + "data_sca_passed": true,
1618 + "data_sca_policy": true,
1619 + "data_sca_policy_id": true,
1620 + "data_sca_scan_id": true,
1621 + "data_sca_score": true,
1622 + "data_sca_total_checks": true,
1623 + "data_sca_type": true,
1624 + "data_script": true,
1625 + "data_src_ip": true,
1626 + "data_src_ip_city_name": true,
1627 + "data_src_ip_country_code": true,
1628 + "data_src_ip_geolocation": true,
1629 + "data_src_port": true,
1630 + "data_srcip": true,
1631 + "data_srcip_city_name": true,
1632 + "data_srcip_country_code": true,
1633 + "data_srcip_geolocation": true,
1634 + "data_srcuser": true,
1635 + "data_timestamp": true,
1636 + "data_title": true,
1637 + "data_tls_session_resumed": true,
1638 + "data_tls_version": true,
1639 + "data_tx_id": true,
1640 + "data_type": true,
1641 + "data_win_eventXML_binaryData": true,
1642 + "data_win_eventXML_binaryDataSize": true,
1643 + "data_win_eventXML_param1": true,
1644 + "data_win_eventdata_authenticationPackageName": true,
1645 + "data_win_eventdata_callTrace": true,
1646 + "data_win_eventdata_commandLine": true,
1647 + "data_win_eventdata_company": true,
1648 + "data_win_eventdata_creationUtcTime": true,
1649 + "data_win_eventdata_currentDirectory": true,
1650 + "data_win_eventdata_description": true,
1651 + "data_win_eventdata_destinationHostname": true,
1652 + "data_win_eventdata_destinationIp": true,
1653 + "data_win_eventdata_destinationIp_city_name": true,
1654 + "data_win_eventdata_destinationIp_country_code": true,
1655 + "data_win_eventdata_destinationIp_geolocation": true,
1656 + "data_win_eventdata_destinationIsIpv6": true,
1657 + "data_win_eventdata_destinationPort": true,
1658 + "data_win_eventdata_destinationPortName": true,
1659 + "data_win_eventdata_details": true,
1660 + "data_win_eventdata_elevatedToken": true,
1661 + "data_win_eventdata_eventType": true,
1662 + "data_win_eventdata_fileVersion": true,
1663 + "data_win_eventdata_fileVersion_city_name": true,
1664 + "data_win_eventdata_fileVersion_country_code": true,
1665 + "data_win_eventdata_fileVersion_geolocation": true,
1666 + "data_win_eventdata_grantedAccess": true,
1667 + "data_win_eventdata_hashes": true,
1668 + "data_win_eventdata_image": true,
1669 + "data_win_eventdata_imageLoaded": true,
1670 + "data_win_eventdata_impersonationLevel": true,
1671 + "data_win_eventdata_initiated": true,
1672 + "data_win_eventdata_integrityLevel": true,
1673 + "data_win_eventdata_ipAddress": true,
1674 + "data_win_eventdata_ipPort": true,
1675 + "data_win_eventdata_keyLength": true,
1676 + "data_win_eventdata_logonGuid": true,
1677 + "data_win_eventdata_logonId": true,
1678 + "data_win_eventdata_logonProcessName": true,
1679 + "data_win_eventdata_logonType": true,
1680 + "data_win_eventdata_originalFileName": true,
1681 + "data_win_eventdata_param1": true,
1682 + "data_win_eventdata_param2": true,
1683 + "data_win_eventdata_param3": true,
1684 + "data_win_eventdata_param4": true,
1685 + "data_win_eventdata_parentCommandLine": true,
1686 + "data_win_eventdata_parentImage": true,
1687 + "data_win_eventdata_parentProcessGuid": true,
1688 + "data_win_eventdata_parentProcessId": true,
1689 + "data_win_eventdata_processGuid": true,
1690 + "data_win_eventdata_processId": true,
1691 + "data_win_eventdata_processName": true,
1692 + "data_win_eventdata_product": true,
1693 + "data_win_eventdata_protocol": true,
1694 + "data_win_eventdata_queryName": true,
1695 + "data_win_eventdata_queryResults": true,
1696 + "data_win_eventdata_queryStatus": true,
1697 + "data_win_eventdata_ruleName": true,
1698 + "data_win_eventdata_serviceName": true,
1699 + "data_win_eventdata_serviceSid": true,
1700 + "data_win_eventdata_signature": true,
1701 + "data_win_eventdata_signatureStatus": true,
1702 + "data_win_eventdata_signed": true,
1703 + "data_win_eventdata_sourceHostname": true,
1704 + "data_win_eventdata_sourceImage": true,
1705 + "data_win_eventdata_sourceIp": true,
1706 + "data_win_eventdata_sourceIp_city_name": true,
1707 + "data_win_eventdata_sourceIp_country_code": true,
1708 + "data_win_eventdata_sourceIp_geolocation": true,
1709 + "data_win_eventdata_sourceIsIpv6": true,
1710 + "data_win_eventdata_sourcePort": true,
1711 + "data_win_eventdata_sourceProcessGUID": true,
1712 + "data_win_eventdata_sourceProcessId": true,
1713 + "data_win_eventdata_sourceThreadId": true,
1714 + "data_win_eventdata_status": true,
1715 + "data_win_eventdata_subjectDomainName": true,
1716 + "data_win_eventdata_subjectLogonId": true,
1717 + "data_win_eventdata_subjectUserName": true,
1718 + "data_win_eventdata_subjectUserSid": true,
1719 + "data_win_eventdata_targetDomainName": true,
1720 + "data_win_eventdata_targetFilename": true,
1721 + "data_win_eventdata_targetImage": true,
1722 + "data_win_eventdata_targetLinkedLogonId": true,
1723 + "data_win_eventdata_targetLogonId": true,
1724 + "data_win_eventdata_targetObject": true,
1725 + "data_win_eventdata_targetProcessGUID": true,
1726 + "data_win_eventdata_targetProcessId": true,
1727 + "data_win_eventdata_targetUserName": true,
1728 + "data_win_eventdata_targetUserSid": true,
1729 + "data_win_eventdata_terminalSessionId": true,
1730 + "data_win_eventdata_ticketEncryptionType": true,
1731 + "data_win_eventdata_ticketOptions": true,
1732 + "data_win_eventdata_user": true,
1733 + "data_win_eventdata_utcTime": true,
1734 + "data_win_eventdata_virtualAccount": true,
1735 + "data_win_system_channel": true,
1736 + "data_win_system_computer": true,
1737 + "data_win_system_eventID": true,
1738 + "data_win_system_eventRecordID": true,
1739 + "data_win_system_eventSourceName": true,
1740 + "data_win_system_keywords": true,
1741 + "data_win_system_level": true,
1742 + "data_win_system_message": true,
1743 + "data_win_system_opcode": true,
1744 + "data_win_system_processID": true,
1745 + "data_win_system_providerGuid": true,
1746 + "data_win_system_providerName": true,
1747 + "data_win_system_severityValue": true,
1748 + "data_win_system_systemTime": true,
1749 + "data_win_system_task": true,
1750 + "data_win_system_threadID": true,
1751 + "data_win_system_version": true,
1752 + "decoder_name": true,
1753 + "decoder_parent": true,
1754 + "dns_query": true,
1755 + "dns_query_threat_indicated": true,
1756 + "dst_ip": true,
1757 + "dst_ip_city_name": true,
1758 + "dst_ip_country_code": true,
1759 + "dst_ip_geolocation": true,
1760 + "dst_ip_threat_indicated": true,
1761 + "dst_port": true,
1762 + "ecs_version": true,
1763 + "error": true,
1764 + "event_hash": true,
1765 + "file_path": true,
1766 + "firewall_rule_name": true,
1767 + "full_log": false,
1768 + "gl2_accounted_message_size": true,
1769 + "gl2_message_id": true,
1770 + "gl2_processing_error": true,
1771 + "gl2_remote_ip": true,
1772 + "gl2_remote_port": true,
1773 + "gl2_source_collector": true,
1774 + "gl2_source_input": true,
1775 + "gl2_source_node": true,
1776 + "hash_md5": true,
1777 + "hash_sha1": true,
1778 + "hash_sha256": true,
1779 + "highlight": true,
1780 + "host_architecture": true,
1781 + "host_containerized": true,
1782 + "host_hostname": true,
1783 + "host_id": true,
1784 + "host_ip": true,
1785 + "host_mac": true,
1786 + "host_name": true,
1787 + "host_os_codename": true,
1788 + "host_os_kernel": true,
1789 + "host_os_name": true,
1790 + "host_os_platform": true,
1791 + "host_os_version": true,
1792 + "hostname": true,
1793 + "id": true,
1794 + "input_type": true,
1795 + "level": true,
1796 + "location": true,
1797 + "log_file_path": true,
1798 + "log_offset": true,
1799 + "manager_name": true,
1800 + "message": true,
1801 + "module": true,
1802 + "parent_process_cmd_line": true,
1803 + "parent_process_id": true,
1804 + "parent_process_image": true,
1805 + "pid": true,
1806 + "predecoder_hostname": true,
1807 + "predecoder_program_name": true,
1808 + "predecoder_timestamp": true,
1809 + "previous_log": true,
1810 + "previous_output": true,
1811 + "process_cmd_line": true,
1812 + "process_id": true,
1813 + "process_image": true,
1814 + "process_name": true,
1815 + "protocol": true,
1816 + "rule_cis": true,
1817 + "rule_cis_csc": true,
1818 + "rule_firedtimes": true,
1819 + "rule_gdpr": true,
1820 + "rule_gdpr_IV": true,
1821 + "rule_gpg13": true,
1822 + "rule_gpg_13": true,
1823 + "rule_group1": true,
1824 + "rule_groups": true,
1825 + "rule_hipaa": true,
1826 + "rule_id": true,
1827 + "rule_info": true,
1828 + "rule_mail": true,
1829 + "rule_mitre_id": true,
1830 + "rule_mitre_tactic": false,
1831 + "rule_nist_800_53": true,
1832 + "rule_pci_dss": true,
1833 + "rule_tsc": true,
1834 + "scanid": true,
1835 + "service": true,
1836 + "software_package": true,
1837 + "software_vendor": true,
1838 + "sort": true,
1839 + "source": true,
1840 + "src_ip": true,
1841 + "src_ip_city_name": true,
1842 + "src_ip_country_code": true,
1843 + "src_ip_geolocation": true,
1844 + "src_port": true,
1845 + "streams": true,
1846 + "syscheck_attrs_after": true,
1847 + "syscheck_audit_effective_user_id": true,
1848 + "syscheck_audit_effective_user_name": true,
1849 + "syscheck_audit_group_id": true,
1850 + "syscheck_audit_group_name": true,
1851 + "syscheck_audit_login_user_id": true,
1852 + "syscheck_audit_login_user_name": true,
1853 + "syscheck_audit_process_cwd": true,
1854 + "syscheck_audit_process_id": true,
1855 + "syscheck_audit_process_name": true,
1856 + "syscheck_audit_process_parent_cwd": true,
1857 + "syscheck_audit_process_parent_name": true,
1858 + "syscheck_audit_process_ppid": true,
1859 + "syscheck_audit_user_id": true,
1860 + "syscheck_audit_user_name": true,
1861 + "syscheck_changed_attributes": true,
1862 + "syscheck_event": true,
1863 + "syscheck_gid_after": true,
1864 + "syscheck_gname_after": true,
1865 + "syscheck_hard_links": true,
1866 + "syscheck_inode_after": true,
1867 + "syscheck_inode_before": true,
1868 + "syscheck_md5_after": true,
1869 + "syscheck_md5_before": true,
1870 + "syscheck_mode": true,
1871 + "syscheck_mtime_after": true,
1872 + "syscheck_mtime_before": true,
1873 + "syscheck_path": true,
1874 + "syscheck_perm_after": true,
1875 + "syscheck_perm_before": true,
1876 + "syscheck_sha1_after": true,
1877 + "syscheck_sha1_before": true,
1878 + "syscheck_sha256_after": true,
1879 + "syscheck_sha256_before": true,
1880 + "syscheck_size_after": true,
1881 + "syscheck_size_before": true,
1882 + "syscheck_uid_after": true,
1883 + "syscheck_uname_after": true,
1884 + "syscheck_win_perm_after": true,
1885 + "syscheck_win_perm_after_0_allowed": true,
1886 + "syscheck_win_perm_after_0_name": true,
1887 + "syscheck_win_perm_after_1_allowed": true,
1888 + "syscheck_win_perm_after_1_name": true,
1889 + "syscheck_win_perm_after_2_allowed": true,
1890 + "syscheck_win_perm_after_2_name": true,
1891 + "syscheck_win_perm_after_3_allowed": true,
1892 + "syscheck_win_perm_after_3_name": true,
1893 + "syslog_customer": true,
1894 + "syslog_level": true,
1895 + "syslog_tag": true,
1896 + "syslog_type": true,
1897 + "sysmon_event_description": true,
1898 + "threat_ids": true,
1899 + "threat_indicated": true,
1900 + "threat_names": true,
1901 + "time": true,
1902 + "timestamp": true,
1903 + "true": true,
1904 + "user_name": true,
1905 + "win_registry_key": true,
1906 + "win_system_eventID": true,
1907 + "windows_auth_package": true,
1908 + "windows_domain": true,
1909 + "windows_event_id": true,
1910 + "windows_event_severity": true,
1911 + "windows_logon_type": true
1912 + },
1913 + "indexByName": {
1914 + "_id": 2,
1915 + "_index": 9,
1916 + "_type": 10,
1917 + "agent_id": 11,
1918 + "agent_name": 5,
1919 + "cluster_name": 12,
1920 + "cluster_node": 13,
1921 + "data_office365_AppAccessContext_APIId": 49,
1922 + "data_office365_AppAccessContext_ClientAppId": 50,
1923 + "data_office365_AppAccessContext_ClientAppName": 51,
1924 + "data_office365_AppAccessContext_CorrelationId": 52,
1925 + "data_office365_ArtifactsShared": 53,
1926 + "data_office365_Attendees": 54,
1927 + "data_office365_ChatName": 55,
1928 + "data_office365_ChatThreadId": 56,
1929 + "data_office365_ClientIP": 4,
1930 + "data_office365_ClientIP_city_name": 14,
1931 + "data_office365_ClientIP_country_code": 15,
1932 + "data_office365_ClientIP_geolocation": 16,
1933 + "data_office365_CommunicationSubType": 57,
1934 + "data_office365_CommunicationType": 58,
1935 + "data_office365_CreationTime": 0,
1936 + "data_office365_DeviceId": 59,
1937 + "data_office365_DeviceInformation": 60,
1938 + "data_office365_EndTime": 61,
1939 + "data_office365_ExchangeId": 62,
1940 + "data_office365_ExtraProperties": 63,
1941 + "data_office365_ICalUid": 64,
1942 + "data_office365_Id": 17,
1943 + "data_office365_ItemName": 65,
1944 + "data_office365_JoinTime": 66,
1945 + "data_office365_LeaveTime": 67,
1946 + "data_office365_MeetingDetailId": 68,
1947 + "data_office365_MeetingURL": 69,
1948 + "data_office365_Members": 70,
1949 + "data_office365_MessageId": 71,
1950 + "data_office365_MessageSizeInBytes": 72,
1951 + "data_office365_MessageURLs": 73,
1952 + "data_office365_MessageVersion": 74,
1953 + "data_office365_Modalities": 75,
1954 + "data_office365_Name": 76,
1955 + "data_office365_NewValue": 77,
1956 + "data_office365_ObjectId": 18,
1957 + "data_office365_Operation": 24,
1958 + "data_office365_OperationScope": 78,
1959 + "data_office365_OrganizationId": 19,
1960 + "data_office365_Organizer_OrganizationId": 79,
1961 + "data_office365_Organizer_RecipientType": 80,
1962 + "data_office365_Organizer_Role": 81,
1963 + "data_office365_Organizer_UserObjectId": 82,
1964 + "data_office365_ProviderTypes": 83,
1965 + "data_office365_RecordType": 20,
1966 + "data_office365_StartTime": 84,
1967 + "data_office365_SubscriptionId": 85,
1968 + "data_office365_TeamGuid": 86,
1969 + "data_office365_UserId": 3,
1970 + "data_office365_UserKey": 21,
1971 + "data_office365_UserType": 22,
1972 + "data_office365_Version": 23,
1973 + "data_office365_Workload": 48,
1974 + "decoder_name": 25,
1975 + "gl2_accounted_message_size": 26,
1976 + "gl2_message_id": 27,
1977 + "gl2_processing_error": 28,
1978 + "gl2_remote_ip": 29,
1979 + "gl2_remote_port": 30,
1980 + "gl2_source_input": 31,
1981 + "gl2_source_node": 32,
1982 + "highlight": 33,
1983 + "id": 34,
1984 + "location": 35,
1985 + "manager_name": 36,
1986 + "message": 37,
1987 + "rule_description": 6,
1988 + "rule_firedtimes": 38,
1989 + "rule_group1": 39,
1990 + "rule_groups": 40,
1991 + "rule_id": 8,
1992 + "rule_level": 7,
1993 + "rule_mail": 41,
1994 + "sort": 42,
1995 + "source": 43,
1996 + "streams": 44,
1997 + "syslog_level": 45,
1998 + "syslog_type": 46,
1999 + "timestamp": 1,
2000 + "true": 47
2001 + },
2002 + "renameByName": {
2003 + "_id": "EVENT ID",
2004 + "agent_name": "",
2005 + "data_office365_ActorIpAddress": "SRC IP",
2006 + "data_office365_ClientIP": "CLIENT IP",
2007 + "data_office365_ClientIP_city_name": "",
2008 + "data_office365_CreationTime": "EVENT TIME",
2009 + "data_office365_ResultStatus": "RESULT",
2010 + "data_office365_UserId": "ACCOUNT",
2011 + "rule_description": "DESCRIPTION",
2012 + "rule_id": "RULE ID",
2013 + "rule_level": "",
2014 + "rule_mitre_tactic": "MITRE TACTIC",
2015 + "rule_mitre_technique": "MITRE TECHNIQUE",
2016 + "timestamp": "Date/Time"
2017 + }
2018 + }
2019 + }
2020 + ],
2021 + "transparent": true,
2022 + "type": "table"
2023 + }
2024 + ],
2025 + "refresh": false,
2026 + "schemaVersion": 37,
2027 + "style": "dark",
2028 + "tags": [
2029 + "O365"
2030 + ],
2031 + "templating": {
2032 + "list": [
2033 + {
2034 + "datasource": {
2035 + "type": "elasticsearch",
2036 + "uid": "replace_datasource_uid"
2037 + },
2038 + "filters": [],
2039 + "hide": 0,
2040 + "label": "",
2041 + "name": "Filters",
2042 + "skipUrlSync": false,
2043 + "type": "adhoc"
2044 + },
2045 + {
2046 + "current": {
2047 + "selected": false,
2048 + "text": "All",
2049 + "value": "$__all"
2050 + },
2051 + "datasource": {
2052 + "type": "elasticsearch",
2053 + "uid": "replace_datasource_uid"
2054 + },
2055 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftTeams\"}",
2056 + "hide": 0,
2057 + "includeAll": true,
2058 + "label": "Operation",
2059 + "multi": false,
2060 + "name": "operation",
2061 + "options": [],
2062 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftTeams\"}",
2063 + "refresh": 2,
2064 + "regex": "",
2065 + "skipUrlSync": false,
2066 + "sort": 1,
2067 + "tagValuesQuery": "",
2068 + "tagsQuery": "",
2069 + "type": "query",
2070 + "useTags": false
2071 + },
2072 + {
2073 + "current": {
2074 + "selected": false,
2075 + "text": "All",
2076 + "value": "$__all"
2077 + },
2078 + "datasource": {
2079 + "type": "elasticsearch",
2080 + "uid": "replace_datasource_uid"
2081 + },
2082 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2083 + "hide": 0,
2084 + "includeAll": true,
2085 + "label": "Rule Level",
2086 + "multi": false,
2087 + "name": "rule_level",
2088 + "options": [],
2089 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2090 + "refresh": 2,
2091 + "regex": "",
2092 + "skipUrlSync": false,
2093 + "sort": 0,
2094 + "type": "query"
2095 + }
2096 + ]
2097 + },
2098 + "time": {
2099 + "from": "now-12h",
2100 + "to": "now"
2101 + },
2102 + "timepicker": {
2103 + "refresh_intervals": [
2104 + "5s",
2105 + "10s",
2106 + "30s",
2107 + "1m",
2108 + "5m",
2109 + "15m",
2110 + "30m",
2111 + "1h",
2112 + "2h",
2113 + "1d"
2114 + ],
2115 + "time_options": [
2116 + "5m",
2117 + "15m",
2118 + "1h",
2119 + "6h",
2120 + "12h",
2121 + "24h",
2122 + "2d",
2123 + "7d",
2124 + "30d"
2125 + ]
2126 + },
2127 + "timezone": "",
2128 + "title": "O365 - MICROSOFT TEAMS",
2129 + "uid": "dslr7w3nz",
2130 + "version": 1,
2131 + "weekStart": ""
2132 +}
backend/app/connectors/grafana/dashboards/Office365/threat_intelligence.json new
+2506
@@ -0,0 +1,2506 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "O365"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "elasticsearch",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "red",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 43,
82 + "links": [],
83 + "options": {
84 + "colorMode": "value",
85 + "graphMode": "area",
86 + "justifyMode": "auto",
87 + "orientation": "horizontal",
88 + "reduceOptions": {
89 + "calcs": [
90 + "sum"
91 + ],
92 + "fields": "",
93 + "values": false
94 + },
95 + "text": {},
96 + "textMode": "auto",
97 + "wideLayout": true
98 + },
99 + "pluginVersion": "10.2.2",
100 + "targets": [
101 + {
102 + "bucketAggs": [
103 + {
104 + "field": "timestamp",
105 + "id": "2",
106 + "settings": {
107 + "interval": "auto",
108 + "min_doc_count": 0,
109 + "trimEdges": 0
110 + },
111 + "type": "date_histogram"
112 + }
113 + ],
114 + "datasource": {
115 + "type": "elasticsearch",
116 + "uid": "replace_datasource_uid"
117 + },
118 + "metrics": [
119 + {
120 + "field": "select field",
121 + "id": "1",
122 + "type": "count"
123 + }
124 + ],
125 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
126 + "refId": "A",
127 + "timeField": "timestamp"
128 + }
129 + ],
130 + "title": "ALERTS",
131 + "type": "stat"
132 + },
133 + {
134 + "datasource": {
135 + "type": "elasticsearch",
136 + "uid": "replace_datasource_uid"
137 + },
138 + "fieldConfig": {
139 + "defaults": {
140 + "color": {
141 + "mode": "palette-classic"
142 + },
143 + "custom": {
144 + "hideFrom": {
145 + "legend": false,
146 + "tooltip": false,
147 + "viz": false
148 + }
149 + },
150 + "mappings": []
151 + },
152 + "overrides": [
153 + {
154 + "matcher": {
155 + "id": "byName",
156 + "options": "Count"
157 + },
158 + "properties": [
159 + {
160 + "id": "displayName",
161 + "value": "EVENTS"
162 + },
163 + {
164 + "id": "unit",
165 + "value": "short"
166 + },
167 + {
168 + "id": "decimals",
169 + "value": -1
170 + }
171 + ]
172 + }
173 + ]
174 + },
175 + "gridPos": {
176 + "h": 7,
177 + "w": 4,
178 + "x": 4,
179 + "y": 0
180 + },
181 + "id": 53,
182 + "options": {
183 + "legend": {
184 + "displayMode": "list",
185 + "placement": "bottom",
186 + "showLegend": false
187 + },
188 + "pieType": "donut",
189 + "reduceOptions": {
190 + "calcs": [
191 + "sum"
192 + ],
193 + "fields": "",
194 + "values": false
195 + },
196 + "tooltip": {
197 + "mode": "single",
198 + "sort": "none"
199 + }
200 + },
201 + "pluginVersion": "8.5.1",
202 + "targets": [
203 + {
204 + "bucketAggs": [
205 + {
206 + "fake": true,
207 + "field": "data_office365_Operation",
208 + "id": "4",
209 + "settings": {
210 + "min_doc_count": 1,
211 + "order": "desc",
212 + "orderBy": "_count",
213 + "size": "10"
214 + },
215 + "type": "terms"
216 + },
217 + {
218 + "field": "data_office365_CreationTime",
219 + "id": "5",
220 + "settings": {
221 + "interval": "auto",
222 + "min_doc_count": "0",
223 + "timeZone": "utc",
224 + "trimEdges": "0"
225 + },
226 + "type": "date_histogram"
227 + }
228 + ],
229 + "datasource": {
230 + "type": "elasticsearch",
231 + "uid": "replace_datasource_uid"
232 + },
233 + "metrics": [
234 + {
235 + "field": "select field",
236 + "id": "1",
237 + "type": "count"
238 + }
239 + ],
240 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
241 + "refId": "A",
242 + "timeField": "timestamp"
243 + }
244 + ],
245 + "title": "EVENTS BY OPERATION (Top 10)",
246 + "transformations": [],
247 + "type": "piechart"
248 + },
249 + {
250 + "datasource": {
251 + "type": "elasticsearch",
252 + "uid": "replace_datasource_uid"
253 + },
254 + "fieldConfig": {
255 + "defaults": {
256 + "color": {
257 + "mode": "thresholds"
258 + },
259 + "custom": {
260 + "align": "auto",
261 + "cellOptions": {
262 + "type": "auto"
263 + },
264 + "inspect": false
265 + },
266 + "mappings": [],
267 + "thresholds": {
268 + "mode": "absolute",
269 + "steps": [
270 + {
271 + "color": "red",
272 + "value": null
273 + }
274 + ]
275 + }
276 + },
277 + "overrides": [
278 + {
279 + "matcher": {
280 + "id": "byName",
281 + "options": "Count"
282 + },
283 + "properties": [
284 + {
285 + "id": "displayName",
286 + "value": "EVENTS"
287 + },
288 + {
289 + "id": "unit",
290 + "value": "short"
291 + },
292 + {
293 + "id": "decimals",
294 + "value": -1
295 + },
296 + {
297 + "id": "custom.align"
298 + },
299 + {
300 + "id": "thresholds",
301 + "value": {
302 + "mode": "absolute",
303 + "steps": [
304 + {
305 + "color": "red",
306 + "value": null
307 + }
308 + ]
309 + }
310 + }
311 + ]
312 + }
313 + ]
314 + },
315 + "gridPos": {
316 + "h": 7,
317 + "w": 5,
318 + "x": 8,
319 + "y": 0
320 + },
321 + "id": 54,
322 + "options": {
323 + "cellHeight": "sm",
324 + "footer": {
325 + "countRows": false,
326 + "fields": "",
327 + "reducer": [
328 + "sum"
329 + ],
330 + "show": false
331 + },
332 + "showHeader": true
333 + },
334 + "pluginVersion": "10.2.2",
335 + "targets": [
336 + {
337 + "bucketAggs": [
338 + {
339 + "fake": true,
340 + "field": "data_office365_Operation",
341 + "id": "4",
342 + "settings": {
343 + "min_doc_count": 1,
344 + "order": "desc",
345 + "orderBy": "_count",
346 + "size": "0"
347 + },
348 + "type": "terms"
349 + }
350 + ],
351 + "datasource": {
352 + "type": "elasticsearch",
353 + "uid": "replace_datasource_uid"
354 + },
355 + "metrics": [
356 + {
357 + "field": "select field",
358 + "id": "1",
359 + "type": "count"
360 + }
361 + ],
362 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
363 + "refId": "A",
364 + "timeField": "timestamp"
365 + }
366 + ],
367 + "title": "EVENTS BY OPERATION",
368 + "transformations": [
369 + {
370 + "id": "merge",
371 + "options": {
372 + "reducers": []
373 + }
374 + },
375 + {
376 + "id": "organize",
377 + "options": {
378 + "excludeByName": {},
379 + "indexByName": {},
380 + "renameByName": {
381 + "Count": "EVENTS",
382 + "data_office365_Operation": "OPERATION"
383 + }
384 + }
385 + }
386 + ],
387 + "type": "table"
388 + },
389 + {
390 + "datasource": {
391 + "type": "grafana-opensearch-datasource",
392 + "uid": "replace_datasource_uid"
393 + },
394 + "fieldConfig": {
395 + "defaults": {
396 + "color": {
397 + "mode": "thresholds"
398 + },
399 + "custom": {
400 + "align": "auto",
401 + "cellOptions": {
402 + "type": "auto"
403 + },
404 + "inspect": false
405 + },
406 + "mappings": [],
407 + "thresholds": {
408 + "mode": "absolute",
409 + "steps": [
410 + {
411 + "color": "red",
412 + "value": null
413 + }
414 + ]
415 + }
416 + },
417 + "overrides": [
418 + {
419 + "matcher": {
420 + "id": "byName",
421 + "options": "Count"
422 + },
423 + "properties": [
424 + {
425 + "id": "displayName",
426 + "value": "EVENTS"
427 + },
428 + {
429 + "id": "unit",
430 + "value": "short"
431 + },
432 + {
433 + "id": "decimals",
434 + "value": -1
435 + },
436 + {
437 + "id": "custom.align"
438 + },
439 + {
440 + "id": "thresholds",
441 + "value": {
442 + "mode": "absolute",
443 + "steps": [
444 + {
445 + "color": "red",
446 + "value": null
447 + }
448 + ]
449 + }
450 + }
451 + ]
452 + }
453 + ]
454 + },
455 + "gridPos": {
456 + "h": 7,
457 + "w": 6,
458 + "x": 13,
459 + "y": 0
460 + },
461 + "id": 61,
462 + "options": {
463 + "cellHeight": "sm",
464 + "footer": {
465 + "countRows": false,
466 + "fields": "",
467 + "reducer": [
468 + "sum"
469 + ],
470 + "show": false
471 + },
472 + "showHeader": true
473 + },
474 + "pluginVersion": "10.2.2",
475 + "targets": [
476 + {
477 + "bucketAggs": [
478 + {
479 + "fake": true,
480 + "field": "data_office365_DetectionMethod",
481 + "id": "4",
482 + "settings": {
483 + "min_doc_count": 1,
484 + "order": "desc",
485 + "orderBy": "_count",
486 + "size": "0"
487 + },
488 + "type": "terms"
489 + }
490 + ],
491 + "datasource": {
492 + "type": "elasticsearch",
493 + "uid": "replace_datasource_uid"
494 + },
495 + "metrics": [
496 + {
497 + "field": "select field",
498 + "id": "1",
499 + "type": "count"
500 + }
501 + ],
502 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
503 + "queryType": "lucene",
504 + "refId": "A",
505 + "timeField": "timestamp"
506 + }
507 + ],
508 + "title": "EVENTS BY DETECTION",
509 + "transformations": [
510 + {
511 + "id": "organize",
512 + "options": {
513 + "excludeByName": {},
514 + "indexByName": {},
515 + "renameByName": {
516 + "Count": "EVENTS",
517 + "data_office365_DetectionMethod": "DETECTION METHOD",
518 + "data_office365_Operation": "OPERATION"
519 + }
520 + }
521 + }
522 + ],
523 + "type": "table"
524 + },
525 + {
526 + "datasource": {
527 + "type": "grafana-opensearch-datasource",
528 + "uid": "replace_datasource_uid"
529 + },
530 + "fieldConfig": {
531 + "defaults": {
532 + "color": {
533 + "mode": "thresholds"
534 + },
535 + "custom": {
536 + "align": "auto",
537 + "cellOptions": {
538 + "type": "auto"
539 + },
540 + "inspect": false
541 + },
542 + "mappings": [],
543 + "thresholds": {
544 + "mode": "absolute",
545 + "steps": [
546 + {
547 + "color": "red",
548 + "value": null
549 + }
550 + ]
551 + }
552 + },
553 + "overrides": [
554 + {
555 + "matcher": {
556 + "id": "byName",
557 + "options": "Count"
558 + },
559 + "properties": [
560 + {
561 + "id": "displayName",
562 + "value": "EVENTS"
563 + },
564 + {
565 + "id": "unit",
566 + "value": "short"
567 + },
568 + {
569 + "id": "decimals",
570 + "value": -1
571 + },
572 + {
573 + "id": "custom.align"
574 + },
575 + {
576 + "id": "thresholds",
577 + "value": {
578 + "mode": "absolute",
579 + "steps": [
580 + {
581 + "color": "red",
582 + "value": null
583 + }
584 + ]
585 + }
586 + }
587 + ]
588 + },
589 + {
590 + "matcher": {
591 + "id": "byName",
592 + "options": "DELIVERY ACTION"
593 + },
594 + "properties": [
595 + {
596 + "id": "color",
597 + "value": {
598 + "mode": "fixed"
599 + }
600 + },
601 + {
602 + "id": "mappings",
603 + "value": [
604 + {
605 + "options": {
606 + "Blocked": {
607 + "color": "green",
608 + "index": 0
609 + },
610 + "Delivered": {
611 + "color": "light-red",
612 + "index": 1
613 + },
614 + "DeliveredAsSpam": {
615 + "color": "orange",
616 + "index": 2
617 + }
618 + },
619 + "type": "value"
620 + }
621 + ]
622 + },
623 + {
624 + "id": "custom.cellOptions",
625 + "value": {
626 + "type": "color-text"
627 + }
628 + }
629 + ]
630 + }
631 + ]
632 + },
633 + "gridPos": {
634 + "h": 7,
635 + "w": 5,
636 + "x": 19,
637 + "y": 0
638 + },
639 + "id": 62,
640 + "options": {
641 + "cellHeight": "sm",
642 + "footer": {
643 + "countRows": false,
644 + "fields": "",
645 + "reducer": [
646 + "sum"
647 + ],
648 + "show": false
649 + },
650 + "showHeader": true
651 + },
652 + "pluginVersion": "10.2.2",
653 + "targets": [
654 + {
655 + "bucketAggs": [
656 + {
657 + "fake": true,
658 + "field": "data_office365_DeliveryAction",
659 + "id": "4",
660 + "settings": {
661 + "min_doc_count": 1,
662 + "order": "desc",
663 + "orderBy": "_count",
664 + "size": "0"
665 + },
666 + "type": "terms"
667 + }
668 + ],
669 + "datasource": {
670 + "type": "elasticsearch",
671 + "uid": "replace_datasource_uid"
672 + },
673 + "metrics": [
674 + {
675 + "field": "select field",
676 + "id": "1",
677 + "type": "count"
678 + }
679 + ],
680 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
681 + "queryType": "lucene",
682 + "refId": "A",
683 + "timeField": "timestamp"
684 + }
685 + ],
686 + "title": "EVENTS BY ACTION (EXCHANGE)",
687 + "transformations": [
688 + {
689 + "id": "organize",
690 + "options": {
691 + "excludeByName": {},
692 + "indexByName": {},
693 + "renameByName": {
694 + "Count": "EVENTS",
695 + "data_office365_DeliveryAction": "DELIVERY ACTION",
696 + "data_office365_DetectionMethod": "DETECTION METHOD",
697 + "data_office365_Operation": "OPERATION"
698 + }
699 + }
700 + }
701 + ],
702 + "type": "table"
703 + },
704 + {
705 + "datasource": {
706 + "type": "elasticsearch",
707 + "uid": "replace_datasource_uid"
708 + },
709 + "fieldConfig": {
710 + "defaults": {
711 + "color": {
712 + "mode": "thresholds"
713 + },
714 + "mappings": [
715 + {
716 + "options": {
717 + "match": "null",
718 + "result": {
719 + "text": "N/A"
720 + }
721 + },
722 + "type": "special"
723 + }
724 + ],
725 + "max": 15,
726 + "min": 0,
727 + "thresholds": {
728 + "mode": "absolute",
729 + "steps": [
730 + {
731 + "color": "#299c46",
732 + "value": null
733 + },
734 + {
735 + "color": "rgba(237, 129, 40, 0.89)",
736 + "value": 8
737 + },
738 + {
739 + "color": "#d44a3a",
740 + "value": 12
741 + }
742 + ]
743 + },
744 + "unit": "none"
745 + },
746 + "overrides": []
747 + },
748 + "gridPos": {
749 + "h": 7,
750 + "w": 4,
751 + "x": 0,
752 + "y": 7
753 + },
754 + "id": 16,
755 + "links": [],
756 + "options": {
757 + "minVizHeight": 75,
758 + "minVizWidth": 75,
759 + "orientation": "horizontal",
760 + "reduceOptions": {
761 + "calcs": [
762 + "max"
763 + ],
764 + "fields": "",
765 + "values": false
766 + },
767 + "showThresholdLabels": false,
768 + "showThresholdMarkers": true,
769 + "text": {}
770 + },
771 + "pluginVersion": "10.2.2",
772 + "targets": [
773 + {
774 + "bucketAggs": [
775 + {
776 + "field": "timestamp",
777 + "id": "2",
778 + "settings": {
779 + "interval": "auto",
780 + "min_doc_count": 0,
781 + "trimEdges": 0
782 + },
783 + "type": "date_histogram"
784 + }
785 + ],
786 + "datasource": {
787 + "type": "elasticsearch",
788 + "uid": "replace_datasource_uid"
789 + },
790 + "metrics": [
791 + {
792 + "field": "rule_level",
793 + "id": "1",
794 + "meta": {},
795 + "settings": {},
796 + "type": "max"
797 + }
798 + ],
799 + "query": "data_office365_Operation:$operation",
800 + "refId": "A",
801 + "timeField": "timestamp"
802 + }
803 + ],
804 + "title": "MAX SEVERITY (0 - 15)",
805 + "type": "gauge"
806 + },
807 + {
808 + "datasource": {
809 + "type": "elasticsearch",
810 + "uid": "replace_datasource_uid"
811 + },
812 + "fieldConfig": {
813 + "defaults": {
814 + "color": {
815 + "mode": "palette-classic"
816 + },
817 + "custom": {
818 + "axisBorderShow": false,
819 + "axisCenteredZero": false,
820 + "axisColorMode": "text",
821 + "axisLabel": "",
822 + "axisPlacement": "auto",
823 + "barAlignment": 0,
824 + "drawStyle": "bars",
825 + "fillOpacity": 0,
826 + "gradientMode": "none",
827 + "hideFrom": {
828 + "legend": false,
829 + "tooltip": false,
830 + "viz": false
831 + },
832 + "insertNulls": false,
833 + "lineInterpolation": "linear",
834 + "lineWidth": 1,
835 + "pointSize": 5,
836 + "scaleDistribution": {
837 + "type": "linear"
838 + },
839 + "showPoints": "auto",
840 + "spanNulls": false,
841 + "stacking": {
842 + "group": "A",
843 + "mode": "normal"
844 + },
845 + "thresholdsStyle": {
846 + "mode": "off"
847 + }
848 + },
849 + "mappings": [],
850 + "thresholds": {
851 + "mode": "absolute",
852 + "steps": [
853 + {
854 + "color": "green",
855 + "value": null
856 + },
857 + {
858 + "color": "red",
859 + "value": 80
860 + }
861 + ]
862 + }
863 + },
864 + "overrides": []
865 + },
866 + "gridPos": {
867 + "h": 13,
868 + "w": 20,
869 + "x": 4,
870 + "y": 7
871 + },
872 + "id": 60,
873 + "options": {
874 + "legend": {
875 + "calcs": [],
876 + "displayMode": "table",
877 + "placement": "right",
878 + "showLegend": true
879 + },
880 + "tooltip": {
881 + "mode": "single",
882 + "sort": "none"
883 + }
884 + },
885 + "targets": [
886 + {
887 + "alias": "",
888 + "bucketAggs": [
889 + {
890 + "field": "data_office365_Operation",
891 + "id": "3",
892 + "settings": {
893 + "min_doc_count": "1",
894 + "order": "desc",
895 + "orderBy": "_count",
896 + "size": "10"
897 + },
898 + "type": "terms"
899 + },
900 + {
901 + "field": "timestamp",
902 + "id": "2",
903 + "settings": {
904 + "interval": "auto"
905 + },
906 + "type": "date_histogram"
907 + }
908 + ],
909 + "datasource": {
910 + "type": "elasticsearch",
911 + "uid": "replace_datasource_uid"
912 + },
913 + "metrics": [
914 + {
915 + "id": "1",
916 + "type": "count"
917 + }
918 + ],
919 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
920 + "refId": "A",
921 + "timeField": "timestamp"
922 + }
923 + ],
924 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
925 + "transparent": true,
926 + "type": "timeseries"
927 + },
928 + {
929 + "datasource": {
930 + "type": "elasticsearch",
931 + "uid": "replace_datasource_uid"
932 + },
933 + "fieldConfig": {
934 + "defaults": {
935 + "mappings": [
936 + {
937 + "options": {
938 + "match": "null",
939 + "result": {
940 + "text": "N/A"
941 + }
942 + },
943 + "type": "special"
944 + }
945 + ],
946 + "thresholds": {
947 + "mode": "absolute",
948 + "steps": [
949 + {
950 + "color": "orange",
951 + "value": null
952 + }
953 + ]
954 + },
955 + "unit": "locale"
956 + },
957 + "overrides": []
958 + },
959 + "gridPos": {
960 + "h": 6,
961 + "w": 4,
962 + "x": 0,
963 + "y": 14
964 + },
965 + "id": 51,
966 + "links": [],
967 + "options": {
968 + "colorMode": "value",
969 + "graphMode": "area",
970 + "justifyMode": "auto",
971 + "orientation": "horizontal",
972 + "reduceOptions": {
973 + "calcs": [
974 + "sum"
975 + ],
976 + "fields": "",
977 + "values": false
978 + },
979 + "text": {},
980 + "textMode": "auto",
981 + "wideLayout": true
982 + },
983 + "pluginVersion": "10.2.2",
984 + "targets": [
985 + {
986 + "bucketAggs": [
987 + {
988 + "$$hashKey": "object:331",
989 + "field": "timestamp",
990 + "id": "2",
991 + "settings": {
992 + "interval": "auto",
993 + "min_doc_count": 0,
994 + "trimEdges": 0
995 + },
996 + "type": "date_histogram"
997 + }
998 + ],
999 + "datasource": {
1000 + "type": "elasticsearch",
1001 + "uid": "replace_datasource_uid"
1002 + },
1003 + "metrics": [
1004 + {
1005 + "$$hashKey": "object:329",
1006 + "field": "select field",
1007 + "id": "1",
1008 + "type": "count"
1009 + }
1010 + ],
1011 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1012 + "refId": "A",
1013 + "timeField": "timestamp"
1014 + }
1015 + ],
1016 + "title": "EVENTS (Total)",
1017 + "type": "stat"
1018 + },
1019 + {
1020 + "datasource": {
1021 + "type": "grafana-opensearch-datasource",
1022 + "uid": "replace_datasource_uid"
1023 + },
1024 + "fieldConfig": {
1025 + "defaults": {
1026 + "color": {
1027 + "mode": "thresholds"
1028 + },
1029 + "custom": {
1030 + "align": "auto",
1031 + "cellOptions": {
1032 + "type": "auto"
1033 + },
1034 + "inspect": false
1035 + },
1036 + "mappings": [],
1037 + "thresholds": {
1038 + "mode": "absolute",
1039 + "steps": [
1040 + {
1041 + "color": "orange",
1042 + "value": null
1043 + }
1044 + ]
1045 + }
1046 + },
1047 + "overrides": [
1048 + {
1049 + "matcher": {
1050 + "id": "byName",
1051 + "options": "Count"
1052 + },
1053 + "properties": [
1054 + {
1055 + "id": "displayName",
1056 + "value": "EVENTS"
1057 + },
1058 + {
1059 + "id": "unit",
1060 + "value": "short"
1061 + },
1062 + {
1063 + "id": "decimals",
1064 + "value": -1
1065 + },
1066 + {
1067 + "id": "custom.align"
1068 + }
1069 + ]
1070 + },
1071 + {
1072 + "matcher": {
1073 + "id": "byName",
1074 + "options": "AD ACCOUNT"
1075 + },
1076 + "properties": [
1077 + {
1078 + "id": "custom.width",
1079 + "value": 377
1080 + }
1081 + ]
1082 + }
1083 + ]
1084 + },
1085 + "gridPos": {
1086 + "h": 12,
1087 + "w": 7,
1088 + "x": 0,
1089 + "y": 20
1090 + },
1091 + "id": 63,
1092 + "options": {
1093 + "cellHeight": "sm",
1094 + "footer": {
1095 + "countRows": false,
1096 + "fields": "",
1097 + "reducer": [
1098 + "sum"
1099 + ],
1100 + "show": false
1101 + },
1102 + "showHeader": true,
1103 + "sortBy": []
1104 + },
1105 + "pluginVersion": "10.2.2",
1106 + "targets": [
1107 + {
1108 + "bucketAggs": [
1109 + {
1110 + "fake": true,
1111 + "field": "data_office365_Directionality",
1112 + "id": "4",
1113 + "settings": {
1114 + "min_doc_count": 1,
1115 + "order": "desc",
1116 + "orderBy": "_count",
1117 + "size": "0"
1118 + },
1119 + "type": "terms"
1120 + }
1121 + ],
1122 + "datasource": {
1123 + "type": "elasticsearch",
1124 + "uid": "replace_datasource_uid"
1125 + },
1126 + "metrics": [
1127 + {
1128 + "field": "select field",
1129 + "id": "1",
1130 + "type": "count"
1131 + }
1132 + ],
1133 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1134 + "queryType": "lucene",
1135 + "refId": "A",
1136 + "timeField": "timestamp"
1137 + }
1138 + ],
1139 + "title": "EVENTS BY DIRECTION",
1140 + "transformations": [
1141 + {
1142 + "id": "organize",
1143 + "options": {
1144 + "excludeByName": {},
1145 + "indexByName": {},
1146 + "renameByName": {
1147 + "Count": "EVENTS",
1148 + "data_office365_ClientIP_country_code": "COUNTRY",
1149 + "data_office365_Directionality": "DIRECTION",
1150 + "data_office365_LogonError": "ERROR",
1151 + "data_office365_Operation": "WORKLOAD",
1152 + "data_office365_P1Sender": "SENDER",
1153 + "data_office365_UserId": "AD ACCOUNT"
1154 + }
1155 + }
1156 + }
1157 + ],
1158 + "type": "table"
1159 + },
1160 + {
1161 + "circleMaxSize": 30,
1162 + "circleMinSize": 2,
1163 + "colors": [
1164 + "rgba(245, 54, 54, 0.9)",
1165 + "rgba(237, 129, 40, 0.89)",
1166 + "rgba(50, 172, 45, 0.97)"
1167 + ],
1168 + "datasource": {
1169 + "type": "grafana-opensearch-datasource",
1170 + "uid": "replace_datasource_uid"
1171 + },
1172 + "decimals": 0,
1173 + "esMetric": "Count",
1174 + "gridPos": {
1175 + "h": 12,
1176 + "w": 7,
1177 + "x": 7,
1178 + "y": 20
1179 + },
1180 + "hideEmpty": false,
1181 + "hideZero": false,
1182 + "id": 50,
1183 + "initialZoom": 1,
1184 + "locationData": "countries",
1185 + "mapCenter": "(0°, 0°)",
1186 + "mapCenterLatitude": 0,
1187 + "mapCenterLongitude": 0,
1188 + "maxDataPoints": 1,
1189 + "mouseWheelZoom": false,
1190 + "showLegend": true,
1191 + "stickyLabels": false,
1192 + "tableQueryOptions": {
1193 + "geohashField": "geohash",
1194 + "latitudeField": "latitude",
1195 + "longitudeField": "longitude",
1196 + "metricField": "metric",
1197 + "queryType": "geohash"
1198 + },
1199 + "targets": [
1200 + {
1201 + "bucketAggs": [
1202 + {
1203 + "fake": true,
1204 + "field": "data_office365_SenderIp_country_code",
1205 + "id": "3",
1206 + "settings": {
1207 + "min_doc_count": 1,
1208 + "order": "desc",
1209 + "orderBy": "_term",
1210 + "size": "0"
1211 + },
1212 + "type": "terms"
1213 + },
1214 + {
1215 + "field": "timestamp",
1216 + "id": "2",
1217 + "settings": {
1218 + "interval": "auto",
1219 + "min_doc_count": 0,
1220 + "trimEdges": 0
1221 + },
1222 + "type": "date_histogram"
1223 + }
1224 + ],
1225 + "datasource": {
1226 + "type": "elasticsearch",
1227 + "uid": "replace_datasource_uid"
1228 + },
1229 + "metrics": [
1230 + {
1231 + "field": "select field",
1232 + "id": "1",
1233 + "type": "count"
1234 + }
1235 + ],
1236 + "query": "data_office365_Workload:ThreatIntelligence AND rule_level:$rule_level",
1237 + "queryType": "lucene",
1238 + "refId": "A",
1239 + "timeField": "timestamp"
1240 + }
1241 + ],
1242 + "thresholds": "0,10",
1243 + "title": "ALL EVENTS BY SENDER COUNTRY",
1244 + "type": "grafana-worldmap-panel",
1245 + "unitPlural": "",
1246 + "unitSingle": "",
1247 + "valueName": "total"
1248 + },
1249 + {
1250 + "datasource": {
1251 + "type": "grafana-opensearch-datasource",
1252 + "uid": "replace_datasource_uid"
1253 + },
1254 + "fieldConfig": {
1255 + "defaults": {
1256 + "color": {
1257 + "mode": "thresholds"
1258 + },
1259 + "custom": {
1260 + "align": "auto",
1261 + "cellOptions": {
1262 + "type": "auto"
1263 + },
1264 + "inspect": false
1265 + },
1266 + "mappings": [],
1267 + "thresholds": {
1268 + "mode": "absolute",
1269 + "steps": [
1270 + {
1271 + "color": "orange",
1272 + "value": null
1273 + }
1274 + ]
1275 + }
1276 + },
1277 + "overrides": [
1278 + {
1279 + "matcher": {
1280 + "id": "byName",
1281 + "options": "Count"
1282 + },
1283 + "properties": [
1284 + {
1285 + "id": "displayName",
1286 + "value": "EVENTS"
1287 + },
1288 + {
1289 + "id": "unit",
1290 + "value": "short"
1291 + },
1292 + {
1293 + "id": "decimals",
1294 + "value": -1
1295 + },
1296 + {
1297 + "id": "custom.align"
1298 + }
1299 + ]
1300 + },
1301 + {
1302 + "matcher": {
1303 + "id": "byName",
1304 + "options": "AD ACCOUNT"
1305 + },
1306 + "properties": [
1307 + {
1308 + "id": "custom.width",
1309 + "value": 377
1310 + }
1311 + ]
1312 + }
1313 + ]
1314 + },
1315 + "gridPos": {
1316 + "h": 12,
1317 + "w": 10,
1318 + "x": 14,
1319 + "y": 20
1320 + },
1321 + "id": 58,
1322 + "options": {
1323 + "cellHeight": "sm",
1324 + "footer": {
1325 + "countRows": false,
1326 + "fields": "",
1327 + "reducer": [
1328 + "sum"
1329 + ],
1330 + "show": false
1331 + },
1332 + "showHeader": true,
1333 + "sortBy": []
1334 + },
1335 + "pluginVersion": "10.2.2",
1336 + "targets": [
1337 + {
1338 + "bucketAggs": [
1339 + {
1340 + "fake": true,
1341 + "field": "data_office365_P1Sender",
1342 + "id": "4",
1343 + "settings": {
1344 + "min_doc_count": 1,
1345 + "order": "desc",
1346 + "orderBy": "_count",
1347 + "size": "0"
1348 + },
1349 + "type": "terms"
1350 + }
1351 + ],
1352 + "datasource": {
1353 + "type": "elasticsearch",
1354 + "uid": "replace_datasource_uid"
1355 + },
1356 + "metrics": [
1357 + {
1358 + "field": "select field",
1359 + "id": "1",
1360 + "type": "count"
1361 + }
1362 + ],
1363 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1364 + "queryType": "lucene",
1365 + "refId": "A",
1366 + "timeField": "timestamp"
1367 + }
1368 + ],
1369 + "title": "EVENTS BY SENDER",
1370 + "transformations": [
1371 + {
1372 + "id": "organize",
1373 + "options": {
1374 + "excludeByName": {},
1375 + "indexByName": {},
1376 + "renameByName": {
1377 + "Count": "EVENTS",
1378 + "data_office365_ClientIP_country_code": "COUNTRY",
1379 + "data_office365_LogonError": "ERROR",
1380 + "data_office365_Operation": "WORKLOAD",
1381 + "data_office365_P1Sender": "SENDER",
1382 + "data_office365_UserId": "AD ACCOUNT"
1383 + }
1384 + }
1385 + }
1386 + ],
1387 + "type": "table"
1388 + },
1389 + {
1390 + "datasource": {
1391 + "type": "grafana-opensearch-datasource",
1392 + "uid": "replace_datasource_uid"
1393 + },
1394 + "fieldConfig": {
1395 + "defaults": {
1396 + "color": {
1397 + "mode": "thresholds"
1398 + },
1399 + "custom": {
1400 + "align": "auto",
1401 + "cellOptions": {
1402 + "type": "auto"
1403 + },
1404 + "filterable": true,
1405 + "inspect": false
1406 + },
1407 + "mappings": [],
1408 + "thresholds": {
1409 + "mode": "absolute",
1410 + "steps": [
1411 + {
1412 + "color": "green",
1413 + "value": null
1414 + },
1415 + {
1416 + "color": "red",
1417 + "value": 80
1418 + }
1419 + ]
1420 + }
1421 + },
1422 + "overrides": [
1423 + {
1424 + "matcher": {
1425 + "id": "byName",
1426 + "options": "rule_level"
1427 + },
1428 + "properties": [
1429 + {
1430 + "id": "displayName",
1431 + "value": "RULE LEVEL"
1432 + },
1433 + {
1434 + "id": "unit",
1435 + "value": "short"
1436 + },
1437 + {
1438 + "id": "decimals",
1439 + "value": -1
1440 + },
1441 + {
1442 + "id": "custom.cellOptions",
1443 + "value": {
1444 + "mode": "gradient",
1445 + "type": "color-background"
1446 + }
1447 + },
1448 + {
1449 + "id": "custom.align"
1450 + },
1451 + {
1452 + "id": "thresholds",
1453 + "value": {
1454 + "mode": "absolute",
1455 + "steps": [
1456 + {
1457 + "color": "#37872D",
1458 + "value": null
1459 + },
1460 + {
1461 + "color": "rgba(237, 129, 40, 0.89)",
1462 + "value": 7
1463 + },
1464 + {
1465 + "color": "rgba(245, 54, 54, 0.9)",
1466 + "value": 12
1467 + }
1468 + ]
1469 + }
1470 + }
1471 + ]
1472 + },
1473 + {
1474 + "matcher": {
1475 + "id": "byName",
1476 + "options": "Date/Time"
1477 + },
1478 + "properties": [
1479 + {
1480 + "id": "custom.width",
1481 + "value": 242
1482 + }
1483 + ]
1484 + },
1485 + {
1486 + "matcher": {
1487 + "id": "byName",
1488 + "options": "MITRE TACTIC"
1489 + },
1490 + "properties": [
1491 + {
1492 + "id": "custom.width",
1493 + "value": 332
1494 + }
1495 + ]
1496 + },
1497 + {
1498 + "matcher": {
1499 + "id": "byName",
1500 + "options": "IP ADDRESS"
1501 + },
1502 + "properties": [
1503 + {
1504 + "id": "custom.width",
1505 + "value": 163
1506 + }
1507 + ]
1508 + },
1509 + {
1510 + "matcher": {
1511 + "id": "byName",
1512 + "options": "MITRE TECHNIQUE"
1513 + },
1514 + "properties": [
1515 + {
1516 + "id": "custom.width",
1517 + "value": 312
1518 + }
1519 + ]
1520 + },
1521 + {
1522 + "matcher": {
1523 + "id": "byName",
1524 + "options": "EVENT ID"
1525 + },
1526 + "properties": [
1527 + {
1528 + "id": "links",
1529 + "value": [
1530 + {
1531 + "targetBlank": true,
1532 + "title": "VIEW EVENT DETAILS",
1533 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1534 + }
1535 + ]
1536 + },
1537 + {
1538 + "id": "custom.width",
1539 + "value": 265
1540 + }
1541 + ]
1542 + },
1543 + {
1544 + "matcher": {
1545 + "id": "byName",
1546 + "options": "RESULT"
1547 + },
1548 + "properties": [
1549 + {
1550 + "id": "custom.width",
1551 + "value": 118
1552 + },
1553 + {
1554 + "id": "mappings",
1555 + "value": [
1556 + {
1557 + "options": {
1558 + "Failed": {
1559 + "color": "orange",
1560 + "index": 1
1561 + },
1562 + "Success": {
1563 + "color": "green",
1564 + "index": 0
1565 + }
1566 + },
1567 + "type": "value"
1568 + }
1569 + ]
1570 + },
1571 + {
1572 + "id": "custom.cellOptions",
1573 + "value": {
1574 + "type": "color-text"
1575 + }
1576 + }
1577 + ]
1578 + },
1579 + {
1580 + "matcher": {
1581 + "id": "byName",
1582 + "options": "SRC IP"
1583 + },
1584 + "properties": [
1585 + {
1586 + "id": "custom.width",
1587 + "value": 265
1588 + }
1589 + ]
1590 + },
1591 + {
1592 + "matcher": {
1593 + "id": "byName",
1594 + "options": "ACCOUNT"
1595 + },
1596 + "properties": [
1597 + {
1598 + "id": "custom.width",
1599 + "value": 227
1600 + }
1601 + ]
1602 + },
1603 + {
1604 + "matcher": {
1605 + "id": "byName",
1606 + "options": "EVENT TIME"
1607 + },
1608 + "properties": [
1609 + {
1610 + "id": "custom.width",
1611 + "value": 195
1612 + }
1613 + ]
1614 + },
1615 + {
1616 + "matcher": {
1617 + "id": "byName",
1618 + "options": "CLIENT IP"
1619 + },
1620 + "properties": [
1621 + {
1622 + "id": "custom.width",
1623 + "value": 229
1624 + }
1625 + ]
1626 + },
1627 + {
1628 + "matcher": {
1629 + "id": "byName",
1630 + "options": "DESCRIPTION"
1631 + },
1632 + "properties": [
1633 + {
1634 + "id": "custom.width",
1635 + "value": 491
1636 + }
1637 + ]
1638 + }
1639 + ]
1640 + },
1641 + "gridPos": {
1642 + "h": 16,
1643 + "w": 24,
1644 + "x": 0,
1645 + "y": 32
1646 + },
1647 + "id": 27,
1648 + "options": {
1649 + "cellHeight": "sm",
1650 + "footer": {
1651 + "countRows": false,
1652 + "enablePagination": true,
1653 + "fields": "",
1654 + "reducer": [
1655 + "sum"
1656 + ],
1657 + "show": false
1658 + },
1659 + "showHeader": true,
1660 + "sortBy": []
1661 + },
1662 + "pluginVersion": "10.2.2",
1663 + "targets": [
1664 + {
1665 + "bucketAggs": [],
1666 + "datasource": {
1667 + "type": "elasticsearch",
1668 + "uid": "replace_datasource_uid"
1669 + },
1670 + "metrics": [
1671 + {
1672 + "id": "1",
1673 + "settings": {
1674 + "size": "250"
1675 + },
1676 + "type": "raw_data"
1677 + }
1678 + ],
1679 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1680 + "queryType": "lucene",
1681 + "refId": "A",
1682 + "timeField": "timestamp"
1683 + }
1684 + ],
1685 + "title": "EVENTS",
1686 + "transformations": [
1687 + {
1688 + "id": "organize",
1689 + "options": {
1690 + "excludeByName": {
1691 + "@metadata_beat": true,
1692 + "@metadata_type": true,
1693 + "@metadata_version": true,
1694 + "IMPHASH": true,
1695 + "MD5": true,
1696 + "SHA1": true,
1697 + "SHA256": true,
1698 + "_id": false,
1699 + "_index": true,
1700 + "_type": true,
1701 + "agent_ephemeral_id": true,
1702 + "agent_hostname": true,
1703 + "agent_id": true,
1704 + "agent_ip_city_name": true,
1705 + "agent_ip_country_code": true,
1706 + "agent_ip_geolocation": true,
1707 + "agent_name": true,
1708 + "agent_type": true,
1709 + "agent_version": true,
1710 + "beats_type": true,
1711 + "cluster_name": true,
1712 + "cluster_node": true,
1713 + "collector_node_id": true,
1714 + "data_alert_action": true,
1715 + "data_alert_category": true,
1716 + "data_alert_gid": true,
1717 + "data_alert_rev": true,
1718 + "data_alert_severity": true,
1719 + "data_alert_signature": true,
1720 + "data_alert_signature_id": true,
1721 + "data_app_proto": true,
1722 + "data_audit_auid": true,
1723 + "data_audit_command": true,
1724 + "data_audit_euid": true,
1725 + "data_audit_exe": true,
1726 + "data_audit_gid": true,
1727 + "data_audit_id": true,
1728 + "data_audit_pid": true,
1729 + "data_audit_res": true,
1730 + "data_audit_session": true,
1731 + "data_audit_type": true,
1732 + "data_audit_uid": true,
1733 + "data_dest_ip": true,
1734 + "data_dest_port": true,
1735 + "data_dstuser": true,
1736 + "data_event_type": true,
1737 + "data_extra_data": true,
1738 + "data_file": true,
1739 + "data_flow_bytes_toclient": true,
1740 + "data_flow_bytes_toserver": true,
1741 + "data_flow_id": true,
1742 + "data_flow_pkts_toclient": true,
1743 + "data_flow_pkts_toserver": true,
1744 + "data_flow_start": true,
1745 + "data_http_http_content_type": true,
1746 + "data_http_http_port": true,
1747 + "data_http_length": true,
1748 + "data_http_status": true,
1749 + "data_http_url": true,
1750 + "data_id": true,
1751 + "data_in_iface": true,
1752 + "data_integration": true,
1753 + "data_metadata_flowbits": true,
1754 + "data_metadata_flowints_http_anomaly_count": true,
1755 + "data_metadata_flowints_tcp_retransmission_count": true,
1756 + "data_office365_AADGroupId": true,
1757 + "data_office365_Actor": true,
1758 + "data_office365_ActorContextId": true,
1759 + "data_office365_ActorIpAddress": false,
1760 + "data_office365_ActorIpAddress_city_name": true,
1761 + "data_office365_ActorIpAddress_country_code": true,
1762 + "data_office365_ActorIpAddress_geolocation": true,
1763 + "data_office365_AdditionalActionsAndResults": true,
1764 + "data_office365_AppAccessContext_APIId": true,
1765 + "data_office365_AppAccessContext_ClientAppId": true,
1766 + "data_office365_AppAccessContext_ClientAppName": true,
1767 + "data_office365_AppAccessContext_CorrelationId": true,
1768 + "data_office365_AppId": true,
1769 + "data_office365_ApplicationId": true,
1770 + "data_office365_ArtifactsShared": true,
1771 + "data_office365_AttachmentData": true,
1772 + "data_office365_Attendees": true,
1773 + "data_office365_AuthDetails": true,
1774 + "data_office365_AzureActiveDirectoryEventType": true,
1775 + "data_office365_ChannelGuid": true,
1776 + "data_office365_ChannelName": true,
1777 + "data_office365_ChatName": true,
1778 + "data_office365_ChatThreadId": true,
1779 + "data_office365_ClientAppId": true,
1780 + "data_office365_ClientIP": false,
1781 + "data_office365_ClientIPAddress": true,
1782 + "data_office365_ClientIPAddress_city_name": true,
1783 + "data_office365_ClientIPAddress_country_code": true,
1784 + "data_office365_ClientIPAddress_geolocation": true,
1785 + "data_office365_ClientIP_city_name": true,
1786 + "data_office365_ClientIP_country_code": true,
1787 + "data_office365_ClientIP_geolocation": true,
1788 + "data_office365_ClientInfoString": true,
1789 + "data_office365_ClientProcessName": true,
1790 + "data_office365_ClientRequestId": true,
1791 + "data_office365_ClientVersion": true,
1792 + "data_office365_CommunicationSubType": true,
1793 + "data_office365_CommunicationType": true,
1794 + "data_office365_ContactEmail1DisplayName": true,
1795 + "data_office365_ContactEmail1EmailAddress": true,
1796 + "data_office365_CreationTime": false,
1797 + "data_office365_CrossMailboxOperation": true,
1798 + "data_office365_DeliveryAction": false,
1799 + "data_office365_DestFolder_Id": true,
1800 + "data_office365_DestFolder_Path": true,
1801 + "data_office365_DetectionMethod": false,
1802 + "data_office365_DetectionType": true,
1803 + "data_office365_DeviceId": true,
1804 + "data_office365_DeviceInformation": true,
1805 + "data_office365_DeviceProperties": true,
1806 + "data_office365_Directionality": true,
1807 + "data_office365_EndTime": true,
1808 + "data_office365_ErrorNumber": true,
1809 + "data_office365_EventDeepLink": true,
1810 + "data_office365_ExchangeId": true,
1811 + "data_office365_ExtendedProperties": true,
1812 + "data_office365_ExternalAccess": true,
1813 + "data_office365_ExtraProperties": true,
1814 + "data_office365_Folder_Id": true,
1815 + "data_office365_Folder_Path": true,
1816 + "data_office365_Folders": true,
1817 + "data_office365_HostedContents": true,
1818 + "data_office365_ICalUid": true,
1819 + "data_office365_Id": true,
1820 + "data_office365_InterSystemsId": true,
1821 + "data_office365_InternalLogonType": true,
1822 + "data_office365_InternetMessageId": true,
1823 + "data_office365_IntraSystemId": true,
1824 + "data_office365_ItemName": true,
1825 + "data_office365_Item_Id": true,
1826 + "data_office365_Item_InternetMessageId": true,
1827 + "data_office365_Item_IsRecord": true,
1828 + "data_office365_Item_ParentFolder_Id": true,
1829 + "data_office365_Item_ParentFolder_Name": true,
1830 + "data_office365_Item_SizeInBytes": true,
1831 + "data_office365_JoinTime": true,
1832 + "data_office365_LatestDeliveryLocation": true,
1833 + "data_office365_LeaveTime": true,
1834 + "data_office365_LogonError": true,
1835 + "data_office365_LogonType": true,
1836 + "data_office365_LogonUserSid": true,
1837 + "data_office365_MailboxGuid": true,
1838 + "data_office365_MailboxOwnerMasterAccountSid": true,
1839 + "data_office365_MailboxOwnerSid": true,
1840 + "data_office365_MailboxOwnerUPN": true,
1841 + "data_office365_MeetingDetailId": true,
1842 + "data_office365_MeetingURL": true,
1843 + "data_office365_Members": true,
1844 + "data_office365_MessageId": true,
1845 + "data_office365_MessageSizeInBytes": true,
1846 + "data_office365_MessageTime": true,
1847 + "data_office365_MessageURLs": true,
1848 + "data_office365_MessageVersion": true,
1849 + "data_office365_Modalities": true,
1850 + "data_office365_ModifiedProperties": true,
1851 + "data_office365_Name": true,
1852 + "data_office365_NetworkMessageId": true,
1853 + "data_office365_NewValue": true,
1854 + "data_office365_ObjectId": true,
1855 + "data_office365_Operation": true,
1856 + "data_office365_OperationCount": true,
1857 + "data_office365_OperationProperties": true,
1858 + "data_office365_OperationScope": true,
1859 + "data_office365_OrganizationId": true,
1860 + "data_office365_OrganizationName": true,
1861 + "data_office365_Organizer_OrganizationId": true,
1862 + "data_office365_Organizer_RecipientType": true,
1863 + "data_office365_Organizer_Role": true,
1864 + "data_office365_Organizer_UserObjectId": true,
1865 + "data_office365_OriginalDeliveryLocation": true,
1866 + "data_office365_OriginatingServer": true,
1867 + "data_office365_P1Sender": true,
1868 + "data_office365_P2Sender": true,
1869 + "data_office365_Parameters": true,
1870 + "data_office365_ParentMessageId": true,
1871 + "data_office365_PhishConfidenceLevel": true,
1872 + "data_office365_Policy": true,
1873 + "data_office365_PolicyAction": true,
1874 + "data_office365_ProviderTypes": true,
1875 + "data_office365_Recipients": false,
1876 + "data_office365_RecordType": true,
1877 + "data_office365_ResultStatus": true,
1878 + "data_office365_SendAsUserMailboxGuid": true,
1879 + "data_office365_SendAsUserSmtp": true,
1880 + "data_office365_SenderIp_city_name": true,
1881 + "data_office365_SenderIp_geolocation": true,
1882 + "data_office365_SessionId": true,
1883 + "data_office365_StartTime": true,
1884 + "data_office365_Subject": true,
1885 + "data_office365_Subscription": true,
1886 + "data_office365_SubscriptionId": true,
1887 + "data_office365_SystemOverrides": true,
1888 + "data_office365_Target": true,
1889 + "data_office365_TargetContextId": true,
1890 + "data_office365_TeamGuid": true,
1891 + "data_office365_TeamName": true,
1892 + "data_office365_ThreatsAndDetectionTech": true,
1893 + "data_office365_UserId": false,
1894 + "data_office365_UserKey": true,
1895 + "data_office365_UserType": true,
1896 + "data_office365_Verdict": true,
1897 + "data_office365_Version": true,
1898 + "data_office365_Workload": true,
1899 + "data_osquery_action": true,
1900 + "data_osquery_calendarTime": true,
1901 + "data_osquery_columns_address": true,
1902 + "data_osquery_columns_address_city_name": true,
1903 + "data_osquery_columns_address_country_code": true,
1904 + "data_osquery_columns_address_geolocation": true,
1905 + "data_osquery_columns_cmdline": true,
1906 + "data_osquery_columns_cwd": true,
1907 + "data_osquery_columns_description": true,
1908 + "data_osquery_columns_directory": true,
1909 + "data_osquery_columns_disk_bytes_read": true,
1910 + "data_osquery_columns_disk_bytes_written": true,
1911 + "data_osquery_columns_egid": true,
1912 + "data_osquery_columns_euid": true,
1913 + "data_osquery_columns_family": true,
1914 + "data_osquery_columns_fd": true,
1915 + "data_osquery_columns_gid": true,
1916 + "data_osquery_columns_gid_signed": true,
1917 + "data_osquery_columns_host": true,
1918 + "data_osquery_columns_interface": true,
1919 + "data_osquery_columns_local_address": true,
1920 + "data_osquery_columns_local_address_city_name": true,
1921 + "data_osquery_columns_local_address_country_code": true,
1922 + "data_osquery_columns_local_address_geolocation": true,
1923 + "data_osquery_columns_local_port": true,
1924 + "data_osquery_columns_mac": true,
1925 + "data_osquery_columns_name": true,
1926 + "data_osquery_columns_net_namespace": true,
1927 + "data_osquery_columns_nice": true,
1928 + "data_osquery_columns_on_disk": true,
1929 + "data_osquery_columns_parent": true,
1930 + "data_osquery_columns_path": true,
1931 + "data_osquery_columns_pgroup": true,
1932 + "data_osquery_columns_pid": true,
1933 + "data_osquery_columns_port": true,
1934 + "data_osquery_columns_protocol": true,
1935 + "data_osquery_columns_remote_address": true,
1936 + "data_osquery_columns_remote_address_city_name": true,
1937 + "data_osquery_columns_remote_address_country_code": true,
1938 + "data_osquery_columns_remote_address_geolocation": true,
1939 + "data_osquery_columns_remote_port": true,
1940 + "data_osquery_columns_resident_size": true,
1941 + "data_osquery_columns_root": true,
1942 + "data_osquery_columns_sgid": true,
1943 + "data_osquery_columns_shell": true,
1944 + "data_osquery_columns_socket": true,
1945 + "data_osquery_columns_start_time": true,
1946 + "data_osquery_columns_state": true,
1947 + "data_osquery_columns_suid": true,
1948 + "data_osquery_columns_system_time": true,
1949 + "data_osquery_columns_threads": true,
1950 + "data_osquery_columns_time_utc": true,
1951 + "data_osquery_columns_total_size": true,
1952 + "data_osquery_columns_tty": true,
1953 + "data_osquery_columns_type": true,
1954 + "data_osquery_columns_uid": true,
1955 + "data_osquery_columns_uid_signed": true,
1956 + "data_osquery_columns_user": true,
1957 + "data_osquery_columns_user_time": true,
1958 + "data_osquery_columns_username": true,
1959 + "data_osquery_columns_wired_size": true,
1960 + "data_osquery_counter": true,
1961 + "data_osquery_decorations_host_uuid": true,
1962 + "data_osquery_decorations_hostname": true,
1963 + "data_osquery_epoch": true,
1964 + "data_osquery_hostIdentifier": true,
1965 + "data_osquery_name": true,
1966 + "data_osquery_numerics": true,
1967 + "data_osquery_unixTime": true,
1968 + "data_proto": true,
1969 + "data_sca_check_command": true,
1970 + "data_sca_check_compliance_cis": true,
1971 + "data_sca_check_compliance_cis_csc": true,
1972 + "data_sca_check_compliance_gdpr_IV": true,
1973 + "data_sca_check_compliance_gpg_13": true,
1974 + "data_sca_check_compliance_hipaa": true,
1975 + "data_sca_check_compliance_nist_800_53": true,
1976 + "data_sca_check_compliance_pci_dss": true,
1977 + "data_sca_check_compliance_tsc": true,
1978 + "data_sca_check_description": true,
1979 + "data_sca_check_id": true,
1980 + "data_sca_check_previous_result": true,
1981 + "data_sca_check_rationale": true,
1982 + "data_sca_check_remediation": true,
1983 + "data_sca_check_result": true,
1984 + "data_sca_check_title": true,
1985 + "data_sca_description": true,
1986 + "data_sca_failed": true,
1987 + "data_sca_file": true,
1988 + "data_sca_invalid": true,
1989 + "data_sca_passed": true,
1990 + "data_sca_policy": true,
1991 + "data_sca_policy_id": true,
1992 + "data_sca_scan_id": true,
1993 + "data_sca_score": true,
1994 + "data_sca_total_checks": true,
1995 + "data_sca_type": true,
1996 + "data_script": true,
1997 + "data_src_ip": true,
1998 + "data_src_ip_city_name": true,
1999 + "data_src_ip_country_code": true,
2000 + "data_src_ip_geolocation": true,
2001 + "data_src_port": true,
2002 + "data_srcip": true,
2003 + "data_srcip_city_name": true,
2004 + "data_srcip_country_code": true,
2005 + "data_srcip_geolocation": true,
2006 + "data_srcuser": true,
2007 + "data_timestamp": true,
2008 + "data_title": true,
2009 + "data_tls_session_resumed": true,
2010 + "data_tls_version": true,
2011 + "data_tx_id": true,
2012 + "data_type": true,
2013 + "data_win_eventXML_binaryData": true,
2014 + "data_win_eventXML_binaryDataSize": true,
2015 + "data_win_eventXML_param1": true,
2016 + "data_win_eventdata_authenticationPackageName": true,
2017 + "data_win_eventdata_callTrace": true,
2018 + "data_win_eventdata_commandLine": true,
2019 + "data_win_eventdata_company": true,
2020 + "data_win_eventdata_creationUtcTime": true,
2021 + "data_win_eventdata_currentDirectory": true,
2022 + "data_win_eventdata_description": true,
2023 + "data_win_eventdata_destinationHostname": true,
2024 + "data_win_eventdata_destinationIp": true,
2025 + "data_win_eventdata_destinationIp_city_name": true,
2026 + "data_win_eventdata_destinationIp_country_code": true,
2027 + "data_win_eventdata_destinationIp_geolocation": true,
2028 + "data_win_eventdata_destinationIsIpv6": true,
2029 + "data_win_eventdata_destinationPort": true,
2030 + "data_win_eventdata_destinationPortName": true,
2031 + "data_win_eventdata_details": true,
2032 + "data_win_eventdata_elevatedToken": true,
2033 + "data_win_eventdata_eventType": true,
2034 + "data_win_eventdata_fileVersion": true,
2035 + "data_win_eventdata_fileVersion_city_name": true,
2036 + "data_win_eventdata_fileVersion_country_code": true,
2037 + "data_win_eventdata_fileVersion_geolocation": true,
2038 + "data_win_eventdata_grantedAccess": true,
2039 + "data_win_eventdata_hashes": true,
2040 + "data_win_eventdata_image": true,
2041 + "data_win_eventdata_imageLoaded": true,
2042 + "data_win_eventdata_impersonationLevel": true,
2043 + "data_win_eventdata_initiated": true,
2044 + "data_win_eventdata_integrityLevel": true,
2045 + "data_win_eventdata_ipAddress": true,
2046 + "data_win_eventdata_ipPort": true,
2047 + "data_win_eventdata_keyLength": true,
2048 + "data_win_eventdata_logonGuid": true,
2049 + "data_win_eventdata_logonId": true,
2050 + "data_win_eventdata_logonProcessName": true,
2051 + "data_win_eventdata_logonType": true,
2052 + "data_win_eventdata_originalFileName": true,
2053 + "data_win_eventdata_param1": true,
2054 + "data_win_eventdata_param2": true,
2055 + "data_win_eventdata_param3": true,
2056 + "data_win_eventdata_param4": true,
2057 + "data_win_eventdata_parentCommandLine": true,
2058 + "data_win_eventdata_parentImage": true,
2059 + "data_win_eventdata_parentProcessGuid": true,
2060 + "data_win_eventdata_parentProcessId": true,
2061 + "data_win_eventdata_processGuid": true,
2062 + "data_win_eventdata_processId": true,
2063 + "data_win_eventdata_processName": true,
2064 + "data_win_eventdata_product": true,
2065 + "data_win_eventdata_protocol": true,
2066 + "data_win_eventdata_queryName": true,
2067 + "data_win_eventdata_queryResults": true,
2068 + "data_win_eventdata_queryStatus": true,
2069 + "data_win_eventdata_ruleName": true,
2070 + "data_win_eventdata_serviceName": true,
2071 + "data_win_eventdata_serviceSid": true,
2072 + "data_win_eventdata_signature": true,
2073 + "data_win_eventdata_signatureStatus": true,
2074 + "data_win_eventdata_signed": true,
2075 + "data_win_eventdata_sourceHostname": true,
2076 + "data_win_eventdata_sourceImage": true,
2077 + "data_win_eventdata_sourceIp": true,
2078 + "data_win_eventdata_sourceIp_city_name": true,
2079 + "data_win_eventdata_sourceIp_country_code": true,
2080 + "data_win_eventdata_sourceIp_geolocation": true,
2081 + "data_win_eventdata_sourceIsIpv6": true,
2082 + "data_win_eventdata_sourcePort": true,
2083 + "data_win_eventdata_sourceProcessGUID": true,
2084 + "data_win_eventdata_sourceProcessId": true,
2085 + "data_win_eventdata_sourceThreadId": true,
2086 + "data_win_eventdata_status": true,
2087 + "data_win_eventdata_subjectDomainName": true,
2088 + "data_win_eventdata_subjectLogonId": true,
2089 + "data_win_eventdata_subjectUserName": true,
2090 + "data_win_eventdata_subjectUserSid": true,
2091 + "data_win_eventdata_targetDomainName": true,
2092 + "data_win_eventdata_targetFilename": true,
2093 + "data_win_eventdata_targetImage": true,
2094 + "data_win_eventdata_targetLinkedLogonId": true,
2095 + "data_win_eventdata_targetLogonId": true,
2096 + "data_win_eventdata_targetObject": true,
2097 + "data_win_eventdata_targetProcessGUID": true,
2098 + "data_win_eventdata_targetProcessId": true,
2099 + "data_win_eventdata_targetUserName": true,
2100 + "data_win_eventdata_targetUserSid": true,
2101 + "data_win_eventdata_terminalSessionId": true,
2102 + "data_win_eventdata_ticketEncryptionType": true,
2103 + "data_win_eventdata_ticketOptions": true,
2104 + "data_win_eventdata_user": true,
2105 + "data_win_eventdata_utcTime": true,
2106 + "data_win_eventdata_virtualAccount": true,
2107 + "data_win_system_channel": true,
2108 + "data_win_system_computer": true,
2109 + "data_win_system_eventID": true,
2110 + "data_win_system_eventRecordID": true,
2111 + "data_win_system_eventSourceName": true,
2112 + "data_win_system_keywords": true,
2113 + "data_win_system_level": true,
2114 + "data_win_system_message": true,
2115 + "data_win_system_opcode": true,
2116 + "data_win_system_processID": true,
2117 + "data_win_system_providerGuid": true,
2118 + "data_win_system_providerName": true,
2119 + "data_win_system_severityValue": true,
2120 + "data_win_system_systemTime": true,
2121 + "data_win_system_task": true,
2122 + "data_win_system_threadID": true,
2123 + "data_win_system_version": true,
2124 + "decoder_name": true,
2125 + "decoder_parent": true,
2126 + "dns_query": true,
2127 + "dns_query_threat_indicated": true,
2128 + "dst_ip": true,
2129 + "dst_ip_city_name": true,
2130 + "dst_ip_country_code": true,
2131 + "dst_ip_geolocation": true,
2132 + "dst_ip_threat_indicated": true,
2133 + "dst_port": true,
2134 + "ecs_version": true,
2135 + "error": true,
2136 + "event_hash": true,
2137 + "file_path": true,
2138 + "firewall_rule_name": true,
2139 + "full_log": false,
2140 + "gl2_accounted_message_size": true,
2141 + "gl2_message_id": true,
2142 + "gl2_processing_error": true,
2143 + "gl2_remote_ip": true,
2144 + "gl2_remote_port": true,
2145 + "gl2_source_collector": true,
2146 + "gl2_source_input": true,
2147 + "gl2_source_node": true,
2148 + "hash_md5": true,
2149 + "hash_sha1": true,
2150 + "hash_sha256": true,
2151 + "highlight": true,
2152 + "host_architecture": true,
2153 + "host_containerized": true,
2154 + "host_hostname": true,
2155 + "host_id": true,
2156 + "host_ip": true,
2157 + "host_mac": true,
2158 + "host_name": true,
2159 + "host_os_codename": true,
2160 + "host_os_kernel": true,
2161 + "host_os_name": true,
2162 + "host_os_platform": true,
2163 + "host_os_version": true,
2164 + "hostname": true,
2165 + "id": true,
2166 + "input_type": true,
2167 + "level": true,
2168 + "location": true,
2169 + "log_file_path": true,
2170 + "log_offset": true,
2171 + "manager_name": true,
2172 + "message": true,
2173 + "module": true,
2174 + "msg_timestamp": true,
2175 + "parent_process_cmd_line": true,
2176 + "parent_process_id": true,
2177 + "parent_process_image": true,
2178 + "pid": true,
2179 + "predecoder_hostname": true,
2180 + "predecoder_program_name": true,
2181 + "predecoder_timestamp": true,
2182 + "previous_log": true,
2183 + "previous_output": true,
2184 + "process_cmd_line": true,
2185 + "process_id": true,
2186 + "process_image": true,
2187 + "process_name": true,
2188 + "protocol": true,
2189 + "rule_cis": true,
2190 + "rule_cis_csc": true,
2191 + "rule_firedtimes": true,
2192 + "rule_gdpr": true,
2193 + "rule_gdpr_IV": true,
2194 + "rule_gpg13": true,
2195 + "rule_gpg_13": true,
2196 + "rule_group1": true,
2197 + "rule_group2": true,
2198 + "rule_groups": true,
2199 + "rule_hipaa": true,
2200 + "rule_id": true,
2201 + "rule_info": true,
2202 + "rule_mail": true,
2203 + "rule_mitre_id": true,
2204 + "rule_mitre_tactic": false,
2205 + "rule_nist_800_53": true,
2206 + "rule_pci_dss": true,
2207 + "rule_tsc": true,
2208 + "scanid": true,
2209 + "service": true,
2210 + "software_package": true,
2211 + "software_vendor": true,
2212 + "sort": true,
2213 + "source": true,
2214 + "source_reserved_ip": true,
2215 + "src_ip": true,
2216 + "src_ip_city_name": true,
2217 + "src_ip_country_code": true,
2218 + "src_ip_geolocation": true,
2219 + "src_port": true,
2220 + "streams": true,
2221 + "syscheck_attrs_after": true,
2222 + "syscheck_audit_effective_user_id": true,
2223 + "syscheck_audit_effective_user_name": true,
2224 + "syscheck_audit_group_id": true,
2225 + "syscheck_audit_group_name": true,
2226 + "syscheck_audit_login_user_id": true,
2227 + "syscheck_audit_login_user_name": true,
2228 + "syscheck_audit_process_cwd": true,
2229 + "syscheck_audit_process_id": true,
2230 + "syscheck_audit_process_name": true,
2231 + "syscheck_audit_process_parent_cwd": true,
2232 + "syscheck_audit_process_parent_name": true,
2233 + "syscheck_audit_process_ppid": true,
2234 + "syscheck_audit_user_id": true,
2235 + "syscheck_audit_user_name": true,
2236 + "syscheck_changed_attributes": true,
2237 + "syscheck_event": true,
2238 + "syscheck_gid_after": true,
2239 + "syscheck_gname_after": true,
2240 + "syscheck_hard_links": true,
2241 + "syscheck_inode_after": true,
2242 + "syscheck_inode_before": true,
2243 + "syscheck_md5_after": true,
2244 + "syscheck_md5_before": true,
2245 + "syscheck_mode": true,
2246 + "syscheck_mtime_after": true,
2247 + "syscheck_mtime_before": true,
2248 + "syscheck_path": true,
2249 + "syscheck_perm_after": true,
2250 + "syscheck_perm_before": true,
2251 + "syscheck_sha1_after": true,
2252 + "syscheck_sha1_before": true,
2253 + "syscheck_sha256_after": true,
2254 + "syscheck_sha256_before": true,
2255 + "syscheck_size_after": true,
2256 + "syscheck_size_before": true,
2257 + "syscheck_uid_after": true,
2258 + "syscheck_uname_after": true,
2259 + "syscheck_win_perm_after": true,
2260 + "syscheck_win_perm_after_0_allowed": true,
2261 + "syscheck_win_perm_after_0_name": true,
2262 + "syscheck_win_perm_after_1_allowed": true,
2263 + "syscheck_win_perm_after_1_name": true,
2264 + "syscheck_win_perm_after_2_allowed": true,
2265 + "syscheck_win_perm_after_2_name": true,
2266 + "syscheck_win_perm_after_3_allowed": true,
2267 + "syscheck_win_perm_after_3_name": true,
2268 + "syslog_customer": true,
2269 + "syslog_level": true,
2270 + "syslog_tag": true,
2271 + "syslog_type": true,
2272 + "sysmon_event_description": true,
2273 + "threat_ids": true,
2274 + "threat_indicated": true,
2275 + "threat_names": true,
2276 + "time": true,
2277 + "timestamp": true,
2278 + "timestamp_utc": true,
2279 + "true": true,
2280 + "user_name": true,
2281 + "win_registry_key": true,
2282 + "win_system_eventID": true,
2283 + "windows_auth_package": true,
2284 + "windows_domain": true,
2285 + "windows_event_id": true,
2286 + "windows_event_severity": true,
2287 + "windows_logon_type": true
2288 + },
2289 + "indexByName": {
2290 + "_id": 2,
2291 + "_index": 8,
2292 + "_type": 9,
2293 + "agent_id": 10,
2294 + "agent_name": 4,
2295 + "cluster_name": 11,
2296 + "cluster_node": 12,
2297 + "data_integration": 43,
2298 + "data_office365_AdditionalActionsAndResults": 44,
2299 + "data_office365_AttachmentData": 45,
2300 + "data_office365_AuthDetails": 46,
2301 + "data_office365_CreationTime": 0,
2302 + "data_office365_DeliveryAction": 47,
2303 + "data_office365_DetectionMethod": 48,
2304 + "data_office365_DetectionType": 49,
2305 + "data_office365_Directionality": 50,
2306 + "data_office365_EventDeepLink": 51,
2307 + "data_office365_Id": 13,
2308 + "data_office365_InternetMessageId": 52,
2309 + "data_office365_LatestDeliveryLocation": 53,
2310 + "data_office365_MessageTime": 54,
2311 + "data_office365_NetworkMessageId": 55,
2312 + "data_office365_ObjectId": 14,
2313 + "data_office365_Operation": 20,
2314 + "data_office365_OrganizationId": 15,
2315 + "data_office365_OriginalDeliveryLocation": 56,
2316 + "data_office365_P1Sender": 57,
2317 + "data_office365_P2Sender": 58,
2318 + "data_office365_PhishConfidenceLevel": 59,
2319 + "data_office365_Recipients": 61,
2320 + "data_office365_RecordType": 16,
2321 + "data_office365_SenderIp": 60,
2322 + "data_office365_SenderIp_city_name": 62,
2323 + "data_office365_SenderIp_country_code": 63,
2324 + "data_office365_SenderIp_geolocation": 64,
2325 + "data_office365_Subject": 65,
2326 + "data_office365_Subscription": 66,
2327 + "data_office365_SystemOverrides": 67,
2328 + "data_office365_ThreatsAndDetectionTech": 68,
2329 + "data_office365_UserId": 3,
2330 + "data_office365_UserKey": 17,
2331 + "data_office365_UserType": 18,
2332 + "data_office365_Verdict": 69,
2333 + "data_office365_Version": 19,
2334 + "data_office365_Workload": 42,
2335 + "decoder_name": 21,
2336 + "gl2_accounted_message_size": 22,
2337 + "gl2_message_id": 23,
2338 + "gl2_processing_error": 24,
2339 + "gl2_remote_ip": 25,
2340 + "gl2_remote_port": 26,
2341 + "gl2_source_input": 27,
2342 + "gl2_source_node": 28,
2343 + "id": 29,
2344 + "location": 30,
2345 + "manager_name": 31,
2346 + "message": 32,
2347 + "rule_description": 5,
2348 + "rule_firedtimes": 33,
2349 + "rule_group1": 34,
2350 + "rule_group2": 70,
2351 + "rule_groups": 35,
2352 + "rule_hipaa": 71,
2353 + "rule_id": 7,
2354 + "rule_level": 6,
2355 + "rule_mail": 36,
2356 + "rule_pci_dss": 72,
2357 + "source": 37,
2358 + "source_reserved_ip": 73,
2359 + "streams": 38,
2360 + "syslog_level": 39,
2361 + "syslog_type": 40,
2362 + "timestamp": 1,
2363 + "timestamp_utc": 74,
2364 + "true": 41
2365 + },
2366 + "renameByName": {
2367 + "_id": "EVENT ID",
2368 + "agent_name": "",
2369 + "data_office365_ActorIpAddress": "SRC IP",
2370 + "data_office365_AffectedItems": "ITEMS",
2371 + "data_office365_ClientIP": "CLIENT IP",
2372 + "data_office365_ClientIP_city_name": "",
2373 + "data_office365_CreationTime": "EVENT TIME",
2374 + "data_office365_DeliveryAction": "DELIVERY ACTION",
2375 + "data_office365_DetectionMethod": "DETECTION",
2376 + "data_office365_DetectionType": "",
2377 + "data_office365_Item_Attachments": "ATTACHMENT",
2378 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2379 + "data_office365_Item_Subject": "SUBJECT",
2380 + "data_office365_OperationProperties": "",
2381 + "data_office365_Recipients": "RCPTS",
2382 + "data_office365_ResultStatus": "RESULT",
2383 + "data_office365_SenderIp": "SENDER IP",
2384 + "data_office365_SenderIp_country_code": "COUNTRY",
2385 + "data_office365_Subject": "",
2386 + "data_office365_UserId": "ACCOUNT",
2387 + "rule_description": "DESCRIPTION",
2388 + "rule_id": "RULE ID",
2389 + "rule_level": "",
2390 + "rule_mitre_tactic": "MITRE TACTIC",
2391 + "rule_mitre_technique": "MITRE TECHNIQUE",
2392 + "timestamp": "Date/Time"
2393 + }
2394 + }
2395 + }
2396 + ],
2397 + "transparent": true,
2398 + "type": "table"
2399 + }
2400 + ],
2401 + "refresh": "",
2402 + "schemaVersion": 38,
2403 + "tags": [
2404 + "O365"
2405 + ],
2406 + "templating": {
2407 + "list": [
2408 + {
2409 + "datasource": {
2410 + "type": "elasticsearch",
2411 + "uid": "replace_datasource_uid"
2412 + },
2413 + "filters": [],
2414 + "hide": 0,
2415 + "label": "",
2416 + "name": "Filters",
2417 + "skipUrlSync": false,
2418 + "type": "adhoc"
2419 + },
2420 + {
2421 + "current": {
2422 + "selected": false,
2423 + "text": "All",
2424 + "value": "$__all"
2425 + },
2426 + "datasource": {
2427 + "type": "elasticsearch",
2428 + "uid": "replace_datasource_uid"
2429 + },
2430 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:ThreatIntelligence\"}",
2431 + "hide": 0,
2432 + "includeAll": true,
2433 + "label": "Operation",
2434 + "multi": false,
2435 + "name": "operation",
2436 + "options": [],
2437 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:ThreatIntelligence\"}",
2438 + "refresh": 2,
2439 + "regex": "",
2440 + "skipUrlSync": false,
2441 + "sort": 1,
2442 + "tagValuesQuery": "",
2443 + "tagsQuery": "",
2444 + "type": "query",
2445 + "useTags": false
2446 + },
2447 + {
2448 + "current": {
2449 + "selected": false,
2450 + "text": "All",
2451 + "value": "$__all"
2452 + },
2453 + "datasource": {
2454 + "type": "elasticsearch",
2455 + "uid": "replace_datasource_uid"
2456 + },
2457 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2458 + "hide": 0,
2459 + "includeAll": true,
2460 + "label": "Rule Level",
2461 + "multi": false,
2462 + "name": "rule_level",
2463 + "options": [],
2464 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2465 + "refresh": 2,
2466 + "regex": "",
2467 + "skipUrlSync": false,
2468 + "sort": 0,
2469 + "type": "query"
2470 + }
2471 + ]
2472 + },
2473 + "time": {
2474 + "from": "now-6h",
2475 + "to": "now"
2476 + },
2477 + "timepicker": {
2478 + "refresh_intervals": [
2479 + "5s",
2480 + "10s",
2481 + "30s",
2482 + "1m",
2483 + "5m",
2484 + "15m",
2485 + "30m",
2486 + "1h",
2487 + "2h",
2488 + "1d"
2489 + ],
2490 + "time_options": [
2491 + "5m",
2492 + "15m",
2493 + "1h",
2494 + "6h",
2495 + "12h",
2496 + "24h",
2497 + "2d",
2498 + "7d",
2499 + "30d"
2500 + ]
2501 + },
2502 + "timezone": "",
2503 + "title": "O365 - THREAT INTELLIGENCE",
2504 + "version": 5,
2505 + "weekStart": ""
2506 +}
backend/app/connectors/grafana/schema/dashboards.py
+15 -2
@@ -46,8 +46,21 @@ class WazuhDashboard(Enum):
46
47
48 class Office365Dashboard(Enum):
49 - DASHBOARD_1 = ("Office365", "dashboard1.json")
50 - DASHBOARD_2 = ("Office365", "dashboard2.json")
49 + ACTIVE_DIRECTORY = ("Office365", "active_directory.json")
50 + APPLICATIONS = ("Office365", "applications.json")
51 + COMPLIANCE_CENTER = ("Office365", "compliance_center.json")
52 + DEFENDER_FOR_IDENTITIY = ("Office365", "defender_for_identity.json")
53 + DLP = ("Office365", "dlp.json")
54 + ENDPOINT = ("Office365", "endpoint.json")
55 + EXCHANGE = ("Office365", "exchange.json")
56 + FORMS = ("Office365", "forms.json")
57 + MITRE = ("Office365", "mitre.json")
58 + ONEDRIVE = ("Office365", "onedrive.json")
59 + POWERBI = ("Office365", "powerbi.json")
60 + SHAREPOINT = ("Office365", "sharepoint.json")
61 + SUMMARY = ("Office365", "summary.json")
62 + TEAMS = ("Office365", "teams.json")
63 + THREAT_INTELLIGENCE = ("Office365", "threat_intelligence.json")
64
65
66 class DashboardProvisionRequest(BaseModel):
backend/app/connectors/graylog/schema/pipelines.py
+12
@@ -56,3 +56,15 @@ class GraylogPipelinesResponseWithRuleID(BaseModel):
56 message: str
57 pipelines: List[PipelineWithRuleID]
58 success: bool
59 +
60 +
61 +# Creation of Pipelines
62 +class CreatePipelineRule(BaseModel):
63 + title: str
64 + description: str
65 + source: str
66 +
67 +class CreatePipeline(BaseModel):
68 + title: str
69 + description: str
70 + source: str
backend/app/connectors/graylog/services/pipelines.py
+72 -1
@@ -5,8 +5,13 @@ from app.connectors.graylog.schema.pipelines import GraylogPipelinesResponse
5 from app.connectors.graylog.schema.pipelines import Pipeline
6 from app.connectors.graylog.schema.pipelines import PipelineRule
7 from app.connectors.graylog.schema.pipelines import PipelineRulesResponse
8 -from app.connectors.graylog.utils.universal import send_get_request
8 +from app.connectors.graylog.schema.pipelines import CreatePipelineRule
9 +from app.connectors.graylog.schema.pipelines import CreatePipeline
10 +from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineRequest
11 +from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineResponse
12
13 +from app.connectors.graylog.utils.universal import send_get_request
14 +from app.connectors.graylog.utils.universal import send_post_request
15
16 async def get_pipelines() -> GraylogPipelinesResponse:
17 """Get pipelines from Graylog.
@@ -78,3 +83,69 @@ async def get_pipeline_rule_by_id(rule_id) -> PipelineRulesResponse:
83 except Exception as e:
84 logger.error(f"Failed to collect pipeline rules: {e}")
85 raise HTTPException(status_code=500, detail=f"Failed to collect pipeline rules: {e}")
86 +
87 +
88 +async def create_pipeline_rule(rule: CreatePipelineRule) -> None:
89 + """
90 + Creates a pipeline rule with the given title.
91 + """
92 + endpoint = "/api/system/pipelines/rule"
93 + data = {
94 + "title": rule.title,
95 + "description": rule.description,
96 + "source": rule.source,
97 + }
98 + await send_post_request(endpoint=endpoint, data=data)
99 +
100 +async def create_pipeline_graylog(pipeline: CreatePipeline) -> None:
101 + """
102 + Creates a pipeline with the given title in Graylog.
103 + """
104 + endpoint = "/api/system/pipelines/pipeline"
105 + data = {
106 + "title": pipeline.title,
107 + "description": pipeline.description,
108 + "source": pipeline.source,
109 + }
110 + await send_post_request(endpoint=endpoint, data=data)
111 +
112 +
113 +async def get_pipeline_id(subscription: str) -> str:
114 + """
115 + Retrieves the pipeline ID for a given subscription.
116 +
117 + Args:
118 + subscription (str): The subscription name.
119 +
120 + Returns:
121 + str: The pipeline ID.
122 +
123 + Raises:
124 + HTTPException: If the pipeline ID cannot be retrieved.
125 + """
126 + logger.info(f"Getting pipeline ID for subscription {subscription}")
127 + pipelines_response = await get_pipelines()
128 + if pipelines_response.success:
129 + for pipeline in pipelines_response.pipelines:
130 + if subscription.lower() in pipeline.description.lower():
131 + return [pipeline.id]
132 + logger.error(f"Failed to get pipeline ID for subscription {subscription}")
133 + raise HTTPException(status_code=500, detail=f"Failed to get pipeline ID for subscription {subscription}")
134 + else:
135 + logger.error(f"Failed to get pipelines: {pipelines_response.message}")
136 + raise HTTPException(status_code=500, detail=f"Failed to get pipelines: {pipelines_response.message}")
137 +
138 +async def connect_stream_to_pipeline(stream_and_pipeline: StreamConnectionToPipelineRequest):
139 + """
140 + Connects a stream to a pipeline.
141 +
142 + Args:
143 + stream_and_pipeline (StreamConnectionToPipelineRequest): The request object containing the stream ID and pipeline IDs.
144 +
145 + Returns:
146 + StreamConnectionToPipelineResponse: The response object containing the connection details.
147 + """
148 + logger.info(f"Connecting stream {stream_and_pipeline.stream_id} to pipeline {stream_and_pipeline.pipeline_ids}")
149 + response_json = await send_post_request(endpoint="/api/system/pipelines/connections/to_stream", data=stream_and_pipeline.dict())
150 + logger.info(f"Response: {response_json}")
151 + return StreamConnectionToPipelineResponse(**response_json)
backend/app/connectors/wazuh_manager/utils/universal.py
+14
@@ -121,6 +121,16 @@ async def send_get_request(endpoint: str, params: Optional[Dict[str, Any]] = Non
121 logger.error("No Wazuh Manager connector found in the database")
122 return None
123 try:
124 + # if params is {"raw": True} then we want to return the raw response
125 + if params == {"raw": True}:
126 + response = requests.get(
127 + f"{attributes['connector_url']}/{endpoint}",
128 + headers=wazuh_manager_client,
129 + params=params,
130 + verify=False,
131 + )
132 + response.raise_for_status()
133 + return {"data": response.text, "success": True, "message": "Successfully retrieved data"}
134 response = requests.get(
135 f"{attributes['connector_url']}/{endpoint}",
136 headers=wazuh_manager_client,
@@ -172,6 +182,7 @@ async def send_put_request(
182 data: Optional[Dict[str, Any]],
183 params: Optional[Dict[str, str]] = None,
184 xml_data: Optional[bool] = False,
185 + binary_data: Optional[bool] = False,
186 connector_name: str = "Wazuh-Manager",
187 ) -> Dict[str, Any]:
188 """
@@ -197,7 +208,10 @@ async def send_put_request(
208 # Add the `Content-Type` header to the request if the data is XML
209 if xml_data:
210 wazuh_manager_client["Content-Type"] = "application/xml"
211 + if binary_data:
212 + wazuh_manager_client["Content-Type"] = "application/octet-stream"
213 try:
214 + logger.debug(f"Sending PUT request to {endpoint} with data: {data}")
215 response = requests.put(
216 f"{attributes['connector_url']}/{endpoint}",
217 headers=wazuh_manager_client,
backend/app/customer_provisioning/schema/graylog.py
+22
@@ -131,6 +131,28 @@ class WazuhEventStream(BaseModel):
131 },
132 }
133
134 +class Office365EventStream(BaseModel):
135 + title: str = Field(..., description="Title of the stream")
136 + description: str = Field(..., description="Description of the stream")
137 + index_set_id: str = Field(..., description="ID of the associated index set")
138 + rules: List[StreamRule] = Field(..., description="List of rules for the stream")
139 + matching_type: str = Field(..., description="Matching type for the rules")
140 + remove_matches_from_default_stream: bool = Field(..., description="Whether to remove matches from the default stream")
141 + content_pack: Optional[str] = Field(None, description="Associated content pack, if any")
142 +
143 + class Config:
144 + schema_extra = {
145 + "example": {
146 + "title": "Office365 EVENTS - Example Company",
147 + "description": "Office365 EVENTS - Example Company",
148 + "index_set_id": "12345",
149 + "rules": [{"field": "agent_labels_customer", "type": 1, "inverted": False, "value": "ExampleCode"}, {"field": "agent_labels_integration", "type": 1, "inverted": False, "value": "Office365"}],
150 + "matching_type": "AND",
151 + "remove_matches_from_default_stream": True,
152 + "content_pack": None,
153 + },
154 + }
155 +
156
157 class StreamData(BaseModel):
158 stream_id: str = Field(..., description="ID of the created stream")
backend/app/db/db_populate.py
+120 -6
@@ -4,10 +4,11 @@ from dotenv import load_dotenv
4 from loguru import logger
5 from sqlalchemy.ext.asyncio import AsyncSession
6 from sqlalchemy.future import select
7 +from sqlalchemy import and_
8
9 from app.auth.models.users import Role
10 from app.connectors.models import Connectors
10 -from app.integrations.models.customer_integration_settings import AvailableIntegrations
11 +from app.integrations.models.customer_integration_settings import AvailableIntegrations, AvailableIntegrationsAuthKeys
12
13 load_dotenv()
14
@@ -69,6 +70,7 @@ def get_connectors_list():
70 ("Grafana", "3", "username_password", "Connection to Grafana. Make sure to use the an admin role user."),
71 ("Wazuh Worker Provisioning", "3", "api_key", "Connection to Wazuh Worker Provisioning. Make sure you have deployed the Wazuh Worker Provisioning Application provided by SOCFortress: https://github.com/socfortress/Customer-Provisioning-Worker"),
72 ("Event Shipper", "3", "api_key", "Connection to Graylog GELF Input to receive events from integrations. Make sure you have created a GELF Input in Graylog.", "GELF_INPUT_PORT"),
73 + ("Alert Creation Provisioning", "3", "api_key", "Connection to Alert Creation Provisioning. Make sure you have deployed the Alert Creation Provisioning Application provided by SOCFortress: https://github.com/socfortress/Customer-Provisioning-Alert"),
74 # ... Add more connectors as needed ...
75 ]
76
@@ -131,7 +133,7 @@ async def add_roles_if_not_exist(session: AsyncSession) -> None:
133 await session.commit() # Commit the transaction
134 logger.info("Role check and addition completed.")
135
134 -def load_available_integrations_data(integration_name: str, description: str):
136 +def load_available_integrations_data(integration_name: str, description: str, integration_details: str):
137 """
138 Load available integrations data from environment variables.
139
@@ -146,22 +148,48 @@ def load_available_integrations_data(integration_name: str, description: str):
148 return {
149 "integration_name": integration_name,
150 "description": description,
151 + "integration_details": integration_details,
152 }
153
154 +def load_markdown_for_integration(integration_name: str) -> str:
155 + """
156 + Load markdown content for a given integration from a file.
157 +
158 + Args:
159 + integration_name (str): The name of the integration.
160 +
161 + Returns:
162 + str: The content of the markdown file.
163 + """
164 + #file_path = os.path.join("integrations_markdown", f"{integration_name.lower()}.md")
165 + file_path = os.path.join("app", "integrations", "markdown", f"{integration_name.lower()}.md")
166 + try:
167 + with open(file_path, "r") as file:
168 + return file.read()
169 + except FileNotFoundError:
170 + return "No deployment intrusctions available."
171 +
172 def get_available_integrations_list():
173 """
174 Get a list of available integrations.
175
176 Returns:
156 - list: A list of available integrations data, where each item contains the integration name and description.
177 + list: A list of available integrations data, where each item contains the integration name, description, and markdown details.
178 """
179 available_integrations = [
159 - ("Office Defender For Endpoint", "Integrate Office Defender For Endpoint with SOCFortress."),
180 + ("Office365", "Integrate Office365 with SOCFortress."),
181 ("Mimecast", "Integrate Mimecast with SOCFortress."),
182 # ... Add more available integrations as needed ...
183 ]
184
164 - return [load_available_integrations_data(*available_integration) for available_integration in available_integrations]
185 + return [
186 + load_available_integrations_data(
187 + integration_name,
188 + description,
189 + load_markdown_for_integration(integration_name)
190 + ) for integration_name, description in available_integrations
191 + ]
192 +
193
194 async def add_available_integrations_if_not_exist(session: AsyncSession):
195 """
@@ -185,4 +213,90 @@ async def add_available_integrations_if_not_exist(session: AsyncSession):
213 session.add(new_available_integration)
214 logger.info(f"Added new available integration: {available_integration_data['integration_name']}")
215
188 - await session.commit()
216 +
217 +def load_available_integrations_auth_keys(integration_id: int, integration_name: str, auth_key_name: str):
218 + """
219 + Load available integrations auth keys from environment variables.
220 +
221 + Args:
222 + integration_id (int): The ID of the integration.
223 + integration_name (str): The name of the integration.
224 + auth_key_name (str): The name of the auth key.
225 +
226 + Returns:
227 + dict: A dictionary containing the auth key data.
228 + """
229 + logger.info(f"Loading available integrations auth keys data for {integration_name}.")
230 + return {
231 + "integration_id": integration_id,
232 + "integration_name": integration_name,
233 + "auth_key_name": auth_key_name,
234 + }
235 +
236 +async def get_available_integrations_auth_keys_list(session: AsyncSession):
237 + """
238 + Get a list of available integrations auth keys with their corresponding integration IDs.
239 +
240 + Args:
241 + session (AsyncSession): The database session.
242 +
243 + Returns:
244 + list: A list of available integrations auth keys data, where each item contains the integration ID, integration name, and auth key name.
245 + """
246 + available_integrations_auth_keys = []
247 + available_integrations = [
248 + ("Office365", "TENANT_ID"),
249 + ("Office365", "CLIENT_ID"),
250 + ("Office365", "CLIENT_SECRET"),
251 + ("Office365", "API_TYPE"),
252 + ("Mimecast", "APP_ID"),
253 + ("Mimecast", "APP_KEY"),
254 + ("Mimecast", "EMAIL_ADDRESS"),
255 + ("Mimecast", "ACCESS_KEY"),
256 + ("Mimecast", "SECRET_KEY"),
257 + # ... Add more available integrations auth keys as needed ...
258 + ]
259 +
260 + for integration_name, auth_key_name in available_integrations:
261 + query = select(AvailableIntegrations.id).where(AvailableIntegrations.integration_name == integration_name)
262 + result = await session.execute(query)
263 + integration_id = result.scalars().first()
264 +
265 + if integration_id:
266 + available_integrations_auth_keys.append(load_available_integrations_auth_keys(integration_id, integration_name, auth_key_name))
267 +
268 + return available_integrations_auth_keys
269 +
270 +
271 +async def add_available_integrations_auth_keys_if_not_exist(session: AsyncSession):
272 + """
273 + Adds available integrations auth keys to the database if they do not already exist.
274 +
275 + Args:
276 + session (AsyncSession): The database session.
277 +
278 + Returns:
279 + None
280 + """
281 + available_integrations_auth_keys_list = await get_available_integrations_auth_keys_list(session=session)
282 +
283 + for available_integration_auth_keys_data in available_integrations_auth_keys_list:
284 + query = select(AvailableIntegrations).where(AvailableIntegrations.integration_name == available_integration_auth_keys_data["integration_name"])
285 + result = await session.execute(query)
286 + existing_integration = result.scalars().first()
287 +
288 + if existing_integration:
289 + available_integration_auth_keys_data["integration_id"] = existing_integration.id
290 + auth_key_query = select(AvailableIntegrationsAuthKeys).where(
291 + and_(
292 + AvailableIntegrationsAuthKeys.integration_id == existing_integration.id,
293 + AvailableIntegrationsAuthKeys.auth_key_name == available_integration_auth_keys_data["auth_key_name"]
294 + )
295 + )
296 + auth_key_result = await session.execute(auth_key_query)
297 + existing_auth_key = auth_key_result.scalars().first()
298 +
299 + if existing_auth_key is None:
300 + new_auth_key = AvailableIntegrationsAuthKeys(**available_integration_auth_keys_data)
301 + session.add(new_auth_key)
302 + logger.info(f"Added new available integration auth keys: {available_integration_auth_keys_data['auth_key_name']} for {available_integration_auth_keys_data['integration_name']}")
backend/app/db/db_setup.py
+3 -1
@@ -9,7 +9,7 @@ from app.auth.services.universal import create_scheduler_user
9 from app.auth.services.universal import remove_scheduler_user
10 from app.db.db_populate import add_connectors_if_not_exist
11 from app.db.db_populate import add_roles_if_not_exist
12 -from app.db.db_populate import add_available_integrations_if_not_exist
12 +from app.db.db_populate import add_available_integrations_if_not_exist, add_available_integrations_auth_keys_if_not_exist
13
14
15 async def create_tables(async_engine):
@@ -61,6 +61,8 @@ async def create_available_integrations(async_engine):
61 async with AsyncSession(async_engine) as session: # Create an AsyncSession, not just a connection
62 async with session.begin(): # Start a transaction
63 await add_available_integrations_if_not_exist(session)
64 + await add_available_integrations_auth_keys_if_not_exist(session)
65 + await session.commit()
66
67
68 async def ensure_admin_user(async_engine):
backend/app/integrations/alert_creation/office365/routes/alert.py new
+83
@@ -0,0 +1,83 @@
1 +from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertRequest
2 +from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertResponse
3 +from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertBase
4 +from app.integrations.alert_creation.office365.schema.exchange import ValidOffice365Workloads
5 +from app.integrations.alert_creation.office365.schema.threat_intel import Office365ThreatIntelAlertRequest
6 +from app.integrations.alert_creation.office365.schema.threat_intel import Office365ThreatIntelAlertResponse
7 +from app.integrations.alert_creation.office365.services.exchange import create_exchange_alert
8 +from app.integrations.alert_creation.office365.services.threat_intel import create_threat_intel_alert
9 +from app.integrations.alert_creation_settings.models.alert_creation_settings import AlertCreationSettings
10 +from sqlalchemy import select
11 +#from app.alerts.office365.services.threat_intel import create_threat_intel_alert
12 +from fastapi import APIRouter
13 +from app.utils import get_customer_alert_settings_office365
14 +from fastapi import HTTPException
15 +from loguru import logger
16 +from fastapi import Depends
17 +from app.db.db_session import get_db
18 +from sqlalchemy.ext.asyncio import AsyncSession
19 +
20 +office365_alerts_router = APIRouter()
21 +
22 +async def is_office365_organization_id_valid(create_alert_request: Office365ExchangeAlertBase, session: AsyncSession) -> bool:
23 + """
24 + Checks if the given organization ID is valid for the specified customer.
25 +
26 + Args:
27 + create_alert_request (Office365ExchangeAlertRequest): The request object containing the organization ID and customer information.
28 + session (AsyncSession): The database session.
29 +
30 + Returns:
31 + bool: True if the organization ID is valid for the customer, False otherwise.
32 + """
33 + logger.info(f"Checking if organization_id: {create_alert_request.data_office365_OrganizationId} is valid for customer: {create_alert_request.data_office365_OrganizationId}")
34 +
35 + result = await session.execute(
36 + select(AlertCreationSettings).where(AlertCreationSettings.office365_organization_id == create_alert_request.data_office365_OrganizationId),
37 + )
38 + settings = result.scalars().first()
39 + if settings is None:
40 + raise HTTPException(status_code=400, detail="Office365 organization ID is not valid, make sure to provision the customer.")
41 +
42 + return True
43 +
44 +
45 +
46 +@office365_alerts_router.post(
47 + "/exchange",
48 + response_model=Office365ExchangeAlertResponse,
49 + description="Create an office365 exchange alert in IRIS.",
50 +)
51 +async def create_office365_exchange_alert(
52 + create_alert_request: Office365ExchangeAlertRequest,
53 + session: AsyncSession = Depends(get_db),
54 +):
55 + logger.info(f"create_alert_request: {create_alert_request}")
56 + if create_alert_request.data_office365_Workload not in [
57 + workload.value for workload in ValidOffice365Workloads
58 + ]:
59 + logger.info(f"Invalid workload: {create_alert_request.data_office365_Workload}")
60 + raise HTTPException(status_code=400, detail="Invalid workload")
61 + logger.info(f"Workload is valid: {create_alert_request.data_office365_Workload}")
62 + await is_office365_organization_id_valid(create_alert_request, session)
63 + return await create_exchange_alert(alert=create_alert_request, session=session)
64 +
65 +
66 +@office365_alerts_router.post(
67 + "/threat_intel",
68 + response_model=Office365ThreatIntelAlertResponse,
69 + description="Create an office365 threat intel alert in IRIS.",
70 +)
71 +async def create_office365_threat_intel_alert(
72 + create_alert_request: Office365ThreatIntelAlertRequest,
73 + session: AsyncSession = Depends(get_db),
74 +):
75 + logger.info(f"create_alert_request: {create_alert_request}")
76 + if create_alert_request.data_office365_Workload not in [
77 + workload.value for workload in ValidOffice365Workloads
78 + ]:
79 + logger.info(f"Invalid workload: {create_alert_request.data_office365_Workload}")
80 + raise HTTPException(status_code=400, detail="Invalid workload")
81 + logger.info(f"Workload is valid: {create_alert_request.data_office365_Workload}")
82 + await is_office365_organization_id_valid(create_alert_request, session)
83 + return await create_threat_intel_alert(alert=create_alert_request, session=session)
backend/app/integrations/alert_creation/office365/schema/exchange.py new
+243
@@ -0,0 +1,243 @@
1 +from enum import Enum
2 +from typing import Any
3 +from typing import Dict
4 +from typing import List
5 +from typing import Optional
6 +
7 +from pydantic import BaseModel
8 +from pydantic import Extra
9 +from pydantic import Field
10 +
11 +
12 +class ValidOffice365Workloads(Enum):
13 + THREAT_INTEL_VALUE = "ThreatIntelligence"
14 + EXCHANGE_VALUE = "Exchange"
15 + ACTIVE_DIRECTORY_VALUE = "AzureActiveDirectory"
16 +
17 +
18 +############### ! REQUEST BODY RECEIVED ! ################
19 +
20 +
21 +class Office365ExchangeAlertBase(BaseModel):
22 + id: str = Field(..., description="Unique identifier for the alert", alias="_id")
23 + index: str = Field(
24 + ...,
25 + description="Index of the alert in the database",
26 + alias="_index",
27 + )
28 + data_office365_OrganizationId: str = Field(
29 + ...,
30 + description="Organization ID of the alert",
31 + )
32 + data_office365_Operation: str = Field(..., description="Operation of the alert")
33 + data_office365_Workload: str = Field(..., description="Workload of the alert")
34 + data_office365_UserId: str = Field(..., description="User ID of the alert")
35 + data_office365_Id: str = Field(..., description="ID of the alert")
36 + rule_description: str = Field(..., description="Description of the alert")
37 + rule_id: str = Field(..., description="ID of the alert")
38 + rule_level: int = Field(..., description="Level of the alert")
39 + timestamp: str = Field(..., description="The timestamp of the alert.")
40 + timestamp_utc: Optional[str] = Field(
41 + ...,
42 + description="The UTC timestamp of the alert.",
43 + )
44 + time_field: Optional[str] = Field(
45 + "timestamp",
46 + description="The timefield of the alert to be used when creating the IRIS alert.",
47 + )
48 +
49 + class Config:
50 + allow_population_by_field_name = True
51 + extra = Extra.allow
52 +
53 + def to_dict(self):
54 + return self.dict(exclude_none=True)
55 +
56 +
57 +class Office365ExchangeAlertRequest(Office365ExchangeAlertBase):
58 + rule_mitre_tactic: Optional[str] = Field(
59 + None,
60 + description="MITRE tactic of the alert",
61 + )
62 + rule_mitre_id: Optional[str] = Field(None, description="MITRE ID of the alert")
63 + rule_mitre_technique: Optional[str] = Field(
64 + None,
65 + description="MITRE technique of the alert",
66 + )
67 +
68 + class Config:
69 + allow_population_by_field_name = True
70 + extra = Extra.allow
71 +
72 + def to_dict(self):
73 + return self.dict(exclude_none=True)
74 +
75 +
76 +class Office365ExchangeAlertResponse(BaseModel):
77 + success: bool
78 + message: str
79 + alert_id: int = Field(..., description="The alert id as created in IRIS.")
80 + customer: str = Field(..., description="The customer name.")
81 + alert_source_link: str = Field(
82 + ...,
83 + description="The link to the alert within Grafana.",
84 + )
85 +
86 +
87 +########### ! Create Alerts Schemas ! ###########
88 +class IrisAsset(BaseModel):
89 + asset_name: Optional[str] = Field(
90 + "Could not find data_office365_UserId in alert",
91 + description="Name of the asset",
92 + example="Server01",
93 + )
94 + asset_ip: Optional[str] = Field(
95 + "n/a",
96 + description="IP address of the asset",
97 + example="192.168.1.1",
98 + )
99 + asset_description: Optional[str] = Field(
100 + "Office365 User ID",
101 + description="Description of the asset",
102 + example="Windows Server",
103 + )
104 + asset_type_id: Optional[int] = Field(
105 + 1,
106 + description="Type ID of the asset",
107 + example=1,
108 + )
109 +
110 + def to_dict(self):
111 + return self.dict(exclude_none=True)
112 +
113 +
114 +class IrisIoc(BaseModel):
115 + ioc_value: str = Field(
116 + ...,
117 + description="Value of the IoC",
118 + example="www.google.com",
119 + )
120 + ioc_description: str = Field(
121 + ...,
122 + description="Description of the IoC",
123 + example="Google",
124 + )
125 + ioc_tlp_id: int = Field(1, description="TLP ID of the IoC", example=1)
126 + ioc_type_id: int = Field(20, description="Type ID of the IoC", example=20)
127 +
128 + def to_dict(self):
129 + return self.dict(exclude_none=True)
130 +
131 +class IrisAlertContext(BaseModel):
132 + customer_iris_id: int = Field(
133 + ...,
134 + description="IRIS ID of the customer",
135 + example=1,
136 + )
137 + customer_name: str = Field(
138 + ...,
139 + description="Name of the customer",
140 + example="SOCFortress",
141 + )
142 + customer_cases_index: str = Field(
143 + ...,
144 + description="IRIS case index name in the Wazuh-Indexer",
145 + example="dfir_iris_00001",
146 + )
147 + alert_id: str = Field(..., description="ID of the alert", example="123")
148 + alert_name: str = Field(
149 + ...,
150 + description="Name of the alert",
151 + example="Office365 Exchange Alert",
152 + )
153 + alert_level: int = Field(..., description="Severity level of the alert", example=3)
154 + rule_id: int = Field(
155 + ...,
156 + description="ID of the Suricata rule that triggered the alert",
157 + example="2001",
158 + )
159 + asset_name: Optional[str] = Field(
160 + "Could not find data_office365_UserId in alert",
161 + description="Name of the asset",
162 + example="Server01",
163 + )
164 + asset_ip: Optional[str] = Field(
165 + "n/a",
166 + description="IP address of the asset",
167 + example="1.1.1.1",
168 + )
169 + asset_type: Optional[int] = Field(
170 + 1,
171 + description="Type ID of the asset",
172 + example=1,
173 + )
174 + office365_operation: str = Field(
175 + ...,
176 + description="Operation of the alert",
177 + example="MailItemsAccessed",
178 + )
179 + data_office365_Id: str = Field(
180 + ...,
181 + description="ID of the alert",
182 + example="123",
183 + )
184 + rule_mitre_id: Optional[str] = Field(None, description="MITRE ID of the alert")
185 + rule_mitre_tactic: Optional[str] = Field(
186 + None,
187 + description="MITRE tactic of the alert",
188 + )
189 + rule_mitre_technique: Optional[str] = Field(
190 + None,
191 + description="MITRE technique of the alert",
192 + )
193 +
194 +
195 +class IrisAlertPayload(BaseModel):
196 + alert_title: str = Field(
197 + ...,
198 + description="Title of the alert",
199 + example="Intrusion Detected",
200 + )
201 + alert_description: str = Field(
202 + ...,
203 + description="Description of the alert",
204 + example="Intrusion Detected by Firewall",
205 + )
206 + alert_source: str = Field(..., description="Source of the alert", example="Wazuh")
207 + assets: List[IrisAsset] = Field(..., description="List of affected assets")
208 + alert_source_link: str = Field(
209 + ...,
210 + description="Link to the alert within Grafana",
211 + example="https://grafana.com",
212 + )
213 + alert_status_id: int = Field(..., description="Status ID of the alert", example=3)
214 + alert_severity_id: int = Field(
215 + ...,
216 + description="Severity ID of the alert",
217 + example=5,
218 + )
219 + alert_customer_id: int = Field(
220 + ...,
221 + description="Customer ID related to the alert",
222 + example=1,
223 + )
224 + alert_source_content: Dict[str, Any] = Field(
225 + ...,
226 + description="Original content from the alert source",
227 + )
228 + alert_context: IrisAlertContext = Field(
229 + ...,
230 + description="Contextual information about the alert",
231 + )
232 + alert_iocs: Optional[List[IrisIoc]] = Field(
233 + None,
234 + description="List of IoCs related to the alert",
235 + )
236 + alert_source_event_time: str = Field(
237 + ...,
238 + description="Timestamp of the alert",
239 + example="2021-01-01T00:00:00.000Z",
240 + )
241 +
242 + def to_dict(self):
243 + return self.dict(exclude_none=True)
backend/app/integrations/alert_creation/office365/schema/threat_intel.py new
+279
@@ -0,0 +1,279 @@
1 +from enum import Enum
2 +from typing import Any
3 +from typing import Dict
4 +from typing import List
5 +from typing import Optional
6 +
7 +from pydantic import BaseModel
8 +from pydantic import Extra
9 +from pydantic import Field
10 +
11 +
12 +class ValidOffice365Workloads(Enum):
13 + THREAT_INTEL_VALUE = "ThreatIntelligence"
14 + EXCHANGE_VALUE = "Exchange"
15 +
16 +
17 +############### ! REQUEST BODY RECEIVED ! ################
18 +
19 +
20 +class Office365ThreatIntelAlertBase(BaseModel):
21 + id: str = Field(..., description="Unique identifier for the alert", alias="_id")
22 + index: str = Field(
23 + ...,
24 + description="Index of the alert in the database",
25 + alias="_index",
26 + )
27 + data_office365_OrganizationId: str = Field(
28 + ...,
29 + description="Organization ID of the alert",
30 + )
31 + data_office365_Operation: str = Field(..., description="Operation of the alert")
32 + data_office365_Workload: str = Field(..., description="Workload of the alert")
33 + data_office365_UserId: str = Field(..., description="User ID of the alert")
34 + data_office365_Id: str = Field(..., description="ID of the alert")
35 + rule_description: str = Field(..., description="Description of the alert")
36 + rule_id: str = Field(..., description="ID of the alert")
37 + rule_level: int = Field(..., description="Level of the alert")
38 + timestamp: str = Field(..., description="The timestamp of the alert.")
39 + timestamp_utc: Optional[str] = Field(
40 + ...,
41 + description="The UTC timestamp of the alert.",
42 + )
43 + time_field: Optional[str] = Field(
44 + "timestamp",
45 + description="The timefield of the alert to be used when creating the IRIS alert.",
46 + )
47 +
48 + class Config:
49 + allow_population_by_field_name = True
50 + extra = Extra.allow
51 +
52 + def to_dict(self):
53 + return self.dict(exclude_none=True)
54 +
55 +
56 +class Office365ThreatIntelAlertRequest(Office365ThreatIntelAlertBase):
57 + rule_mitre_tactic: Optional[str] = Field(
58 + None,
59 + description="MITRE tactic of the alert",
60 + )
61 + rule_mitre_id: Optional[str] = Field(None, description="MITRE ID of the alert")
62 + rule_mitre_technique: Optional[str] = Field(
63 + None,
64 + description="MITRE technique of the alert",
65 + )
66 + data_office365_SenderIp: Optional[str] = Field(
67 + None,
68 + description="Sender IP of the alert",
69 + )
70 + data_office365_Recipients: Optional[str] = Field(
71 + None,
72 + description="Recipients of the alert",
73 + )
74 + data_office365_EventDeepLink: Optional[str] = Field(
75 + None,
76 + description="Event Deep Link of the alert",
77 + )
78 + data_office365_ThreatsAndDetectionTech: Optional[str] = Field(
79 + None,
80 + description="Threats and Detection Techniques of the alert",
81 + )
82 +
83 + class Config:
84 + allow_population_by_field_name = True
85 + extra = Extra.allow
86 +
87 + def to_dict(self):
88 + return self.dict(exclude_none=True)
89 +
90 +
91 +class Office365ThreatIntelAlertResponse(BaseModel):
92 + success: bool
93 + message: str
94 + alert_id: int = Field(..., description="The alert id as created in IRIS.")
95 + customer: str = Field(..., description="The customer name.")
96 + alert_source_link: str = Field(
97 + ...,
98 + description="The link to the alert within Grafana.",
99 + )
100 +
101 +
102 +########### ! Create Alerts Schemas ! ###########
103 +class IrisAsset(BaseModel):
104 + asset_name: Optional[str] = Field(
105 + "Could not find data_office365_UserId in alert",
106 + description="Name of the asset",
107 + example="Server01",
108 + )
109 + asset_ip: Optional[str] = Field(
110 + "n/a",
111 + description="IP address of the asset",
112 + example="192.168.1.1",
113 + )
114 + asset_description: Optional[str] = Field(
115 + "Office365 User ID",
116 + description="Description of the asset",
117 + example="Windows Server",
118 + )
119 + asset_type_id: Optional[int] = Field(
120 + 1,
121 + description="Type ID of the asset",
122 + example=1,
123 + )
124 +
125 + def to_dict(self):
126 + return self.dict(exclude_none=True)
127 +
128 +
129 +class IrisIoc(BaseModel):
130 + ioc_value: str = Field(
131 + ...,
132 + description="Value of the IoC",
133 + example="www.google.com",
134 + )
135 + ioc_description: str = Field(
136 + ...,
137 + description="Description of the IoC",
138 + example="Google",
139 + )
140 + ioc_tlp_id: int = Field(1, description="TLP ID of the IoC", example=1)
141 + ioc_type_id: int = Field(20, description="Type ID of the IoC", example=20)
142 +
143 + def to_dict(self):
144 + return self.dict(exclude_none=True)
145 +
146 +
147 +class IrisAlertContext(BaseModel):
148 + customer_iris_id: int = Field(
149 + ...,
150 + description="IRIS ID of the customer",
151 + example=1,
152 + )
153 + customer_name: str = Field(
154 + ...,
155 + description="Name of the customer",
156 + example="SOCFortress",
157 + )
158 + customer_cases_index: str = Field(
159 + ...,
160 + description="IRIS case index name in the Wazuh-Indexer",
161 + example="dfir_iris_00001",
162 + )
163 + alert_id: str = Field(..., description="ID of the alert", example="123")
164 + alert_name: str = Field(
165 + ...,
166 + description="Name of the alert",
167 + example="Office365 Exchange Alert",
168 + )
169 + alert_level: int = Field(..., description="Severity level of the alert", example=3)
170 + rule_id: int = Field(
171 + ...,
172 + description="ID of the Suricata rule that triggered the alert",
173 + example="2001",
174 + )
175 + asset_name: Optional[str] = Field(
176 + "Could not find data_office365_UserId in alert",
177 + description="Name of the asset",
178 + example="Server01",
179 + )
180 + asset_ip: Optional[str] = Field(
181 + "n/a",
182 + description="IP address of the asset",
183 + example="1.1.1.1",
184 + )
185 + asset_type: Optional[int] = Field(
186 + 1,
187 + description="Type ID of the asset",
188 + example=1,
189 + )
190 + office365_operation: str = Field(
191 + ...,
192 + description="Operation of the alert",
193 + example="MailItemsAccessed",
194 + )
195 + data_office365_Id: str = Field(
196 + ...,
197 + description="ID of the alert",
198 + example="123",
199 + )
200 + recipient: Optional[str] = Field(
201 + None,
202 + description="Recipient of the alert",
203 + example="info@socfortress.co",
204 + )
205 + sender_ip: Optional[str] = Field(
206 + None,
207 + description="Sender IP of the alert",
208 + example="1.1.1.1",
209 + )
210 + detection_type: Optional[str] = Field(
211 + None,
212 + description="Detection type of the alert",
213 + example="Malware",
214 + )
215 + event_link: Optional[str] = Field(
216 + None,
217 + description="Event link of the alert",
218 + example="https://www.google.com",
219 + )
220 + rule_mitre_id: Optional[str] = Field(None, description="MITRE ID of the alert")
221 + rule_mitre_tactic: Optional[str] = Field(
222 + None,
223 + description="MITRE tactic of the alert",
224 + )
225 + rule_mitre_technique: Optional[str] = Field(
226 + None,
227 + description="MITRE technique of the alert",
228 + )
229 +
230 +
231 +class IrisAlertPayload(BaseModel):
232 + alert_title: str = Field(
233 + ...,
234 + description="Title of the alert",
235 + example="Intrusion Detected",
236 + )
237 + alert_description: str = Field(
238 + ...,
239 + description="Description of the alert",
240 + example="Intrusion Detected by Firewall",
241 + )
242 + alert_source: str = Field(..., description="Source of the alert", example="Wazuh")
243 + assets: List[IrisAsset] = Field(..., description="List of affected assets")
244 + alert_source_link: str = Field(
245 + ...,
246 + description="Link to the alert within Grafana",
247 + example="https://grafana.com",
248 + )
249 + alert_status_id: int = Field(..., description="Status ID of the alert", example=3)
250 + alert_severity_id: int = Field(
251 + ...,
252 + description="Severity ID of the alert",
253 + example=5,
254 + )
255 + alert_customer_id: int = Field(
256 + ...,
257 + description="Customer ID related to the alert",
258 + example=1,
259 + )
260 + alert_source_content: Dict[str, Any] = Field(
261 + ...,
262 + description="Original content from the alert source",
263 + )
264 + alert_context: IrisAlertContext = Field(
265 + ...,
266 + description="Contextual information about the alert",
267 + )
268 + alert_iocs: Optional[List[IrisIoc]] = Field(
269 + None,
270 + description="List of IoCs related to the alert",
271 + )
272 + alert_source_event_time: str = Field(
273 + ...,
274 + description="Timestamp of the alert",
275 + example="2021-01-01T00:00:00.000Z",
276 + )
277 +
278 + def to_dict(self):
279 + return self.dict(exclude_none=True)
backend/app/integrations/alert_creation/office365/services/exchange.py new
+247
@@ -0,0 +1,247 @@
1 +from typing import Optional
2 +from typing import Set
3 +
4 +from app.integrations.alert_creation.general.schema.alert import ValidIocFields
5 +from app.integrations.alert_creation.office365.schema.exchange import IrisAlertContext
6 +from app.integrations.alert_creation.office365.schema.exchange import IrisAlertPayload
7 +from app.integrations.alert_creation.office365.schema.exchange import IrisAsset
8 +from app.integrations.alert_creation.office365.schema.exchange import IrisIoc
9 +from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertRequest
10 +from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertResponse
11 +from app.integrations.utils.schema import ShufflePayload
12 +from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
13 +from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
14 +from app.integrations.utils.alerts import send_to_shuffle
15 +from app.integrations.utils.alerts import validate_ioc_type
16 +from app.utils import get_customer_alert_settings, get_customer_alert_settings_office365
17 +from loguru import logger
18 +from sqlalchemy.ext.asyncio import AsyncSession
19 +
20 +
21 +def valid_ioc_fields() -> Set[str]:
22 + """
23 + Getter for the set of valid IoC fields.
24 + Returns
25 + -------
26 + Set[str]
27 + The set of valid IoC fields.
28 + """
29 + return {field.value for field in ValidIocFields}
30 +
31 +
32 +async def construct_alert_source_link(alert_details: Office365ExchangeAlertRequest, session: AsyncSession) -> str:
33 + """
34 + Construct the alert source link for the alert details.
35 + Parameters
36 + ----------
37 + alert_details: Office365ExchangeAlertRequest
38 + The alert details.
39 + Returns
40 + -------
41 + str
42 + The alert source link.
43 + """
44 + grafana_url = (await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)).grafana_url
45 +
46 + return (
47 + f"{grafana_url}/explore?left=%5B%22now-6h%22,%22now%22,%22O365%22,%7B%22refId%22"
48 + ":%22A%22,%22query%22:%22data_office365_Id:%5C%22"
49 + f"{alert_details.data_office365_Id}%5C%22%22,%22alias%22"
50 + ":%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22"
51 + "%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
52 + )
53 +
54 +
55 +async def build_ioc_payload(alert_details: Office365ExchangeAlertRequest) -> Optional[IrisIoc]:
56 + """
57 + Builds an IoC payload based on the provided alert details.
58 +
59 + Args:
60 + alert_details (Office365ExchangeAlertRequest): The details of the alert.
61 +
62 + Returns:
63 + Optional[IrisIoc]: The constructed IoC payload, or None if no valid IoC fields are found.
64 + """
65 + for field in valid_ioc_fields():
66 + if hasattr(alert_details, field):
67 + ioc_value = getattr(alert_details, field)
68 + ioc_type = await validate_ioc_type(ioc_value=ioc_value)
69 + return IrisIoc(
70 + ioc_value=ioc_value,
71 + ioc_description="IoC found in alert",
72 + ioc_tlp_id=1,
73 + ioc_type_id=ioc_type,
74 + )
75 + return None
76 +
77 +
78 +async def build_asset_payload(alert_details: Office365ExchangeAlertRequest) -> IrisAsset:
79 + if alert_details.data_office365_UserId:
80 + return IrisAsset(
81 + asset_name=alert_details.data_office365_UserId,
82 + asset_ip="n/a",
83 + asset_description="Office365 User ID",
84 + asset_type_id=1,
85 + )
86 + return IrisAsset()
87 +
88 +
89 +async def build_alert_context_payload(
90 + alert_details: Office365ExchangeAlertRequest,
91 + session: AsyncSession,
92 +) -> IrisAlertContext:
93 + """
94 + Builds the payload for the alert context.
95 +
96 + Args:
97 + alert_details (CreateAlertRequest): The details of the alert.
98 + agent_data (AgentsResponse): The agent data.
99 + session (AsyncSession): The async session.
100 +
101 + Returns:
102 + IrisAlertContext: The built alert context payload.
103 + """
104 + return IrisAlertContext(
105 + customer_iris_id=(
106 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
107 + ).iris_customer_id,
108 + customer_name=(await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)).customer_name,
109 + customer_cases_index=(
110 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
111 + ).iris_index,
112 + alert_id=alert_details.id,
113 + alert_name=alert_details.rule_description,
114 + alert_level=alert_details.rule_level,
115 + rule_id=alert_details.rule_id,
116 + asset_name=alert_details.data_office365_UserId,
117 + asset_ip="n/a",
118 + asset_type=1,
119 + office365_operation=alert_details.data_office365_Operation,
120 + data_office365_Id=alert_details.data_office365_Id,
121 + rule_mitre_id=alert_details.rule_mitre_id,
122 + rule_mitre_technique=alert_details.rule_mitre_technique,
123 + rule_mitre_tactic=alert_details.rule_mitre_tactic,
124 + )
125 +
126 +
127 +async def build_alert_payload(
128 + alert_details: Office365ExchangeAlertRequest,
129 + ioc_payload: Optional[IrisIoc],
130 + session: AsyncSession,
131 +) -> IrisAlertPayload:
132 + """
133 + Builds the payload for an alert based on the provided alert details, agent data, IoC payload, and session.
134 +
135 + Args:
136 + alert_details (CreateAlertRequest): The details of the alert.
137 + agent_data: The agent data associated with the alert.
138 + ioc_payload (Optional[IrisIoc]): The IoC payload associated with the alert.
139 + session (AsyncSession): The session used for database operations.
140 +
141 + Returns:
142 + IrisAlertPayload: The built alert payload.
143 + """
144 + asset_payload = await build_asset_payload(alert_details)
145 + context_payload = await build_alert_context_payload(alert_details=alert_details, session=session)
146 + timefield = "timestamp_utc"
147 + # Get the timefield value from the alert_details
148 + if hasattr(alert_details, timefield):
149 + alert_details.time_field = getattr(alert_details, timefield)
150 + logger.info(f"Alert has context: {context_payload}")
151 + if ioc_payload:
152 + logger.info(f"Alert has IoC: {ioc_payload}")
153 + return IrisAlertPayload(
154 + alert_title=alert_details.data_office365_Operation,
155 + alert_source_link=await construct_alert_source_link(alert_details, session=session),
156 + alert_description=alert_details.rule_description,
157 + alert_source="Office365 Exchange Rule",
158 + assets=[asset_payload],
159 + alert_status_id=3,
160 + alert_severity_id=5,
161 + alert_customer_id=(
162 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
163 + ).iris_customer_id,
164 + alert_source_content=alert_details.to_dict(),
165 + alert_context=context_payload,
166 + alert_iocs=[ioc_payload],
167 + alert_source_event_time=alert_details.time_field,
168 + )
169 + else:
170 + logger.info("Alert does not have IoC")
171 + return IrisAlertPayload(
172 + alert_title=alert_details.data_office365_Operation,
173 + alert_source_link=await construct_alert_source_link(alert_details, session=session),
174 + alert_description=alert_details.rule_description,
175 + alert_source="Office365 Exchange Rule",
176 + assets=[asset_payload],
177 + alert_status_id=3,
178 + alert_severity_id=5,
179 + alert_customer_id=(
180 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
181 + ).iris_customer_id,
182 + alert_source_content=alert_details.to_dict(),
183 + alert_context=context_payload,
184 + alert_source_event_time=alert_details.time_field,
185 + )
186 +
187 +
188 +async def create_exchange_alert(alert: Office365ExchangeAlertRequest, session: AsyncSession) -> Office365ExchangeAlertResponse:
189 + """
190 + Creates an Office365 Exchange alert in IRIS.
191 +
192 + Args:
193 + alert (CreateAlertRequest): The alert details.
194 + session (AsyncSession): The database session.
195 +
196 + Returns:
197 + CreateAlertResponse: The response containing the alert ID and other details.
198 + """
199 + logger.info(f"Creating alert with {alert.id} in IRIS.")
200 + ioc_payload = await build_ioc_payload(alert_details=alert)
201 + iris_alert_payload = await build_alert_payload(
202 + alert_details=alert,
203 + ioc_payload=ioc_payload,
204 + session=session,
205 + )
206 + client, alert_client = await initialize_client_and_alert("DFIR-IRIS")
207 + result = await fetch_and_validate_data(
208 + client,
209 + alert_client.add_alert,
210 + iris_alert_payload.to_dict(),
211 + )
212 + alert_id = result["data"]["alert_id"]
213 + logger.info(f"Successfully created alert {alert_id} in IRIS.")
214 + # Update the alert with the asset payload
215 + await fetch_and_validate_data(
216 + client,
217 + alert_client.update_alert,
218 + alert_id,
219 + {"assets": [dict(IrisAsset(**iris_alert_payload.assets[0].to_dict()))]},
220 + )
221 + # Updae the alert if the ioc_payload is not None
222 + if ioc_payload:
223 + await fetch_and_validate_data(
224 + client,
225 + alert_client.update_alert,
226 + alert_id,
227 + {"iocs": [dict(IrisIoc(**iris_alert_payload.alert_iocs[0].to_dict()))]},
228 + )
229 +
230 + await send_to_shuffle(
231 + ShufflePayload(
232 + alert_id=alert_id,
233 + customer= (await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_name,
234 + customer_code= (await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_code,
235 + alert_source_link=await construct_alert_source_link(alert, session=session),
236 + rule_description=alert.rule_description,
237 + hostname=alert.data_office365_UserId,
238 + ),
239 + session=session,
240 + )
241 + return Office365ExchangeAlertResponse(
242 + alert_id=alert_id,
243 + customer=(await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_name,
244 + alert_source_link=await construct_alert_source_link(alert, session=session),
245 + success=True,
246 + message=f"Successfully created alert {alert_id} in IRIS.",
247 + )
backend/app/integrations/alert_creation/office365/services/threat_intel.py new
+247
@@ -0,0 +1,247 @@
1 +from typing import Optional
2 +from typing import Set
3 +
4 +from app.integrations.alert_creation.general.schema.alert import ValidIocFields
5 +from app.integrations.alert_creation.office365.schema.threat_intel import IrisAlertContext
6 +from app.integrations.alert_creation.office365.schema.threat_intel import IrisAlertPayload
7 +from app.integrations.alert_creation.office365.schema.threat_intel import IrisAsset
8 +from app.integrations.alert_creation.office365.schema.threat_intel import IrisIoc
9 +from app.integrations.alert_creation.office365.schema.threat_intel import Office365ThreatIntelAlertBase
10 +from app.integrations.alert_creation.office365.schema.threat_intel import Office365ThreatIntelAlertResponse, Office365ThreatIntelAlertRequest
11 +from app.integrations.utils.schema import ShufflePayload
12 +from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
13 +from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
14 +from app.integrations.utils.alerts import send_to_shuffle
15 +from app.integrations.utils.alerts import validate_ioc_type
16 +from app.utils import get_customer_alert_settings, get_customer_alert_settings_office365
17 +from loguru import logger
18 +from sqlalchemy.ext.asyncio import AsyncSession
19 +
20 +
21 +def valid_ioc_fields() -> Set[str]:
22 + """
23 + Getter for the set of valid IoC fields.
24 + Returns
25 + -------
26 + Set[str]
27 + The set of valid IoC fields.
28 + """
29 + return {field.value for field in ValidIocFields}
30 +
31 +
32 +async def construct_alert_source_link(alert_details: Office365ThreatIntelAlertRequest, session: AsyncSession) -> str:
33 + """
34 + Construct the alert source link for the alert details.
35 + Parameters
36 + ----------
37 + alert_details: Office365ExchangeAlertRequest
38 + The alert details.
39 + Returns
40 + -------
41 + str
42 + The alert source link.
43 + """
44 + grafana_url = (await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)).grafana_url
45 +
46 + return (
47 + f"{grafana_url}/explore?left=%5B%22now-6h%22,%22now%22,%22O365%22,%7B%22refId%22"
48 + ":%22A%22,%22query%22:%22data_office365_Id:%5C%22"
49 + f"{alert_details.data_office365_Id}%5C%22%22,%22alias%22"
50 + ":%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22"
51 + "%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
52 + )
53 +
54 +
55 +async def build_ioc_payload(alert_details: Office365ThreatIntelAlertRequest) -> Optional[IrisIoc]:
56 + """
57 + Builds an IoC payload based on the provided alert details.
58 +
59 + Args:
60 + alert_details (Office365ThreatIntelAlertRequest): The details of the alert.
61 +
62 + Returns:
63 + Optional[IrisIoc]: The constructed IoC payload, or None if no valid IoC fields are found.
64 + """
65 + for field in valid_ioc_fields():
66 + if hasattr(alert_details, field):
67 + ioc_value = getattr(alert_details, field)
68 + ioc_type = await validate_ioc_type(ioc_value=ioc_value)
69 + return IrisIoc(
70 + ioc_value=ioc_value,
71 + ioc_description="IoC found in alert",
72 + ioc_tlp_id=1,
73 + ioc_type_id=ioc_type,
74 + )
75 + return None
76 +
77 +
78 +async def build_asset_payload(alert_details: Office365ThreatIntelAlertRequest) -> IrisAsset:
79 + if alert_details.data_office365_UserId:
80 + return IrisAsset(
81 + asset_name=alert_details.data_office365_UserId,
82 + asset_ip="n/a",
83 + asset_description="Office365 User ID",
84 + asset_type_id=1,
85 + )
86 + return IrisAsset()
87 +
88 +
89 +async def build_alert_context_payload(
90 + alert_details: Office365ThreatIntelAlertRequest,
91 + session: AsyncSession,
92 +) -> IrisAlertContext:
93 + """
94 + Builds the payload for the alert context.
95 +
96 + Args:
97 + alert_details (CreateAlertRequest): The details of the alert.
98 + agent_data (AgentsResponse): The agent data.
99 + session (AsyncSession): The async session.
100 +
101 + Returns:
102 + IrisAlertContext: The built alert context payload.
103 + """
104 + return IrisAlertContext(
105 + customer_iris_id=(
106 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
107 + ).iris_customer_id,
108 + customer_name=(await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)).customer_name,
109 + customer_cases_index=(
110 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
111 + ).iris_index,
112 + alert_id=alert_details.id,
113 + alert_name=alert_details.rule_description,
114 + alert_level=alert_details.rule_level,
115 + rule_id=alert_details.rule_id,
116 + asset_name=alert_details.data_office365_UserId,
117 + asset_ip="n/a",
118 + asset_type=1,
119 + office365_operation=alert_details.data_office365_Operation,
120 + data_office365_Id=alert_details.data_office365_Id,
121 + rule_mitre_id=alert_details.rule_mitre_id,
122 + rule_mitre_technique=alert_details.rule_mitre_technique,
123 + rule_mitre_tactic=alert_details.rule_mitre_tactic,
124 + )
125 +
126 +
127 +async def build_alert_payload(
128 + alert_details: Office365ThreatIntelAlertRequest,
129 + ioc_payload: Optional[IrisIoc],
130 + session: AsyncSession,
131 +) -> IrisAlertPayload:
132 + """
133 + Builds the payload for an alert based on the provided alert details, agent data, IoC payload, and session.
134 +
135 + Args:
136 + alert_details (CreateAlertRequest): The details of the alert.
137 + agent_data: The agent data associated with the alert.
138 + ioc_payload (Optional[IrisIoc]): The IoC payload associated with the alert.
139 + session (AsyncSession): The session used for database operations.
140 +
141 + Returns:
142 + IrisAlertPayload: The built alert payload.
143 + """
144 + asset_payload = await build_asset_payload(alert_details)
145 + context_payload = await build_alert_context_payload(alert_details=alert_details, session=session)
146 + timefield = "timestamp_utc"
147 + # Get the timefield value from the alert_details
148 + if hasattr(alert_details, timefield):
149 + alert_details.time_field = getattr(alert_details, timefield)
150 + logger.info(f"Alert has context: {context_payload}")
151 + if ioc_payload:
152 + logger.info(f"Alert has IoC: {ioc_payload}")
153 + return IrisAlertPayload(
154 + alert_title=alert_details.data_office365_Operation,
155 + alert_source_link=await construct_alert_source_link(alert_details, session=session),
156 + alert_description=alert_details.rule_description,
157 + alert_source="Office365 Threat Intel Rule",
158 + assets=[asset_payload],
159 + alert_status_id=3,
160 + alert_severity_id=5,
161 + alert_customer_id=(
162 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
163 + ).iris_customer_id,
164 + alert_source_content=alert_details.to_dict(),
165 + alert_context=context_payload,
166 + alert_iocs=[ioc_payload],
167 + alert_source_event_time=alert_details.time_field,
168 + )
169 + else:
170 + logger.info("Alert does not have IoC")
171 + return IrisAlertPayload(
172 + alert_title=alert_details.data_office365_Operation,
173 + alert_source_link=await construct_alert_source_link(alert_details, session=session),
174 + alert_description=alert_details.rule_description,
175 + alert_source="Office365 Threat Intel Rule",
176 + assets=[asset_payload],
177 + alert_status_id=3,
178 + alert_severity_id=5,
179 + alert_customer_id=(
180 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
181 + ).iris_customer_id,
182 + alert_source_content=alert_details.to_dict(),
183 + alert_context=context_payload,
184 + alert_source_event_time=alert_details.time_field,
185 + )
186 +
187 +
188 +async def create_threat_intel_alert(alert: Office365ThreatIntelAlertRequest, session: AsyncSession) -> Office365ThreatIntelAlertResponse:
189 + """
190 + Creates an Office365 Threat Intel alert in IRIS.
191 +
192 + Args:
193 + alert (Office365ThreatIntelAlertRequest): The alert details.
194 + session (AsyncSession): The database session.
195 +
196 + Returns:
197 + CreateAlertResponse: The response containing the alert ID and other details.
198 + """
199 + logger.info(f"Creating alert with {alert.id} in IRIS.")
200 + ioc_payload = await build_ioc_payload(alert_details=alert)
201 + iris_alert_payload = await build_alert_payload(
202 + alert_details=alert,
203 + ioc_payload=ioc_payload,
204 + session=session,
205 + )
206 + client, alert_client = await initialize_client_and_alert("DFIR-IRIS")
207 + result = await fetch_and_validate_data(
208 + client,
209 + alert_client.add_alert,
210 + iris_alert_payload.to_dict(),
211 + )
212 + alert_id = result["data"]["alert_id"]
213 + logger.info(f"Successfully created alert {alert_id} in IRIS.")
214 + # Update the alert with the asset payload
215 + await fetch_and_validate_data(
216 + client,
217 + alert_client.update_alert,
218 + alert_id,
219 + {"assets": [dict(IrisAsset(**iris_alert_payload.assets[0].to_dict()))]},
220 + )
221 + # Updae the alert if the ioc_payload is not None
222 + if ioc_payload:
223 + await fetch_and_validate_data(
224 + client,
225 + alert_client.update_alert,
226 + alert_id,
227 + {"iocs": [dict(IrisIoc(**iris_alert_payload.alert_iocs[0].to_dict()))]},
228 + )
229 +
230 + await send_to_shuffle(
231 + ShufflePayload(
232 + alert_id=alert_id,
233 + customer= (await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_name,
234 + customer_code= (await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_code,
235 + alert_source_link=await construct_alert_source_link(alert, session=session),
236 + rule_description=alert.rule_description,
237 + hostname=alert.data_office365_UserId,
238 + ),
239 + session=session,
240 + )
241 + return Office365ThreatIntelAlertResponse(
242 + alert_id=alert_id,
243 + customer=(await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_name,
244 + alert_source_link=await construct_alert_source_link(alert, session=session),
245 + success=True,
246 + message=f"Successfully created alert {alert_id} in IRIS.",
247 + )
backend/app/integrations/log_shipper_test/routes/event_shipper.py
+2 -2
@@ -4,7 +4,7 @@ from loguru import logger
4 from fastapi import HTTPException
5 from fastapi import Depends
6 import json
7 -from app.integrations.utils.event_shipper import event_shipper_test
7 +from app.integrations.utils.event_shipper import event_shipper
8 from app.integrations.utils.schema import EventShipperPayload
9
10 log_shipper_test_router = APIRouter()
@@ -22,7 +22,7 @@ async def event_shipper_test_route():
22 host="example.org",
23 )
24 try:
25 - return await event_shipper_test(message)
25 + return await event_shipper(message)
26 except Exception as e:
27 logger.error(f"Failed to send test message to log shipper: {e}")
28 raise HTTPException(status_code=500, detail=f"Failed to send test message to log shipper: {e}")
backend/app/integrations/markdown/mimecast.md new
+112
@@ -0,0 +1,112 @@
1 +# [Mimecast](https://integrations.mimecast.com/documentation/api-overview/authentication-scripts-server-apps/)
2 +
3 +When developing a script of server application integration you will:
4 +
5 +- Use a single user that has the Mimecast administrator permissions to perform the actions required by your use case.
6 +- Update the Authentication Cache TTL setting in the service user's effective Authentication Profile to "Never Expire."
7 +
8 +This page provides a step-by-step guide to prepare a user for your integration and get the access key and secret key values required to authorize all requests to the API.
9 +
10 +### Step 1: Create a New User
11 +1. Login to the Administration Console.
12 +2. Navigate to the Administration | Directories | Internal Directories menu item to display a list of internal domains.
13 +3. Select the internal domain where you would like to create your new user.
14 +4. Select the New Address button from the menu bar.
15 +5. Complete the new address form and select Save and Exit to create the new user.
16 +6. Keep a note of the password set as you will use this to get your Authentication Token in Step 6.
17 +
18 +### Step 2: Add the User to an Administrative Role
19 +1. While logged into the Administration Console, navigate to the Administration | Account | Roles menu item to display the Roles page.
20 +2. Right-click the Basic Administrator role and select Add users to role.
21 +3. Browse or search to find the new user created in Step 1.
22 +4. Select the tick box to the left of the user.
23 +5. Select the Add selected users button to add the user to the role.
24 +
25 +### Step 3: Create a New Group and Add Your New User
26 +1. While logged into the Administration Console, navigate to the Administration | Directories | Profile Groups menu item to display the Profile groups page.
27 +2. Create a new group by selecting the plus icon on the parent folder where you would like to create the group. This creates a new group with the Name "New Folder"
28 +3. To rename the group, select the newly created "New Folder" group. Then from the Edit group text box type the name you want to give the folder, for example, Splunk Admin and press the Enter key to apply the change.
29 +4. With the group selected select the Build drop-down button and select Add Email Addresses.
30 +5. Type the name of the new user created in Step 1.
31 +6. Select Save and Exit to add the new user to the group.
32 +
33 +### Step 4: Create a New Authentication Profile
34 +1. While logged into the Administration Console, navigate to the Administration | Services | Applications menu item to display the Application Settings page.
35 +2. Select the Authentication Profiles button.
36 +3. Select the New Authentication Profile button.
37 +4. Type a Description for the new profile.
38 +5. Set the Authentication TTL setting to Never Expires. This will make sure that when you create your Authentication Token it will not expire and impact the data collection of the app.
39 +6. Leave all other settings as their default.
40 +7. Select Save and Exit to create the profile.
41 +
42 +### Step 5: Create a New Application Setting
43 +1. While logged into the Administration Console, navigate to the Administration | Services | Applications menu item to display the Application Settings page.
44 +2. Select the New Application Settings button.
45 +3. Type a Description.
46 +4. Use the Group Lookup button to select the Group that you created in Step 3.
47 +5. Use the Authentication Profile Lookup button to select the Authentication Profile created in Step 4.
48 +6. Leave all other settings as their default.
49 +7. Select Save and Exit to create and apply the Application Settings to your new group and user.
50 +
51 +### Step 6: Get Your Authentication Token
52 +Now that you have a dedicated user who will receive an Authentication Token that will never expire, the final preparation task is to get the Authentication Token for the user.
53 +
54 +#### Get an Authentication Token Using Windows
55 +NOTE: This process has been tested in Powershell version 4 and 5.
56 +
57 +Copy paste the following script into a Powershell window:
58 +```powershell
59 +$appId = Read-Host -Prompt 'Input your registered application id'
60 +
61 +$creds = Get-Credential
62 +
63 +$discoverPostBody = @{"data" = ,@{"emailAddress" = $creds.UserName}}
64 +
65 +$discoverPostBodyJson = ConvertTo-Json $discoverPostBody
66 +
67 +$discoverRequestId = [GUID]::NewGuid().guid
68 +
69 +$discoverRequestHeaders = @{"x-mc-app-id" = $appId; "x-mc-req-id" = $discoverRequestId; "Content-Type" = "application/json"}
70 +
71 +$discoveryData = Invoke-RestMethod -Method Post -Headers $discoverRequestHeaders -Body $discoverPostBodyJson -Uri "https://api.mimecast.com/api/login/discover-authentication"
72 +
73 +$baseUrl = $discoveryData.data.region.api
74 +
75 +$keys = @{}
76 +
77 +$uri = $baseUrl + "/api/login/login"
78 +
79 +$requestId = [GUID]::NewGuid()
80 +
81 +$netCred = $creds.GetNetworkCredential()
82 +
83 +$PlainPassword = $netCred.Password
84 +
85 +$credsBytes = [System.Text.Encoding]::ASCII.GetBytes($creds.UserName + ":" + $PlainPassword)
86 +
87 +$creds64 = [System.Convert]::ToBase64String($credsBytes)
88 +
89 +$headers = @{"Authorization" = "Basic-Cloud " + $creds64; "x-mc-app-id" = $appId; "x-mc-req-id" = $requestId; "Content-Type" = "application/json"}
90 +
91 +$postBody = @{"data" = ,@{"username" = $creds.UserName}}
92 +
93 +$postBodyJson = ConvertTo-Json $postBody
94 +
95 +$data = Invoke-RestMethod -Method Post -Headers $headers -Body $postBodyJson -Uri $uri
96 +
97 +"Meta: " + $data.meta
98 +
99 +"Access key: " + $data.data.accessKey
100 +
101 +"Secret key: " + $data.data.secretKey
102 +
103 +"Fail: " + $data.fail.errorss
104 +```
105 +
106 +When prompted, enter the Application ID value received when you registered your application.
107 +
108 +Enter the email address and password of the user created in Step 1: Create a new user into the Windows credentials box that will launch after you have pasted the script into the Powershell window.
109 +
110 +Copy and paste the accessKey and secretKey values printed at the bottom of the Powershell window to use in your application.
111 +
112 +IMPORTANT: be sure to copy and paste these values to a text editor and remove any line breaks caused by your Powershell window size before using the values.
backend/app/integrations/markdown/office365.md new
+206
@@ -0,0 +1,206 @@
1 +Documentation provided by [Wazuh](https://documentation.wazuh.com/current/cloud-security/office365/monitoring-office365-activity.html).
2 +
3 +Learn how to monitor your organization's Office 365 activity with Wazuh in this section of our documentation.
4 +
5 +Monitoring Office 365 Activity
6 +==============================
7 +
8 +The `audit log` allows organization admins to quickly review the actions performed by members of your organization. It includes details such as who performed the action, what the action was, and when it was performed.
9 +This Wazuh module allows you to collect all the logs from Office 365 using its API. The Office 365 Management Activity API aggregates actions and events into tenant-specific content blobs, which are classified by the type and source of the content they contain.
10 +
11 +**List available content:**
12 +
13 +This operation lists the content currently available for retrieval for the specified content type.
14 +
15 + GET https://manage.office.com/api/v1.0/{tenant_id}/activity/feed/subscriptions/content?contentType={content_type}&startTime={start_time}&endTime={end_time}
16 +
17 +**Retrieving content:**
18 +
19 +To retrieve a content blob, make a GET request against the corresponding content URI that is included in the list of available content.
20 +
21 + GET {content_uri}
22 +
23 +Office 365 API description can be found in this `link <https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference>`_.
24 +
25 +### Office 365 API requirements
26 +
27 +For **Wazuh** to successfully connect to the **Office365 API**, an authentication process is required. To do this, we must provide the ``tenant_id``, ``client_id``, and ``client_secret`` of the application that we authorize in the organization.
28 +
29 +# Register your app
30 +
31 +To authenticate with the Microsoft identity platform endpoint, you need to register an app in your [Microsoft Azure portal app registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) section. Once there click on **New registration**:
32 +
33 +![Register your app](/src/assets/images/office365/0-azure-app-new-registration.png)
34 +
35 +Fill in the name of your app, choose the desired account type and click on the **Register** button:
36 +
37 +![Register your app](/src/assets/images/office365/1-azure-wazuh-app-register-application.png)
38 +
39 +The app is now registered, and you can see information about it in its **Overview** section, at this point we can get the ``client`` and ``tenant`` IDs:
40 +
41 +![Register your app](/src/assets/images/office365/2-azure-wazuh-app-overview.png)
42 +
43 +# Certificates & secrets
44 +
45 +You can generate a password to use during the authentication process. Go to **Certificates & secrets** and click on **New client secret**,
46 +then the name and the expiration date of the **New client secret** are requested:
47 +
48 +![Certificates & secrets](/src/assets/images/office365/3-azure-wazuh-app-create-password.png)
49 +
50 +Copy and save the value section.
51 +
52 +![Certificates & secrets](/src/assets/images/office365/3-azure-wazuh-app-create-password-copy-value.png)
53 +
54 +Make sure you write it down because the UI won’t let you copy it afterward.
55 +
56 +# API permissions
57 +
58 + The application needs specific API permissions to be able to request the Office 365 activity events. In this case, you are looking for permissions related to the ``https://manage.office.com`` resource.
59 +
60 + To configure the application permissions, go to the **API permissions** page and choose **Add a permission**. Select the **Office 365 Management APIs** and click on **Application permissions**.
61 +
62 + You need to add the following permissions under the **ActivityFeed** group:
63 +
64 +- ``ActivityFeed.Read``. Read activity data for your organization.
65 +
66 +- ``ActivityFeed.ReadDlp``. Read DLP policy events including detected sensitive data.
67 +
68 +![API permissions](/src/assets/images/office365/4-azure-wazuh-app-configure-permissions.png)
69 +
70 + Admin consent is required for API permission changes.
71 +
72 +![API permissions](/src/assets/images/office365/4-azure-wazuh-app-configure-permissions-admin-consent.png)
73 +
74 +### Wazuh configuration
75 +
76 +Next, we will see the options we have to configure for the Wazuh integration.
77 +
78 +Configure the ``office365`` module either in the Wazuh manager or the Wazuh agent. To do so, modify the :doc:`ossec.conf </user-manual/reference/ossec-conf/index>` configuration file. Through the following configuration, Wazuh is ready to search for logs created by Office 365 audit-log. In this case, we will only search for the ``Audit.SharePoint`` type events within an interval of ``1m``. Those logs will be only those that were created after the module was started:
79 +```html
80 + <office365>
81 + <enabled>yes</enabled>
82 + <interval>1m</interval>
83 + <curl_max_size>1M</curl_max_size>
84 + <only_future_events>yes</only_future_events>
85 + <api_auth>
86 + <tenant_id>your_tenant_id</tenant_id>
87 + <client_id>your_client_id</client_id>
88 + <client_secret>your_client_secret</client_secret>
89 + <api_type>commercial</api_type>
90 + </api_auth>
91 + <subscriptions>
92 + <subscription>Audit.SharePoint</subscription>
93 + </subscriptions>
94 + </office365>
95 +```
96 +To learn more, check the :ref:`office365-module` module reference.
97 +
98 +Using the configuration mentioned above, we will see an example of monitoring Office 365 activity.
99 +
100 +### Generate activity on Office 365
101 +
102 +For this example, we will start by generating some activity in our Office 365 Organization. In this case, let's modify a ``Communication site`` in ``SharePoint``. If we do that, we can see that Office 365 will generate a new json event, something like this:
103 +```json
104 + {
105 + "CreationTime":"2021-06-09T22:10:45",
106 + "Id":"xxxx-xxxx-xxxx-xxxx-xxxx",
107 + "Operation":"FileModified",
108 + "OrganizationId":"xxxx-xxxx-xxxx-xxxx-xxxx",
109 + "RecordType":"6",
110 + "UserKey":"i:xx.f|membership|xxxx@live.com",
111 + "UserType":"0",
112 + "Version":"1",
113 + "Workload":"SharePoint",
114 + "ClientIP":"xxx.xx.x.xxx",
115 + "ObjectId":"https://xxxx.sharepoint.com/SitePages/xxxx.aspx",
116 + "UserId":"xxx.xxx@xxx.com",
117 + "CorrelationId":"0b50d09f-e0f2-2000-d9c7-a5b468efc712",
118 + "DoNotDistributeEvent":"true",
119 + "EventSource":"SharePoint",
120 + "ItemType":"File",
121 + "ListId":"xxxx-xxxx-xxxx-xxxx-xxxx",
122 + "ListItemUniqueId":"xxxx-xxxx-xxxx-xxxx-xxxx",
123 + "Site":"xxxx-xxxx-xxxx-xxxx-xxxx",
124 + "UserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36",
125 + "WebId":"xxxx-xxxx-xxxx-xxxx-xxxx",
126 + "SourceFileExtension":"aspx",
127 + "SiteUrl":"https://xxxx.sharepoint.com/",
128 + "SourceFileName":"xxxx.aspx",
129 + "SourceRelativeUrl":"SitePages"
130 + }
131 +```
132 +
133 +### Wazuh Rules
134 +
135 +Wazuh provides a series of rules to catch different events on Office365, for this example we will take the rule id ``91537`` which detects a ``Office 365: SharePoint file operation events.`` action.
136 +
137 +```html
138 + <rule id="91537" level="3">
139 + <if_sid>91532</if_sid>
140 + <field name="office365.RecordType" type="osregex">^6$</field>
141 + <description>Office 365: SharePoint file operation events.</description>
142 + <options>no_full_log</options>
143 + <group>SharePointFileOperation</group>
144 + </rule>
145 +```
146 +
147 +If Wazuh successfully connects to Office 365 API, the events raised above will trigger these rules and cause an alert like this:
148 +
149 +```json
150 + {
151 + "timestamp":"2021-06-09T22:12:54.301+0000",
152 + "rule":{
153 + "level":3,
154 + "description":"Office 365: SharePoint file operation events.",
155 + "id":"91537",
156 + "firedtimes":2,
157 + "mail":false,
158 + "groups":["office365","SharePointFileOperation"]
159 + },
160 + "agent":{
161 + "id":"001",
162 + "name":"ubuntu-bionic"
163 + },
164 + "manager":{
165 + "name":"ubuntu-bionic"
166 + },
167 + "id":"1623276774.47272",
168 + "decoder":{
169 + "name":"json"
170 + },
171 + "data":{
172 + "integration":"office365",
173 + "office365":{
174 + "CreationTime":"2021-06-09T22:10:45",
175 + "Id":"xxxx-xxxx-xxxx-xxxx-xxxx",
176 + "Operation":"FileModified",
177 + "OrganizationId":"xxxx-xxxx-xxxx-xxxx-xxxx",
178 + "RecordType":"6",
179 + "UserKey":"i:xx.f|membership|xxxx@live.com",
180 + "UserType":"0",
181 + "Version":"1",
182 + "Workload":"SharePoint",
183 + "ClientIP":"xxx.xx.x.xxx",
184 + "ObjectId":"https://xxxx.sharepoint.com/SitePages/xxxx.aspx",
185 + "UserId":"xxx.xxx@xxx.com",
186 + "CorrelationId":"0b50d09f-e0f2-2000-d9c7-a5b468efc712",
187 + "DoNotDistributeEvent":"true",
188 + "EventSource":"SharePoint",
189 + "ItemType":"File",
190 + "ListId":"xxxx-xxxx-xxxx-xxxx-xxxx",
191 + "ListItemUniqueId":"xxxx-xxxx-xxxx-xxxx-xxxx",
192 + "Site":"xxxx-xxxx-xxxx-xxxx-xxxx",
193 + "UserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36",
194 + "WebId":"xxxx-xxxx-xxxx-xxxx-xxxx",
195 + "SourceFileExtension":"aspx",
196 + "SiteUrl":"https://xxxx.sharepoint.com/",
197 + "SourceFileName":"xxxx.aspx",
198 + "SourceRelativeUrl":"SitePages",
199 + "Subscription":"Audit.SharePoint"
200 + }
201 + },
202 + "location":"office365"
203 + }
204 +```
205 +
206 +For further information, please refer to the [Modules](https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/settings.html#modules)
backend/app/integrations/mimecast/checkpoint/mimecast_00002.checkpoint new
+1
@@ -0,0 +1 @@
1 +eNo9jl1vgjAYRv_Le02yVoFSk13oVIwfbA6WZctusL4tRbSGVhTM_vvYLnb9nHPy3MGiuNSo9zCCW6wHtDywaJ5ytXBx-fpskhfTvedu06qlFGSbNKvV9evBdaz8cJ-5vrVTNinkshF0suEizbSoqp3aDc5r5MM17_aFTKLZXB_iWahst8DpNet0sX0ED4yUFh2MqAdW47Ey6vcG9zmjLOBDD0SNucNMH7GHGAl8nzAWhn70L7j23G_EgwZrq83pL5YLYS6nPgxPb-mYUjYOCHz_ADEZS48
\ No newline at end of file
backend/app/integrations/mimecast/routes/mimecast.py new
+95
@@ -0,0 +1,95 @@
1 +from fastapi import APIRouter
2 +from fastapi import Depends
3 +from fastapi import Security
4 +from loguru import logger
5 +from sqlalchemy.ext.asyncio import AsyncSession
6 +from fastapi import HTTPException
7 +
8 +from app.auth.utils import AuthHandler
9 +from app.db.db_session import get_db
10 +from app.integrations.mimecast.schema.mimecast import MimecastRequest, MimecastResponse, MimecastAuthKeys
11 +from app.integrations.alert_escalation.services.general_alert import create_alert
12 +from app.integrations.routes import get_customer_integrations_by_customer_code, find_customer_integration
13 +from app.integrations.schema import CustomerIntegrationsResponse, CustomerIntegrations
14 +from app.integrations.mimecast.services.mimecast import invoke_mimecast
15 +from typing import Dict
16 +
17 +integration_mimecast_router = APIRouter()
18 +
19 +async def get_customer_integration_response(customer_code: str, session: AsyncSession) -> CustomerIntegrationsResponse:
20 + """
21 + Retrieves the integration response for a customer.
22 +
23 + Args:
24 + customer_code (str): The code of the customer.
25 + session (AsyncSession): The async session object for database operations.
26 +
27 + Returns:
28 + CustomerIntegrationsResponse: The integration response for the customer.
29 +
30 + Raises:
31 + HTTPException: If the customer integration settings are not found.
32 + """
33 + customer_integration_response = await get_customer_integrations_by_customer_code(customer_code, session)
34 + if customer_integration_response.available_integrations == []:
35 + raise HTTPException(status_code=404, detail="Customer integration settings not found.")
36 + return customer_integration_response
37 +
38 +def extract_mimecast_auth_keys(customer_integration: CustomerIntegrations) -> Dict[str, str]:
39 + """
40 + Extracts the authentication keys for Office365 integration from the given customer integration.
41 +
42 + Args:
43 + customer_integration (CustomerIntegrations): The customer integration object.
44 +
45 + Returns:
46 + Dict[str, str]: A dictionary containing the authentication keys for Office365 integration.
47 +
48 + Raises:
49 + HTTPException: If no authentication keys are found for Office365 integration.
50 + """
51 + mimecast_auth_keys = {}
52 + try:
53 + for subscription in customer_integration.integration_subscriptions:
54 + if subscription.integration_service.service_name == "Mimecast":
55 + for auth_key in subscription.integration_auth_keys:
56 + mimecast_auth_keys[auth_key.auth_key_name] = auth_key.auth_value
57 + if not mimecast_auth_keys:
58 + raise HTTPException(status_code=404, detail="No auth keys found for Mimecast integration. Please create auth keys for Mimecast integration.")
59 + except Exception as e:
60 + raise HTTPException(status_code=404, detail="No auth keys found for Mimecast integration. Please create auth keys for Mimecast integration.")
61 + return mimecast_auth_keys
62 +
63 +
64 +@integration_mimecast_router.post(
65 + "/invoke",
66 + response_model=MimecastResponse,
67 + description="Invoke a mimecast integration.",
68 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
69 +)
70 +async def invoke_mimecast_route(mimecast_request: MimecastRequest, session: AsyncSession = Depends(get_db)) -> MimecastResponse:
71 + """
72 + Provisions Office365 integration for a customer.
73 +
74 + Args:
75 + provision_office365_request (ProvisionOffice365Request): The request object containing the necessary information for provisioning.
76 + session (AsyncSession, optional): The database session. Defaults to Depends(get_db).
77 +
78 + Returns:
79 + ProvisionOffice365Response: The response object containing the result of the provisioning.
80 + """
81 + customer_integration_response = await get_customer_integration_response(mimecast_request.customer_code, session)
82 +
83 + customer_integration = await find_customer_integration(mimecast_request.customer_code, mimecast_request.integration_name, customer_integration_response)
84 +
85 + mimecast_auth_keys = extract_mimecast_auth_keys(customer_integration)
86 +
87 + auth_keys = MimecastAuthKeys(**mimecast_auth_keys)
88 +
89 + return await invoke_mimecast(mimecast_request, auth_keys)
90 +
91 +
92 +
93 +
94 +
95 +
backend/app/integrations/mimecast/routes/provision.py new
+37
@@ -0,0 +1,37 @@
1 +from fastapi import APIRouter
2 +from fastapi import Depends
3 +from fastapi import Security
4 +from loguru import logger
5 +from sqlalchemy.ext.asyncio import AsyncSession
6 +from fastapi import HTTPException
7 +from app.schedulers.models.scheduler import JobMetadata, CreateSchedulerRequest
8 +from app.auth.utils import AuthHandler
9 +from app.db.db_session import get_db
10 +from app.schedulers.services.invoke_mimecast import invoke_mimecast_integration
11 +from app.integrations.mimecast.schema.mimecast import MimecastScheduledResponse
12 +from app.schedulers.scheduler import add_scheduler_jobs
13 +
14 +integration_mimecast_scheduler_router = APIRouter()
15 +
16 +
17 +@integration_mimecast_scheduler_router.post(
18 + "/invoke/scheduler",
19 + description="Invoke a mimecast integration.",
20 +)
21 +async def invoke_mimecast_schedule_create(time_interval: int) -> MimecastScheduledResponse:
22 + """
23 + Provisions Office365 integration for a customer.
24 +
25 + Args:
26 + provision_office365_request (ProvisionOffice365Request): The request object containing the necessary information for provisioning.
27 + session (AsyncSession, optional): The database session. Defaults to Depends(get_db).
28 +
29 + Returns:
30 + ProvisionOffice365Response: The response object containing the result of the provisioning.
31 + """
32 + await add_scheduler_jobs(CreateSchedulerRequest(function_name="invoke_mimecast_integration", time_interval=time_interval, job_id="invoke_mimecast_integration"))
33 + return MimecastScheduledResponse(success=True, message="Mimecast integration scheduled.")
34 +
35 +
36 +
37 +
backend/app/integrations/mimecast/schema/mimecast.py new
+107
@@ -0,0 +1,107 @@
1 +from enum import Enum
2 +from typing import Any
3 +from typing import Dict
4 +from typing import List
5 +from typing import Optional
6 +
7 +from pydantic import BaseModel
8 +from pydantic import Extra, HttpUrl
9 +from pydantic import Field, root_validator
10 +
11 +from enum import Enum
12 +
13 +class PipelineRuleTitles(Enum):
14 + WAZUH_INFO = "WAZUH CREATE FIELD SYSLOG LEVEL - INFO"
15 + WAZUH_WARNING = "WAZUH CREATE FIELD SYSLOG LEVEL - WARNING"
16 + WAZUH_NOTICE = "WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE"
17 + WAZUH_ALERT = "WAZUH CREATE FIELD SYSLOG LEVEL - ALERT"
18 + OFFICE365_TIMESTAMP = "Office365 Timestamp - UTC"
19 +
20 +class PipelineTitles(Enum):
21 + OFFICE365 = "OFFICE365 PROCESSING PIPELINE"
22 +
23 +class MimecastRequest(BaseModel):
24 + customer_code: str = Field(
25 + ...,
26 + description="The customer code.",
27 + examples=["00002"],
28 + )
29 + integration_name: str = Field(
30 + "Mimecast",
31 + description="The integration name.",
32 + examples=["Office365"],
33 + )
34 +
35 + # # ensure the `integration_name` is always set to "Office365"
36 + # @root_validator(pre=True)
37 + # def set_integration_name(cls, values: Dict[str, Any]) -> Dict[str, Any]:
38 + # values["integration_name"] = "Office365"
39 + # return values
40 +
41 +
42 +class MimecastResponse(BaseModel):
43 + success: bool
44 + message: str
45 +
46 +class MimecastAuthKeys(BaseModel):
47 + APP_ID: str = Field(
48 + ...,
49 + description="YOUR DEVELOPER APPLICATION ID",
50 + examples=["00002"],
51 + )
52 + APP_KEY: str = Field(
53 + ...,
54 + description="YOUR DEVELOPER APPLICATION KEY",
55 + examples=["00002"],
56 + )
57 + EMAIL_ADDRESS: str = Field(
58 + ...,
59 + description="EMAIL ADDRESS OF YOUR ADMINISTRATOR",
60 + examples=["00002"],
61 + )
62 + ACCESS_KEY: str = Field(
63 + ...,
64 + description="ACCESS KEY FOR YOUR ADMINISTRATOR",
65 + examples=["00002"],
66 + )
67 + SECRET_KEY: str = Field(
68 + ...,
69 + description="SECRET KEY FOR YOUR ADMINISTRATOR",
70 + examples=["00002"],
71 + )
72 + URI = str = Field(
73 + '/api/audit/get-siem-logs',
74 + description="URI FOR YOUR API Endpoint",
75 + examples=["/api/audit/get-siem-logs"],
76 + )
77 +
78 +class APIEndpointRegion(BaseModel):
79 + code: str
80 + api: HttpUrl
81 + mpp: HttpUrl
82 + adminConsole: HttpUrl
83 + name: str
84 +
85 +class APIEndpointDataItem(BaseModel):
86 + emailAddress: str
87 + emailToken: str
88 + authenticate: List
89 + region: APIEndpointRegion
90 +
91 +class APIEndpointMeta(BaseModel):
92 + status: int
93 +
94 +class APIEndpointData(BaseModel):
95 + meta: APIEndpointMeta
96 + data: List[APIEndpointDataItem]
97 + fail: List
98 +
99 +class MimecastAPIEndpointResponse(BaseModel):
100 + data: APIEndpointData
101 + success: bool
102 + message: str
103 +
104 +
105 +class MimecastScheduledResponse(BaseModel):
106 + success: bool
107 + message: str
backend/app/integrations/mimecast/services/mimecast.py new
+315
@@ -0,0 +1,315 @@
1 +from fastapi import APIRouter
2 +from fastapi import Depends
3 +from fastapi import Security
4 +import datetime
5 +import os
6 +import json
7 +import hashlib
8 +import hashlib
9 +import io
10 +from zipfile import ZipFile
11 +import shutil
12 +import hmac
13 +import requests
14 +import time
15 +import base64
16 +import aiofiles
17 +from loguru import logger
18 +from sqlalchemy.ext.asyncio import AsyncSession
19 +from fastapi import HTTPException
20 +from app.integrations.utils.event_shipper import event_shipper
21 +from app.integrations.utils.schema import EventShipperPayload
22 +import uuid
23 +
24 +from app.auth.utils import AuthHandler
25 +from app.db.db_session import get_db
26 +from app.integrations.mimecast.schema.mimecast import MimecastRequest, MimecastResponse, MimecastAuthKeys, MimecastAPIEndpointResponse
27 +from app.integrations.alert_escalation.services.general_alert import create_alert
28 +from app.integrations.routes import get_customer_integrations_by_customer_code, find_customer_integration
29 +from app.integrations.schema import CustomerIntegrationsResponse, CustomerIntegrations
30 +from typing import Dict
31 +from app.integrations.utils.collection import send_get_request, send_post_request
32 +
33 +async def get_checkpoint_filename(customer_code: str):
34 + """
35 + Retrieves the checkpoint filename for the Mimecast integration.
36 + If the checkpoint file does not exist, it will be created asynchronously.
37 + """
38 + # Relative path from the current script to the checkpoint directory
39 + checkpoint_directory = os.path.join(os.path.dirname(__file__), '..', 'checkpoint')
40 + checkpoint_filename = os.path.join(checkpoint_directory, f"mimecast_{customer_code}.checkpoint")
41 +
42 + # Normalize the path to remove relative path components
43 + checkpoint_filename = os.path.normpath(checkpoint_filename)
44 +
45 + # Create the checkpoint directory if it does not exist
46 + if not os.path.exists(checkpoint_directory):
47 + os.makedirs(checkpoint_directory)
48 +
49 + # Create the checkpoint file if it does not exist
50 + if not os.path.exists(checkpoint_filename):
51 + async with aiofiles.open(checkpoint_filename, "w") as f:
52 + await f.write("")
53 +
54 + return checkpoint_filename
55 +
56 +async def get_log_file_path(customer_code: str):
57 + """
58 + Retrieves the log file path for the Mimecast integration and customer.
59 +
60 + Args:
61 + customer_code (str): The code of the customer.
62 +
63 + Returns:
64 + str: The log file path for the Mimecast integration and customer.
65 + """
66 + # Relative path from the current script to the log directory
67 + log_directory = os.path.join(os.path.dirname(__file__), '..', 'logs')
68 + # Normalize the path to remove relative path components
69 + log_directory = os.path.abspath(log_directory)
70 +
71 + # Create a directory for the customer if it does not exist
72 + customer_log_directory = os.path.join(log_directory, customer_code)
73 + if not os.path.exists(customer_log_directory):
74 + os.makedirs(customer_log_directory)
75 +
76 + # Return the customer directory
77 + return customer_log_directory
78 +
79 +
80 +async def read_file(filename: str):
81 + """
82 + Reads the contents of the given file.
83 + """
84 + async with aiofiles.open(filename, "r") as f:
85 + return await f.read()
86 +
87 +async def get_hdr_date():
88 + return datetime.datetime.utcnow().strftime("%a, %d %b %Y %H:%M:%S UTC")
89 +
90 +async def get_base_url(mimecast_auth_keys: MimecastAuthKeys) -> MimecastAPIEndpointResponse:
91 + """
92 + Retrieves the base URL for the Mimecast integration.
93 + """
94 + post_body = dict()
95 + post_body["data"] = [{}]
96 + post_body["data"][0]["emailAddress"] = mimecast_auth_keys.EMAIL_ADDRESS
97 +
98 + # Create variables required for request headers
99 + request_id = str(uuid.uuid4())
100 + request_date = await get_hdr_date()
101 + headers = {
102 + "x-mc-app-id": mimecast_auth_keys.APP_ID,
103 + "x-mc-req-id": request_id,
104 + "x-mc-date": request_date,
105 + }
106 + try:
107 + response = await send_post_request(
108 + endpoint="https://api.mimecast.com/api/login/discover-authentication",
109 + headers=headers,
110 + data=post_body,
111 + )
112 + if response['success'] == True:
113 + logger.info(f"Successfully retrieved base URL for Mimecast integration. Response: {response}")
114 + return MimecastAPIEndpointResponse(**response)
115 + else:
116 + logger.error(f"Unable to retrieve base URL for Mimecast integration. Response: {response}")
117 + raise HTTPException(status_code=400, detail="Unable to retrieve base URL for Mimecast integration.")
118 + except Exception as e:
119 + logger.error(f"Unable to retrieve base URL for Mimecast integration. Exception: {e}")
120 + raise HTTPException(status_code=400, detail="Unable to retrieve base URL for Mimecast integration.")
121 +
122 +async def get_mta_siem_logs(checkpoint_filename: str, base_url: str, auth_keys: MimecastAuthKeys):
123 + """
124 + Retrieves the MTA SIEM logs from the Mimecast integration.
125 + """
126 + # Build post body for request
127 + post_body = dict()
128 + post_body["data"] = [{}]
129 + post_body["data"][0]["type"] = "MTA"
130 + post_body["data"][0]["compress"] = True
131 + post_body["data"][0]["token"] = await read_file(checkpoint_filename)
132 +
133 +
134 + # Create variables required for request headers
135 + request_id = str(uuid.uuid4())
136 + request_date = await get_hdr_date()
137 +
138 + unsigned_auth_header = "{date}:{req_id}:{uri}:{app_key}".format(
139 + date=request_date,
140 + req_id=request_id,
141 + uri=auth_keys.URI,
142 + app_key=auth_keys.APP_KEY,
143 + )
144 + hmac_sha1 = hmac.new(
145 + base64.b64decode(auth_keys.SECRET_KEY),
146 + unsigned_auth_header.encode(),
147 + digestmod=hashlib.sha1,
148 + ).digest()
149 + sig = base64.encodebytes(hmac_sha1).rstrip()
150 + headers = {
151 + "Authorization": "MC " + auth_keys.ACCESS_KEY + ":" + sig.decode(),
152 + "x-mc-app-id": auth_keys.APP_ID,
153 + "x-mc-date": request_date,
154 + "x-mc-req-id": request_id,
155 + "Content-Type": "application/json",
156 + }
157 + try:
158 + response = requests.post(
159 + url=base_url + auth_keys.URI,
160 + headers=headers,
161 + data=json.dumps(post_body),
162 + )
163 + return response.content, response.headers
164 + except Exception as e:
165 + logger.error(f"Unable to retrieve MTA SIEM logs from Mimecast integration. Exception: {e}")
166 + raise HTTPException(status_code=400, detail="Unable to retrieve MTA SIEM logs from Mimecast integration.")
167 +
168 +async def process_response(response, checkpoint_filename: str, log_file_path: str):
169 + """
170 + Processes the response body from the Mimecast integration.
171 + """
172 + if response != "error":
173 + resp_body = response[0]
174 + resp_headers = response[1]
175 + content_type = resp_headers["Content-Type"]
176 +
177 + # End if response is JSON as there is no log file to download
178 + if content_type == "application/json":
179 + logger.info("No more logs available")
180 + return False
181 + # Process log file
182 + elif content_type == "application/octet-stream":
183 + logger.info("Content-Type: application/octet-stream")
184 + file_name = resp_headers["Content-Disposition"].split('="')
185 + file_name = file_name[1][:-1]
186 +
187 + # Save mc-siem-token page token to check point directory
188 + await write_checkpoint_file(checkpoint_filename, resp_headers["mc-siem-token"])
189 + log_filename = os.path.join(log_file_path, file_name)
190 + await write_log_file(log_filename, resp_body)
191 + return None
192 +
193 +async def write_checkpoint_file(filename: str, data: str):
194 + """
195 + Writes the given data to the given file.
196 + """
197 + async with aiofiles.open(filename, "w") as f:
198 + await f.write(data)
199 +
200 +async def write_log_file(filename: str, resp_body):
201 + """
202 + Writes the given data to the given file.
203 + """
204 + if ".zip" in filename:
205 + try:
206 + byte_content = io.BytesIO(resp_body)
207 + zip_file = ZipFile(byte_content)
208 + zip_file.extractall(filename)
209 + except Exception as e:
210 + logger.error(f"Unable to extract zip file. Exception: {e}")
211 + raise HTTPException(status_code=400, detail="Unable to extract zip file.")
212 + else:
213 + async with aiofiles.open(filename, "w") as f:
214 + await f.write(resp_body)
215 +
216 +async def process_log_file(filename: str, filename2: str, log_file_path: str, customer_code: str):
217 + """
218 + Process a log file by reading its contents and shipping events.
219 + """
220 + log_file_full_path = build_log_file_path(log_file_path, filename, filename2)
221 + file_creation_time = get_file_creation_time(log_file_full_path)
222 + logger.info(f"File creation time: {file_creation_time} and filename: {filename2}")
223 +
224 + await read_and_ship_log_file(log_file_full_path, customer_code)
225 + await safely_delete_file(log_file_full_path)
226 +
227 +
228 +def build_log_file_path(log_file_path: str, filename: str, filename2: str) -> str:
229 + """
230 + Constructs the full path for a log file.
231 + """
232 + return os.path.join(log_file_path, filename, filename2)
233 +
234 +
235 +def get_file_creation_time(file_path: str) -> str:
236 + """
237 + Returns the creation time of a file.
238 + """
239 + return time.ctime(os.path.getctime(file_path))
240 +
241 +
242 +async def read_and_ship_log_file(file_path: str, customer_code: str):
243 + """
244 + Reads a log file line by line, converts each line to JSON, and ships the event.
245 + """
246 + with open(file_path, 'r', encoding='utf-8') as file:
247 + for line in file:
248 + log_entry = convert_to_json(line)
249 + message = EventShipperPayload(
250 + customer_code=customer_code,
251 + integration="mimecast",
252 + version="1.0",
253 + **log_entry,
254 + )
255 + await event_shipper(message)
256 +
257 +
258 +async def safely_delete_file(file_path: str):
259 + """
260 + Attempts to delete a file and logs the outcome.
261 + """
262 + try:
263 + os.remove(file_path)
264 + logger.info(f"Successfully deleted the file: {file_path}")
265 + except OSError as e:
266 + logger.error(f"Error: {e.strerror}. File: {file_path}")
267 +
268 +
269 +def convert_to_json(log_line: str) -> dict:
270 + """
271 + Converts a log line to a JSON object.
272 + """
273 + log_dict = {}
274 + for pair in log_line.split('|'):
275 + if '=' in pair:
276 + key, value = pair.split('=', 1)
277 + log_dict[key.strip()] = value.strip()
278 + return log_dict
279 +
280 +
281 +async def delete_log_directory(log_file_path: str):
282 + """
283 + Deletes the log directory for the given customer.
284 + """
285 + try:
286 + shutil.rmtree(log_file_path)
287 + logger.info(f"Successfully deleted the directory: {log_file_path}")
288 + except OSError as e:
289 + raise HTTPException(status_code=400, detail=f"Error: {e.strerror}. Directory: {log_file_path}")
290 +
291 +async def invoke_mimecast(mimecast_request: MimecastRequest, auth_keys: MimecastAuthKeys) -> MimecastResponse:
292 + """
293 + Invokes the Mimecast integration.
294 + """
295 + mimecast_base_url = await get_base_url(auth_keys)
296 + try:
297 + logger.info(f"mimecast_base_url: {mimecast_base_url.data.data[0].region.api}")
298 + except Exception as e:
299 + logger.error(f"Unable to retrieve base URL for Mimecast integration. Exception: {e}")
300 + raise HTTPException(status_code=400, detail="Unable to retrieve base URL for Mimecast integration.")
301 + checkpoint_filename = await get_checkpoint_filename(mimecast_request.customer_code)
302 + log_file_path = await get_log_file_path(mimecast_request.customer_code)
303 + response = await get_mta_siem_logs(checkpoint_filename, mimecast_base_url.data.data[0].region.api, auth_keys)
304 +
305 + await process_response(response, checkpoint_filename, log_file_path)
306 + for filename in os.listdir(log_file_path):
307 + if os.path.isdir(os.path.join(log_file_path, filename)):
308 + for filename2 in os.listdir(os.path.join(log_file_path, filename)):
309 + await process_log_file(filename, filename2, log_file_path, customer_code=mimecast_request.customer_code)
310 + logger.info(f"Log file path: {log_file_path}")
311 + else:
312 + await process_log_file(filename, filename2, log_file_path)
313 +
314 + await delete_log_directory(log_file_path)
315 + return MimecastResponse(success=True, message="Successfully invoked Mimecast integration.")
backend/app/integrations/models/customer_integration_settings.py
+22 -6
@@ -1,17 +1,33 @@
1 from typing import List, Optional
2 from sqlmodel import Field, Relationship, SQLModel
3 +from sqlalchemy import Text
4
5 class AvailableIntegrations(SQLModel, table=True):
6 __tablename__ = "available_integrations"
7 id: Optional[int] = Field(default=None, primary_key=True)
8 integration_name: str = Field(max_length=255, nullable=False)
9 description: str = Field(max_length=1024)
10 + integration_details: str = Field(sa_column=Text)
11 + # Relationships
12 + auth_keys: List["AvailableIntegrationsAuthKeys"] = Relationship(back_populates="integration")
13 +
14 +class AvailableIntegrationsAuthKeys(SQLModel, table=True):
15 + __tablename__ = "available_integrations_auth_keys"
16 + id: Optional[int] = Field(default=None, primary_key=True)
17 + integration_id: int = Field(default=None, foreign_key="available_integrations.id")
18 + integration_name: str = Field(max_length=255, nullable=False)
19 + auth_key_name: str = Field(max_length=255, nullable=False)
20 + # Relationships
21 + integration: "AvailableIntegrations" = Relationship(back_populates="auth_keys")
22
23 class CustomerIntegrations(SQLModel, table=True):
24 __tablename__ = "customer_integrations"
25 id: Optional[int] = Field(default=None, primary_key=True)
26 customer_code: str = Field(max_length=50, nullable=False)
27 customer_name: str = Field(max_length=255, nullable=False)
28 + integration_service_id: Optional[int] = Field(default=None, nullable=False)
29 + integration_service_name: str = Field(max_length=255, nullable=False)
30 + deployed: bool = Field(default=False)
31 # Relationships
32 integration_subscriptions: List["IntegrationSubscription"] = Relationship(back_populates="customer_integrations")
33
@@ -32,7 +48,7 @@ class IntegrationSubscription(SQLModel, table=True):
48 # Relationships
49 customer_integrations: "CustomerIntegrations" = Relationship(back_populates="integration_subscriptions")
50 integration_service: "IntegrationService" = Relationship(back_populates="integration_subscriptions")
35 - integration_metadata: List["IntegrationMetadata"] = Relationship(back_populates="integration_subscription") # Moved here
51 + integration_auth_keys: List["IntegrationAuthKeys"] = Relationship(back_populates="integration_subscription") # Moved here
52
53 class IntegrationConfig(SQLModel, table=True):
54 __tablename__ = "integration_configs"
@@ -43,12 +59,12 @@ class IntegrationConfig(SQLModel, table=True):
59 # Relationships
60 integration_service: "IntegrationService" = Relationship(back_populates="configs")
61
46 -class IntegrationMetadata(SQLModel, table=True):
47 - __tablename__ = "integration_metadata"
62 +class IntegrationAuthKeys(SQLModel, table=True):
63 + __tablename__ = "integration_auth_keys"
64 id: Optional[int] = Field(default=None, primary_key=True)
65 subscription_id: int = Field(default=None, foreign_key="integration_subscriptions.id")
50 - metadata_key: str = Field(max_length=255) # e.g., 'credentials', 'rate_limit'
51 - metadata_value: str = Field(max_length=1024) # e.g., JSON/encrypted credentials
66 + auth_key_name: str = Field(max_length=255) # e.g., 'credentials', 'rate_limit'
67 + auth_value: str = Field(max_length=1024) # e.g., JSON/encrypted credentials
68 # Relationships
53 - integration_subscription: "IntegrationSubscription" = Relationship(back_populates="integration_metadata") # Adjusted relationship
69 + integration_subscription: "IntegrationSubscription" = Relationship(back_populates="integration_auth_keys") # Adjusted relationship
70
backend/app/integrations/office365/routes/provision.py new
+91
@@ -0,0 +1,91 @@
1 +from fastapi import APIRouter
2 +from fastapi import Depends
3 +from fastapi import Security
4 +from loguru import logger
5 +from sqlalchemy.ext.asyncio import AsyncSession
6 +from fastapi import HTTPException
7 +
8 +from app.auth.utils import AuthHandler
9 +from app.db.db_session import get_db
10 +from app.integrations.office365.schema.provision import ProvisionOffice365Request
11 +from app.integrations.office365.schema.provision import ProvisionOffice365Response, ProvisionOffice365AuthKeys
12 +from app.integrations.alert_escalation.services.general_alert import create_alert
13 +from app.integrations.routes import get_customer_integrations_by_customer_code, find_customer_integration
14 +from app.integrations.schema import CustomerIntegrationsResponse, CustomerIntegrations
15 +from app.integrations.office365.services.provision import provision_office365
16 +from typing import Dict
17 +
18 +integration_office365_router = APIRouter()
19 +
20 +async def get_customer_integration_response(customer_code: str, session: AsyncSession) -> CustomerIntegrationsResponse:
21 + """
22 + Retrieves the integration response for a customer.
23 +
24 + Args:
25 + customer_code (str): The code of the customer.
26 + session (AsyncSession): The async session object for database operations.
27 +
28 + Returns:
29 + CustomerIntegrationsResponse: The integration response for the customer.
30 +
31 + Raises:
32 + HTTPException: If the customer integration settings are not found.
33 + """
34 + customer_integration_response = await get_customer_integrations_by_customer_code(customer_code, session)
35 + if customer_integration_response.available_integrations == []:
36 + raise HTTPException(status_code=404, detail="Customer integration settings not found.")
37 + return customer_integration_response
38 +
39 +def extract_office365_auth_keys(customer_integration: CustomerIntegrations) -> Dict[str, str]:
40 + """
41 + Extracts the authentication keys for Office365 integration from the given customer integration.
42 +
43 + Args:
44 + customer_integration (CustomerIntegrations): The customer integration object.
45 +
46 + Returns:
47 + Dict[str, str]: A dictionary containing the authentication keys for Office365 integration.
48 +
49 + Raises:
50 + HTTPException: If no authentication keys are found for Office365 integration.
51 + """
52 + office365_auth_keys = {}
53 + for subscription in customer_integration.integration_subscriptions:
54 + if subscription.integration_service.service_name == "Office365":
55 + for auth_key in subscription.integration_auth_keys:
56 + office365_auth_keys[auth_key.auth_key_name] = auth_key.auth_value
57 + if not office365_auth_keys:
58 + raise HTTPException(status_code=404, detail="No auth keys found for Office365 integration. Please create auth keys for Office365 integration.")
59 + return office365_auth_keys
60 +
61 +
62 +@integration_office365_router.post(
63 + "/provision",
64 + response_model=ProvisionOffice365Response,
65 + description="Provision Office365 integration for a customer.",
66 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
67 +)
68 +async def provision_office365_route(provision_office365_request: ProvisionOffice365Request, session: AsyncSession = Depends(get_db)) -> ProvisionOffice365Response:
69 + """
70 + Provisions Office365 integration for a customer.
71 +
72 + Args:
73 + provision_office365_request (ProvisionOffice365Request): The request object containing the necessary information for provisioning.
74 + session (AsyncSession, optional): The database session. Defaults to Depends(get_db).
75 +
76 + Returns:
77 + ProvisionOffice365Response: The response object containing the result of the provisioning.
78 + """
79 + customer_integration_response = await get_customer_integration_response(provision_office365_request.customer_code, session)
80 +
81 + customer_integration = await find_customer_integration(provision_office365_request.customer_code, provision_office365_request.integration_name, customer_integration_response)
82 +
83 + office365_auth_keys = extract_office365_auth_keys(customer_integration)
84 +
85 + auth_keys = ProvisionOffice365AuthKeys(**office365_auth_keys)
86 +
87 + return await provision_office365(provision_office365_request.customer_code, auth_keys, session)
88 +
89 +
90 +
91 +
backend/app/integrations/office365/schema/provision.py new
+66
@@ -0,0 +1,66 @@
1 +from enum import Enum
2 +from typing import Any
3 +from typing import Dict
4 +from typing import List
5 +from typing import Optional
6 +
7 +from pydantic import BaseModel
8 +from pydantic import Extra
9 +from pydantic import Field, root_validator
10 +
11 +from enum import Enum
12 +
13 +class PipelineRuleTitles(Enum):
14 + WAZUH_INFO = "WAZUH CREATE FIELD SYSLOG LEVEL - INFO"
15 + WAZUH_WARNING = "WAZUH CREATE FIELD SYSLOG LEVEL - WARNING"
16 + WAZUH_NOTICE = "WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE"
17 + WAZUH_ALERT = "WAZUH CREATE FIELD SYSLOG LEVEL - ALERT"
18 + OFFICE365_TIMESTAMP = "Office365 Timestamp - UTC"
19 +
20 +class PipelineTitles(Enum):
21 + OFFICE365 = "OFFICE365 PROCESSING PIPELINE"
22 +
23 +class ProvisionOffice365Request(BaseModel):
24 + customer_code: str = Field(
25 + ...,
26 + description="The customer code.",
27 + examples=["00002"],
28 + )
29 + integration_name: str = Field(
30 + "Office365",
31 + description="The integration name.",
32 + examples=["Office365"],
33 + )
34 +
35 + # ensure the `integration_name` is always set to "Office365"
36 + @root_validator(pre=True)
37 + def set_integration_name(cls, values: Dict[str, Any]) -> Dict[str, Any]:
38 + values["integration_name"] = "Office365"
39 + return values
40 +
41 +
42 +class ProvisionOffice365Response(BaseModel):
43 + success: bool
44 + message: str
45 +
46 +class ProvisionOffice365AuthKeys(BaseModel):
47 + TENANT_ID: str = Field(
48 + ...,
49 + description="The tenant id.",
50 + examples=["00002"],
51 + )
52 + CLIENT_ID: str = Field(
53 + ...,
54 + description="The client id.",
55 + examples=["00002"],
56 + )
57 + CLIENT_SECRET: str = Field(
58 + ...,
59 + description="The client secret.",
60 + examples=["00002"],
61 + )
62 + API_TYPE: str = Field(
63 + ...,
64 + description="The api type.",
65 + examples=["00002"],
66 + )
backend/app/integrations/office365/services/provision.py new
+744
@@ -0,0 +1,744 @@
1 +from loguru import logger
2 +from datetime import datetime
3 +from sqlalchemy.ext.asyncio import AsyncSession
4 +import requests
5 +import os
6 +from sqlalchemy import update, and_
7 +
8 +
9 +from dotenv import load_dotenv
10 +from app.integrations.models.customer_integration_settings import (
11 + CustomerIntegrations,
12 +)
13 +from app.customer_provisioning.services.grafana import get_opensearch_version
14 +import json
15 +from app.integrations.utils.schema import PraecoAlertConfig, PraecoProvisionAlertResponse
16 +from app.connectors.grafana.utils.universal import create_grafana_client
17 +from app.connectors.wazuh_indexer.utils.universal import create_wazuh_indexer_client
18 +from app.customer_provisioning.schema.grafana import GrafanaDatasource
19 +from app.utils import get_connector_attribute
20 +from app.customer_provisioning.schema.grafana import GrafanaDataSourceCreationResponse
21 +from app.connectors.grafana.services.dashboards import provision_dashboards
22 +from fastapi import HTTPException
23 +from app.customer_provisioning.schema.graylog import StreamCreationResponse
24 +from app.connectors.graylog.schema.pipelines import PipelineRulesResponse
25 +from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineRequest
26 +from app.connectors.graylog.services.management import start_stream
27 +from app.customer_provisioning.schema.graylog import GraylogIndexSetCreationResponse
28 +from app.integrations.office365.schema.provision import ProvisionOffice365Response, ProvisionOffice365AuthKeys, PipelineRuleTitles, PipelineTitles
29 +from app.integrations.alert_escalation.services.general_alert import create_alert
30 +from app.connectors.graylog.services.pipelines import get_pipelines
31 +from app.connectors.graylog.utils.universal import send_post_request
32 +from typing import List
33 +from app.connectors.grafana.schema.dashboards import Office365Dashboard
34 +from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
35 +from app.customer_provisioning.schema.graylog import Office365EventStream
36 +from app.connectors.wazuh_manager.utils.universal import send_get_request
37 +from app.connectors.wazuh_manager.utils.universal import send_put_request
38 +from app.customer_provisioning.schema.graylog import TimeBasedIndexSet
39 +from app.customers.routes.customers import get_customer
40 +from app.connectors.graylog.schema.pipelines import GraylogPipelinesResponse
41 +from app.connectors.graylog.services.pipelines import get_pipeline_rules
42 +from app.connectors.graylog.services.pipelines import create_pipeline_rule, create_pipeline_graylog, get_pipeline_id, connect_stream_to_pipeline
43 +from app.connectors.graylog.schema.pipelines import CreatePipelineRule
44 +from app.connectors.graylog.schema.pipelines import CreatePipeline
45 +from app.customers.routes.customers import get_customer_meta
46 +from app.customer_provisioning.services.grafana import create_grafana_folder
47 +
48 +load_dotenv()
49 +
50 +############ ! WAZUH MANAGER ! ############
51 +async def get_wazuh_configuration() -> str:
52 + """
53 + Retrieves the Wazuh configuration from the manager.
54 +
55 + Returns:
56 + str: The Wazuh configuration data.
57 + """
58 + endpoint = "manager/configuration"
59 + params = {"raw": True}
60 + response = await send_get_request(endpoint=endpoint, params=params)
61 + return response['data']
62 +
63 +async def office365_template_with_api_type(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys) -> str:
64 + """
65 + Returns a configured Office365 template for Wazuh.
66 +
67 + Args:
68 + wazuh_config (str): The current Wazuh configuration.
69 + tenant_id (str): Office365 Tenant ID.
70 + client_id (str): Office365 Client ID.
71 + client_secret (str): Office365 Client Secret.
72 + api_type (str): The type of Office365 API.
73 +
74 + Returns:
75 + str: The Office365 template configured with the given parameters.
76 + """
77 +
78 + template = f"""
79 + <ossec_config>
80 + <office365>
81 + <enabled>yes</enabled>
82 + <interval>1m</interval>
83 + <curl_max_size>5M</curl_max_size>
84 + <only_future_events>yes</only_future_events>
85 + <!-- Office365 Integration For {customer_code} -->
86 + <api_auth>
87 + <tenant_id>{provision_office365_auth_keys.TENANT_ID}</tenant_id>
88 + <client_id>{provision_office365_auth_keys.CLIENT_ID}</client_id>
89 + <client_secret>{provision_office365_auth_keys.CLIENT_SECRET}</client_secret>
90 + <api_type>{provision_office365_auth_keys.API_TYPE}</api_type>
91 + </api_auth>
92 + <subscriptions>
93 + <subscription>Audit.SharePoint</subscription>
94 + <subscription>Audit.Exchange</subscription>
95 + <subscription>DLP.ALL</subscription>
96 + <subscription>Audit.General</subscription>
97 + <subscription>Audit.AzureActiveDirectory</subscription>
98 + </subscriptions>
99 + </office365>
100 + </ossec_config>
101 + """
102 +
103 + return template
104 +
105 +async def office365_template(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys) -> str:
106 + """
107 + Returns a configured Office365 template for Wazuh.
108 +
109 + Args:
110 + wazuh_config (str): The current Wazuh configuration.
111 + tenant_id (str): Office365 Tenant ID.
112 + client_id (str): Office365 Client ID.
113 + client_secret (str): Office365 Client Secret.
114 + api_type (str): The type of Office365 API.
115 +
116 + Returns:
117 + str: The Office365 template configured with the given parameters.
118 + """
119 +
120 + template = f"""
121 + <ossec_config>
122 + <office365>
123 + <enabled>yes</enabled>
124 + <interval>1m</interval>
125 + <curl_max_size>5M</curl_max_size>
126 + <only_future_events>yes</only_future_events>
127 + <!-- Office365 Integration For {customer_code} -->
128 + <api_auth>
129 + <tenant_id>{provision_office365_auth_keys.TENANT_ID}</tenant_id>
130 + <client_id>{provision_office365_auth_keys.CLIENT_ID}</client_id>
131 + <client_secret>{provision_office365_auth_keys.CLIENT_SECRET}</client_secret>
132 + </api_auth>
133 + <subscriptions>
134 + <subscription>Audit.SharePoint</subscription>
135 + <subscription>Audit.Exchange</subscription>
136 + <subscription>DLP.ALL</subscription>
137 + <subscription>Audit.General</subscription>
138 + <subscription>Audit.AzureActiveDirectory</subscription>
139 + </subscriptions>
140 + </office365>
141 + </ossec_config>
142 + """
143 +
144 + return template
145 +
146 +async def append_office365_template(wazuh_config: str, office365_template: str) -> str:
147 + """
148 + Appends the Office365 template to the Wazuh configuration.
149 +
150 + Args:
151 + wazuh_config (str): The current Wazuh configuration.
152 + office365_template (str): The Office365 template to append.
153 +
154 + Returns:
155 + str: The Wazuh configuration with the Office365 template appended.
156 + """
157 +
158 + return wazuh_config + office365_template
159 +
160 +async def update_wazuh_configuration(wazuh_config: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys) -> None:
161 + """
162 + Updates the Wazuh configuration. If it fails, remove the <api_type> tag and retry.
163 +
164 + Args:
165 + wazuh_config (str): The Wazuh configuration in string format.
166 + provision_office365_auth_keys (ProvisionOffice365AuthKeys): The Office365 authentication keys.
167 + """
168 + endpoint = "manager/configuration"
169 + data = wazuh_config.encode('utf-8')
170 +
171 + try:
172 + # First attempt to update configuration
173 + response = await send_put_request(endpoint=endpoint, data=data, binary_data=True)
174 + if response.get('success') and response['data'].get('error') == 0:
175 + logger.info("Wazuh configuration updated successfully.")
176 + return
177 + else:
178 + logger.error("Failed to update Wazuh configuration. Error: {}".format(response))
179 +
180 + except Exception as e:
181 + logger.error(f"Exception occurred during Wazuh configuration update: {e}")
182 +
183 + # Remove <api_type> tag and retry
184 + api_type_tag = f"<api_type>{provision_office365_auth_keys.API_TYPE}</api_type>"
185 + modified_wazuh_config = wazuh_config.replace(api_type_tag, "")
186 + data = modified_wazuh_config.encode('utf-8')
187 +
188 + try:
189 + response = await send_put_request(endpoint=endpoint, data=data, binary_data=True)
190 + if response.get('success') and response['data'].get('error') == 0:
191 + logger.info("Wazuh configuration updated successfully after removing <api_type> tag.")
192 + else:
193 + logger.error("Failed to update Wazuh configuration after removing <api_type> tag. Error: {}".format(response))
194 +
195 + except Exception as e:
196 + logger.error(f"Exception occurred during retry of Wazuh configuration update: {e}")
197 + raise HTTPException(status_code=500, detail="Failed to update Wazuh configuration.")
198 +
199 +
200 +async def check_if_office365_is_already_provisioned(customer_code: str, wazuh_config: str) -> bool:
201 + """
202 + If the string "Office365 Integration For {customer_code}" is found in the Wazuh configuration, return True.
203 +
204 + Args:
205 + customer_code (str): The customer code.
206 + wazuh_config (str): The Wazuh configuration in string format.
207 +
208 + Returns:
209 + bool: True if the Office365 integration is already provisioned, False otherwise.
210 + """
211 + if f"Office365 Integration For {customer_code}" in wazuh_config:
212 + raise HTTPException(status_code=400, detail=f"Office365 integration already provisioned for customer {customer_code}.")
213 +
214 +
215 +async def restart_wazuh_manager() -> None:
216 + """
217 + Restarts the Wazuh manager service.
218 + """
219 + logger.info("Restarting Wazuh manager service.")
220 + await send_put_request(endpoint="manager/restart", data=None)
221 +
222 +
223 +################## ! GRAYLOG ! ##################
224 +
225 +async def build_index_set_config(customer_code: str, session: AsyncSession) -> TimeBasedIndexSet:
226 + """
227 + Build the configuration for a time-based index set.
228 +
229 + Args:
230 + request (ProvisionNewCustomer): The request object containing customer information.
231 +
232 + Returns:
233 + TimeBasedIndexSet: The configured time-based index set.
234 + """
235 + return TimeBasedIndexSet(
236 + title=f"Office365 - {(await get_customer(customer_code, session)).customer.customer_name}",
237 + description=f"Office365 - {customer_code}",
238 + index_prefix=f"office365_{customer_code}",
239 + rotation_strategy_class="org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategy",
240 + rotation_strategy={
241 + "type": "org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategyConfig",
242 + "rotation_period": "P1D",
243 + "rotate_empty_index_set": False,
244 + "max_rotation_period": None,
245 + },
246 + retention_strategy_class="org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy",
247 + retention_strategy={
248 + "type": "org.graylog2.indexer.retention.strategies.DeletionRetentionStrategyConfig",
249 + "max_number_of_indices": 30,
250 + },
251 + creation_date=datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
252 + index_analyzer="standard",
253 + shards=1,
254 + replicas=0,
255 + index_optimization_max_num_segments=1,
256 + index_optimization_disabled=False,
257 + writable=True,
258 + field_type_refresh_interval=5000,
259 + )
260 +
261 +# Function to send the POST request and handle the response
262 +async def send_index_set_creation_request(index_set: TimeBasedIndexSet) -> GraylogIndexSetCreationResponse:
263 + """
264 + Sends a request to create an index set in Graylog.
265 +
266 + Args:
267 + index_set (TimeBasedIndexSet): The index set to be created.
268 +
269 + Returns:
270 + GraylogIndexSetCreationResponse: The response from Graylog after creating the index set.
271 + """
272 + json_index_set = json.dumps(index_set.dict())
273 + logger.info(f"json_index_set set: {json_index_set}")
274 + response_json = await send_post_request(endpoint="/api/system/indices/index_sets", data=index_set.dict())
275 + return GraylogIndexSetCreationResponse(**response_json)
276 +
277 +
278 +# Refactored create_index_set function
279 +async def create_index_set(customer_code: str, session: AsyncSession) -> GraylogIndexSetCreationResponse:
280 + """
281 + Creates an index set for a new customer.
282 +
283 + Args:
284 + request (ProvisionNewCustomer): The request object containing the customer information.
285 +
286 + Returns:
287 + GraylogIndexSetCreationResponse: The response object containing the result of the index set creation.
288 + """
289 + logger.info(f"Creating index set for customer {customer_code}")
290 + index_set_config = await build_index_set_config(customer_code, session)
291 + return await send_index_set_creation_request(index_set_config)
292 +
293 +
294 +# Function to extract index set ID
295 +def extract_index_set_id(response: GraylogIndexSetCreationResponse) -> str:
296 + """
297 + Extracts the index set ID from the given GraylogIndexSetCreationResponse object.
298 +
299 + Args:
300 + response (GraylogIndexSetCreationResponse): The GraylogIndexSetCreationResponse object.
301 +
302 + Returns:
303 + str: The index set ID extracted from the response.
304 + """
305 + return response.data.id
306 +
307 +# ! Event STREAMS ! #
308 +# Function to create event stream configuration
309 +async def build_event_stream_config(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys, index_set_id: str, session: AsyncSession) -> Office365EventStream:
310 + """
311 + Build the configuration for a Wazuh event stream.
312 +
313 + Args:
314 + request (ProvisionNewCustomer): The request object containing customer information.
315 + index_set_id (str): The ID of the index set.
316 +
317 + Returns:
318 + Office365EventStream: The configured Wazuh event stream.
319 + """
320 + return Office365EventStream(
321 + title=f"Office365 EVENTS - {(await get_customer(customer_code, session)).customer.customer_name}",
322 + description=f"Office365 EVENTS - {(await get_customer(customer_code, session)).customer.customer_name}",
323 + index_set_id=index_set_id,
324 + rules=[
325 + {
326 + "field": "rule_group1",
327 + "type": 1,
328 + "inverted": False,
329 + "value": "office365",
330 + },
331 + {
332 + "field": "data_office365_OrganizationId",
333 + "type": 1,
334 + "inverted": False,
335 + "value": f"{provision_office365_auth_keys.TENANT_ID}",
336 + }
337 + ],
338 + matching_type="AND",
339 + remove_matches_from_default_stream=True,
340 + content_pack=None,
341 + )
342 +
343 +
344 +async def send_event_stream_creation_request(event_stream: Office365EventStream) -> StreamCreationResponse:
345 + """
346 + Sends a request to create an event stream.
347 +
348 + Args:
349 + event_stream (WazuhEventStream): The event stream to be created.
350 +
351 + Returns:
352 + StreamCreationResponse: The response containing the created event stream.
353 + """
354 + json_event_stream = json.dumps(event_stream.dict())
355 + logger.info(f"json_event_stream set: {json_event_stream}")
356 + response_json = await send_post_request(endpoint="/api/streams", data=event_stream.dict())
357 + return StreamCreationResponse(**response_json)
358 +
359 +
360 +async def create_event_stream(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys, index_set_id: str, session: AsyncSession) -> StreamCreationResponse:
361 + """
362 + Creates an event stream for a customer.
363 +
364 + Args:
365 + request (ProvisionNewCustomer): The request object containing customer information.
366 + index_set_id (str): The ID of the index set.
367 +
368 + Returns:
369 + The result of the event stream creation request.
370 + """
371 + event_stream_config = await build_event_stream_config(customer_code, provision_office365_auth_keys, index_set_id, session)
372 + return await send_event_stream_creation_request(event_stream_config)
373 +
374 +
375 +############### ! PIPELINES AND RULES ! ################
376 +
377 +# ! PIPELINE RULES ! #
378 +async def check_pipeline_rules() -> None:
379 + """
380 + Checks if the pipeline rules exist in Graylog. If they don't, create them.
381 + """
382 + pipeline_rules = await get_pipeline_rules()
383 + non_existing_rules = await pipeline_rules_exists(pipeline_rules)
384 + if non_existing_rules:
385 + logger.info(f"Creating pipeline rules: {non_existing_rules}")
386 + await create_pipeline_rules(non_existing_rules)
387 +
388 +async def pipeline_rules_exists(pipeline_rules: PipelineRulesResponse) -> List[str]:
389 + """
390 + Checks if the pipeline rules exist in Graylog and returns a list of non-existing pipeline rules.
391 + """
392 + return [
393 + rule_title.value
394 + for rule_title in PipelineRuleTitles
395 + if not any(rule.title == rule_title.value for rule in pipeline_rules.pipeline_rules)
396 + ]
397 +
398 +async def create_pipeline_rules(non_existing_rules: List[str]) -> None:
399 + """
400 + Creates the given pipeline rules.
401 + """
402 + rule_creators = {
403 + "Office365 Timestamp - UTC": create_office365_utc_rule,
404 + "WAZUH CREATE FIELD SYSLOG LEVEL - INFO": create_wazuh_info_rule,
405 + "WAZUH CREATE FIELD SYSLOG LEVEL - WARNING": create_wazuh_warning_rule,
406 + "WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE": create_wazuh_notice_rule,
407 + "WAZUH CREATE FIELD SYSLOG LEVEL - ALERT": create_wazuh_alert_rule,
408 + }
409 +
410 + for rule_title in non_existing_rules:
411 + logger.info(f"Creating pipeline rule {rule_title}.")
412 + await rule_creators[rule_title](rule_title)
413 +
414 +async def create_office365_utc_rule(rule_title: str) -> None:
415 + """
416 + Creates the 'Office365 Timestamp - UTC' pipeline rule.
417 + """
418 + rule_source = (
419 + f"rule \"{rule_title}\"\n"
420 + "when\n"
421 + " has_field(\"data_office_365_CreationTime\")\n"
422 + "then\n"
423 + " let creation_time = $message.data_office_365_CreationTime;\n"
424 + " set_field(\"timestamp_utc\", creation_time);\n"
425 + "end"
426 + )
427 + await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
428 +
429 +async def create_wazuh_info_rule(rule_title: str) -> None:
430 + """
431 + Creates the 'WAZUH CREATE FIELD SYSLOG LEVEL - INFO' pipeline rule.
432 + """
433 + rule_source = (
434 + f"rule \"{rule_title}\"\n"
435 + "when\n"
436 + " to_long($message.rule_level) > 0 AND to_long($message.rule_level) < 4\n"
437 + "then\n"
438 + " set_field(\"syslog_level\", \"INFO\");\n"
439 + "end"
440 + )
441 + await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
442 +
443 +async def create_wazuh_warning_rule(rule_title: str) -> None:
444 + """
445 + Creates the 'WAZUH CREATE FIELD SYSLOG LEVEL - WARNING' pipeline rule.
446 + """
447 + rule_source = (
448 + f"rule \"{rule_title}\"\n"
449 + "when\n"
450 + " to_long($message.rule_level) > 7 AND to_long($message.rule_level) < 12\n"
451 + "then\n"
452 + " set_field(\"syslog_level\", \"WARNING\");\n"
453 + "end"
454 + )
455 + await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
456 +
457 +async def create_wazuh_notice_rule(rule_title: str) -> None:
458 + """
459 + Creates the 'WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE' pipeline rule.
460 + """
461 + rule_source = (
462 + f"rule \"{rule_title}\"\n"
463 + "when\n"
464 + " to_long($message.rule_level) > 3 AND to_long($message.rule_level) < 8\n"
465 + "then\n"
466 + " set_field(\"syslog_level\", \"NOTICE\");\n"
467 + "end"
468 + )
469 + await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
470 +
471 +async def create_wazuh_alert_rule(rule_title: str) -> None:
472 + """
473 + Creates the 'WAZUH CREATE FIELD SYSLOG LEVEL - ALERT' pipeline rule.
474 + """
475 + rule_source = (
476 + f"rule \"{rule_title}\"\n"
477 + "when\n"
478 + " to_long($message.rule_level) > 11\n"
479 + "then\n"
480 + " set_field(\"syslog_level\", \"ALERT\");\n"
481 + "end"
482 + )
483 + await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
484 +
485 +# ! PIPELINE ! #
486 +async def check_pipeline() -> None:
487 + """
488 + Checks if the pipeline exists in Graylog. If it doesn't, create it.
489 + """
490 + pipelines = await get_pipelines()
491 + non_existing_pipelines = await pipeline_exists(pipelines)
492 + if non_existing_pipelines:
493 + logger.info(f"Creating pipelines: {non_existing_pipelines}")
494 + await create_pipeline(non_existing_pipelines)
495 +
496 +async def pipeline_exists(pipelines: GraylogPipelinesResponse) -> List[str]:
497 + """
498 + Checks if the pipeline exists in Graylog and returns a list of non-existing pipelines.
499 + """
500 + return [
501 + pipeline_title.value
502 + for pipeline_title in PipelineTitles
503 + if not any(pipeline.title == pipeline_title.value for pipeline in pipelines.pipelines)
504 + ]
505 +
506 +async def create_pipeline(non_existing_pipelines: List[str]) -> None:
507 + """
508 + Creates the given pipeline.
509 + """
510 + pipeline_creators = {
511 + "OFFICE365 PROCESSING PIPELINE": create_office365_pipeline,
512 + }
513 +
514 + for pipeline_title in non_existing_pipelines:
515 + logger.info(f"Creating pipeline {pipeline_title}.")
516 + await pipeline_creators[pipeline_title](pipeline_title)
517 +
518 +async def create_office365_pipeline(pipeline_title: str) -> None:
519 + """
520 + Creates the 'OFFICE365 PROCESSING PIPELINE' pipeline.
521 + """
522 + pipeline_description = "OFFICE365 PROCESSING PIPELINE"
523 + pipeline_source = (
524 + "pipeline \"OFFICE365 PROCESSING PIPELINE\"\nstage 0 match either\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - ALERT\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - INFO\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - WARNING\"\nrule \"Office365 Timestamp - UTC\"\nend"
525 + )
526 + await create_pipeline_graylog(CreatePipeline(title=pipeline_title, description=pipeline_description, source=pipeline_source))
527 +
528 +
529 +#### ! GRAFANA ! ####
530 +async def create_grafana_datasource(
531 + customer_code: str,
532 + session: AsyncSession,
533 +) -> GrafanaDataSourceCreationResponse:
534 + """
535 + Creates a Grafana Wazuh datasource for a new customer using the OpenSearch Data Source.
536 +
537 + Args:
538 + request (ProvisionNewCustomer): The request object containing customer information.
539 + organization_id (int): The ID of the organization to create the datasource for.
540 + session (AsyncSession): The database session.
541 +
542 + Returns:
543 + GrafanaDataSourceCreationResponse: The response object containing the result of the datasource creation.
544 + """
545 + logger.info("Creating Grafana datasource")
546 + grafana_client = await create_grafana_client("Grafana")
547 + # Switch to the newly created organization
548 + grafana_client.user.switch_actual_user_organisation((await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id)
549 + datasource_payload = GrafanaDatasource(
550 + name="O365",
551 + type="grafana-opensearch-datasource",
552 + typeName="OpenSearch",
553 + access="proxy",
554 + url=await get_connector_attribute(connector_id=1, column_name="connector_url", session=session),
555 + database=f"office365_{customer_code}*",
556 + basicAuth=True,
557 + basicAuthUser=await get_connector_attribute(connector_id=1, column_name="connector_username", session=session),
558 + secureJsonData={
559 + "basicAuthPassword": await get_connector_attribute(connector_id=1, column_name="connector_password", session=session),
560 + },
561 + isDefault=False,
562 + jsonData={
563 + "database": f"office365_{customer_code}*",
564 + "flavor": "opensearch",
565 + "includeFrozen": False,
566 + "logLevelField": "syslog_level",
567 + "logMessageField": "rule_description",
568 + "maxConcurrentShardRequests": 5,
569 + "pplEnabled": True,
570 + "timeField": "timestamp",
571 + "tlsSkipVerify": True,
572 + "version": await get_opensearch_version(),
573 + },
574 + readOnly=True,
575 + )
576 + results = grafana_client.datasource.create_datasource(
577 + datasource=datasource_payload.dict(),
578 + )
579 + return GrafanaDataSourceCreationResponse(**results)
580 +
581 +
582 +
583 +
584 +################## ! MAIN FUNCTION ! ##################
585 +
586 +async def provision_office365(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys, session: AsyncSession) -> ProvisionOffice365Response:
587 + logger.info(f"Provisioning Office365 integration for customer {customer_code}.")
588 +
589 + # Get Wazuh configuration
590 + wazuh_config = await get_wazuh_configuration()
591 +
592 + # Check if Office365 is already provisioned
593 + await check_if_office365_is_already_provisioned(customer_code, wazuh_config)
594 +
595 + # Create Office365 template
596 + office365_templated = await office365_template_with_api_type(customer_code, provision_office365_auth_keys)
597 +
598 + # Append Office365 template to Wazuh configuration
599 + wazuh_config = await append_office365_template(wazuh_config, office365_templated)
600 +
601 + # Update Wazuh configuration
602 + await update_wazuh_configuration(wazuh_config, provision_office365_auth_keys)
603 +
604 + # Restart Wazuh manager
605 + await restart_wazuh_manager()
606 +
607 + # Graylog Deployment
608 + await check_pipeline_rules()
609 + await check_pipeline()
610 +
611 + # Create Index Set
612 + index_set_id = (await create_index_set(customer_code=customer_code, session=session)).data.id
613 + logger.info(f"Index set: {index_set_id}")
614 + # Create event stream
615 + stream_id = (await create_event_stream(customer_code, provision_office365_auth_keys, index_set_id, session)).data.stream_id
616 + pipeline_id = await get_pipeline_id(subscription="OFFICE365")
617 + # Combine stream and pipeline IDs
618 + stream_and_pipeline = StreamConnectionToPipelineRequest(stream_id=stream_id, pipeline_ids=pipeline_id)
619 + # Connect stream to pipeline
620 + logger.info(f"Stream and pipeline: {stream_and_pipeline}")
621 + await connect_stream_to_pipeline(stream_and_pipeline)
622 + # Start stream
623 + await start_stream(stream_id=stream_id)
624 +
625 + # Grafana Deployment
626 + office365_datasource_uid = (await create_grafana_datasource(customer_code=customer_code, session=session)).datasource.uid
627 + grafana_o365_folder_id = (await create_grafana_folder(organization_id=(await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id, folder_title="OFFICE 365")).id
628 + await provision_dashboards(
629 + DashboardProvisionRequest(
630 + dashboards=[dashboard.name for dashboard in Office365Dashboard],
631 + organizationId=(await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id,
632 + folderId=grafana_o365_folder_id,
633 + datasourceUid=office365_datasource_uid,
634 + )
635 + )
636 +
637 + # Create alert in Praeco
638 + await provision_alert_in_praeco(
639 + PraecoAlertConfig(
640 + alert=["post"],
641 + filter=[{"query": {"query_string": {"query": "syslog_level:ALERT AND data_office365_Subscription:Audit.Exchange"}}}],
642 + generate_kibana_discover_url=False,
643 + http_post_ignore_ssl_errors=False,
644 + http_post_timeout=60,
645 + http_post_url=[f"http://{os.getenv('SERVER_IP')}:5000/api/v1/alerts/office365/exchange"],
646 + import_config="BaseRule.config",
647 + index="office365_*",
648 + is_enabled=True,
649 + kibana_discover_from_timedelta={"minutes": 10},
650 + kibana_discover_to_timedelta={"minutes": 10},
651 + match_enhancements=[],
652 + name="Office365 - Exchange",
653 + realert={"minutes": 0},
654 + timestamp_field="timestamp_utc",
655 + timestamp_type="iso",
656 + type="any",
657 + use_strftime_index=False,
658 + ),
659 + session=session,
660 + )
661 +
662 + await provision_alert_in_praeco(
663 + PraecoAlertConfig(
664 + alert=["post"],
665 + filter=[{"query": {"query_string": {"query": "syslog_level:ALERT AND data_office365_UserId:ThreatIntel"}}}],
666 + generate_kibana_discover_url=False,
667 + http_post_ignore_ssl_errors=False,
668 + http_post_timeout=60,
669 + http_post_url=[f"http://{os.getenv('SERVER_IP')}:5000/api/v1/alerts/office365/threat_intel"],
670 + import_config="BaseRule.config",
671 + index="office365_*",
672 + is_enabled=True,
673 + kibana_discover_from_timedelta={"minutes": 10},
674 + kibana_discover_to_timedelta={"minutes": 10},
675 + match_enhancements=[],
676 + name="Office365 - Threat Intel",
677 + realert={"minutes": 0},
678 + timestamp_field="timestamp_utc",
679 + timestamp_type="iso",
680 + type="any",
681 + use_strftime_index=False,
682 + ),
683 + session=session,
684 + )
685 +
686 + await update_customer_integration_table(customer_code, session)
687 +
688 + return ProvisionOffice365Response(success=True, message=f"Successfully provisioned Office365 integration for customer {customer_code}.")
689 +
690 +
691 +######### ! Provision in Praeco ! ############
692 +async def provision_alert_in_praeco(request: PraecoAlertConfig, session: AsyncSession) -> PraecoProvisionAlertResponse:
693 + """
694 + Provisions the given alert in Praeco. https://github.com/socfortress/Customer-Provisioning-Alert
695 +
696 + Args:
697 + request (PraecoAlertConfig): The request object containing the necessary information for provisioning.
698 + session (AsyncSession): The async session object for making HTTP requests.
699 +
700 + Returns:
701 + PraecoProvisionAlertResponse: The response object indicating the success or failure of the provisioning operation.
702 + """
703 + logger.info(f"Provisioning to alert creation - Praeco {request}")
704 + api_endpoint = await get_connector_attribute(connector_id=15, column_name="connector_url", session=session)
705 + # Send the POST request to Praeco
706 + response = requests.post(
707 + url=f"{api_endpoint}/provision_alert",
708 + json=request.dict(by_alias=True),
709 + )
710 + logger.info(f"Response: {response.json()}")
711 + # Check the response status code
712 + if response.status_code != 200:
713 + return PraecoProvisionAlertResponse(success=False, message=f"Failed to provision to Alert Creation App: {response.text}")
714 + # Return the response
715 + return PraecoProvisionAlertResponse(success=True, message="Successfully provisioned to Alert Creation App.")
716 +
717 +
718 +######### ! Update Database ! ############
719 +async def update_customer_integration_table(customer_code: str, session: AsyncSession) -> None:
720 + """
721 + Updates the `customer_integrations` table to set the `deployed` column to True where the `customer_code`
722 + matches the given customer code and the `integration_service_name` is "Office365".
723 +
724 + Args:
725 + customer_code (str): The customer code.
726 + session (AsyncSession): The async session object for making HTTP requests.
727 + """
728 + await session.execute(
729 + update(CustomerIntegrations)
730 + .where(
731 + and_(
732 + CustomerIntegrations.customer_code == customer_code,
733 + CustomerIntegrations.integration_service_name == "Office365",
734 + )
735 + )
736 + .values(deployed=True)
737 + )
738 + await session.commit()
739 +
740 + return None
741 +
742 +
743 +
744 +
backend/app/integrations/routes.py
+285 -43
@@ -9,6 +9,11 @@ from sqlalchemy.future import select
9 from sqlalchemy.orm import joinedload
10 from sqlalchemy.exc import NoResultFound
11 from sqlalchemy import delete
12 +from fastapi import Security
13 +from app.auth.utils import AuthHandler
14 +from pydantic import ValidationError
15 +from sqlalchemy import update
16 +from typing import Optional
17
18 from app.db.db_session import get_db
19 from app.integrations.models.customer_integration_settings import (
@@ -24,26 +29,44 @@ from app.integrations.models.customer_integration_settings import (
29 IntegrationConfig,
30 )
31 from app.integrations.models.customer_integration_settings import (
27 - IntegrationMetadata, AvailableIntegrations
32 + IntegrationAuthKeys, AvailableIntegrations
33 )
29 -from app.db.universal_models import Customers
30 -from app.integrations.schema import AvailableIntegrationsResponse, CustomerIntegrationCreate, CreateIntegrationService, CreateIntegrationMetadata, CustomerIntegrationCreateResponse, CustomerIntegrationsResponse, DeleteCustomerIntegration, CustomerIntegrationDeleteResponse
34 +from app.db.universal_models import Customers, CustomersMeta
35 +from app.integrations.schema import AvailableIntegrationsResponse, CustomerIntegrationCreate, CreateIntegrationService, CreateIntegrationAuthKeys, CustomerIntegrationCreateResponse, CustomerIntegrationsResponse, DeleteCustomerIntegration, CustomerIntegrationDeleteResponse, AuthKey, IntegrationWithAuthKeys, UpdateCustomerIntegration
36 +from app.integrations.alert_creation_settings.models.alert_creation_settings import AlertCreationSettings
37
38 integration_settings_router = APIRouter()
39
40 async def fetch_available_integrations(session: AsyncSession):
41 """
36 - Fetches available integrations from the database.
42 + Fetches available integrations and their auth keys from the database.
43
44 Args:
45 session (AsyncSession): The database session.
46
47 Returns:
42 - List[AvailableIntegrations]: A list of available integrations.
48 + List[IntegrationWithAuthKeys]: A list of available integrations with their auth keys.
49 """
44 - stmt = select(AvailableIntegrations)
50 + stmt = select(AvailableIntegrations).options(joinedload(AvailableIntegrations.auth_keys))
51 result = await session.execute(stmt)
46 - return result.scalars().all()
52 +
53 + # Use unique() to avoid duplicates caused by joined eager loading
54 + unique_integrations = result.unique().scalars().all()
55 +
56 + integrations_with_auth_keys = []
57 + for integration in unique_integrations:
58 + auth_keys = [AuthKey(auth_key_name=key.auth_key_name) for key in integration.auth_keys]
59 + integration_data = IntegrationWithAuthKeys(
60 + id=integration.id,
61 + integration_name=integration.integration_name,
62 + description=integration.description,
63 + integration_details=integration.integration_details,
64 + auth_keys=auth_keys
65 + )
66 + integrations_with_auth_keys.append(integration_data)
67 +
68 + return integrations_with_auth_keys
69 +
70
71 async def validate_integration_name(integration_name: str, session: AsyncSession):
72 """
@@ -51,7 +74,31 @@ async def validate_integration_name(integration_name: str, session: AsyncSession
74 """
75 available_integrations = await fetch_available_integrations(session)
76 if integration_name not in [ai.integration_name for ai in available_integrations]:
54 - raise HTTPException(status_code=400, detail=f"Integration {integration_name} does not exist.")
77 + raise HTTPException(status_code=400, detail=f"Integration {integration_name} is not a valid integration.")
78 +
79 +async def validate_integration_auth_keys(integration_name: str, integration_auth_keys: List[AuthKey], session: AsyncSession):
80 + """
81 + Validate if the integration auth keys are valid.
82 + """
83 + available_integrations = await fetch_available_integrations(session)
84 + integration = [ai for ai in available_integrations if ai.integration_name == integration_name][0]
85 + available_auth_keys = [ak.auth_key_name for ak in integration.auth_keys]
86 + # loop through the `available_auth_keys` and check if the `integration_auth_keys` contains the `auth_key_name`
87 + for auth_key in available_auth_keys:
88 + if auth_key not in [iak.auth_key_name for iak in integration_auth_keys]:
89 + raise HTTPException(status_code=400, detail=f"Integration auth key {auth_key} does not exist.")
90 +
91 +async def validate_integration_auth_key_update(integration_name: str, integration_auth_key: List[AuthKey], session: AsyncSession):
92 + """
93 + Validate if the integration auth key is valid.
94 + """
95 + logger.info(f"integration_auth_key: {integration_auth_key}")
96 + available_integrations = await fetch_available_integrations(session)
97 + integration = [ai for ai in available_integrations if ai.integration_name == integration_name][0]
98 + available_auth_keys = [ak.auth_key_name for ak in integration.auth_keys]
99 + for auth_key in integration_auth_key:
100 + if auth_key.auth_key_name not in available_auth_keys:
101 + raise HTTPException(status_code=400, detail=f"Integration auth key {auth_key.auth_key_name} does not exist.")
102
103 async def validate_customer_code(customer_code: str, session: AsyncSession):
104 """
@@ -62,6 +109,15 @@ async def validate_customer_code(customer_code: str, session: AsyncSession):
109 if result.scalars().first() is None:
110 raise HTTPException(status_code=400, detail=f"Customer {customer_code} does not exist.")
111
112 +async def validate_customer_meta(customer_code: str, session: AsyncSession):
113 + """
114 + Validate if the customer code exists in the customers_meta table.
115 + """
116 + stmt = select(CustomersMeta).where(CustomersMeta.customer_code == customer_code)
117 + result = await session.execute(stmt)
118 + if result.scalars().first() is None:
119 + raise HTTPException(status_code=400, detail=f"Customer {customer_code} meta does not exist. Please provision the customer before creating an integration.")
120 +
121 async def check_existing_customer_integration(customer_code: str, integration_name: str, session: AsyncSession):
122 """
123 Check if the customer integration already exists.
@@ -88,29 +144,34 @@ async def create_integration_service(integration_name: str, settings: CreateInte
144 await session.flush()
145 return integration_service
146
91 -async def create_customer_integrations(customer_code: str, customer_name: str, session: AsyncSession) -> CustomerIntegrations:
147 +async def create_customer_integrations(customer_code: str, customer_name: str, integration_service_id: int, integration_service_name: str, session: AsyncSession) -> CustomerIntegrations:
148 """
149 Create CustomerIntegrations instance.
150 """
151 customer_integrations = CustomerIntegrations(
152 customer_code=customer_code,
153 customer_name=customer_name,
154 + integration_service_id=integration_service_id,
155 + integration_service_name=integration_service_name,
156 + deployed=False,
157 )
158 session.add(customer_integrations)
159 await session.flush()
160 return customer_integrations
161
103 -async def create_integration_subscription(customer_integrations: CustomerIntegrations, integration_service: IntegrationService, integration_metadata: CreateIntegrationMetadata, session: AsyncSession):
162 +async def create_integration_subscription(customer_integrations: CustomerIntegrations, integration_service: IntegrationService, integration_auth_keys: List[CreateIntegrationAuthKeys], session: AsyncSession):
163 """
164 Create IntegrationSubscription instance.
165 """
107 - new_integration_subscription = IntegrationSubscription(
108 - customer_integrations=customer_integrations,
109 - integration_service=integration_service,
110 - integration_metadata=[IntegrationMetadata(metadata_key=integration_metadata.metadata_key, metadata_value=integration_metadata.metadata_value)]
111 - )
112 - session.add(new_integration_subscription)
113 - await session.commit()
166 + logger.info(f"integration_auth_keys: {integration_auth_keys}")
167 + for auth_key in integration_auth_keys:
168 + new_integration_subscription = IntegrationSubscription(
169 + customer_integrations=customer_integrations,
170 + integration_service=integration_service,
171 + integration_auth_keys=[IntegrationAuthKeys(auth_key_name=auth_key.auth_key_name, auth_value=auth_key.auth_value)]
172 + )
173 + session.add(new_integration_subscription)
174 + await session.commit()
175
176 async def get_customer_and_service_ids(session, customer_code, integration_name):
177 try:
@@ -147,8 +208,8 @@ async def get_subscription_ids(session, customer_id, integration_service_id):
208
209 async def delete_metadata(session, subscription_ids):
210 await session.execute(
150 - delete(IntegrationMetadata)
151 - .where(IntegrationMetadata.subscription_id.in_(subscription_ids))
211 + delete(IntegrationAuthKeys)
212 + .where(IntegrationAuthKeys.subscription_id.in_(subscription_ids))
213 )
214
215 async def delete_subscriptions(session, subscription_ids):
@@ -175,10 +236,107 @@ async def delete_customer_integration_record(session, customer_id):
236 .where(CustomerIntegrations.id == customer_id)
237 )
238
239 +async def find_customer_integration(customer_code: str, integration_name: str, customer_integration_response) -> Optional[CustomerIntegrations]:
240 + for ci in customer_integration_response.available_integrations:
241 + for subscription in ci.integration_subscriptions:
242 + if subscription.integration_service.service_name == integration_name:
243 + return ci
244 + return None
245 +
246 +def get_subscription_id(customer_integration, integration_name: str, auth_key_name: str) -> Optional[int]:
247 + for subscription in customer_integration.integration_subscriptions:
248 + if subscription.integration_service.service_name == integration_name:
249 + for auth_key in subscription.integration_auth_keys:
250 + if auth_key.auth_key_name == auth_key_name:
251 + return subscription.id
252 + return None
253 +
254 +async def get_tenant_id(customer_integration: CustomerIntegrationCreate, session: AsyncSession) -> str:
255 + """
256 + Retrieves the Tenant ID for a given customer integration. This is the Office365 organization ID and
257 + is used to create alerts for the customer in DFIR-IRIS.
258 + """
259 + stmt = select(IntegrationAuthKeys).join(IntegrationSubscription, IntegrationAuthKeys.subscription_id == IntegrationSubscription.id).join(CustomerIntegrations, IntegrationSubscription.customer_id == CustomerIntegrations.id).join(IntegrationService, IntegrationSubscription.integration_service_id == IntegrationService.id).where(CustomerIntegrations.customer_code == customer_integration.customer_code, IntegrationService.service_name == customer_integration.integration_name, IntegrationAuthKeys.auth_key_name == "TENANT_ID")
260 +
261 + result = await session.execute(stmt)
262 + tenant_id = result.scalars().first()
263 + if tenant_id is None:
264 + raise HTTPException(status_code=404, detail=f"Tenant ID for customer {customer_integration.customer_code} not found.")
265 + logger.info(f"tenant_id: {tenant_id.auth_value}")
266 + return tenant_id.auth_value
267 +
268 +async def update_office365_organization_id(customer_code: str, tenant_id: str, session: AsyncSession):
269 + """
270 + Updates the Office365 organization ID in the alert_creation_settings table.
271 + """
272 + stmt = update(AlertCreationSettings).where(AlertCreationSettings.customer_code == customer_code).values(office365_organization_id=tenant_id)
273 + await session.execute(stmt)
274 + await session.commit()
275 +
276 +async def get_integration_service_id(integration_name: str, session: AsyncSession) -> int:
277 + """
278 + Retrieves the AvailableIntegrations ID for a given integration name.
279 + """
280 + stmt = select(AvailableIntegrations).where(AvailableIntegrations.integration_name == integration_name)
281 + result = await session.execute(stmt)
282 + integration_service = result.scalars().first()
283 + if integration_service is None:
284 + raise HTTPException(status_code=404, detail=f"Integration service {integration_name} not found.")
285 + return integration_service.id
286 +
287 +async def get_integration_service_name(integration_name: str, session: AsyncSession) -> str:
288 + """
289 + Retrieves the AvailableIntegrations ID for a given integration name.
290 + """
291 + stmt = select(AvailableIntegrations).where(AvailableIntegrations.integration_name == integration_name)
292 + result = await session.execute(stmt)
293 + integration_service = result.scalars().first()
294 + if integration_service is None:
295 + raise HTTPException(status_code=404, detail=f"Integration service {integration_name} not found.")
296 + return integration_service.integration_name
297 +
298 +async def fetch_customer_integrations_data(session: AsyncSession):
299 + """
300 + Fetches customer integrations data from the database.
301 + """
302 + stmt = (
303 + select(CustomerIntegrations)
304 + .options(
305 + joinedload(CustomerIntegrations.integration_subscriptions)
306 + .joinedload(IntegrationSubscription.integration_service),
307 + joinedload(CustomerIntegrations.integration_subscriptions)
308 + .subqueryload(IntegrationSubscription.integration_auth_keys)
309 + )
310 + )
311 + result = await session.execute(stmt)
312 + return result.scalars().unique().all()
313 +
314 +def process_customer_integrations(customer_integrations_data):
315 + """
316 + Processes customer integrations data and returns a list of CustomerIntegrations objects.
317 + """
318 + processed_customer_integrations = []
319 + for ci in customer_integrations_data:
320 + first_service_id = ci.integration_subscriptions[0].integration_service_id if ci.integration_subscriptions else None
321 + customer_integration_obj = CustomerIntegrations(
322 + id=ci.id,
323 + customer_code=ci.customer_code,
324 + customer_name=ci.customer_name,
325 + integration_subscriptions=ci.integration_subscriptions,
326 + integration_service_id=first_service_id,
327 + integration_service_name=ci.integration_subscriptions[0].integration_service.service_name if ci.integration_subscriptions else None,
328 + deployed=ci.deployed,
329 + )
330 + processed_customer_integrations.append(customer_integration_obj)
331 + return processed_customer_integrations
332 +
333 +
334 +
335 @integration_settings_router.get(
336 "/available_integrations",
337 response_model=AvailableIntegrationsResponse,
181 - description="Get a list of available integrations."
338 + description="Get a list of available integrations.",
339 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
340 )
341 async def get_available_integrations(
342 session: AsyncSession = Depends(get_db),
@@ -194,30 +352,23 @@ async def get_available_integrations(
352 )
353
354
355 +
356 @integration_settings_router.get(
357 "/customer_integrations",
358 response_model=CustomerIntegrationsResponse,
200 - description="Get a list of customer integrations."
359 + description="Get a list of customer integrations.",
360 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
361 )
202 -async def get_customer_integrations(
203 - session: AsyncSession = Depends(get_db),
204 -):
362 +async def get_customer_integrations(session: AsyncSession = Depends(get_db)):
363 """
364 Endpoint to get a list of customer integrations.
365 """
208 - stmt = (
209 - select(CustomerIntegrations)
210 - .options(
211 - joinedload(CustomerIntegrations.integration_subscriptions)
212 - .joinedload(IntegrationSubscription.integration_service),
213 - joinedload(CustomerIntegrations.integration_subscriptions)
214 - .subqueryload(IntegrationSubscription.integration_metadata) # Load IntegrationMetadata
215 - )
216 - )
217 - result = await session.execute(stmt)
218 - customer_integrations = result.scalars().unique().all()
366 + customer_integrations_data = await fetch_customer_integrations_data(session)
367 + processed_customer_integrations = process_customer_integrations(customer_integrations_data)
368 +
369 + logger.info(f"Processed customer_integrations: {processed_customer_integrations}")
370 return CustomerIntegrationsResponse(
220 - available_integrations=customer_integrations,
371 + available_integrations=processed_customer_integrations,
372 message="Customer integrations successfully retrieved.",
373 success=True,
374 )
@@ -225,7 +376,8 @@ async def get_customer_integrations(
376 @integration_settings_router.get(
377 "/customer_integrations/{customer_code}",
378 response_model=CustomerIntegrationsResponse,
228 - description="Get a list of customer integrations for a specific customer."
379 + description="Get a list of customer integrations for a specific customer.",
380 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
381 )
382 async def get_customer_integrations_by_customer_code(
383 customer_code: str,
@@ -240,12 +392,13 @@ async def get_customer_integrations_by_customer_code(
392 joinedload(CustomerIntegrations.integration_subscriptions)
393 .joinedload(IntegrationSubscription.integration_service),
394 joinedload(CustomerIntegrations.integration_subscriptions)
243 - .subqueryload(IntegrationSubscription.integration_metadata) # Load IntegrationMetadata
395 + .subqueryload(IntegrationSubscription.integration_auth_keys) # Load IntegrationAuthKeys
396 )
397 .where(CustomerIntegrations.customer_code == customer_code)
398 )
399 result = await session.execute(stmt)
400 customer_integrations = result.scalars().unique().all()
401 + logger.info(f"customer_integrations: {customer_integrations}")
402 return CustomerIntegrationsResponse(
403 available_integrations=customer_integrations,
404 message="Customer integrations successfully retrieved.",
@@ -255,7 +408,8 @@ async def get_customer_integrations_by_customer_code(
408 @integration_settings_router.post(
409 "/create_integration",
410 response_model=CustomerIntegrationCreateResponse,
258 - description="Create a new customer integration."
411 + description="Create a new customer integration.",
412 + #dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
413 )
414 async def create_integration(
415 customer_integration_create: CustomerIntegrationCreate,
@@ -264,25 +418,113 @@ async def create_integration(
418 """
419 Endpoint to create a new customer integration.
420 """
267 -
421 await validate_integration_name(customer_integration_create.integration_name, session)
422 + await validate_integration_auth_keys(customer_integration_create.integration_name, customer_integration_create.integration_auth_keys, session)
423 await validate_customer_code(customer_integration_create.customer_code, session)
424 + await validate_customer_meta(customer_integration_create.customer_code, session)
425 await check_existing_customer_integration(customer_integration_create.customer_code, customer_integration_create.integration_name, session)
426 + integration_service_id = await get_integration_service_id(customer_integration_create.integration_name, session)
427 + integration_service_name = await get_integration_service_name(customer_integration_create.integration_name, session)
428
429 integration_service = await create_integration_service(customer_integration_create.integration_name, settings=customer_integration_create.integration_config, session=session)
273 - customer_integrations = await create_customer_integrations(customer_integration_create.customer_code, customer_integration_create.customer_name, session)
274 - await create_integration_subscription(customer_integrations, integration_service, integration_metadata=customer_integration_create.integration_metadata, session=session)
430 + customer_integrations = await create_customer_integrations(customer_integration_create.customer_code, customer_integration_create.customer_name, integration_service_id=integration_service_id, integration_service_name=integration_service_name, session=session)
431 + await create_integration_subscription(customer_integrations, integration_service, integration_auth_keys=customer_integration_create.integration_auth_keys, session=session)
432 +
433 + # Office365 specific integration handling
434 + if customer_integration_create.integration_name == "Office365":
435 + tenant_id = await get_tenant_id(customer_integration_create, session)
436 + await update_office365_organization_id(customer_integration_create.customer_code, tenant_id, session)
437 +
438
439 return CustomerIntegrationCreateResponse(
440 message=f"Customer integration {customer_integration_create.customer_code} {customer_integration_create.integration_name} successfully created.",
441 success=True,
442 )
443
444 +@integration_settings_router.put(
445 + "/update_integration/{customer_code}",
446 + response_model=CustomerIntegrationCreateResponse,
447 + description="Update a customer integration.",
448 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
449 +)
450 +async def update_integration(
451 + customer_code: str,
452 + customer_integration_update: UpdateCustomerIntegration,
453 + session: AsyncSession = Depends(get_db),
454 +):
455 + await validate_integration_name(customer_integration_update.integration_name, session)
456 + customer_integration_response = await get_customer_integrations_by_customer_code(customer_code, session)
457 +
458 + if not customer_integration_response:
459 + raise HTTPException(status_code=404, detail="Customer integrations not found")
460 +
461 + customer_integration = await find_customer_integration(customer_code, customer_integration_update.integration_name, customer_integration_response)
462 +
463 + if not customer_integration:
464 + raise HTTPException(status_code=404, detail="Customer integration with specified service name not found.")
465 +
466 + await validate_integration_auth_key_update(customer_integration_update.integration_name, customer_integration_update.integration_auth_keys, session)
467 +
468 + subscription_id = get_subscription_id(customer_integration, customer_integration_update.integration_name, customer_integration_update.integration_auth_keys[0].auth_key_name)
469 +
470 + if not subscription_id:
471 + raise HTTPException(status_code=404, detail=f"Integration auth key {customer_integration_update.integration_auth_keys[0].auth_key_name} not found.")
472 +
473 + await session.execute(
474 + update(IntegrationAuthKeys)
475 + .where(IntegrationAuthKeys.subscription_id == subscription_id)
476 + .values(auth_value=customer_integration_update.integration_auth_keys[0].auth_value)
477 + )
478 +
479 + await session.commit()
480 +
481 + return CustomerIntegrationCreateResponse(
482 + message=f"Customer integration {customer_code} {customer_integration_update.integration_name} successfully updated.",
483 + success=True,
484 + )
485 +
486 +
487 +@integration_settings_router.put(
488 + "/available_integrations",
489 + response_model=AvailableIntegrationsResponse,
490 + description="Update an available integration.",
491 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
492 +)
493 +async def update_available_integrations(
494 + available_integrations: List[AvailableIntegrations],
495 + session: AsyncSession = Depends(get_db),
496 +):
497 + """
498 + Endpoint to update an available integration.
499 + """
500 + for integration in available_integrations:
501 + stmt = (
502 + select(AvailableIntegrations)
503 + .where(AvailableIntegrations.integration_name == integration.integration_name)
504 + )
505 + result = await session.execute(stmt)
506 + existing_integration = result.scalars().first()
507 +
508 + if existing_integration is None:
509 + raise HTTPException(status_code=404, detail=f"Integration {integration.integration_name} not found.")
510 +
511 + existing_integration.description = integration.description
512 + existing_integration.integration_details = integration.integration_details
513 +
514 + await session.commit()
515 +
516 + return AvailableIntegrationsResponse(
517 + available_integrations=available_integrations,
518 + message="Available integrations successfully updated.",
519 + success=True,
520 + )
521 +
522
523 @integration_settings_router.delete(
524 "/delete_integration",
525 response_model=CustomerIntegrationDeleteResponse,
285 - description="Delete a customer integration."
526 + description="Delete a customer integration.",
527 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
528 )
529 async def delete_integration(
530 delete_customer_integration: DeleteCustomerIntegration,
backend/app/integrations/schema.py
+57 -27
@@ -1,24 +1,24 @@
1 from pydantic import BaseModel
2 from pydantic import Field
3 from app.integrations.models.customer_integration_settings import AvailableIntegrations
4 -from typing import List
4 +from typing import List, Optional, Union
5 +from typing import Dict
6 +from typing import Type
7 +
8 +class AuthKey(BaseModel):
9 + auth_key_name: str
10 +
11 +class IntegrationWithAuthKeys(BaseModel):
12 + id: int
13 + integration_name: str
14 + description: str
15 + integration_details: str
16 + auth_keys: List[AuthKey]
17
18 class AvailableIntegrationsResponse(BaseModel):
7 - """
8 - The response model for the /integrations/available_integrations endpoint.
9 - """
10 - available_integrations: list[AvailableIntegrations] = Field(
11 - ...,
12 - description="The available integrations.",
13 - )
14 - message: str = Field(
15 - ...,
16 - description="The message.",
17 - )
18 - success: bool = Field(
19 - ...,
20 - description="The success status.",
21 - )
19 + available_integrations: List[IntegrationWithAuthKeys]
20 + message: str
21 + success: bool
22
23 class CreateIntegrationService(BaseModel):
24 auth_type: str = Field(
@@ -37,15 +37,15 @@ class CreateIntegrationService(BaseModel):
37 examples=["https://api.mimecast.com"],
38 )
39
40 -class CreateIntegrationMetadata(BaseModel):
41 - metadata_key: str = Field(
40 +class CreateIntegrationAuthKeys(BaseModel):
41 + auth_key_name: str = Field(
42 ...,
43 - description="The metadata key.",
43 + description="The auth key.",
44 examples=["username"],
45 )
46 - metadata_value: str = Field(
46 + auth_value: str = Field(
47 ...,
48 - description="The metadata value.",
48 + description="The auth value.",
49 examples=["test-user"],
50 )
51
@@ -69,9 +69,13 @@ class CustomerIntegrationCreate(BaseModel):
69 ...,
70 description="The integration service.",
71 )
72 - integration_metadata: CreateIntegrationMetadata = Field(
72 + # integration_auth_key: CreateIntegrationAuthKeys = Field(
73 + # ...,
74 + # description="The integration metadata.",
75 + # )
76 + integration_auth_keys: List[CreateIntegrationAuthKeys] = Field(
77 ...,
74 - description="The integration metadata.",
78 + description="The integration auth keys.",
79 )
80
81 class CustomerIntegrationCreateResponse(BaseModel):
@@ -122,10 +126,10 @@ class CustomerIntegrationDeleteResponse(BaseModel):
126 # message: str
127 # success: bool
128
125 -class IntegrationMetadata(BaseModel):
129 +class IntegrationAuthKeys(BaseModel):
130 id: int
127 - metadata_value: str
128 - metadata_key: str
131 + auth_key_name: str
132 + auth_value: str
133 subscription_id: int
134
135 class IntegrationService(BaseModel):
@@ -138,13 +142,28 @@ class IntegrationSubscription(BaseModel):
142 customer_id: int
143 integration_service_id: int
144 integration_service: IntegrationService
141 - integration_metadata: List[IntegrationMetadata] # Changed from IntegrationConfig
145 + integration_auth_keys: List[IntegrationAuthKeys] # Changed from IntegrationConfig
146
147 class CustomerIntegrations(BaseModel):
148 customer_code: str
149 id: int
150 customer_name: str
151 integration_subscriptions: List[IntegrationSubscription]
152 + integration_service_id: Optional[int] = Field(
153 + None,
154 + description="The integration service id.",
155 + examples=[1],
156 + )
157 + integration_service_name: Optional[str] = Field(
158 + ...,
159 + description="The integration service name.",
160 + examples=["Mimecast"],
161 + )
162 + deployed: Optional[bool] = Field(
163 + None,
164 + description="The deployment status.",
165 + examples=[True],
166 + )
167
168 class CustomerIntegrationsResponse(BaseModel):
169 available_integrations: List[CustomerIntegrations]
@@ -162,3 +181,14 @@ class DeleteCustomerIntegration(BaseModel):
181 description="The integration name.",
182 examples=["Mimecast"],
183 )
184 +
185 +class UpdateCustomerIntegration(BaseModel):
186 + integration_name: str = Field(
187 + ...,
188 + description="The integration name.",
189 + examples=["Mimecast"],
190 + )
191 + integration_auth_keys: List[CreateIntegrationAuthKeys] = Field(
192 + ...,
193 + description="The integration auth keys.",
194 + )
backend/app/integrations/utils/collection.py new
+60
@@ -0,0 +1,60 @@
1 +import httpx
2 +from typing import Any, Dict, Optional
3 +from loguru import logger
4 +import time
5 +import json
6 +import traceback
7 +import asyncio
8 +async def send_get_request(endpoint: str, headers: Optional[Dict[str, Any]] = None, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
9 + """Send a GET request to the given endpoint.
10 +
11 + Args:
12 + endpoint (str): The endpoint to send the request to.
13 + params (Optional[Dict[str, Any]], optional): The parameters to send with the request. Defaults to None.
14 +
15 + Returns:
16 + Dict[str, Any]: The response from the request.
17 + """
18 + async with httpx.AsyncClient() as client:
19 + try:
20 + response = await client.get(endpoint, params=params, headers=headers)
21 + response.raise_for_status()
22 + return {"data": response.json(), "success": True, "message": "Successfully retrieved data"}
23 + except httpx.HTTPError as e:
24 + return {"success": False, "message": f"Failed to retrieve data: {e}"}
25 +
26 +async def send_post_request(endpoint: str, data: Dict[str, Any], headers: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
27 + """
28 + Send a POST request to the given endpoint.
29 + """
30 + async with httpx.AsyncClient() as client:
31 + try:
32 + logger.info(f"Sending POST request to {endpoint} with data: {data} and headers: {headers}")
33 + response = await client.post(endpoint, json=data, headers=headers)
34 +
35 + if response.status_code == 429:
36 + retry_after = int(response.headers.get("X-RateLimit-Reset", 1))
37 + logger.warning(f"Rate limit exceeded. Retrying after {retry_after} seconds.")
38 + await asyncio.sleep(retry_after)
39 + response = await client.post(endpoint, json=data, headers=headers)
40 +
41 + if response.status_code != 200:
42 + error_message = f"Request failed with status code {response.status_code}: {response.text}"
43 + logger.error(error_message)
44 + return {"success": False, "message": error_message}
45 +
46 + content_type = response.headers.get('Content-Type', '')
47 + logger.info(f"Content-Type: {content_type}")
48 +
49 + if 'application/json' in content_type:
50 + logger.info(f"Successfully retrieved data from {endpoint} with data: {data} and headers: {headers}")
51 + return {"data": response.json(), "success": True, "message": "Successfully retrieved data"}
52 + else:
53 + logger.info(f"Successfully retrieved data from {endpoint} with data: {data} and headers: {headers}")
54 + return {"data": response.content, "success": True, "message": "Successfully retrieved data"}
55 +
56 + except Exception as e:
57 + error_message = f"Failed to send POST request: {str(e)}"
58 + logger.error(error_message)
59 + return {"success": False, "message": error_message}
60 +
backend/app/integrations/utils/event_shipper.py
+1 -1
@@ -13,7 +13,7 @@ async def get_gelf_logger():
13 logger.error(f"Failed to initialize GelfLogger: {e}")
14 raise HTTPException(status_code=500, detail=f"Failed to initialize GelfLogger: {e}")
15
16 -async def event_shipper_test(message: EventShipperPayload) -> EventShipperPayloadResponse:
16 +async def event_shipper(message: EventShipperPayload) -> EventShipperPayloadResponse:
17 """
18 Test the log shipper.
19 """
backend/app/integrations/utils/schema.py
+46
@@ -223,4 +223,50 @@ class EventShipperPayloadResponse(BaseModel):
223 description="The Event Shipper response data.",
224 )
225
226 +######### ! SEND TO ALERT CREATION ! #########
227 +class QueryString(BaseModel):
228 + query: str
229
230 +class Query(BaseModel):
231 + query_string: QueryString
232 +
233 +
234 +class Filter(BaseModel):
235 + query: Query
236 +
237 +
238 +class KibanaDiscoverTimeDelta(BaseModel):
239 + minutes: int
240 +
241 +
242 +class Realert(BaseModel):
243 + minutes: int
244 +
245 +
246 +class PraecoAlertConfig(BaseModel):
247 + alert: List[str]
248 + filter: List[Filter]
249 + generate_kibana_discover_url: bool
250 + http_post_ignore_ssl_errors: bool
251 + http_post_timeout: int
252 + http_post_url: List[str]
253 + import_config: str = Field(..., alias="import") # Using alias
254 + index: str
255 + is_enabled: bool
256 + kibana_discover_from_timedelta: KibanaDiscoverTimeDelta
257 + kibana_discover_to_timedelta: KibanaDiscoverTimeDelta
258 + match_enhancements: List[str]
259 + name: str
260 + realert: Realert
261 + timestamp_field: str
262 + timestamp_type: str
263 + type: str
264 + use_strftime_index: bool
265 +
266 + class Config:
267 + allow_population_by_field_name = True
268 +
269 +
270 +class PraecoProvisionAlertResponse(BaseModel):
271 + success: bool
272 + message: str
backend/app/routers/alert_creation.py
+2
@@ -1,9 +1,11 @@
1 from fastapi import APIRouter
2
3 from app.integrations.alert_creation.general.routes.alert import general_alerts_router
4 +from app.integrations.alert_creation.office365.routes.alert import office365_alerts_router
5
6 # Instantiate the APIRouter
7 router = APIRouter()
8
9 # Include the Ask SocFortress related routes
10 router.include_router(general_alerts_router, prefix="/api/v1/alerts/general", tags=["Alert Creation"])
11 +router.include_router(office365_alerts_router, prefix="/api/v1/alerts/office365", tags=["Alert Creation"])
backend/app/routers/mimecast.py new
+11
@@ -0,0 +1,11 @@
1 +from fastapi import APIRouter
2 +
3 +from app.integrations.mimecast.routes.mimecast import integration_mimecast_router
4 +from app.integrations.mimecast.routes.provision import integration_mimecast_scheduler_router
5 +
6 +# Instantiate the APIRouter
7 +router = APIRouter()
8 +
9 +# Include the Mimecast related routes
10 +router.include_router(integration_mimecast_router, prefix="/mimecast", tags=["mimecast"])
11 +router.include_router(integration_mimecast_scheduler_router, prefix="/mimecast", tags=["mimecast"])
backend/app/routers/office365.py new
+10
@@ -0,0 +1,10 @@
1 +from fastapi import APIRouter
2 +
3 +from app.integrations.office365.routes.provision import integration_office365_router
4 +
5 +
6 +# Instantiate the APIRouter
7 +router = APIRouter()
8 +
9 +# Include the Office365 related routes
10 +router.include_router(integration_office365_router, prefix="/office365", tags=["Office365"])
backend/app/schedulers/models/scheduler.py
+7 -1
@@ -1,6 +1,6 @@
1 from datetime import datetime
2 from typing import Optional
3 -
3 +from pydantic import BaseModel
4 from sqlmodel import Field
5 from sqlmodel import SQLModel
6
@@ -12,3 +12,9 @@ class JobMetadata(SQLModel, table=True):
12 last_success: Optional[datetime] = None
13 time_interval: int # The frequency of the job in minutes
14 enabled: bool # Indicates if the job is active or not
15 +
16 +
17 +class CreateSchedulerRequest(BaseModel):
18 + function_name: str
19 + job_id: str
20 + time_interval: int
backend/app/schedulers/scheduler.py
+172 -12
@@ -3,32 +3,192 @@ from apscheduler.schedulers.asyncio import AsyncIOScheduler
3
4 from app.db.db_session import SyncSessionLocal
5 from app.db.db_session import sync_engine
6 -from app.schedulers.models.scheduler import JobMetadata
6 +from app.schedulers.models.scheduler import JobMetadata, CreateSchedulerRequest
7 from app.schedulers.services.agent_sync import agent_sync
8 +from app.schedulers.services.invoke_mimecast import invoke_mimecast_integration
9 +from loguru import logger
10
11 +# def init_scheduler():
12 +# """
13 +# Initializes and configures the scheduler.
14 +
15 +# Returns:
16 +# scheduler (AsyncIOScheduler): The initialized scheduler object.
17 +# """
18 +# scheduler = AsyncIOScheduler()
19 +# jobstores = {"default": SQLAlchemyJobStore(engine=sync_engine)}
20 +# scheduler.configure(jobstores=jobstores)
21 +
22 +# # Use SyncSessionLocal to create a synchronous session
23 +# with SyncSessionLocal() as session:
24 +# # Synchronous ORM operations
25 +# job_metadata = session.query(JobMetadata).filter_by(job_id="agent_sync").one_or_none()
26 +# #invoke_mimecast_job_metadata = session.query(JobMetadata).filter_by(job_id="invoke_mimecast_integration").one_or_none()
27 +# if not job_metadata:
28 +# job_metadata = JobMetadata(job_id="agent_sync", last_success=None, time_interval=60, enabled=True)
29 +# #invoke_mimecast_job_metadata = JobMetadata(job_id="invoke_mimecast_integration", last_success=None, time_interval=60, enabled=True)
30 +# session.add(job_metadata)
31 +# #session.add(invoke_mimecast_job_metadata)
32 +# else:
33 +# job_metadata.time_interval = 1
34 +# job_metadata.enabled = True
35 +# session.commit()
36 +
37 +# scheduler.add_job(agent_sync, "interval", minutes=60, id="agent_sync", replace_existing=True)
38 +# #scheduler.add_job(invoke_mimecast_integration, "interval", minutes=1, id="invoke_mimecast_integration", replace_existing=True)
39 +# return scheduler
40 +
41 +
42 +# async def add_scheduler_jobs(create_scheduler_request: CreateSchedulerRequest):
43 +# """
44 +# Adds a job to the scheduler.
45 +
46 +# Args:
47 +# create_scheduler_request (CreateSchedulerRequest): The request object containing the job details.
48 +# """
49 +# scheduler = init_scheduler()
50 +# logger.info(f"create_scheduler_request: {create_scheduler_request}")
51 +
52 +# # Assuming 'get_function_by_name' fetches the actual function based on a string name.
53 +# job_function = get_function_by_name(create_scheduler_request.function_name)
54 +
55 +# scheduler.add_job(
56 +# job_function,
57 +# "interval",
58 +# minutes=create_scheduler_request.time_interval,
59 +# id=create_scheduler_request.job_id,
60 +# replace_existing=True,
61 +# )
62 +# if not scheduler.running:
63 +# scheduler.start()
64 +
65 +# def init_scheduler():
66 +# """
67 +# Initializes and returns an AsyncIO scheduler.
68 +# """
69 +# return AsyncIOScheduler()
70 +
71 +# def get_function_by_name(function_name: str):
72 +# """
73 +# Returns a function object based on its name.
74 +
75 +# Args:
76 +# function_name (str): The name of the function to retrieve.
77 +
78 +# Returns:
79 +# Callable: The function object.
80 +# """
81 +# # Example implementation
82 +# if function_name == "invoke_mimecast_integration":
83 +# return invoke_mimecast_integration
84 +# else:
85 +# raise ValueError(f"Function {function_name} not found")
86
87 def init_scheduler():
88 """
89 Initializes and configures the scheduler.
13 -
14 - Returns:
15 - scheduler (AsyncIOScheduler): The initialized scheduler object.
90 """
91 scheduler = AsyncIOScheduler()
92 jobstores = {"default": SQLAlchemyJobStore(engine=sync_engine)}
93 scheduler.configure(jobstores=jobstores)
94
21 - # Use SyncSessionLocal to create a synchronous session
95 + initialize_job_metadata()
96 + schedule_enabled_jobs(scheduler)
97 +
98 + if not scheduler.running:
99 + scheduler.start()
100 +
101 + return scheduler
102 +
103 +def initialize_job_metadata():
104 + """
105 + Initializes job metadata from the database.
106 + """
107 + with SyncSessionLocal() as session:
108 + # Implement logic to initialize or update job metadata.
109 + # Example: Check and add metadata for each known job
110 + known_jobs = [
111 + {"job_id": "agent_sync", "time_interval": 60, "function": agent_sync},
112 + #{"job_id": "invoke_mimecast_integration", "time_interval": 5, "function": invoke_mimecast_integration}
113 + ]
114 + for job in known_jobs:
115 + job_metadata = session.query(JobMetadata).filter_by(job_id=job["job_id"]).one_or_none()
116 + if not job_metadata:
117 + job_metadata = JobMetadata(job_id=job["job_id"], last_success=None, time_interval=job["time_interval"], enabled=True)
118 + session.add(job_metadata)
119 + else:
120 + job_metadata.time_interval = job["time_interval"]
121 + job_metadata.enabled = True
122 + session.commit()
123 +
124 +def schedule_enabled_jobs(scheduler):
125 + """
126 + Schedules jobs that are enabled in the database.
127 + """
128 with SyncSessionLocal() as session:
23 - # Synchronous ORM operations
24 - job_metadata = session.query(JobMetadata).filter_by(job_id="agent_sync").one_or_none()
129 + job_metadatas = session.query(JobMetadata).filter_by(enabled=True).all()
130 + for job_metadata in job_metadatas:
131 + try:
132 + job_function = get_function_by_name(job_metadata.job_id)
133 + scheduler.add_job(
134 + job_function,
135 + "interval",
136 + minutes=job_metadata.time_interval,
137 + id=job_metadata.job_id,
138 + replace_existing=True,
139 + )
140 + except ValueError as e:
141 + logger.error(f"Error scheduling job: {e}")
142 +
143 +def get_function_by_name(function_name: str):
144 + """
145 + Returns a function object based on its name.
146 + """
147 + function_map = {
148 + "agent_sync": agent_sync,
149 + "invoke_mimecast_integration": invoke_mimecast_integration,
150 + # Add other function mappings here
151 + }
152 + return function_map.get(function_name, lambda: ValueError(f"Function {function_name} not found"))
153 +
154 +async def add_scheduler_jobs(create_scheduler_request: CreateSchedulerRequest):
155 + """
156 + Adds a job to the scheduler.
157 +
158 + Args:
159 + create_scheduler_request (CreateSchedulerRequest): The request object containing the job details.
160 + """
161 + scheduler = init_scheduler()
162 + logger.info(f"create_scheduler_request: {create_scheduler_request}")
163 +
164 + job_function = get_function_by_name(create_scheduler_request.function_name)
165 +
166 + scheduler.add_job(
167 + job_function,
168 + "interval",
169 + minutes=create_scheduler_request.time_interval,
170 + id=create_scheduler_request.job_id,
171 + replace_existing=True,
172 + )
173 +
174 + await add_job_metadata(create_scheduler_request)
175 +
176 + if not scheduler.running:
177 + scheduler.start()
178 +
179 +async def add_job_metadata(create_scheduler_request: CreateSchedulerRequest):
180 + """
181 + Adds a job to the scheduler.
182 +
183 + Args:
184 + create_scheduler_request (CreateSchedulerRequest): The request object containing the job details.
185 + """
186 + with SyncSessionLocal() as session:
187 + job_metadata = session.query(JobMetadata).filter_by(job_id=create_scheduler_request.job_id).one_or_none()
188 if not job_metadata:
26 - job_metadata = JobMetadata(job_id="agent_sync", last_success=None, time_interval=60, enabled=True)
189 + job_metadata = JobMetadata(job_id=create_scheduler_request.job_id, last_success=None, time_interval=create_scheduler_request.time_interval, enabled=True)
190 session.add(job_metadata)
191 else:
29 - job_metadata.time_interval = 1
192 + job_metadata.time_interval = create_scheduler_request.time_interval
193 job_metadata.enabled = True
194 session.commit()
32 -
33 - scheduler.add_job(agent_sync, "interval", minutes=60, id="agent_sync", replace_existing=True)
34 - return scheduler
backend/app/schedulers/services/agent_sync.py
+26
@@ -6,6 +6,8 @@ import os
6 from app.db.db_session import get_sync_db_session
7 from app.schedulers.models.scheduler import JobMetadata
8 from app.schedulers.utils.universal import scheduler_login
9 +from app.integrations.mimecast.routes.mimecast import invoke_mimecast_route
10 +from app.integrations.mimecast.schema.mimecast import MimecastRequest
11
12 load_dotenv()
13
@@ -44,3 +46,27 @@ def agent_sync():
46 else:
47 # Handle the case where job_metadata does not exist
48 print("JobMetadata for 'agent_sync' not found.")
49 +
50 +async def invoke_mimecast_integration():
51 + """
52 + Invokes the Mimecast integration.
53 + """
54 + # Use get_sync_db_session to create and manage a synchronous session
55 + with get_sync_db_session() as session:
56 + # Synchronous ORM operations
57 + job_metadata = session.query(JobMetadata).filter_by(job_id="invoke_mimecast_integration").one_or_none()
58 + if job_metadata:
59 + job_metadata.last_success = datetime.utcnow()
60 + session.add(job_metadata)
61 + session.commit()
62 + else:
63 + # Handle the case where job_metadata does not exist
64 + print("JobMetadata for 'invoke_mimecast_integration' not found.")
65 + # Invoke the Mimecast integration
66 + await invoke_mimecast_route(
67 + MimecastRequest(
68 + customer_code="",
69 + integration_name="Mimecast"
70 + ),
71 + session,
72 + )
backend/app/schedulers/services/invoke_mimecast.py new
+50
@@ -0,0 +1,50 @@
1 +from datetime import datetime
2 +
3 +import requests
4 +from dotenv import load_dotenv
5 +import os
6 +from app.db.db_session import get_db_session, get_sync_db_session
7 +from app.schedulers.models.scheduler import JobMetadata
8 +from app.integrations.models.customer_integration_settings import CustomerIntegrations
9 +from app.schedulers.utils.universal import scheduler_login
10 +from app.integrations.mimecast.routes.mimecast import invoke_mimecast_route
11 +from app.integrations.mimecast.schema.mimecast import MimecastRequest, MimecastResponse
12 +from app.db.db_session import AsyncSession
13 +from app.schedulers.models.scheduler import JobMetadata
14 +from loguru import logger
15 +from sqlalchemy import select
16 +
17 +load_dotenv()
18 +
19 +
20 +async def invoke_mimecast_integration() -> MimecastResponse:
21 + """
22 + Invokes the Mimecast integration.
23 + """
24 + customer_codes = []
25 + async with get_db_session() as session:
26 + stmt = select(CustomerIntegrations).where(CustomerIntegrations.integration_service_name == "Mimecast")
27 + result = await session.execute(stmt)
28 + customer_codes = [row.customer_code for row in result.scalars()]
29 + logger.info(f"customer_codes: {customer_codes}")
30 + for customer_code in customer_codes:
31 + await invoke_mimecast_route(
32 + MimecastRequest(
33 + customer_code=customer_code,
34 + integration_name="Mimecast"
35 + ),
36 + session,
37 + )
38 + # Close the session
39 + await session.close()
40 + with get_sync_db_session() as session:
41 + # Synchronous ORM operations
42 + job_metadata = session.query(JobMetadata).filter_by(job_id="invoke_mimecast_integration").one_or_none()
43 + if job_metadata:
44 + job_metadata.last_success = datetime.utcnow()
45 + session.add(job_metadata)
46 + session.commit()
47 + else:
48 + # Handle the case where job_metadata does not exist
49 + print("JobMetadata for 'invoke_mimecast_integration' not found.")
50 + return MimecastResponse(success=True, message="Mimecast integration invoked.")
backend/app/utils.py
+18
@@ -578,6 +578,24 @@ async def get_customer_alert_settings(customer_code: str, session: AsyncSession)
578 return settings
579 return None
580
581 +async def get_customer_alert_settings_office365(office365_organization_id: str, session: AsyncSession) -> Optional[AlertCreationSettings]:
582 + """
583 + Retrieve the alert creation settings for a specific customer.
584 +
585 + Args:
586 + office365_organization_id (str): The Office365 Organization ID of the customer.
587 + session (AsyncSession): The database session.
588 +
589 + Returns:
590 + Optional[AlertCreationSettings]: The alert creation settings for the customer, or None if not found.
591 + """
592 + result = await session.execute(select(AlertCreationSettings).filter(AlertCreationSettings.office365_organization_id == office365_organization_id))
593 + settings = result.scalars().first()
594 +
595 + if settings:
596 + return settings
597 + return None
598 +
599
600 async def get_customer_alert_event_configs(
601 customer_code: str,
backend/copilot.py
+4 -1
@@ -44,6 +44,8 @@ from app.routers import wazuh_indexer
44 from app.routers import wazuh_manager
45 from app.routers import log_shipper_test
46 from app.routers import integrations
47 +from app.routers import mimecast
48 +from app.routers import office365
49 from app.schedulers.scheduler import init_scheduler
50
51 auth_handler = AuthHandler()
@@ -100,7 +102,8 @@ app.include_router(alert_creation.router)
102 app.include_router(alert_creation_settings.router)
103 app.include_router(log_shipper_test.router)
104 app.include_router(integrations.router)
103 -
105 +app.include_router(office365.router)
106 +app.include_router(mimecast.router)
107
108 @app.on_event("startup")
109 async def init_db():
package-lock.json
+609 -1179
@@ -9,13 +9,14 @@
9 "version": "1.0.0",
10 "dependencies": {
11 "@ajoelp/json-to-formdata": "^1.5.0",
12 + "@f3ve/vue-markdown-it": "^0.2.0",
13 "@fontsource/jetbrains-mono": "^5.0.18",
14 "@fontsource/lexend": "^5.0.18",
15 "@fontsource/public-sans": "^5.0.16",
16 "@popperjs/core": "^2.11.8",
16 - "@vueuse/components": "^10.7.1",
17 - "@vueuse/core": "^10.7.1",
18 - "apexcharts": "^3.45.1",
17 + "@vueuse/components": "^10.7.2",
18 + "@vueuse/core": "^10.7.2",
19 + "apexcharts": "^3.45.2",
20 "bytes": "^3.1.2",
21 "colord": "^2.9.3",
22 "crypto-js": "^4.2.0",
@@ -25,6 +26,7 @@
26 "jose": "^5.2.0",
27 "js-md5": "^0.8.3",
28 "lodash": "^4.17.21",
29 + "markdown-it-highlightjs": "^4.0.1",
30 "mitt": "^3.0.1",
31 "naive-ui": "^2.37.3",
32 "password-validator": "^5.3.0",
@@ -32,7 +34,7 @@
34 "pinia-plugin-persistedstate": "^3.2.1",
35 "secure-ls": "^1.2.6",
36 "validator": "^13.11.0",
35 - "vue": "^3.4.11",
37 + "vue": "^3.4.15",
38 "vue-advanced-cropper": "^2.8.8",
39 "vue-highlight-words": "^3.0.1",
40 "vue-i18n": "^9.9.0",
@@ -50,7 +52,7 @@
52 "@types/inquirer": "^9.0.7",
53 "@types/jsdom": "^21.1.6",
54 "@types/lodash": "^4.14.202",
53 - "@types/node": "^20.11.0",
55 + "@types/node": "^20.11.5",
56 "@types/validator": "^13.11.8",
57 "@vitejs/plugin-vue": "^5.0.3",
58 "@vitejs/plugin-vue-jsx": "^3.1.0",
@@ -58,19 +60,19 @@
60 "@vue/eslint-config-typescript": "^12.0.0",
61 "@vue/test-utils": "^2.4.3",
62 "@vue/tsconfig": "^0.5.1",
61 - "autoprefixer": "^10.4.16",
62 - "cypress": "^13.6.2",
63 + "autoprefixer": "^10.4.17",
64 + "cypress": "^13.6.3",
65 "eslint": "^8.56.0",
66 "eslint-plugin-cypress": "^2.15.1",
65 - "eslint-plugin-vue": "^9.20.0",
67 + "eslint-plugin-vue": "^9.20.1",
68 "fs-extra": "^11.2.0",
67 - "jsdom": "^23.2.0",
69 + "jsdom": "^24.0.0",
70 "json5": "^2.2.3",
71 "npm-run-all": "^4.1.5",
72 "picocolors": "^1.0.0",
73 "postcss": "^8.4.33",
72 - "prettier": "^3.2.1",
73 - "sass": "^1.69.7",
74 + "prettier": "^3.2.4",
75 + "sass": "^1.70.0",
76 "start-server-and-test": "^2.0.3",
77 "tailwind-config-viewer": "^1.7.3",
78 "tailwindcss": "^3.4.1",
@@ -78,11 +80,11 @@
80 "ts-node": "^10.9.2",
81 "typescript": "~5.2.2",
82 "unplugin-vue-components": "^0.26.0",
81 - "vite": "^5.0.11",
82 - "vite-bundle-analyzer": "^0.6.1",
83 + "vite": "^5.0.12",
84 + "vite-bundle-analyzer": "^0.7.0",
85 "vite-bundle-visualizer": "^1.0.0",
86 "vite-svg-loader": "^5.1.0",
85 - "vitest": "^1.2.0",
87 + "vitest": "^1.2.1",
88 "vue-tsc": "^1.8.27"
89 },
90 "engines": {
@@ -93,7 +95,6 @@
95 "version": "1.2.6",
96 "resolved": "https://registry.npmjs.org/@aashutoshrathi/word-wrap/-/word-wrap-1.2.6.tgz",
97 "integrity": "sha512-1Yjs2SvM8TflER/OD3cOjhWWOZb58A2t7wpE2S9XfBYTiIl+XFhQG2bjy4Pu1I+EAlCNUzRDYDdFwFYUKvXcIA==",
96 - "dev": true,
98 "engines": {
99 "node": ">=0.10.0"
100 }
@@ -150,22 +151,10 @@
151 "version": "0.7.7",
152 "resolved": "https://registry.npmjs.org/@antfu/utils/-/utils-0.7.7.tgz",
153 "integrity": "sha512-gFPqTG7otEJ8uP6wrhDv6mqwGWYZKNvAcCq6u9hOj0c+IKCEsY4L1oC9trPq2SaWIzAfHvqfBDxF591JkMf+kg==",
153 - "dev": true,
154 "funding": {
155 "url": "https://github.com/sponsors/antfu"
156 }
157 },
158 - "node_modules/@asamuzakjp/dom-selector": {
159 - "version": "2.0.2",
160 - "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-2.0.2.tgz",
161 - "integrity": "sha512-x1KXOatwofR6ZAYzXRBL5wrdV0vwNxlTCK9NCuLqAzQYARqGcvFwiJA6A1ERuh+dgeA4Dxm3JBYictIes+SqUQ==",
162 - "dev": true,
163 - "dependencies": {
164 - "bidi-js": "^1.0.3",
165 - "css-tree": "^2.3.1",
166 - "is-potential-custom-element-name": "^1.0.1"
167 - }
168 - },
158 "node_modules/@babel/code-frame": {
159 "version": "7.23.5",
160 "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.23.5.tgz",
@@ -218,6 +207,15 @@
207 "url": "https://opencollective.com/babel"
208 }
209 },
210 + "node_modules/@babel/core/node_modules/semver": {
211 + "version": "6.3.1",
212 + "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
213 + "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
214 + "dev": true,
215 + "bin": {
216 + "semver": "bin/semver.js"
217 + }
218 + },
219 "node_modules/@babel/generator": {
220 "version": "7.23.6",
221 "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.23.6.tgz",
@@ -261,6 +259,15 @@
259 "node": ">=6.9.0"
260 }
261 },
262 + "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
263 + "version": "6.3.1",
264 + "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
265 + "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
266 + "dev": true,
267 + "bin": {
268 + "semver": "bin/semver.js"
269 + }
270 + },
271 "node_modules/@babel/helper-create-class-features-plugin": {
272 "version": "7.23.7",
273 "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.23.7.tgz",
@@ -284,6 +291,15 @@
291 "@babel/core": "^7.0.0"
292 }
293 },
294 + "node_modules/@babel/helper-create-class-features-plugin/node_modules/semver": {
295 + "version": "6.3.1",
296 + "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
297 + "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
298 + "dev": true,
299 + "bin": {
300 + "semver": "bin/semver.js"
301 + }
302 + },
303 "node_modules/@babel/helper-environment-visitor": {
304 "version": "7.22.20",
305 "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.22.20.tgz",
@@ -595,6 +611,15 @@
611 "node": ">=6.9.0"
612 }
613 },
614 + "node_modules/@babel/traverse/node_modules/globals": {
615 + "version": "11.12.0",
616 + "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
617 + "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
618 + "dev": true,
619 + "engines": {
620 + "node": ">=4"
621 + }
622 + },
623 "node_modules/@babel/types": {
624 "version": "7.23.6",
625 "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.23.6.tgz",
@@ -636,7 +661,6 @@
661 },
662 "node_modules/@clack/prompts/node_modules/is-unicode-supported": {
663 "version": "1.3.0",
639 - "dev": true,
664 "inBundle": true,
665 "license": "MIT",
666 "engines": {
@@ -1119,7 +1143,6 @@
1143 "version": "4.4.0",
1144 "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.4.0.tgz",
1145 "integrity": "sha512-1/sA4dwrzBAyeUoQ6oxahHKmrZvsnLCg4RfxW3ZFGGmQkSNQPFNLV9CUEFQP1x9EYXHTo5p6xdhZM1Ne9p/AfA==",
1122 - "dev": true,
1146 "dependencies": {
1147 "eslint-visitor-keys": "^3.3.0"
1148 },
@@ -1134,7 +1157,6 @@
1157 "version": "4.10.0",
1158 "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.10.0.tgz",
1159 "integrity": "sha512-Cu96Sd2By9mCNTx2iyKOmq10v22jUVQv0lQnlGNy16oE9589yE+QADPbrMGCkA51cKZSg3Pu/aTJVTGfL/qjUA==",
1137 - "dev": true,
1160 "engines": {
1161 "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
1162 }
@@ -1143,7 +1165,6 @@
1165 "version": "2.1.4",
1166 "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-2.1.4.tgz",
1167 "integrity": "sha512-269Z39MS6wVJtsoUl10L60WdkhJVdPG24Q4eZTH3nnF6lpvSShEK3wQjDX9JRWAUPvPh7COouPpU9IrqaZFvtQ==",
1146 - "dev": true,
1168 "dependencies": {
1169 "ajv": "^6.12.4",
1170 "debug": "^4.3.2",
@@ -1166,32 +1187,15 @@
1187 "version": "1.1.11",
1188 "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
1189 "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
1169 - "dev": true,
1190 "dependencies": {
1191 "balanced-match": "^1.0.0",
1192 "concat-map": "0.0.1"
1193 }
1194 },
1175 - "node_modules/@eslint/eslintrc/node_modules/globals": {
1176 - "version": "13.24.0",
1177 - "resolved": "https://registry.npmjs.org/globals/-/globals-13.24.0.tgz",
1178 - "integrity": "sha512-AhO5QUcj8llrbG09iWhPU2B204J1xnPeL8kQmVorSsy+Sjj1sk8gIyh6cUocGmH4L0UuhAJy+hJMRA4mgA4mFQ==",
1179 - "dev": true,
1180 - "dependencies": {
1181 - "type-fest": "^0.20.2"
1182 - },
1183 - "engines": {
1184 - "node": ">=8"
1185 - },
1186 - "funding": {
1187 - "url": "https://github.com/sponsors/sindresorhus"
1188 - }
1189 - },
1195 "node_modules/@eslint/eslintrc/node_modules/minimatch": {
1196 "version": "3.1.2",
1197 "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
1198 "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
1194 - "dev": true,
1199 "dependencies": {
1200 "brace-expansion": "^1.1.7"
1201 },
@@ -1199,27 +1203,56 @@
1203 "node": "*"
1204 }
1205 },
1202 - "node_modules/@eslint/eslintrc/node_modules/type-fest": {
1203 - "version": "0.20.2",
1204 - "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
1205 - "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
1206 - "dev": true,
1207 - "engines": {
1208 - "node": ">=10"
1209 - },
1210 - "funding": {
1211 - "url": "https://github.com/sponsors/sindresorhus"
1212 - }
1213 - },
1206 "node_modules/@eslint/js": {
1207 "version": "8.56.0",
1208 "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.56.0.tgz",
1209 "integrity": "sha512-gMsVel9D7f2HLkBma9VbtzZRehRogVRfbr++f06nL2vnCGCNlzOD+/MUov/F4p8myyAHspEhVobgjpX64q5m6A==",
1218 - "dev": true,
1210 "engines": {
1211 "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
1212 }
1213 },
1214 + "node_modules/@f3ve/eslint-config": {
1215 + "version": "1.0.6",
1216 + "resolved": "https://registry.npmjs.org/@f3ve/eslint-config/-/eslint-config-1.0.6.tgz",
1217 + "integrity": "sha512-DVLPAVZskaOUY6Gu/1VFaL0gGyY3VhjZBVExZVde2siwwgdwt+8XDSupLll0arKqVv4bqO2fRK21QomN3jy2yg==",
1218 + "funding": [
1219 + {
1220 + "type": "GitHub Sponsors",
1221 + "url": "https://github.com/sponsors/f3ve"
1222 + },
1223 + {
1224 + "type": "Buy me a Coffee",
1225 + "url": "https://www.buymeacoffee.com/f3ve"
1226 + }
1227 + ],
1228 + "dependencies": {
1229 + "@eslint/js": "^8.50.0",
1230 + "@typescript-eslint/eslint-plugin": "^6.7.3",
1231 + "@typescript-eslint/parser": "^6.7.3",
1232 + "@unocss/eslint-config": "^0.56.4",
1233 + "eslint-config-prettier": "^9.0.0",
1234 + "eslint-define-config": "^1.23.0",
1235 + "eslint-plugin-prettier": "^5.0.0",
1236 + "eslint-plugin-vue": "^9.17.0",
1237 + "globals": "^13.22.0",
1238 + "vue-eslint-parser": "^9.3.1"
1239 + },
1240 + "peerDependencies": {
1241 + "eslint": ">=8.0.0"
1242 + }
1243 + },
1244 + "node_modules/@f3ve/vue-markdown-it": {
1245 + "version": "0.2.0",
1246 + "resolved": "https://registry.npmjs.org/@f3ve/vue-markdown-it/-/vue-markdown-it-0.2.0.tgz",
1247 + "integrity": "sha512-ILDL0vfhl+Z9FxRm+iqZBrgpMpRc0SVfdE5/YEqCVX3VAz7fWIwJc6zmM2sUGtV6CaLY2fSJzX94v1znd7O24Q==",
1248 + "dependencies": {
1249 + "@f3ve/eslint-config": "^1.0.3",
1250 + "markdown-it": "^13.0.2"
1251 + },
1252 + "peerDependencies": {
1253 + "vue": "^3.3.4"
1254 + }
1255 + },
1256 "node_modules/@fontsource/jetbrains-mono": {
1257 "version": "5.0.18",
1258 "resolved": "https://registry.npmjs.org/@fontsource/jetbrains-mono/-/jetbrains-mono-5.0.18.tgz",
@@ -1254,7 +1287,6 @@
1287 "version": "0.11.14",
1288 "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.14.tgz",
1289 "integrity": "sha512-3T8LkOmg45BV5FICb15QQMsyUSWrQ8AygVfC7ZG32zOalnqrilm018ZVCw0eapXux8FtA33q8PSRSstjee3jSg==",
1257 - "dev": true,
1290 "dependencies": {
1291 "@humanwhocodes/object-schema": "^2.0.2",
1292 "debug": "^4.3.1",
@@ -1268,7 +1300,6 @@
1300 "version": "1.1.11",
1301 "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
1302 "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
1271 - "dev": true,
1303 "dependencies": {
1304 "balanced-match": "^1.0.0",
1305 "concat-map": "0.0.1"
@@ -1278,7 +1309,6 @@
1309 "version": "3.1.2",
1310 "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
1311 "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
1281 - "dev": true,
1312 "dependencies": {
1313 "brace-expansion": "^1.1.7"
1314 },
@@ -1290,7 +1320,6 @@
1320 "version": "1.0.1",
1321 "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
1322 "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
1293 - "dev": true,
1323 "engines": {
1324 "node": ">=12.22"
1325 },
@@ -1302,8 +1331,7 @@
1331 "node_modules/@humanwhocodes/object-schema": {
1332 "version": "2.0.2",
1333 "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.2.tgz",
1305 - "integrity": "sha512-6EwiSjwWYP7pTckG6I5eyFANjPhmPjUX9JRLUSfNPC7FX7zK9gyZAfUEaECL6ALTpGX5AjnBq3C9XmVWPitNpw==",
1306 - "dev": true
1334 + "integrity": "sha512-6EwiSjwWYP7pTckG6I5eyFANjPhmPjUX9JRLUSfNPC7FX7zK9gyZAfUEaECL6ALTpGX5AjnBq3C9XmVWPitNpw=="
1335 },
1336 "node_modules/@iconify/types": {
1337 "version": "2.0.0",
@@ -1518,7 +1546,6 @@
1546 "version": "2.1.5",
1547 "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
1548 "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
1521 - "dev": true,
1549 "dependencies": {
1550 "@nodelib/fs.stat": "2.0.5",
1551 "run-parallel": "^1.1.9"
@@ -1531,7 +1558,6 @@
1558 "version": "2.0.5",
1559 "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
1560 "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
1534 - "dev": true,
1561 "engines": {
1562 "node": ">= 8"
1563 }
@@ -1540,7 +1566,6 @@
1566 "version": "1.2.8",
1567 "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
1568 "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
1543 - "dev": true,
1569 "dependencies": {
1570 "@nodelib/fs.scandir": "2.1.5",
1571 "fastq": "^1.6.0"
@@ -1617,39 +1642,6 @@
1642 "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
1643 }
1644 },
1620 - "node_modules/@npmcli/config/node_modules/lru-cache": {
1621 - "version": "6.0.0",
1622 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
1623 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
1624 - "dev": true,
1625 - "dependencies": {
1626 - "yallist": "^4.0.0"
1627 - },
1628 - "engines": {
1629 - "node": ">=10"
1630 - }
1631 - },
1632 - "node_modules/@npmcli/config/node_modules/semver": {
1633 - "version": "7.5.4",
1634 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
1635 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
1636 - "dev": true,
1637 - "dependencies": {
1638 - "lru-cache": "^6.0.0"
1639 - },
1640 - "bin": {
1641 - "semver": "bin/semver.js"
1642 - },
1643 - "engines": {
1644 - "node": ">=10"
1645 - }
1646 - },
1647 - "node_modules/@npmcli/config/node_modules/yallist": {
1648 - "version": "4.0.0",
1649 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
1650 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
1651 - "dev": true
1652 - },
1645 "node_modules/@npmcli/fs": {
1646 "version": "3.1.0",
1647 "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-3.1.0.tgz",
@@ -1662,39 +1654,6 @@
1654 "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
1655 }
1656 },
1665 - "node_modules/@npmcli/fs/node_modules/lru-cache": {
1666 - "version": "6.0.0",
1667 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
1668 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
1669 - "dev": true,
1670 - "dependencies": {
1671 - "yallist": "^4.0.0"
1672 - },
1673 - "engines": {
1674 - "node": ">=10"
1675 - }
1676 - },
1677 - "node_modules/@npmcli/fs/node_modules/semver": {
1678 - "version": "7.5.4",
1679 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
1680 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
1681 - "dev": true,
1682 - "dependencies": {
1683 - "lru-cache": "^6.0.0"
1684 - },
1685 - "bin": {
1686 - "semver": "bin/semver.js"
1687 - },
1688 - "engines": {
1689 - "node": ">=10"
1690 - }
1691 - },
1692 - "node_modules/@npmcli/fs/node_modules/yallist": {
1693 - "version": "4.0.0",
1694 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
1695 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
1696 - "dev": true
1697 - },
1657 "node_modules/@npmcli/git": {
1658 "version": "5.0.4",
1659 "resolved": "https://registry.npmjs.org/@npmcli/git/-/git-5.0.4.tgz",
@@ -1732,33 +1691,6 @@
1691 "node": "14 || >=16.14"
1692 }
1693 },
1735 - "node_modules/@npmcli/git/node_modules/semver": {
1736 - "version": "7.5.4",
1737 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
1738 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
1739 - "dev": true,
1740 - "dependencies": {
1741 - "lru-cache": "^6.0.0"
1742 - },
1743 - "bin": {
1744 - "semver": "bin/semver.js"
1745 - },
1746 - "engines": {
1747 - "node": ">=10"
1748 - }
1749 - },
1750 - "node_modules/@npmcli/git/node_modules/semver/node_modules/lru-cache": {
1751 - "version": "6.0.0",
1752 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
1753 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
1754 - "dev": true,
1755 - "dependencies": {
1756 - "yallist": "^4.0.0"
1757 - },
1758 - "engines": {
1759 - "node": ">=10"
1760 - }
1761 - },
1694 "node_modules/@npmcli/git/node_modules/which": {
1695 "version": "4.0.0",
1696 "resolved": "https://registry.npmjs.org/which/-/which-4.0.0.tgz",
@@ -1774,12 +1706,6 @@
1706 "node": "^16.13.0 || >=18.0.0"
1707 }
1708 },
1777 - "node_modules/@npmcli/git/node_modules/yallist": {
1778 - "version": "4.0.0",
1779 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
1780 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
1781 - "dev": true
1782 - },
1709 "node_modules/@npmcli/installed-package-contents": {
1710 "version": "2.0.2",
1711 "resolved": "https://registry.npmjs.org/@npmcli/installed-package-contents/-/installed-package-contents-2.0.2.tgz",
@@ -1922,10 +1848,9 @@
1848 }
1849 },
1850 "node_modules/@pkgr/core": {
1925 - "version": "0.1.0",
1926 - "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.1.0.tgz",
1927 - "integrity": "sha512-Zwq5OCzuwJC2jwqmpEQt7Ds1DTi6BWSwoGkbb1n9pO3hzb35BoJELx7c0T23iDkBGkh2e7tvOtjF3tr3OaQHDQ==",
1928 - "dev": true,
1851 + "version": "0.1.1",
1852 + "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.1.1.tgz",
1853 + "integrity": "sha512-cq8o4cWH0ibXh9VGi5P20Tu9XF/0fFXl9EUinr9QfTM7a7p0oTA4iJRCQWppXR1Pg8dSM0UCItCkPwsk9qWWYA==",
1854 "engines": {
1855 "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
1856 },
@@ -2161,9 +2086,9 @@
2086 "dev": true
2087 },
2088 "node_modules/@sigstore/bundle": {
2164 - "version": "2.1.0",
2165 - "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-2.1.0.tgz",
2166 - "integrity": "sha512-89uOo6yh/oxaU8AeOUnVrTdVMcGk9Q1hJa7Hkvalc6G3Z3CupWk4Xe9djSgJm9fMkH69s0P0cVHUoKSOemLdng==",
2089 + "version": "2.1.1",
2090 + "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-2.1.1.tgz",
2091 + "integrity": "sha512-v3/iS+1nufZdKQ5iAlQKcCsoh0jffQyABvYIxKsZQFWc4ubuGjwZklFHpDgV6O6T7vvV78SW5NHI91HFKEcxKg==",
2092 "dev": true,
2093 "dependencies": {
2094 "@sigstore/protobuf-specs": "^0.2.1"
@@ -2172,6 +2097,15 @@
2097 "node": "^16.14.0 || >=18.0.0"
2098 }
2099 },
2100 + "node_modules/@sigstore/core": {
2101 + "version": "0.2.0",
2102 + "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-0.2.0.tgz",
2103 + "integrity": "sha512-THobAPPZR9pDH2CAvDLpkrYedt7BlZnsyxDe+Isq4ZmGfPy5juOFZq487vCU2EgKD7aHSiTfE/i7sN7aEdzQnA==",
2104 + "dev": true,
2105 + "engines": {
2106 + "node": "^16.14.0 || >=18.0.0"
2107 + }
2108 + },
2109 "node_modules/@sigstore/protobuf-specs": {
2110 "version": "0.2.1",
2111 "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.2.1.tgz",
@@ -2182,12 +2116,13 @@
2116 }
2117 },
2118 "node_modules/@sigstore/sign": {
2185 - "version": "2.2.0",
2186 - "resolved": "https://registry.npmjs.org/@sigstore/sign/-/sign-2.2.0.tgz",
2187 - "integrity": "sha512-AAbmnEHDQv6CSfrWA5wXslGtzLPtAtHZleKOgxdQYvx/s76Fk6T6ZVt7w2IGV9j1UrFeBocTTQxaXG2oRrDhYA==",
2119 + "version": "2.2.1",
2120 + "resolved": "https://registry.npmjs.org/@sigstore/sign/-/sign-2.2.1.tgz",
2121 + "integrity": "sha512-U5sKQEj+faE1MsnLou1f4DQQHeFZay+V9s9768lw48J4pKykPj34rWyI1lsMOGJ3Mae47Ye6q3HAJvgXO21rkQ==",
2122 "dev": true,
2123 "dependencies": {
2190 - "@sigstore/bundle": "^2.1.0",
2124 + "@sigstore/bundle": "^2.1.1",
2125 + "@sigstore/core": "^0.2.0",
2126 "@sigstore/protobuf-specs": "^0.2.1",
2127 "make-fetch-happen": "^13.0.0"
2128 },
@@ -2196,13 +2131,27 @@
2131 }
2132 },
2133 "node_modules/@sigstore/tuf": {
2199 - "version": "2.2.0",
2200 - "resolved": "https://registry.npmjs.org/@sigstore/tuf/-/tuf-2.2.0.tgz",
2201 - "integrity": "sha512-KKATZ5orWfqd9ZG6MN8PtCIx4eevWSuGRKQvofnWXRpyMyUEpmrzg5M5BrCpjM+NfZ0RbNGOh5tCz/P2uoRqOA==",
2134 + "version": "2.3.0",
2135 + "resolved": "https://registry.npmjs.org/@sigstore/tuf/-/tuf-2.3.0.tgz",
2136 + "integrity": "sha512-S98jo9cpJwO1mtQ+2zY7bOdcYyfVYCUaofCG6wWRzk3pxKHVAkSfshkfecto2+LKsx7Ovtqbgb2LS8zTRhxJ9Q==",
2137 "dev": true,
2138 "dependencies": {
2139 "@sigstore/protobuf-specs": "^0.2.1",
2205 - "tuf-js": "^2.1.0"
2140 + "tuf-js": "^2.2.0"
2141 + },
2142 + "engines": {
2143 + "node": "^16.14.0 || >=18.0.0"
2144 + }
2145 + },
2146 + "node_modules/@sigstore/verify": {
2147 + "version": "0.1.0",
2148 + "resolved": "https://registry.npmjs.org/@sigstore/verify/-/verify-0.1.0.tgz",
2149 + "integrity": "sha512-2UzMNYAa/uaz11NhvgRnIQf4gpLTJ59bhb8ESXaoSS5sxedfS+eLak8bsdMc+qpNQfITUTFoSKFx5h8umlRRiA==",
2150 + "dev": true,
2151 + "dependencies": {
2152 + "@sigstore/bundle": "^2.1.1",
2153 + "@sigstore/core": "^0.2.0",
2154 + "@sigstore/protobuf-specs": "^0.2.1"
2155 },
2156 "engines": {
2157 "node": "^16.14.0 || >=18.0.0"
@@ -2321,8 +2270,7 @@
2270 "node_modules/@types/json-schema": {
2271 "version": "7.0.15",
2272 "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
2324 - "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
2325 - "dev": true
2273 + "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="
2274 },
2275 "node_modules/@types/jsonfile": {
2276 "version": "6.1.4",
@@ -2352,9 +2300,9 @@
2300 }
2301 },
2302 "node_modules/@types/node": {
2355 - "version": "20.11.0",
2356 - "resolved": "https://registry.npmjs.org/@types/node/-/node-20.11.0.tgz",
2357 - "integrity": "sha512-o9bjXmDNcF7GbM4CNQpmi+TutCgap/K3w1JyKgxAjqx41zp9qlIAVFi0IhCNsJcXolEqLWhbFbEeL0PvYm4pcQ==",
2303 + "version": "20.11.5",
2304 + "resolved": "https://registry.npmjs.org/@types/node/-/node-20.11.5.tgz",
2305 + "integrity": "sha512-g557vgQjUUfN76MZAN/dt1z3dzcUsimuysco0KeluHgrPdJXkP/XdAURgyO2W9fZWHRtRBiVKzKn8vyOAwlG+w==",
2306 "dev": true,
2307 "dependencies": {
2308 "undici-types": "~5.26.4"
@@ -2363,8 +2311,7 @@
2311 "node_modules/@types/semver": {
2312 "version": "7.5.6",
2313 "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.5.6.tgz",
2366 - "integrity": "sha512-dn1l8LaMea/IjDoHNd9J52uBbInB796CDffS6VdIxvqYCPSG0V0DzHp76GpaWnlhg88uYyPbXCDIowa86ybd5A==",
2367 - "dev": true
2314 + "integrity": "sha512-dn1l8LaMea/IjDoHNd9J52uBbInB796CDffS6VdIxvqYCPSG0V0DzHp76GpaWnlhg88uYyPbXCDIowa86ybd5A=="
2315 },
2316 "node_modules/@types/sinonjs__fake-timers": {
2317 "version": "8.1.1",
@@ -2415,16 +2362,15 @@
2362 }
2363 },
2364 "node_modules/@typescript-eslint/eslint-plugin": {
2418 - "version": "6.18.1",
2419 - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-6.18.1.tgz",
2420 - "integrity": "sha512-nISDRYnnIpk7VCFrGcu1rnZfM1Dh9LRHnfgdkjcbi/l7g16VYRri3TjXi9Ir4lOZSw5N/gnV/3H7jIPQ8Q4daA==",
2421 - "dev": true,
2365 + "version": "6.19.0",
2366 + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-6.19.0.tgz",
2367 + "integrity": "sha512-DUCUkQNklCQYnrBSSikjVChdc84/vMPDQSgJTHBZ64G9bA9w0Crc0rd2diujKbTdp6w2J47qkeHQLoi0rpLCdg==",
2368 "dependencies": {
2369 "@eslint-community/regexpp": "^4.5.1",
2424 - "@typescript-eslint/scope-manager": "6.18.1",
2425 - "@typescript-eslint/type-utils": "6.18.1",
2426 - "@typescript-eslint/utils": "6.18.1",
2427 - "@typescript-eslint/visitor-keys": "6.18.1",
2370 + "@typescript-eslint/scope-manager": "6.19.0",
2371 + "@typescript-eslint/type-utils": "6.19.0",
2372 + "@typescript-eslint/utils": "6.19.0",
2373 + "@typescript-eslint/visitor-keys": "6.19.0",
2374 "debug": "^4.3.4",
2375 "graphemer": "^1.4.0",
2376 "ignore": "^5.2.4",
@@ -2449,49 +2395,15 @@
2395 }
2396 }
2397 },
2452 - "node_modules/@typescript-eslint/eslint-plugin/node_modules/lru-cache": {
2453 - "version": "6.0.0",
2454 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
2455 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
2456 - "dev": true,
2457 - "dependencies": {
2458 - "yallist": "^4.0.0"
2459 - },
2460 - "engines": {
2461 - "node": ">=10"
2462 - }
2463 - },
2464 - "node_modules/@typescript-eslint/eslint-plugin/node_modules/semver": {
2465 - "version": "7.5.4",
2466 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
2467 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
2468 - "dev": true,
2469 - "dependencies": {
2470 - "lru-cache": "^6.0.0"
2471 - },
2472 - "bin": {
2473 - "semver": "bin/semver.js"
2474 - },
2475 - "engines": {
2476 - "node": ">=10"
2477 - }
2478 - },
2479 - "node_modules/@typescript-eslint/eslint-plugin/node_modules/yallist": {
2480 - "version": "4.0.0",
2481 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
2482 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
2483 - "dev": true
2484 - },
2398 "node_modules/@typescript-eslint/parser": {
2486 - "version": "6.18.1",
2487 - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-6.18.1.tgz",
2488 - "integrity": "sha512-zct/MdJnVaRRNy9e84XnVtRv9Vf91/qqe+hZJtKanjojud4wAVy/7lXxJmMyX6X6J+xc6c//YEWvpeif8cAhWA==",
2489 - "dev": true,
2490 - "dependencies": {
2491 - "@typescript-eslint/scope-manager": "6.18.1",
2492 - "@typescript-eslint/types": "6.18.1",
2493 - "@typescript-eslint/typescript-estree": "6.18.1",
2494 - "@typescript-eslint/visitor-keys": "6.18.1",
2399 + "version": "6.19.0",
2400 + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-6.19.0.tgz",
2401 + "integrity": "sha512-1DyBLG5SH7PYCd00QlroiW60YJ4rWMuUGa/JBV0iZuqi4l4IK3twKPq5ZkEebmGqRjXWVgsUzfd3+nZveewgow==",
2402 + "dependencies": {
2403 + "@typescript-eslint/scope-manager": "6.19.0",
2404 + "@typescript-eslint/types": "6.19.0",
2405 + "@typescript-eslint/typescript-estree": "6.19.0",
2406 + "@typescript-eslint/visitor-keys": "6.19.0",
2407 "debug": "^4.3.4"
2408 },
2409 "engines": {
@@ -2511,13 +2423,12 @@
2423 }
2424 },
2425 "node_modules/@typescript-eslint/scope-manager": {
2514 - "version": "6.18.1",
2515 - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-6.18.1.tgz",
2516 - "integrity": "sha512-BgdBwXPFmZzaZUuw6wKiHKIovms97a7eTImjkXCZE04TGHysG+0hDQPmygyvgtkoB/aOQwSM/nWv3LzrOIQOBw==",
2517 - "dev": true,
2426 + "version": "6.19.0",
2427 + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-6.19.0.tgz",
2428 + "integrity": "sha512-dO1XMhV2ehBI6QN8Ufi7I10wmUovmLU0Oru3n5LVlM2JuzB4M+dVphCPLkVpKvGij2j/pHBWuJ9piuXx+BhzxQ==",
2429 "dependencies": {
2519 - "@typescript-eslint/types": "6.18.1",
2520 - "@typescript-eslint/visitor-keys": "6.18.1"
2430 + "@typescript-eslint/types": "6.19.0",
2431 + "@typescript-eslint/visitor-keys": "6.19.0"
2432 },
2433 "engines": {
2434 "node": "^16.0.0 || >=18.0.0"
@@ -2528,13 +2439,12 @@
2439 }
2440 },
2441 "node_modules/@typescript-eslint/type-utils": {
2531 - "version": "6.18.1",
2532 - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-6.18.1.tgz",
2533 - "integrity": "sha512-wyOSKhuzHeU/5pcRDP2G2Ndci+4g653V43gXTpt4nbyoIOAASkGDA9JIAgbQCdCkcr1MvpSYWzxTz0olCn8+/Q==",
2534 - "dev": true,
2442 + "version": "6.19.0",
2443 + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-6.19.0.tgz",
2444 + "integrity": "sha512-mcvS6WSWbjiSxKCwBcXtOM5pRkPQ6kcDds/juxcy/727IQr3xMEcwr/YLHW2A2+Fp5ql6khjbKBzOyjuPqGi/w==",
2445 "dependencies": {
2536 - "@typescript-eslint/typescript-estree": "6.18.1",
2537 - "@typescript-eslint/utils": "6.18.1",
2446 + "@typescript-eslint/typescript-estree": "6.19.0",
2447 + "@typescript-eslint/utils": "6.19.0",
2448 "debug": "^4.3.4",
2449 "ts-api-utils": "^1.0.1"
2450 },
@@ -2555,10 +2465,9 @@
2465 }
2466 },
2467 "node_modules/@typescript-eslint/types": {
2558 - "version": "6.18.1",
2559 - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.18.1.tgz",
2560 - "integrity": "sha512-4TuMAe+tc5oA7wwfqMtB0Y5OrREPF1GeJBAjqwgZh1lEMH5PJQgWgHGfYufVB51LtjD+peZylmeyxUXPfENLCw==",
2561 - "dev": true,
2468 + "version": "6.19.0",
2469 + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.19.0.tgz",
2470 + "integrity": "sha512-lFviGV/vYhOy3m8BJ/nAKoAyNhInTdXpftonhWle66XHAtT1ouBlkjL496b5H5hb8dWXHwtypTqgtb/DEa+j5A==",
2471 "engines": {
2472 "node": "^16.0.0 || >=18.0.0"
2473 },
@@ -2568,13 +2477,12 @@
2477 }
2478 },
2479 "node_modules/@typescript-eslint/typescript-estree": {
2571 - "version": "6.18.1",
2572 - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-6.18.1.tgz",
2573 - "integrity": "sha512-fv9B94UAhywPRhUeeV/v+3SBDvcPiLxRZJw/xZeeGgRLQZ6rLMG+8krrJUyIf6s1ecWTzlsbp0rlw7n9sjufHA==",
2574 - "dev": true,
2480 + "version": "6.19.0",
2481 + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-6.19.0.tgz",
2482 + "integrity": "sha512-o/zefXIbbLBZ8YJ51NlkSAt2BamrK6XOmuxSR3hynMIzzyMY33KuJ9vuMdFSXW+H0tVvdF9qBPTHA91HDb4BIQ==",
2483 "dependencies": {
2576 - "@typescript-eslint/types": "6.18.1",
2577 - "@typescript-eslint/visitor-keys": "6.18.1",
2484 + "@typescript-eslint/types": "6.19.0",
2485 + "@typescript-eslint/visitor-keys": "6.19.0",
2486 "debug": "^4.3.4",
2487 "globby": "^11.1.0",
2488 "is-glob": "^4.0.3",
@@ -2595,51 +2503,17 @@
2503 }
2504 }
2505 },
2598 - "node_modules/@typescript-eslint/typescript-estree/node_modules/lru-cache": {
2599 - "version": "6.0.0",
2600 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
2601 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
2602 - "dev": true,
2603 - "dependencies": {
2604 - "yallist": "^4.0.0"
2605 - },
2606 - "engines": {
2607 - "node": ">=10"
2608 - }
2609 - },
2610 - "node_modules/@typescript-eslint/typescript-estree/node_modules/semver": {
2611 - "version": "7.5.4",
2612 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
2613 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
2614 - "dev": true,
2615 - "dependencies": {
2616 - "lru-cache": "^6.0.0"
2617 - },
2618 - "bin": {
2619 - "semver": "bin/semver.js"
2620 - },
2621 - "engines": {
2622 - "node": ">=10"
2623 - }
2624 - },
2625 - "node_modules/@typescript-eslint/typescript-estree/node_modules/yallist": {
2626 - "version": "4.0.0",
2627 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
2628 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
2629 - "dev": true
2630 - },
2506 "node_modules/@typescript-eslint/utils": {
2632 - "version": "6.18.1",
2633 - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-6.18.1.tgz",
2634 - "integrity": "sha512-zZmTuVZvD1wpoceHvoQpOiewmWu3uP9FuTWo8vqpy2ffsmfCE8mklRPi+vmnIYAIk9t/4kOThri2QCDgor+OpQ==",
2635 - "dev": true,
2507 + "version": "6.19.0",
2508 + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-6.19.0.tgz",
2509 + "integrity": "sha512-QR41YXySiuN++/dC9UArYOg4X86OAYP83OWTewpVx5ct1IZhjjgTLocj7QNxGhWoTqknsgpl7L+hGygCO+sdYw==",
2510 "dependencies": {
2511 "@eslint-community/eslint-utils": "^4.4.0",
2512 "@types/json-schema": "^7.0.12",
2513 "@types/semver": "^7.5.0",
2640 - "@typescript-eslint/scope-manager": "6.18.1",
2641 - "@typescript-eslint/types": "6.18.1",
2642 - "@typescript-eslint/typescript-estree": "6.18.1",
2514 + "@typescript-eslint/scope-manager": "6.19.0",
2515 + "@typescript-eslint/types": "6.19.0",
2516 + "@typescript-eslint/typescript-estree": "6.19.0",
2517 "semver": "^7.5.4"
2518 },
2519 "engines": {
@@ -2653,62 +2527,82 @@
2527 "eslint": "^7.0.0 || ^8.0.0"
2528 }
2529 },
2656 - "node_modules/@typescript-eslint/utils/node_modules/lru-cache": {
2657 - "version": "6.0.0",
2658 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
2659 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
2660 - "dev": true,
2530 + "node_modules/@typescript-eslint/visitor-keys": {
2531 + "version": "6.19.0",
2532 + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.19.0.tgz",
2533 + "integrity": "sha512-hZaUCORLgubBvtGpp1JEFEazcuEdfxta9j4iUwdSAr7mEsYYAp3EAUyCZk3VEEqGj6W+AV4uWyrDGtrlawAsgQ==",
2534 "dependencies": {
2662 - "yallist": "^4.0.0"
2535 + "@typescript-eslint/types": "6.19.0",
2536 + "eslint-visitor-keys": "^3.4.1"
2537 },
2538 "engines": {
2665 - "node": ">=10"
2539 + "node": "^16.0.0 || >=18.0.0"
2540 + },
2541 + "funding": {
2542 + "type": "opencollective",
2543 + "url": "https://opencollective.com/typescript-eslint"
2544 }
2545 },
2668 - "node_modules/@typescript-eslint/utils/node_modules/semver": {
2669 - "version": "7.5.4",
2670 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
2671 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
2672 - "dev": true,
2546 + "node_modules/@ungap/structured-clone": {
2547 + "version": "1.2.0",
2548 + "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.2.0.tgz",
2549 + "integrity": "sha512-zuVdFrMJiuCDQUMCzQaD6KL28MjnqqN8XnAqiEq9PNm/hCPTSGfrXCOfwj1ow4LFb/tNymJPwsNbVePc1xFqrQ=="
2550 + },
2551 + "node_modules/@unocss/config": {
2552 + "version": "0.56.5",
2553 + "resolved": "https://registry.npmjs.org/@unocss/config/-/config-0.56.5.tgz",
2554 + "integrity": "sha512-rscnFIYgUlN/0hXHdhANyjFcDjDutt3JO0ZRITdNLzoglh7GVNiDTURBJwUZejF/vGJ7IkMd3qOdNhPFuRY1Bg==",
2555 "dependencies": {
2674 - "lru-cache": "^6.0.0"
2675 - },
2676 - "bin": {
2677 - "semver": "bin/semver.js"
2556 + "@unocss/core": "0.56.5",
2557 + "unconfig": "^0.3.10"
2558 },
2559 "engines": {
2680 - "node": ">=10"
2560 + "node": ">=14"
2561 + },
2562 + "funding": {
2563 + "url": "https://github.com/sponsors/antfu"
2564 }
2565 },
2683 - "node_modules/@typescript-eslint/utils/node_modules/yallist": {
2684 - "version": "4.0.0",
2685 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
2686 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
2687 - "dev": true
2566 + "node_modules/@unocss/core": {
2567 + "version": "0.56.5",
2568 + "resolved": "https://registry.npmjs.org/@unocss/core/-/core-0.56.5.tgz",
2569 + "integrity": "sha512-fx5VhOjSHn0HdV2D34pEwFMAHJcJQRTCp1xEE4GzxY1irXzaa+m2aYf5PZjmDxehiOC16IH7TO9FOWANXk1E0w==",
2570 + "funding": {
2571 + "url": "https://github.com/sponsors/antfu"
2572 + }
2573 + },
2574 + "node_modules/@unocss/eslint-config": {
2575 + "version": "0.56.5",
2576 + "resolved": "https://registry.npmjs.org/@unocss/eslint-config/-/eslint-config-0.56.5.tgz",
2577 + "integrity": "sha512-UP7EBTl4ORRO0yqptW7oUWxM0qNh1Nk+z4rufC0C2kI8vKc8yab+sWvlBSC8DeX3kzR7uJxvtUsHGcBcoqZujg==",
2578 + "dependencies": {
2579 + "@unocss/eslint-plugin": "0.56.5"
2580 + },
2581 + "engines": {
2582 + "node": ">=14"
2583 + },
2584 + "funding": {
2585 + "url": "https://github.com/sponsors/antfu"
2586 + }
2587 },
2689 - "node_modules/@typescript-eslint/visitor-keys": {
2690 - "version": "6.18.1",
2691 - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.18.1.tgz",
2692 - "integrity": "sha512-/kvt0C5lRqGoCfsbmm7/CwMqoSkY3zzHLIjdhHZQW3VFrnz7ATecOHR7nb7V+xn4286MBxfnQfQhAmCI0u+bJA==",
2693 - "dev": true,
2588 + "node_modules/@unocss/eslint-plugin": {
2589 + "version": "0.56.5",
2590 + "resolved": "https://registry.npmjs.org/@unocss/eslint-plugin/-/eslint-plugin-0.56.5.tgz",
2591 + "integrity": "sha512-nMVw/kc0sYU5i8UBU1rEahzKhZRPTUjCztpPzo2KUKFKLBPAbTv0gJAOmU/n2kV3YiGk5Tl6jmShxu1MHjk5rA==",
2592 "dependencies": {
2695 - "@typescript-eslint/types": "6.18.1",
2696 - "eslint-visitor-keys": "^3.4.1"
2593 + "@typescript-eslint/utils": "^6.7.3",
2594 + "@unocss/config": "0.56.5",
2595 + "@unocss/core": "0.56.5",
2596 + "magic-string": "^0.30.3",
2597 + "synckit": "^0.8.5"
2598 },
2599 "engines": {
2699 - "node": "^16.0.0 || >=18.0.0"
2600 + "node": ">=14"
2601 },
2602 "funding": {
2702 - "type": "opencollective",
2703 - "url": "https://opencollective.com/typescript-eslint"
2603 + "url": "https://github.com/sponsors/antfu"
2604 }
2605 },
2706 - "node_modules/@ungap/structured-clone": {
2707 - "version": "1.2.0",
2708 - "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.2.0.tgz",
2709 - "integrity": "sha512-zuVdFrMJiuCDQUMCzQaD6KL28MjnqqN8XnAqiEq9PNm/hCPTSGfrXCOfwj1ow4LFb/tNymJPwsNbVePc1xFqrQ==",
2710 - "dev": true
2711 - },
2606 "node_modules/@vitejs/plugin-vue": {
2607 "version": "5.0.3",
2608 "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-5.0.3.tgz",
@@ -2741,13 +2635,13 @@
2635 }
2636 },
2637 "node_modules/@vitest/expect": {
2744 - "version": "1.2.0",
2745 - "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-1.2.0.tgz",
2746 - "integrity": "sha512-H+2bHzhyvgp32o7Pgj2h9RTHN0pgYaoi26Oo3mE+dCi1PAqV31kIIVfTbqMO3Bvshd5mIrJLc73EwSRrbol9Lw==",
2638 + "version": "1.2.1",
2639 + "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-1.2.1.tgz",
2640 + "integrity": "sha512-/bqGXcHfyKgFWYwIgFr1QYDaR9e64pRKxgBNWNXPefPFRhgm+K3+a/dS0cUGEreWngets3dlr8w8SBRw2fCfFQ==",
2641 "dev": true,
2642 "dependencies": {
2749 - "@vitest/spy": "1.2.0",
2750 - "@vitest/utils": "1.2.0",
2643 + "@vitest/spy": "1.2.1",
2644 + "@vitest/utils": "1.2.1",
2645 "chai": "^4.3.10"
2646 },
2647 "funding": {
@@ -2755,12 +2649,12 @@
2649 }
2650 },
2651 "node_modules/@vitest/runner": {
2758 - "version": "1.2.0",
2759 - "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-1.2.0.tgz",
2760 - "integrity": "sha512-vaJkDoQaNUTroT70OhM0NPznP7H3WyRwt4LvGwCVYs/llLaqhoSLnlIhUClZpbF5RgAee29KRcNz0FEhYcgxqA==",
2652 + "version": "1.2.1",
2653 + "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-1.2.1.tgz",
2654 + "integrity": "sha512-zc2dP5LQpzNzbpaBt7OeYAvmIsRS1KpZQw4G3WM/yqSV1cQKNKwLGmnm79GyZZjMhQGlRcSFMImLjZaUQvNVZQ==",
2655 "dev": true,
2656 "dependencies": {
2763 - "@vitest/utils": "1.2.0",
2657 + "@vitest/utils": "1.2.1",
2658 "p-limit": "^5.0.0",
2659 "pathe": "^1.1.1"
2660 },
@@ -2796,9 +2690,9 @@
2690 }
2691 },
2692 "node_modules/@vitest/snapshot": {
2799 - "version": "1.2.0",
2800 - "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-1.2.0.tgz",
2801 - "integrity": "sha512-P33EE7TrVgB3HDLllrjK/GG6WSnmUtWohbwcQqmm7TAk9AVHpdgf7M3F3qRHKm6vhr7x3eGIln7VH052Smo6Kw==",
2693 + "version": "1.2.1",
2694 + "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-1.2.1.tgz",
2695 + "integrity": "sha512-Tmp/IcYEemKaqAYCS08sh0vORLJkMr0NRV76Gl8sHGxXT5151cITJCET20063wk0Yr/1koQ6dnmP6eEqezmd/Q==",
2696 "dev": true,
2697 "dependencies": {
2698 "magic-string": "^0.30.5",
@@ -2810,9 +2704,9 @@
2704 }
2705 },
2706 "node_modules/@vitest/spy": {
2813 - "version": "1.2.0",
2814 - "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-1.2.0.tgz",
2815 - "integrity": "sha512-MNxSAfxUaCeowqyyGwC293yZgk7cECZU9wGb8N1pYQ0yOn/SIr8t0l9XnGRdQZvNV/ZHBYu6GO/W3tj5K3VN1Q==",
2707 + "version": "1.2.1",
2708 + "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-1.2.1.tgz",
2709 + "integrity": "sha512-vG3a/b7INKH7L49Lbp0IWrG6sw9j4waWAucwnksPB1r1FTJgV7nkBByd9ufzu6VWya/QTvQW4V9FShZbZIB2UQ==",
2710 "dev": true,
2711 "dependencies": {
2712 "tinyspy": "^2.2.0"
@@ -2822,9 +2716,9 @@
2716 }
2717 },
2718 "node_modules/@vitest/utils": {
2825 - "version": "1.2.0",
2826 - "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-1.2.0.tgz",
2827 - "integrity": "sha512-FyD5bpugsXlwVpTcGLDf3wSPYy8g541fQt14qtzo8mJ4LdEpDKZ9mQy2+qdJm2TZRpjY5JLXihXCgIxiRJgi5g==",
2719 + "version": "1.2.1",
2720 + "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-1.2.1.tgz",
2721 + "integrity": "sha512-bsH6WVZYe/J2v3+81M5LDU8kW76xWObKIURpPrOXm2pjBniBu2MERI/XP60GpS4PHU3jyK50LUutOwrx4CyHUg==",
2722 "dev": true,
2723 "dependencies": {
2724 "diff-sequences": "^29.6.3",
@@ -2905,49 +2799,60 @@
2799 }
2800 },
2801 "node_modules/@vue/compiler-core": {
2908 - "version": "3.4.11",
2909 - "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.4.11.tgz",
2910 - "integrity": "sha512-xFD+p14L4J0DkzHMdgLiQBU5g861fuOTzag30GsfPXBpghLZOvmd22lKiBMTRRpQRpp7qxPnBlFMoeiGMM4MBg==",
2802 + "version": "3.4.15",
2803 + "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.4.15.tgz",
2804 + "integrity": "sha512-XcJQVOaxTKCnth1vCxEChteGuwG6wqnUHxAm1DO3gCz0+uXKaJNx8/digSz4dLALCy8n2lKq24jSUs8segoqIw==",
2805 "dependencies": {
2806 "@babel/parser": "^7.23.6",
2913 - "@vue/shared": "3.4.11",
2807 + "@vue/shared": "3.4.15",
2808 "entities": "^4.5.0",
2809 "estree-walker": "^2.0.2",
2810 "source-map-js": "^1.0.2"
2811 }
2812 },
2813 + "node_modules/@vue/compiler-core/node_modules/entities": {
2814 + "version": "4.5.0",
2815 + "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
2816 + "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
2817 + "engines": {
2818 + "node": ">=0.12"
2819 + },
2820 + "funding": {
2821 + "url": "https://github.com/fb55/entities?sponsor=1"
2822 + }
2823 + },
2824 "node_modules/@vue/compiler-dom": {
2920 - "version": "3.4.11",
2921 - "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.4.11.tgz",
2922 - "integrity": "sha512-cRVLROlY7D72WK2xS91L126Dd6xHNTWDWPUBRh1Syk7+TahCk8Eown1/fSi+VX9c76sMMqEZROQSbwV0HSJnhg==",
2825 + "version": "3.4.15",
2826 + "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.4.15.tgz",
2827 + "integrity": "sha512-wox0aasVV74zoXyblarOM3AZQz/Z+OunYcIHe1OsGclCHt8RsRm04DObjefaI82u6XDzv+qGWZ24tIsRAIi5MQ==",
2828 "dependencies": {
2924 - "@vue/compiler-core": "3.4.11",
2925 - "@vue/shared": "3.4.11"
2829 + "@vue/compiler-core": "3.4.15",
2830 + "@vue/shared": "3.4.15"
2831 }
2832 },
2833 "node_modules/@vue/compiler-sfc": {
2929 - "version": "3.4.11",
2930 - "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.4.11.tgz",
2931 - "integrity": "sha512-1y5xHAD4a/AhK5+dgsZwFg145J6/rl1c8ILC7Gokca+ql51tTpduz/njCHeNmU15XiE7O62LjJFNOtSZ9vxKOQ==",
2834 + "version": "3.4.15",
2835 + "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.4.15.tgz",
2836 + "integrity": "sha512-LCn5M6QpkpFsh3GQvs2mJUOAlBQcCco8D60Bcqmf3O3w5a+KWS5GvYbrrJBkgvL1BDnTp+e8q0lXCLgHhKguBA==",
2837 "dependencies": {
2838 "@babel/parser": "^7.23.6",
2934 - "@vue/compiler-core": "3.4.11",
2935 - "@vue/compiler-dom": "3.4.11",
2936 - "@vue/compiler-ssr": "3.4.11",
2937 - "@vue/shared": "3.4.11",
2839 + "@vue/compiler-core": "3.4.15",
2840 + "@vue/compiler-dom": "3.4.15",
2841 + "@vue/compiler-ssr": "3.4.15",
2842 + "@vue/shared": "3.4.15",
2843 "estree-walker": "^2.0.2",
2844 "magic-string": "^0.30.5",
2940 - "postcss": "^8.4.32",
2845 + "postcss": "^8.4.33",
2846 "source-map-js": "^1.0.2"
2847 }
2848 },
2849 "node_modules/@vue/compiler-ssr": {
2945 - "version": "3.4.11",
2946 - "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.4.11.tgz",
2947 - "integrity": "sha512-cP9Z2ArRgciYmNraqE0gQkuYInfdn66+LE4pR+16uyBiQeswcU4kEzGA+mF1MdhqYXuENpyGQsTkZapq4cy9YA==",
2850 + "version": "3.4.15",
2851 + "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.4.15.tgz",
2852 + "integrity": "sha512-1jdeQyiGznr8gjFDadVmOJqZiLNSsMa5ZgqavkPZ8O2wjHv0tVuAEsw5hTdUoUW4232vpBbL/wJhzVW/JwY1Uw==",
2853 "dependencies": {
2949 - "@vue/compiler-dom": "3.4.11",
2950 - "@vue/shared": "3.4.11"
2854 + "@vue/compiler-dom": "3.4.15",
2855 + "@vue/shared": "3.4.15"
2856 }
2857 },
2858 "node_modules/@vue/devtools-api": {
@@ -3019,48 +2924,48 @@
2924 }
2925 },
2926 "node_modules/@vue/reactivity": {
3022 - "version": "3.4.11",
3023 - "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.4.11.tgz",
3024 - "integrity": "sha512-KscADwKpSynT3S2iJEX8EfPqc9kPFR261sHIQnDh1xhOBf8qd4ait9tEgLt1/uVxyrAgFj/TNGmjDkcsytyA8w==",
2927 + "version": "3.4.15",
2928 + "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.4.15.tgz",
2929 + "integrity": "sha512-55yJh2bsff20K5O84MxSvXKPHHt17I2EomHznvFiJCAZpJTNW8IuLj1xZWMLELRhBK3kkFV/1ErZGHJfah7i7w==",
2930 "dependencies": {
3026 - "@vue/shared": "3.4.11"
2931 + "@vue/shared": "3.4.15"
2932 }
2933 },
2934 "node_modules/@vue/runtime-core": {
3030 - "version": "3.4.11",
3031 - "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.4.11.tgz",
3032 - "integrity": "sha512-wduRf9w1OtSORFs5KVpKEQ1bRwW5D9/E8mB0I4m0f5Wrd53OZridzWWVZaowSKNMXXIF5Y/lYFP9GOM/IL5i2g==",
2935 + "version": "3.4.15",
2936 + "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.4.15.tgz",
2937 + "integrity": "sha512-6E3by5m6v1AkW0McCeAyhHTw+3y17YCOKG0U0HDKDscV4Hs0kgNT5G+GCHak16jKgcCDHpI9xe5NKb8sdLCLdw==",
2938 "dependencies": {
3034 - "@vue/reactivity": "3.4.11",
3035 - "@vue/shared": "3.4.11"
2939 + "@vue/reactivity": "3.4.15",
2940 + "@vue/shared": "3.4.15"
2941 }
2942 },
2943 "node_modules/@vue/runtime-dom": {
3039 - "version": "3.4.11",
3040 - "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.4.11.tgz",
3041 - "integrity": "sha512-pWlCTzo6Ad3pSBjzgcZ9maPaz+N/SngLOMfkSKIx7rIWJgcHBoFp4GAbhnkR3jxT4BqIvti6EH3aNSC02VtgOg==",
2944 + "version": "3.4.15",
2945 + "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.4.15.tgz",
2946 + "integrity": "sha512-EVW8D6vfFVq3V/yDKNPBFkZKGMFSvZrUQmx196o/v2tHKdwWdiZjYUBS+0Ez3+ohRyF8Njwy/6FH5gYJ75liUw==",
2947 "dependencies": {
3043 - "@vue/runtime-core": "3.4.11",
3044 - "@vue/shared": "3.4.11",
2948 + "@vue/runtime-core": "3.4.15",
2949 + "@vue/shared": "3.4.15",
2950 "csstype": "^3.1.3"
2951 }
2952 },
2953 "node_modules/@vue/server-renderer": {
3049 - "version": "3.4.11",
3050 - "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.4.11.tgz",
3051 - "integrity": "sha512-19rLK9N0yNNzQ83ieyoO9ZT/iBt0S8IkxQ4eVmnqPLCbZgSRMm7GRXnjTFvo0n5vTVVeyaYosBzZ2559L/rP+w==",
2954 + "version": "3.4.15",
2955 + "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.4.15.tgz",
2956 + "integrity": "sha512-3HYzaidu9cHjrT+qGUuDhFYvF/j643bHC6uUN9BgM11DVy+pM6ATsG6uPBLnkwOgs7BpJABReLmpL3ZPAsUaqw==",
2957 "dependencies": {
3053 - "@vue/compiler-ssr": "3.4.11",
3054 - "@vue/shared": "3.4.11"
2958 + "@vue/compiler-ssr": "3.4.15",
2959 + "@vue/shared": "3.4.15"
2960 },
2961 "peerDependencies": {
3057 - "vue": "3.4.11"
2962 + "vue": "3.4.15"
2963 }
2964 },
2965 "node_modules/@vue/shared": {
3061 - "version": "3.4.11",
3062 - "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.4.11.tgz",
3063 - "integrity": "sha512-BtC+vE8kHf/jZoyJnTFd0PmY8NejyUeUkshXm8LriHs8KmQUmcZXIbrifjA3WDmvzg7C8D6gBSvdl49pOfU2lQ=="
2966 + "version": "3.4.15",
2967 + "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.4.15.tgz",
2968 + "integrity": "sha512-KzfPTxVaWfB+eGcGdbSf4CWdaXcGDqckoeXUh7SB3fZdEtzPCK2Vq9B/lRRL3yutax/LWITz+SwvgyOxz5V75g=="
2969 },
2970 "node_modules/@vue/test-utils": {
2971 "version": "2.4.3",
@@ -3088,12 +2993,12 @@
2993 "dev": true
2994 },
2995 "node_modules/@vueuse/components": {
3091 - "version": "10.7.1",
3092 - "resolved": "https://registry.npmjs.org/@vueuse/components/-/components-10.7.1.tgz",
3093 - "integrity": "sha512-bAS5ff1uNhNSeIYL7R3qeR0DP5u+Lutb0mFiTZTMhcicjhBfGiDbahHqoOAr9M/wfpYKNluP1U107y2fUTw4yw==",
2996 + "version": "10.7.2",
2997 + "resolved": "https://registry.npmjs.org/@vueuse/components/-/components-10.7.2.tgz",
2998 + "integrity": "sha512-r39DLLtRo1hEKI/SQzVQjCts7yelwFyUrTxDFi821NdyU3EfQ9GCNNBcMirXcn3IQApFBRKrvTTtQ9cJGrb/+A==",
2999 "dependencies": {
3095 - "@vueuse/core": "10.7.1",
3096 - "@vueuse/shared": "10.7.1",
3000 + "@vueuse/core": "10.7.2",
3001 + "@vueuse/shared": "10.7.2",
3002 "vue-demi": ">=0.14.6"
3003 }
3004 },
@@ -3123,13 +3028,13 @@
3028 }
3029 },
3030 "node_modules/@vueuse/core": {
3126 - "version": "10.7.1",
3127 - "resolved": "https://registry.npmjs.org/@vueuse/core/-/core-10.7.1.tgz",
3128 - "integrity": "sha512-74mWHlaesJSWGp1ihg76vAnfVq9NTv1YT0SYhAQ6zwFNdBkkP+CKKJmVOEHcdSnLXCXYiL5e7MaewblfiYLP7g==",
3031 + "version": "10.7.2",
3032 + "resolved": "https://registry.npmjs.org/@vueuse/core/-/core-10.7.2.tgz",
3033 + "integrity": "sha512-AOyAL2rK0By62Hm+iqQn6Rbu8bfmbgaIMXcE3TSr7BdQ42wnSFlwIdPjInO62onYsEMK/yDMU8C6oGfDAtZ2qQ==",
3034 "dependencies": {
3035 "@types/web-bluetooth": "^0.0.20",
3131 - "@vueuse/metadata": "10.7.1",
3132 - "@vueuse/shared": "10.7.1",
3036 + "@vueuse/metadata": "10.7.2",
3037 + "@vueuse/shared": "10.7.2",
3038 "vue-demi": ">=0.14.6"
3039 },
3040 "funding": {
@@ -3162,17 +3067,17 @@
3067 }
3068 },
3069 "node_modules/@vueuse/metadata": {
3165 - "version": "10.7.1",
3166 - "resolved": "https://registry.npmjs.org/@vueuse/metadata/-/metadata-10.7.1.tgz",
3167 - "integrity": "sha512-jX8MbX5UX067DYVsbtrmKn6eG6KMcXxLRLlurGkZku5ZYT3vxgBjui2zajvUZ18QLIjrgBkFRsu7CqTAg18QFw==",
3070 + "version": "10.7.2",
3071 + "resolved": "https://registry.npmjs.org/@vueuse/metadata/-/metadata-10.7.2.tgz",
3072 + "integrity": "sha512-kCWPb4J2KGrwLtn1eJwaJD742u1k5h6v/St5wFe8Quih90+k2a0JP8BS4Zp34XUuJqS2AxFYMb1wjUL8HfhWsQ==",
3073 "funding": {
3074 "url": "https://github.com/sponsors/antfu"
3075 }
3076 },
3077 "node_modules/@vueuse/shared": {
3173 - "version": "10.7.1",
3174 - "resolved": "https://registry.npmjs.org/@vueuse/shared/-/shared-10.7.1.tgz",
3175 - "integrity": "sha512-v0jbRR31LSgRY/C5i5X279A/WQjD6/JsMzGa+eqt658oJ75IvQXAeONmwvEMrvJQKnRElq/frzBR7fhmWY5uLw==",
3078 + "version": "10.7.2",
3079 + "resolved": "https://registry.npmjs.org/@vueuse/shared/-/shared-10.7.2.tgz",
3080 + "integrity": "sha512-qFbXoxS44pi2FkgFjPvF4h7c9oMDutpyBdcJdMYIMg9XyXli2meFMuaKn+UMgsClo//Th6+beeCgqweT/79BVA==",
3081 "dependencies": {
3082 "vue-demi": ">=0.14.6"
3083 },
@@ -3236,7 +3141,6 @@
3141 "version": "8.11.3",
3142 "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.11.3.tgz",
3143 "integrity": "sha512-Y9rRfJG5jcKOE0CLisYbojUjIrIEE7AGMzA/Sm4BslANhbS+cDMpgBdcPT91oJ7OuJ9hYJBx59RjbhxVnrF8Xg==",
3239 - "dev": true,
3144 "bin": {
3145 "acorn": "bin/acorn"
3146 },
@@ -3248,7 +3152,6 @@
3152 "version": "5.3.2",
3153 "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
3154 "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
3251 - "dev": true,
3155 "peerDependencies": {
3156 "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
3157 }
@@ -3291,7 +3194,6 @@
3194 "version": "6.12.6",
3195 "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
3196 "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
3294 - "dev": true,
3197 "dependencies": {
3198 "fast-deep-equal": "^3.1.1",
3199 "fast-json-stable-stringify": "^2.0.0",
@@ -3327,11 +3229,22 @@
3229 "url": "https://github.com/sponsors/sindresorhus"
3230 }
3231 },
3232 + "node_modules/ansi-escapes/node_modules/type-fest": {
3233 + "version": "0.21.3",
3234 + "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
3235 + "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
3236 + "dev": true,
3237 + "engines": {
3238 + "node": ">=10"
3239 + },
3240 + "funding": {
3241 + "url": "https://github.com/sponsors/sindresorhus"
3242 + }
3243 + },
3244 "node_modules/ansi-regex": {
3245 "version": "5.0.1",
3246 "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
3247 "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
3334 - "dev": true,
3248 "engines": {
3249 "node": ">=8"
3250 }
@@ -3368,9 +3281,9 @@
3281 }
3282 },
3283 "node_modules/apexcharts": {
3371 - "version": "3.45.1",
3372 - "resolved": "https://registry.npmjs.org/apexcharts/-/apexcharts-3.45.1.tgz",
3373 - "integrity": "sha512-pPjj/SA6dfPvR/IKRZF0STdfBGpBh3WRt7K0DFuW9P8erypYkX17EHu3/molPRfo2zSiQwTVpshHC5ncysqfkA==",
3284 + "version": "3.45.2",
3285 + "resolved": "https://registry.npmjs.org/apexcharts/-/apexcharts-3.45.2.tgz",
3286 + "integrity": "sha512-PpuM4sJWy70sUh5U1IFn1m1p45MdHSChLUNnqEoUUUHSU2IHZugFrsVNhov1S8Q0cvfdrCRCvdBtHGSs6PSAWQ==",
3287 "dependencies": {
3288 "@yr/monotone-cubic-spline": "^1.0.3",
3289 "svg.draggable.js": "^2.2.2",
@@ -3410,8 +3323,7 @@
3323 "node_modules/argparse": {
3324 "version": "2.0.1",
3325 "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
3413 - "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
3414 - "dev": true
3326 + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="
3327 },
3328 "node_modules/array-buffer-byte-length": {
3329 "version": "1.0.0",
@@ -3430,7 +3342,6 @@
3342 "version": "2.1.0",
3343 "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz",
3344 "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==",
3433 - "dev": true,
3345 "engines": {
3346 "node": ">=8"
3347 }
@@ -3519,9 +3430,9 @@
3430 }
3431 },
3432 "node_modules/autoprefixer": {
3522 - "version": "10.4.16",
3523 - "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.16.tgz",
3524 - "integrity": "sha512-7vd3UC6xKp0HLfua5IjZlcXvGAGy7cBAXTg2lyQ/8WpNhd6SiZ8Be+xm3FyBSYJx5GKcpRCzBh7RH4/0dnY+uQ==",
3433 + "version": "10.4.17",
3434 + "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.17.tgz",
3435 + "integrity": "sha512-/cpVNRLSfhOtcGflT13P2794gVSgmPgTR+erw5ifnMLZb0UnSlkK4tquLmkd3BhA+nLo5tX8Cu0upUsGKvKbmg==",
3436 "dev": true,
3437 "funding": [
3438 {
@@ -3538,9 +3449,9 @@
3449 }
3450 ],
3451 "dependencies": {
3541 - "browserslist": "^4.21.10",
3542 - "caniuse-lite": "^1.0.30001538",
3543 - "fraction.js": "^4.3.6",
3452 + "browserslist": "^4.22.2",
3453 + "caniuse-lite": "^1.0.30001578",
3454 + "fraction.js": "^4.3.7",
3455 "normalize-range": "^0.1.2",
3456 "picocolors": "^1.0.0",
3457 "postcss-value-parser": "^4.2.0"
@@ -3616,8 +3527,7 @@
3527 "node_modules/balanced-match": {
3528 "version": "1.0.2",
3529 "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
3619 - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
3620 - "dev": true
3530 + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
3531 },
3532 "node_modules/base64-js": {
3533 "version": "1.5.1",
@@ -3648,15 +3558,6 @@
3558 "tweetnacl": "^0.14.3"
3559 }
3560 },
3651 - "node_modules/bidi-js": {
3652 - "version": "1.0.3",
3653 - "resolved": "https://registry.npmjs.org/bidi-js/-/bidi-js-1.0.3.tgz",
3654 - "integrity": "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==",
3655 - "dev": true,
3656 - "dependencies": {
3657 - "require-from-string": "^2.0.2"
3658 - }
3659 - },
3561 "node_modules/big-integer": {
3562 "version": "1.6.52",
3563 "resolved": "https://registry.npmjs.org/big-integer/-/big-integer-1.6.52.tgz",
@@ -3690,8 +3591,7 @@
3591 "node_modules/boolbase": {
3592 "version": "1.0.0",
3593 "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
3693 - "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==",
3694 - "dev": true
3594 + "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww=="
3595 },
3596 "node_modules/bplist-parser": {
3597 "version": "0.2.0",
@@ -3709,7 +3609,6 @@
3609 "version": "2.0.1",
3610 "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
3611 "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
3712 - "dev": true,
3612 "dependencies": {
3613 "balanced-match": "^1.0.0"
3614 }
@@ -3718,7 +3617,6 @@
3617 "version": "3.0.2",
3618 "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
3619 "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
3721 - "dev": true,
3620 "dependencies": {
3621 "fill-range": "^7.0.1"
3622 },
@@ -3800,39 +3698,6 @@
3698 "semver": "^7.0.0"
3699 }
3700 },
3803 - "node_modules/builtins/node_modules/lru-cache": {
3804 - "version": "6.0.0",
3805 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
3806 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
3807 - "dev": true,
3808 - "dependencies": {
3809 - "yallist": "^4.0.0"
3810 - },
3811 - "engines": {
3812 - "node": ">=10"
3813 - }
3814 - },
3815 - "node_modules/builtins/node_modules/semver": {
3816 - "version": "7.5.4",
3817 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
3818 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
3819 - "dev": true,
3820 - "dependencies": {
3821 - "lru-cache": "^6.0.0"
3822 - },
3823 - "bin": {
3824 - "semver": "bin/semver.js"
3825 - },
3826 - "engines": {
3827 - "node": ">=10"
3828 - }
3829 - },
3830 - "node_modules/builtins/node_modules/yallist": {
3831 - "version": "4.0.0",
3832 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
3833 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
3834 - "dev": true
3835 - },
3701 "node_modules/bundle-name": {
3702 "version": "3.0.0",
3703 "resolved": "https://registry.npmjs.org/bundle-name/-/bundle-name-3.0.0.tgz",
@@ -3937,7 +3802,6 @@
3802 "version": "3.1.0",
3803 "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
3804 "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
3940 - "dev": true,
3805 "engines": {
3806 "node": ">=6"
3807 }
@@ -3964,9 +3828,9 @@
3828 }
3829 },
3830 "node_modules/caniuse-lite": {
3967 - "version": "1.0.30001576",
3968 - "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001576.tgz",
3969 - "integrity": "sha512-ff5BdakGe2P3SQsMsiqmt1Lc8221NR1VzHj5jXN5vBny9A6fpze94HiVV/n7XRosOlsShJcvMv5mdnpjOGCEgg==",
3831 + "version": "1.0.30001579",
3832 + "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001579.tgz",
3833 + "integrity": "sha512-u5AUVkixruKHJjw/pj9wISlcMpgFWzSrczLZbrqBSxukQixmg0SJ5sZTpvaFvxU0HoQKd4yoyAogyrAz9pzJnA==",
3834 "dev": true,
3835 "funding": [
3836 {
@@ -4313,8 +4177,7 @@
4177 "node_modules/concat-map": {
4178 "version": "0.0.1",
4179 "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
4316 - "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
4317 - "dev": true
4180 + "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
4181 },
4182 "node_modules/config-chain": {
4183 "version": "1.1.13",
@@ -4388,7 +4251,6 @@
4251 "version": "7.0.3",
4252 "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
4253 "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
4391 - "dev": true,
4254 "dependencies": {
4255 "path-key": "^3.1.0",
4256 "shebang-command": "^2.0.0",
@@ -4462,7 +4324,6 @@
4324 "version": "3.0.0",
4325 "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
4326 "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
4465 - "dev": true,
4327 "bin": {
4328 "cssesc": "bin/cssesc"
4329 },
@@ -4521,15 +4382,14 @@
4382 "integrity": "sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw=="
4383 },
4384 "node_modules/cypress": {
4524 - "version": "13.6.2",
4525 - "resolved": "https://registry.npmjs.org/cypress/-/cypress-13.6.2.tgz",
4526 - "integrity": "sha512-TW3bGdPU4BrfvMQYv1z3oMqj71YI4AlgJgnrycicmPZAXtvywVFZW9DAToshO65D97rCWfG/kqMFsYB6Kp91gQ==",
4385 + "version": "13.6.3",
4386 + "resolved": "https://registry.npmjs.org/cypress/-/cypress-13.6.3.tgz",
4387 + "integrity": "sha512-d/pZvgwjAyZsoyJ3FOsJT5lDsqnxQ/clMqnNc++rkHjbkkiF2h9s0JsZSyyH4QXhVFW3zPFg82jD25roFLOdZA==",
4388 "dev": true,
4389 "hasInstallScript": true,
4390 "dependencies": {
4391 "@cypress/request": "^3.0.0",
4392 "@cypress/xvfb": "^1.2.4",
4532 - "@types/node": "^18.17.5",
4393 "@types/sinonjs__fake-timers": "8.1.1",
4394 "@types/sizzle": "^2.3.2",
4395 "arch": "^2.2.0",
@@ -4578,15 +4438,6 @@
4438 "node": "^16.0.0 || ^18.0.0 || >=20.0.0"
4439 }
4440 },
4581 - "node_modules/cypress/node_modules/@types/node": {
4582 - "version": "18.19.6",
4583 - "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.6.tgz",
4584 - "integrity": "sha512-X36s5CXMrrJOs2lQCdDF68apW4Rfx9ixYMawlepwmE4Anezv/AV2LSpKD1Ub8DAc+urp5bk0BGZ6NtmBitfnsg==",
4585 - "dev": true,
4586 - "dependencies": {
4587 - "undici-types": "~5.26.4"
4588 - }
4589 - },
4441 "node_modules/cypress/node_modules/ansi-styles": {
4442 "version": "4.3.0",
4443 "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
@@ -4672,33 +4523,6 @@
4523 "node": ">=8"
4524 }
4525 },
4675 - "node_modules/cypress/node_modules/lru-cache": {
4676 - "version": "6.0.0",
4677 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
4678 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
4679 - "dev": true,
4680 - "dependencies": {
4681 - "yallist": "^4.0.0"
4682 - },
4683 - "engines": {
4684 - "node": ">=10"
4685 - }
4686 - },
4687 - "node_modules/cypress/node_modules/semver": {
4688 - "version": "7.5.4",
4689 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
4690 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
4691 - "dev": true,
4692 - "dependencies": {
4693 - "lru-cache": "^6.0.0"
4694 - },
4695 - "bin": {
4696 - "semver": "bin/semver.js"
4697 - },
4698 - "engines": {
4699 - "node": ">=10"
4700 - }
4701 - },
4526 "node_modules/cypress/node_modules/supports-color": {
4527 "version": "8.1.1",
4528 "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
@@ -4714,12 +4538,6 @@
4538 "url": "https://github.com/chalk/supports-color?sponsor=1"
4539 }
4540 },
4717 - "node_modules/cypress/node_modules/yallist": {
4718 - "version": "4.0.0",
4719 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
4720 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
4721 - "dev": true
4722 - },
4541 "node_modules/dashdash": {
4542 "version": "1.14.1",
4543 "resolved": "https://registry.npmjs.org/dashdash/-/dashdash-1.14.1.tgz",
@@ -4788,7 +4606,6 @@
4606 "version": "4.3.4",
4607 "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
4608 "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
4791 - "dev": true,
4609 "dependencies": {
4610 "ms": "2.1.2"
4611 },
@@ -4828,8 +4645,7 @@
4645 "node_modules/deep-is": {
4646 "version": "0.1.4",
4647 "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
4831 - "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
4832 - "dev": true
4648 + "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ=="
4649 },
4650 "node_modules/deepmerge": {
4651 "version": "4.3.1",
@@ -5039,8 +4855,7 @@
4855 "node_modules/defu": {
4856 "version": "6.1.4",
4857 "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz",
5042 - "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
5043 - "dev": true
4858 + "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg=="
4859 },
4860 "node_modules/delayed-stream": {
4861 "version": "1.0.0",
@@ -5118,7 +4933,6 @@
4933 "version": "3.0.1",
4934 "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
4935 "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
5121 - "dev": true,
4936 "dependencies": {
4937 "path-type": "^4.0.0"
4938 },
@@ -5136,7 +4950,6 @@
4950 "version": "3.0.0",
4951 "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
4952 "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
5139 - "dev": true,
4953 "dependencies": {
4954 "esutils": "^2.0.2"
4955 },
@@ -5158,6 +4971,18 @@
4971 "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
4972 }
4973 },
4974 + "node_modules/dom-serializer/node_modules/entities": {
4975 + "version": "4.5.0",
4976 + "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
4977 + "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
4978 + "dev": true,
4979 + "engines": {
4980 + "node": ">=0.12"
4981 + },
4982 + "funding": {
4983 + "url": "https://github.com/fb55/entities?sponsor=1"
4984 + }
4985 + },
4986 "node_modules/domelementtype": {
4987 "version": "2.3.0",
4988 "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
@@ -5262,18 +5087,6 @@
5087 "node": ">=14"
5088 }
5089 },
5265 - "node_modules/editorconfig/node_modules/lru-cache": {
5266 - "version": "6.0.0",
5267 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
5268 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
5269 - "dev": true,
5270 - "dependencies": {
5271 - "yallist": "^4.0.0"
5272 - },
5273 - "engines": {
5274 - "node": ">=10"
5275 - }
5276 - },
5090 "node_modules/editorconfig/node_modules/minimatch": {
5091 "version": "9.0.1",
5092 "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.1.tgz",
@@ -5289,27 +5102,6 @@
5102 "url": "https://github.com/sponsors/isaacs"
5103 }
5104 },
5292 - "node_modules/editorconfig/node_modules/semver": {
5293 - "version": "7.5.4",
5294 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
5295 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
5296 - "dev": true,
5297 - "dependencies": {
5298 - "lru-cache": "^6.0.0"
5299 - },
5300 - "bin": {
5301 - "semver": "bin/semver.js"
5302 - },
5303 - "engines": {
5304 - "node": ">=10"
5305 - }
5306 - },
5307 - "node_modules/editorconfig/node_modules/yallist": {
5308 - "version": "4.0.0",
5309 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
5310 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
5311 - "dev": true
5312 - },
5105 "node_modules/ee-first": {
5106 "version": "1.1.1",
5107 "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -5317,9 +5109,9 @@
5109 "dev": true
5110 },
5111 "node_modules/electron-to-chromium": {
5320 - "version": "1.4.630",
5321 - "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.630.tgz",
5322 - "integrity": "sha512-osHqhtjojpCsACVnuD11xO5g9xaCyw7Qqn/C2KParkMv42i8jrJJgx3g7mkHfpxwhy9MnOJr8+pKOdZ7qzgizg==",
5112 + "version": "1.4.637",
5113 + "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.637.tgz",
5114 + "integrity": "sha512-G7j3UCOukFtxVO1vWrPQUoDk3kL70mtvjc/DC/k2o7lE0wAdq+Vwp1ipagOow+BH0uVztFysLWbkM/RTIrbK3w==",
5115 "dev": true
5116 },
5117 "node_modules/emoji-regex": {
@@ -5370,9 +5162,9 @@
5162 }
5163 },
5164 "node_modules/entities": {
5373 - "version": "4.5.0",
5374 - "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
5375 - "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
5165 + "version": "3.0.1",
5166 + "resolved": "https://registry.npmjs.org/entities/-/entities-3.0.1.tgz",
5167 + "integrity": "sha512-WiyBqoomrwMdFG1e0kqvASYfnlb0lp8M5o5Fw2OFq1hNZxxcNk8Ik0Xm7LxzBhuidnZB/UtBqVCgUz3kBOP51Q==",
5168 "engines": {
5169 "node": ">=0.12"
5170 },
@@ -5554,7 +5346,6 @@
5346 "version": "8.56.0",
5347 "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.56.0.tgz",
5348 "integrity": "sha512-Go19xM6T9puCOWntie1/P997aXxFsOi37JIHRWI514Hc6ZnaHGKY9xFhrU65RT6CcBEzZoGG1e6Nq+DT04ZtZQ==",
5557 - "dev": true,
5349 "dependencies": {
5350 "@eslint-community/eslint-utils": "^4.2.0",
5351 "@eslint-community/regexpp": "^4.6.1",
@@ -5609,7 +5400,6 @@
5400 "version": "9.1.0",
5401 "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-9.1.0.tgz",
5402 "integrity": "sha512-NSWl5BFQWEPi1j4TjVNItzYV7dZXZ+wP6I6ZhrBGpChQhZRUaElihE9uRRkcbRnNb76UMKDF3r+WTmNcGPKsqw==",
5612 - "dev": true,
5403 "bin": {
5404 "eslint-config-prettier": "bin/cli.js"
5405 },
@@ -5617,6 +5407,26 @@
5407 "eslint": ">=7.0.0"
5408 }
5409 },
5410 + "node_modules/eslint-define-config": {
5411 + "version": "1.24.1",
5412 + "resolved": "https://registry.npmjs.org/eslint-define-config/-/eslint-define-config-1.24.1.tgz",
5413 + "integrity": "sha512-o36vBhPSWyIQlHoMqGhhcGmOOm2A2ccBVIdLTG/AWdm9YmjpsLpf+5ntf9LlHR6dduLREgxtGwvwPwSt7vnXJg==",
5414 + "funding": [
5415 + {
5416 + "type": "github",
5417 + "url": "https://github.com/Shinigami92"
5418 + },
5419 + {
5420 + "type": "paypal",
5421 + "url": "https://www.paypal.com/donate/?hosted_button_id=L7GY729FBKTZY"
5422 + }
5423 + ],
5424 + "engines": {
5425 + "node": ">=18.0.0",
5426 + "npm": ">=9.0.0",
5427 + "pnpm": ">= 8.6.0"
5428 + }
5429 + },
5430 "node_modules/eslint-plugin-cypress": {
5431 "version": "2.15.1",
5432 "resolved": "https://registry.npmjs.org/eslint-plugin-cypress/-/eslint-plugin-cypress-2.15.1.tgz",
@@ -5629,38 +5439,10 @@
5439 "eslint": ">= 3.2.1"
5440 }
5441 },
5632 - "node_modules/eslint-plugin-cypress/node_modules/globals": {
5633 - "version": "13.24.0",
5634 - "resolved": "https://registry.npmjs.org/globals/-/globals-13.24.0.tgz",
5635 - "integrity": "sha512-AhO5QUcj8llrbG09iWhPU2B204J1xnPeL8kQmVorSsy+Sjj1sk8gIyh6cUocGmH4L0UuhAJy+hJMRA4mgA4mFQ==",
5636 - "dev": true,
5637 - "dependencies": {
5638 - "type-fest": "^0.20.2"
5639 - },
5640 - "engines": {
5641 - "node": ">=8"
5642 - },
5643 - "funding": {
5644 - "url": "https://github.com/sponsors/sindresorhus"
5645 - }
5646 - },
5647 - "node_modules/eslint-plugin-cypress/node_modules/type-fest": {
5648 - "version": "0.20.2",
5649 - "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
5650 - "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
5651 - "dev": true,
5652 - "engines": {
5653 - "node": ">=10"
5654 - },
5655 - "funding": {
5656 - "url": "https://github.com/sponsors/sindresorhus"
5657 - }
5658 - },
5442 "node_modules/eslint-plugin-prettier": {
5443 "version": "5.1.3",
5444 "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-5.1.3.tgz",
5445 "integrity": "sha512-C9GCVAs4Eq7ZC/XFQHITLiHJxQngdtraXaM+LoUFoFp/lHNl2Zn8f3WQbe9HvTBBQ9YnKFB0/2Ajdqwo5D1EAw==",
5663 - "dev": true,
5446 "dependencies": {
5447 "prettier-linter-helpers": "^1.0.0",
5448 "synckit": "^0.8.6"
@@ -5686,65 +5468,30 @@
5468 }
5469 }
5470 },
5689 - "node_modules/eslint-plugin-vue": {
5690 - "version": "9.20.0",
5691 - "resolved": "https://registry.npmjs.org/eslint-plugin-vue/-/eslint-plugin-vue-9.20.0.tgz",
5692 - "integrity": "sha512-9/DV5CM7ItfgWmXjL6j3zyDtVTrslYdnEm+rnYNajdElx17b3erxi/Wc6FY7t3BQ6dgo0t/UBpgiWCOKtJyN8Q==",
5693 - "dev": true,
5694 - "dependencies": {
5695 - "@eslint-community/eslint-utils": "^4.4.0",
5696 - "natural-compare": "^1.4.0",
5697 - "nth-check": "^2.1.1",
5698 - "postcss-selector-parser": "^6.0.13",
5699 - "semver": "^7.5.4",
5700 - "vue-eslint-parser": "^9.4.0",
5701 - "xml-name-validator": "^4.0.0"
5702 - },
5703 - "engines": {
5704 - "node": "^14.17.0 || >=16.0.0"
5705 - },
5706 - "peerDependencies": {
5707 - "eslint": "^6.2.0 || ^7.0.0 || ^8.0.0"
5708 - }
5709 - },
5710 - "node_modules/eslint-plugin-vue/node_modules/lru-cache": {
5711 - "version": "6.0.0",
5712 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
5713 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
5714 - "dev": true,
5715 - "dependencies": {
5716 - "yallist": "^4.0.0"
5717 - },
5718 - "engines": {
5719 - "node": ">=10"
5720 - }
5721 - },
5722 - "node_modules/eslint-plugin-vue/node_modules/semver": {
5723 - "version": "7.5.4",
5724 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
5725 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
5726 - "dev": true,
5471 + "node_modules/eslint-plugin-vue": {
5472 + "version": "9.20.1",
5473 + "resolved": "https://registry.npmjs.org/eslint-plugin-vue/-/eslint-plugin-vue-9.20.1.tgz",
5474 + "integrity": "sha512-GyCs8K3lkEvoyC1VV97GJhP1SvqsKCiWGHnbn0gVUYiUhaH2+nB+Dv1uekv1THFMPbBfYxukrzQdltw950k+LQ==",
5475 "dependencies": {
5728 - "lru-cache": "^6.0.0"
5729 - },
5730 - "bin": {
5731 - "semver": "bin/semver.js"
5476 + "@eslint-community/eslint-utils": "^4.4.0",
5477 + "natural-compare": "^1.4.0",
5478 + "nth-check": "^2.1.1",
5479 + "postcss-selector-parser": "^6.0.13",
5480 + "semver": "^7.5.4",
5481 + "vue-eslint-parser": "^9.4.0",
5482 + "xml-name-validator": "^4.0.0"
5483 },
5484 "engines": {
5734 - "node": ">=10"
5485 + "node": "^14.17.0 || >=16.0.0"
5486 + },
5487 + "peerDependencies": {
5488 + "eslint": "^6.2.0 || ^7.0.0 || ^8.0.0"
5489 }
5490 },
5737 - "node_modules/eslint-plugin-vue/node_modules/yallist": {
5738 - "version": "4.0.0",
5739 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
5740 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
5741 - "dev": true
5742 - },
5491 "node_modules/eslint-scope": {
5492 "version": "7.2.2",
5493 "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.2.2.tgz",
5494 "integrity": "sha512-dOt21O7lTMhDM+X9mB4GX+DZrZtCUJPL/wlcTqxyrx5IvO0IYtILdtrQGQp+8n5S0gwSVmOf9NQrjMOgfQZlIg==",
5747 - "dev": true,
5495 "dependencies": {
5496 "esrecurse": "^4.3.0",
5497 "estraverse": "^5.2.0"
@@ -5760,7 +5507,6 @@
5507 "version": "3.4.3",
5508 "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
5509 "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
5763 - "dev": true,
5510 "engines": {
5511 "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
5512 },
@@ -5772,7 +5518,6 @@
5518 "version": "4.3.0",
5519 "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
5520 "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
5775 - "dev": true,
5521 "dependencies": {
5522 "color-convert": "^2.0.1"
5523 },
@@ -5787,7 +5532,6 @@
5532 "version": "1.1.11",
5533 "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
5534 "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
5790 - "dev": true,
5535 "dependencies": {
5536 "balanced-match": "^1.0.0",
5537 "concat-map": "0.0.1"
@@ -5797,7 +5541,6 @@
5541 "version": "4.1.2",
5542 "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
5543 "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
5800 - "dev": true,
5544 "dependencies": {
5545 "ansi-styles": "^4.1.0",
5546 "supports-color": "^7.1.0"
@@ -5813,7 +5556,6 @@
5556 "version": "2.0.1",
5557 "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
5558 "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
5816 - "dev": true,
5559 "dependencies": {
5560 "color-name": "~1.1.4"
5561 },
@@ -5824,14 +5566,12 @@
5566 "node_modules/eslint/node_modules/color-name": {
5567 "version": "1.1.4",
5568 "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
5827 - "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
5828 - "dev": true
5569 + "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
5570 },
5571 "node_modules/eslint/node_modules/escape-string-regexp": {
5572 "version": "4.0.0",
5573 "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
5574 "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
5834 - "dev": true,
5575 "engines": {
5576 "node": ">=10"
5577 },
@@ -5839,26 +5579,10 @@
5579 "url": "https://github.com/sponsors/sindresorhus"
5580 }
5581 },
5842 - "node_modules/eslint/node_modules/globals": {
5843 - "version": "13.24.0",
5844 - "resolved": "https://registry.npmjs.org/globals/-/globals-13.24.0.tgz",
5845 - "integrity": "sha512-AhO5QUcj8llrbG09iWhPU2B204J1xnPeL8kQmVorSsy+Sjj1sk8gIyh6cUocGmH4L0UuhAJy+hJMRA4mgA4mFQ==",
5846 - "dev": true,
5847 - "dependencies": {
5848 - "type-fest": "^0.20.2"
5849 - },
5850 - "engines": {
5851 - "node": ">=8"
5852 - },
5853 - "funding": {
5854 - "url": "https://github.com/sponsors/sindresorhus"
5855 - }
5856 - },
5582 "node_modules/eslint/node_modules/has-flag": {
5583 "version": "4.0.0",
5584 "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
5585 "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
5861 - "dev": true,
5586 "engines": {
5587 "node": ">=8"
5588 }
@@ -5867,7 +5591,6 @@
5591 "version": "3.1.2",
5592 "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
5593 "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
5870 - "dev": true,
5594 "dependencies": {
5595 "brace-expansion": "^1.1.7"
5596 },
@@ -5879,7 +5602,6 @@
5602 "version": "7.2.0",
5603 "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
5604 "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
5882 - "dev": true,
5605 "dependencies": {
5606 "has-flag": "^4.0.0"
5607 },
@@ -5887,23 +5609,10 @@
5609 "node": ">=8"
5610 }
5611 },
5890 - "node_modules/eslint/node_modules/type-fest": {
5891 - "version": "0.20.2",
5892 - "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
5893 - "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
5894 - "dev": true,
5895 - "engines": {
5896 - "node": ">=10"
5897 - },
5898 - "funding": {
5899 - "url": "https://github.com/sponsors/sindresorhus"
5900 - }
5901 - },
5612 "node_modules/espree": {
5613 "version": "9.6.1",
5614 "resolved": "https://registry.npmjs.org/espree/-/espree-9.6.1.tgz",
5615 "integrity": "sha512-oruZaFkjorTpF32kDSI5/75ViwGeZginGGy2NoOSg3Q9bnwlnmDm4HLnkl0RE3n+njDXR037aY1+x58Z/zFdwQ==",
5906 - "dev": true,
5616 "dependencies": {
5617 "acorn": "^8.9.0",
5618 "acorn-jsx": "^5.3.2",
@@ -5920,7 +5629,6 @@
5629 "version": "1.5.0",
5630 "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.5.0.tgz",
5631 "integrity": "sha512-YQLXUplAwJgCydQ78IMJywZCceoqk1oH01OERdSAJc/7U2AylwjhSCLDEtqwg811idIS/9fIU5GjG73IgjKMVg==",
5923 - "dev": true,
5632 "dependencies": {
5633 "estraverse": "^5.1.0"
5634 },
@@ -5932,7 +5640,6 @@
5640 "version": "4.3.0",
5641 "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
5642 "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
5935 - "dev": true,
5643 "dependencies": {
5644 "estraverse": "^5.2.0"
5645 },
@@ -5944,7 +5651,6 @@
5651 "version": "5.3.0",
5652 "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
5653 "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
5947 - "dev": true,
5654 "engines": {
5655 "node": ">=4.0"
5656 }
@@ -5958,7 +5664,6 @@
5664 "version": "2.0.3",
5665 "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
5666 "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
5961 - "dev": true,
5667 "engines": {
5668 "node": ">=0.10.0"
5669 }
@@ -6068,20 +5773,17 @@
5773 "node_modules/fast-deep-equal": {
5774 "version": "3.1.3",
5775 "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
6071 - "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
6072 - "dev": true
5776 + "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="
5777 },
5778 "node_modules/fast-diff": {
5779 "version": "1.3.0",
5780 "resolved": "https://registry.npmjs.org/fast-diff/-/fast-diff-1.3.0.tgz",
6077 - "integrity": "sha512-VxPP4NqbUjj6MaAOafWeUn2cXWLcCtljklUtZf0Ind4XQ+QPtmA0b18zZy0jIQx+ExRVCR/ZQpBmik5lXshNsw==",
6078 - "dev": true
5781 + "integrity": "sha512-VxPP4NqbUjj6MaAOafWeUn2cXWLcCtljklUtZf0Ind4XQ+QPtmA0b18zZy0jIQx+ExRVCR/ZQpBmik5lXshNsw=="
5782 },
5783 "node_modules/fast-glob": {
5784 "version": "3.3.2",
5785 "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.2.tgz",
5786 "integrity": "sha512-oX2ruAFQwf/Orj8m737Y5adxDQO0LAB7/S5MnxCdTNDd4p6BsyIVsv9JQsATbTSq8KHRpLwIHbVlUNatxd+1Ow==",
6084 - "dev": true,
5787 "dependencies": {
5788 "@nodelib/fs.stat": "^2.0.2",
5789 "@nodelib/fs.walk": "^1.2.3",
@@ -6097,7 +5799,6 @@
5799 "version": "5.1.2",
5800 "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
5801 "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
6100 - "dev": true,
5802 "dependencies": {
5803 "is-glob": "^4.0.1"
5804 },
@@ -6108,20 +5809,17 @@
5809 "node_modules/fast-json-stable-stringify": {
5810 "version": "2.1.0",
5811 "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
6111 - "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
6112 - "dev": true
5812 + "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="
5813 },
5814 "node_modules/fast-levenshtein": {
5815 "version": "2.0.6",
5816 "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
6117 - "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
6118 - "dev": true
5817 + "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw=="
5818 },
5819 "node_modules/fastq": {
5820 "version": "1.16.0",
5821 "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.16.0.tgz",
5822 "integrity": "sha512-ifCoaXsDrsdkWTtiNJX5uzHDsrck5TzfKKDcuFFTIrrc/BS076qgEIfoIy1VeZqViznfKiysPYTh/QeHtnIsYA==",
6124 - "dev": true,
5823 "dependencies": {
5824 "reusify": "^1.0.4"
5825 }
@@ -6154,7 +5852,6 @@
5852 "version": "6.0.1",
5853 "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
5854 "integrity": "sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==",
6157 - "dev": true,
5855 "dependencies": {
5856 "flat-cache": "^3.0.4"
5857 },
@@ -6166,7 +5863,6 @@
5863 "version": "7.0.1",
5864 "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
5865 "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
6169 - "dev": true,
5866 "dependencies": {
5867 "to-regex-range": "^5.0.1"
5868 },
@@ -6178,7 +5874,6 @@
5874 "version": "5.0.0",
5875 "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
5876 "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
6181 - "dev": true,
5877 "dependencies": {
5878 "locate-path": "^6.0.0",
5879 "path-exists": "^4.0.0"
@@ -6194,7 +5889,6 @@
5889 "version": "3.2.0",
5890 "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-3.2.0.tgz",
5891 "integrity": "sha512-CYcENa+FtcUKLmhhqyctpclsq7QF38pKjZHsGNiSQF5r4FtoKDWabFDl3hzaEQMvT1LHEysw5twgLvpYYb4vbw==",
6197 - "dev": true,
5892 "dependencies": {
5893 "flatted": "^3.2.9",
5894 "keyv": "^4.5.3",
@@ -6207,8 +5901,7 @@
5901 "node_modules/flatted": {
5902 "version": "3.2.9",
5903 "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.9.tgz",
6210 - "integrity": "sha512-36yxDn5H7OFZQla0/jFJmbIKTdZAQHngCedGxiMmpNfEZM0sdEeT+WczLQrjK6D7o2aiyLYDnkw0R3JK0Qv1RQ==",
6211 - "dev": true
5904 + "integrity": "sha512-36yxDn5H7OFZQla0/jFJmbIKTdZAQHngCedGxiMmpNfEZM0sdEeT+WczLQrjK6D7o2aiyLYDnkw0R3JK0Qv1RQ=="
5905 },
5906 "node_modules/follow-redirects": {
5907 "version": "1.15.5",
@@ -6347,8 +6040,7 @@
6040 "node_modules/fs.realpath": {
6041 "version": "1.0.0",
6042 "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
6350 - "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
6351 - "dev": true
6043 + "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
6044 },
6045 "node_modules/fsevents": {
6046 "version": "2.3.3",
@@ -6517,7 +6209,6 @@
6209 "version": "6.0.2",
6210 "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
6211 "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
6520 - "dev": true,
6212 "dependencies": {
6213 "is-glob": "^4.0.3"
6214 },
@@ -6541,12 +6232,17 @@
6232 }
6233 },
6234 "node_modules/globals": {
6544 - "version": "11.12.0",
6545 - "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
6546 - "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
6547 - "dev": true,
6235 + "version": "13.24.0",
6236 + "resolved": "https://registry.npmjs.org/globals/-/globals-13.24.0.tgz",
6237 + "integrity": "sha512-AhO5QUcj8llrbG09iWhPU2B204J1xnPeL8kQmVorSsy+Sjj1sk8gIyh6cUocGmH4L0UuhAJy+hJMRA4mgA4mFQ==",
6238 + "dependencies": {
6239 + "type-fest": "^0.20.2"
6240 + },
6241 "engines": {
6549 - "node": ">=4"
6242 + "node": ">=8"
6243 + },
6244 + "funding": {
6245 + "url": "https://github.com/sponsors/sindresorhus"
6246 }
6247 },
6248 "node_modules/globalthis": {
@@ -6568,7 +6264,6 @@
6264 "version": "11.1.0",
6265 "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz",
6266 "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==",
6571 - "dev": true,
6267 "dependencies": {
6268 "array-union": "^2.1.0",
6269 "dir-glob": "^3.0.1",
@@ -6605,8 +6300,7 @@
6300 "node_modules/graphemer": {
6301 "version": "1.4.0",
6302 "resolved": "https://registry.npmjs.org/graphemer/-/graphemer-1.4.0.tgz",
6608 - "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==",
6609 - "dev": true
6303 + "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag=="
6304 },
6305 "node_modules/has-bigints": {
6306 "version": "1.0.2",
@@ -6895,7 +6589,6 @@
6589 "version": "5.3.0",
6590 "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.0.tgz",
6591 "integrity": "sha512-g7dmpshy+gD7mh88OC9NwSGTKoc3kyLAZQRU1mt53Aw/vnvfXnbC+F/7F7QoYVKbV+KNvJx8wArewKy1vXMtlg==",
6898 - "dev": true,
6592 "engines": {
6593 "node": ">= 4"
6594 }
@@ -6922,7 +6615,6 @@
6615 "version": "3.3.0",
6616 "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.0.tgz",
6617 "integrity": "sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==",
6925 - "dev": true,
6618 "dependencies": {
6619 "parent-module": "^1.0.0",
6620 "resolve-from": "^4.0.0"
@@ -6961,7 +6653,6 @@
6653 "version": "0.1.4",
6654 "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
6655 "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
6964 - "dev": true,
6656 "engines": {
6657 "node": ">=0.8.19"
6658 }
@@ -6979,7 +6670,6 @@
6670 "version": "1.0.6",
6671 "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
6672 "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
6982 - "dev": true,
6673 "dependencies": {
6674 "once": "^1.3.0",
6675 "wrappy": "1"
@@ -6988,8 +6678,7 @@
6678 "node_modules/inherits": {
6679 "version": "2.0.4",
6680 "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
6991 - "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
6992 - "dev": true
6681 + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
6682 },
6683 "node_modules/ini": {
6684 "version": "2.0.0",
@@ -7150,7 +6839,6 @@
6839 "version": "2.1.1",
6840 "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
6841 "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
7153 - "dev": true,
6842 "engines": {
6843 "node": ">=0.10.0"
6844 }
@@ -7183,7 +6871,6 @@
6871 "version": "4.0.3",
6872 "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
6873 "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
7186 - "dev": true,
6874 "dependencies": {
6875 "is-extglob": "^2.1.1"
6876 },
@@ -7262,7 +6949,6 @@
6949 "version": "7.0.0",
6950 "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
6951 "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
7265 - "dev": true,
6952 "engines": {
6953 "node": ">=0.12.0"
6954 }
@@ -7286,7 +6972,6 @@
6972 "version": "3.0.3",
6973 "resolved": "https://registry.npmjs.org/is-path-inside/-/is-path-inside-3.0.3.tgz",
6974 "integrity": "sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==",
7289 - "dev": true,
6975 "engines": {
6976 "node": ">=8"
6977 }
@@ -7433,8 +7118,7 @@
7118 "node_modules/isexe": {
7119 "version": "2.0.0",
7120 "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
7436 - "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
7437 - "dev": true
7121 + "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="
7122 },
7123 "node_modules/isstream": {
7124 "version": "0.1.2",
@@ -7464,20 +7148,19 @@
7148 "version": "1.21.0",
7149 "resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.0.tgz",
7150 "integrity": "sha512-gFqAIbuKyyso/3G2qhiO2OM6shY6EPP/R0+mkDbyspxKazh8BXDC5FiFsUjlczgdNz/vfra0da2y+aHrusLG/Q==",
7467 - "dev": true,
7151 "bin": {
7152 "jiti": "bin/jiti.js"
7153 }
7154 },
7155 "node_modules/joi": {
7473 - "version": "17.11.0",
7474 - "resolved": "https://registry.npmjs.org/joi/-/joi-17.11.0.tgz",
7475 - "integrity": "sha512-NgB+lZLNoqISVy1rZocE9PZI36bL/77ie924Ri43yEvi9GUUMPeyVIr8KdFTMUlby1p0PBYMk9spIxEUQYqrJQ==",
7156 + "version": "17.12.0",
7157 + "resolved": "https://registry.npmjs.org/joi/-/joi-17.12.0.tgz",
7158 + "integrity": "sha512-HSLsmSmXz+PV9PYoi3p7cgIbj06WnEBNT28n+bbBNcPZXZFqCzzvGqpTBPujx/Z0nh1+KNQPDrNgdmQ8dq0qYw==",
7159 "dev": true,
7160 "dependencies": {
7478 - "@hapi/hoek": "^9.0.0",
7479 - "@hapi/topo": "^5.0.0",
7480 - "@sideway/address": "^4.1.3",
7161 + "@hapi/hoek": "^9.3.0",
7162 + "@hapi/topo": "^5.1.0",
7163 + "@sideway/address": "^4.1.4",
7164 "@sideway/formula": "^3.0.1",
7165 "@sideway/pinpoint": "^2.0.0"
7166 }
@@ -7525,7 +7208,6 @@
7208 "version": "4.1.0",
7209 "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
7210 "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
7528 - "dev": true,
7211 "dependencies": {
7212 "argparse": "^2.0.1"
7213 },
@@ -7540,12 +7222,11 @@
7222 "dev": true
7223 },
7224 "node_modules/jsdom": {
7543 - "version": "23.2.0",
7544 - "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-23.2.0.tgz",
7545 - "integrity": "sha512-L88oL7D/8ufIES+Zjz7v0aes+oBMh2Xnh3ygWvL0OaICOomKEPKuPnIfBJekiXr+BHbbMjrWn/xqrDQuxFTeyA==",
7225 + "version": "24.0.0",
7226 + "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-24.0.0.tgz",
7227 + "integrity": "sha512-UDS2NayCvmXSXVP6mpTj+73JnNQadZlr9N68189xib2tx5Mls7swlTNao26IoHv46BZJFvXygyRtyXd1feAk1A==",
7228 "dev": true,
7229 "dependencies": {
7548 - "@asamuzakjp/dom-selector": "^2.0.1",
7230 "cssstyle": "^4.0.1",
7231 "data-urls": "^5.0.0",
7232 "decimal.js": "^10.4.3",
@@ -7554,6 +7235,7 @@
7235 "http-proxy-agent": "^7.0.0",
7236 "https-proxy-agent": "^7.0.2",
7237 "is-potential-custom-element-name": "^1.0.1",
7238 + "nwsapi": "^2.2.7",
7239 "parse5": "^7.1.2",
7240 "rrweb-cssom": "^0.6.0",
7241 "saxes": "^6.0.0",
@@ -7617,8 +7299,7 @@
7299 "node_modules/json-buffer": {
7300 "version": "3.0.1",
7301 "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
7620 - "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
7621 - "dev": true
7302 + "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ=="
7303 },
7304 "node_modules/json-parse-better-errors": {
7305 "version": "1.0.2",
@@ -7644,14 +7325,12 @@
7325 "node_modules/json-schema-traverse": {
7326 "version": "0.4.1",
7327 "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
7647 - "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
7648 - "dev": true
7328 + "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="
7329 },
7330 "node_modules/json-stable-stringify-without-jsonify": {
7331 "version": "1.0.1",
7332 "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
7653 - "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
7654 - "dev": true
7333 + "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw=="
7334 },
7335 "node_modules/json-stringify-safe": {
7336 "version": "5.0.1",
@@ -7674,8 +7353,7 @@
7353 "node_modules/jsonc-parser": {
7354 "version": "3.2.0",
7355 "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.0.tgz",
7677 - "integrity": "sha512-gfFQZrcTc8CnKXp6Y4/CBT3fTc0OVuDofpre4aEeEpSBPV5X5v4+Vmx+8snU7RLPrNHPKSgLxGo9YuQzz20o+w==",
7678 - "dev": true
7356 + "integrity": "sha512-gfFQZrcTc8CnKXp6Y4/CBT3fTc0OVuDofpre4aEeEpSBPV5X5v4+Vmx+8snU7RLPrNHPKSgLxGo9YuQzz20o+w=="
7357 },
7358 "node_modules/jsonfile": {
7359 "version": "6.1.0",
@@ -7729,7 +7407,6 @@
7407 "version": "4.5.4",
7408 "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
7409 "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
7732 - "dev": true,
7410 "dependencies": {
7411 "json-buffer": "3.0.1"
7412 }
@@ -7913,7 +7590,6 @@
7590 "version": "0.4.1",
7591 "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
7592 "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
7916 - "dev": true,
7593 "dependencies": {
7594 "prelude-ls": "^1.2.1",
7595 "type-check": "~0.4.0"
@@ -7937,6 +7613,14 @@
7613 "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==",
7614 "dev": true
7615 },
7616 + "node_modules/linkify-it": {
7617 + "version": "4.0.1",
7618 + "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-4.0.1.tgz",
7619 + "integrity": "sha512-C7bfi1UZmoj8+PQx22XyeXCuBlokoyWQL5pWSP+EI6nzRylyThouddufc2c1NDIcP9k5agmN9fLpA7VNJfIiqw==",
7620 + "dependencies": {
7621 + "uc.micro": "^1.0.1"
7622 + }
7623 + },
7624 "node_modules/listr2": {
7625 "version": "3.14.0",
7626 "resolved": "https://registry.npmjs.org/listr2/-/listr2-3.14.0.tgz",
@@ -8054,7 +7738,6 @@
7738 "version": "6.0.0",
7739 "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
7740 "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
8057 - "dev": true,
7741 "dependencies": {
7742 "p-locate": "^5.0.0"
7743 },
@@ -8078,8 +7761,7 @@
7761 "node_modules/lodash.merge": {
7762 "version": "4.6.2",
7763 "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
8081 - "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
8082 - "dev": true
7764 + "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ=="
7765 },
7766 "node_modules/lodash.once": {
7767 "version": "4.1.1",
@@ -8326,12 +8008,40 @@
8008 "integrity": "sha512-CkYQrPYZfWnu/DAmVCpTSX/xHpKZ80eKh2lAkyA6AJTef6bW+6JpbQZN5rofum7da+SyN1bi5ctTm+lTfcCW3g==",
8009 "dev": true
8010 },
8011 + "node_modules/markdown-it": {
8012 + "version": "13.0.2",
8013 + "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-13.0.2.tgz",
8014 + "integrity": "sha512-FtwnEuuK+2yVU7goGn/MJ0WBZMM9ZPgU9spqlFs7/A/pDIUNSOQZhUgOqYCficIuR2QaFnrt8LHqBWsbTAoI5w==",
8015 + "dependencies": {
8016 + "argparse": "^2.0.1",
8017 + "entities": "~3.0.1",
8018 + "linkify-it": "^4.0.1",
8019 + "mdurl": "^1.0.1",
8020 + "uc.micro": "^1.0.5"
8021 + },
8022 + "bin": {
8023 + "markdown-it": "bin/markdown-it.js"
8024 + }
8025 + },
8026 + "node_modules/markdown-it-highlightjs": {
8027 + "version": "4.0.1",
8028 + "resolved": "https://registry.npmjs.org/markdown-it-highlightjs/-/markdown-it-highlightjs-4.0.1.tgz",
8029 + "integrity": "sha512-EPXwFEN6P5nqR3G4KjT20r20xbGYKMMA/360hhSYFmeoGXTE6hsLtJAiB/8ID8slVH4CWHHEL7GX0YenyIstVQ==",
8030 + "dependencies": {
8031 + "highlight.js": "^11.5.1"
8032 + }
8033 + },
8034 "node_modules/mdn-data": {
8035 "version": "2.0.30",
8036 "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.0.30.tgz",
8037 "integrity": "sha512-GaqWWShW4kv/G9IEucWScBx9G1/vsFZZJUO+tD26M8J8z3Kw5RDQjaoZe03YAClgeS/SWPOcb4nkFBTEi5DUEA==",
8038 "dev": true
8039 },
8040 + "node_modules/mdurl": {
8041 + "version": "1.0.1",
8042 + "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-1.0.1.tgz",
8043 + "integrity": "sha512-/sKlQJCBYVY9Ers9hqzKou4H6V5UWc/M59TH2dvkt+84itfnq7uFOMLpOiOS4ujvHP4etln18fmIxA5R5fll0g=="
8044 + },
8045 "node_modules/media-typer": {
8046 "version": "0.3.0",
8047 "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
@@ -8360,7 +8070,6 @@
8070 "version": "1.4.1",
8071 "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
8072 "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
8363 - "dev": true,
8073 "engines": {
8074 "node": ">= 8"
8075 }
@@ -8378,7 +8087,6 @@
8087 "version": "4.0.5",
8088 "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz",
8089 "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==",
8381 - "dev": true,
8090 "dependencies": {
8091 "braces": "^3.0.2",
8092 "picomatch": "^2.3.1"
@@ -8421,7 +8129,6 @@
8129 "version": "9.0.3",
8130 "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.3.tgz",
8131 "integrity": "sha512-RHiac9mvaRw0x3AYRgDC1CxAP7HTcNrrECeA8YYJeWnpo+2Q5CegtZjaotWTWxDG3UeGA1coE05iH1mPjT/2mg==",
8424 - "dev": true,
8132 "dependencies": {
8133 "brace-expansion": "^2.0.1"
8134 },
@@ -8649,7 +8356,6 @@
8356 "version": "1.5.0",
8357 "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.5.0.tgz",
8358 "integrity": "sha512-NPVQvAY1xr1QoVeG0cy8yUYC7FQcOx6evl/RjT1wL5FvzPnzOysoqB/jmx/DhssT2dYa8nxECLAaFI/+gVLhDQ==",
8652 - "dev": true,
8359 "dependencies": {
8360 "acorn": "^8.11.3",
8361 "pathe": "^1.1.2",
@@ -8669,8 +8375,7 @@
8375 "node_modules/ms": {
8376 "version": "2.1.2",
8377 "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
8672 - "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
8673 - "dev": true
8378 + "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="
8379 },
8380 "node_modules/muggle-string": {
8381 "version": "0.3.1",
@@ -8738,8 +8443,7 @@
8443 "node_modules/natural-compare": {
8444 "version": "1.4.0",
8445 "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
8741 - "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
8742 - "dev": true
8446 + "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="
8447 },
8448 "node_modules/negotiator": {
8449 "version": "0.6.3",
@@ -8789,33 +8493,6 @@
8493 "node": ">=16"
8494 }
8495 },
8792 - "node_modules/node-gyp/node_modules/lru-cache": {
8793 - "version": "6.0.0",
8794 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
8795 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
8796 - "dev": true,
8797 - "dependencies": {
8798 - "yallist": "^4.0.0"
8799 - },
8800 - "engines": {
8801 - "node": ">=10"
8802 - }
8803 - },
8804 - "node_modules/node-gyp/node_modules/semver": {
8805 - "version": "7.5.4",
8806 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
8807 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
8808 - "dev": true,
8809 - "dependencies": {
8810 - "lru-cache": "^6.0.0"
8811 - },
8812 - "bin": {
8813 - "semver": "bin/semver.js"
8814 - },
8815 - "engines": {
8816 - "node": ">=10"
8817 - }
8818 - },
8496 "node_modules/node-gyp/node_modules/which": {
8497 "version": "4.0.0",
8498 "resolved": "https://registry.npmjs.org/which/-/which-4.0.0.tgz",
@@ -8831,12 +8508,6 @@
8508 "node": "^16.13.0 || >=18.0.0"
8509 }
8510 },
8834 - "node_modules/node-gyp/node_modules/yallist": {
8835 - "version": "4.0.0",
8836 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
8837 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
8838 - "dev": true
8839 - },
8511 "node_modules/node-releases": {
8512 "version": "2.0.14",
8513 "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.14.tgz",
@@ -8921,39 +8592,6 @@
8592 "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
8593 }
8594 },
8924 - "node_modules/npm-install-checks/node_modules/lru-cache": {
8925 - "version": "6.0.0",
8926 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
8927 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
8928 - "dev": true,
8929 - "dependencies": {
8930 - "yallist": "^4.0.0"
8931 - },
8932 - "engines": {
8933 - "node": ">=10"
8934 - }
8935 - },
8936 - "node_modules/npm-install-checks/node_modules/semver": {
8937 - "version": "7.5.4",
8938 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
8939 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
8940 - "dev": true,
8941 - "dependencies": {
8942 - "lru-cache": "^6.0.0"
8943 - },
8944 - "bin": {
8945 - "semver": "bin/semver.js"
8946 - },
8947 - "engines": {
8948 - "node": ">=10"
8949 - }
8950 - },
8951 - "node_modules/npm-install-checks/node_modules/yallist": {
8952 - "version": "4.0.0",
8953 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
8954 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
8955 - "dev": true
8956 - },
8595 "node_modules/npm-normalize-package-bin": {
8596 "version": "3.0.1",
8597 "resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-3.0.1.tgz",
@@ -8999,39 +8637,6 @@
8637 "node": "14 || >=16.14"
8638 }
8639 },
9002 - "node_modules/npm-package-arg/node_modules/semver": {
9003 - "version": "7.5.4",
9004 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
9005 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
9006 - "dev": true,
9007 - "dependencies": {
9008 - "lru-cache": "^6.0.0"
9009 - },
9010 - "bin": {
9011 - "semver": "bin/semver.js"
9012 - },
9013 - "engines": {
9014 - "node": ">=10"
9015 - }
9016 - },
9017 - "node_modules/npm-package-arg/node_modules/semver/node_modules/lru-cache": {
9018 - "version": "6.0.0",
9019 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
9020 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
9021 - "dev": true,
9022 - "dependencies": {
9023 - "yallist": "^4.0.0"
9024 - },
9025 - "engines": {
9026 - "node": ">=10"
9027 - }
9028 - },
9029 - "node_modules/npm-package-arg/node_modules/yallist": {
9030 - "version": "4.0.0",
9031 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
9032 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
9033 - "dev": true
9034 - },
8640 "node_modules/npm-packlist": {
8641 "version": "8.0.2",
8642 "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-8.0.2.tgz",
@@ -9049,49 +8654,16 @@
8654 "resolved": "https://registry.npmjs.org/npm-pick-manifest/-/npm-pick-manifest-9.0.0.tgz",
8655 "integrity": "sha512-VfvRSs/b6n9ol4Qb+bDwNGUXutpy76x6MARw/XssevE0TnctIKcmklJZM5Z7nqs5z5aW+0S63pgCNbpkUNNXBg==",
8656 "dev": true,
9052 - "dependencies": {
9053 - "npm-install-checks": "^6.0.0",
9054 - "npm-normalize-package-bin": "^3.0.0",
9055 - "npm-package-arg": "^11.0.0",
9056 - "semver": "^7.3.5"
9057 - },
9058 - "engines": {
9059 - "node": "^16.14.0 || >=18.0.0"
9060 - }
9061 - },
9062 - "node_modules/npm-pick-manifest/node_modules/lru-cache": {
9063 - "version": "6.0.0",
9064 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
9065 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
9066 - "dev": true,
9067 - "dependencies": {
9068 - "yallist": "^4.0.0"
9069 - },
9070 - "engines": {
9071 - "node": ">=10"
9072 - }
9073 - },
9074 - "node_modules/npm-pick-manifest/node_modules/semver": {
9075 - "version": "7.5.4",
9076 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
9077 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
9078 - "dev": true,
9079 - "dependencies": {
9080 - "lru-cache": "^6.0.0"
9081 - },
9082 - "bin": {
9083 - "semver": "bin/semver.js"
8657 + "dependencies": {
8658 + "npm-install-checks": "^6.0.0",
8659 + "npm-normalize-package-bin": "^3.0.0",
8660 + "npm-package-arg": "^11.0.0",
8661 + "semver": "^7.3.5"
8662 },
8663 "engines": {
9086 - "node": ">=10"
8664 + "node": "^16.14.0 || >=18.0.0"
8665 }
8666 },
9089 - "node_modules/npm-pick-manifest/node_modules/yallist": {
9090 - "version": "4.0.0",
9091 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
9092 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
9093 - "dev": true
9094 - },
8667 "node_modules/npm-registry-fetch": {
8668 "version": "16.1.0",
8669 "resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-16.1.0.tgz",
@@ -9240,7 +8812,6 @@
8812 "version": "2.1.1",
8813 "resolved": "https://registry.npmjs.org/nth-check/-/nth-check-2.1.1.tgz",
8814 "integrity": "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==",
9243 - "dev": true,
8815 "dependencies": {
8816 "boolbase": "^1.0.0"
8817 },
@@ -9248,6 +8819,12 @@
8819 "url": "https://github.com/fb55/nth-check?sponsor=1"
8820 }
8821 },
8822 + "node_modules/nwsapi": {
8823 + "version": "2.2.7",
8824 + "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.7.tgz",
8825 + "integrity": "sha512-ub5E4+FBPKwAZx0UwIQOjYWGHTEq5sPqHQNRN8Z9e4A7u3Tj1weLJsL59yH9vmvqEtBHaOmT6cYQKIZOxp35FQ==",
8826 + "dev": true
8827 + },
8828 "node_modules/object-assign": {
8829 "version": "4.1.1",
8830 "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
@@ -9318,7 +8895,6 @@
8895 "version": "1.4.0",
8896 "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
8897 "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
9321 - "dev": true,
8898 "dependencies": {
8899 "wrappy": "1"
8900 }
@@ -9364,7 +8940,6 @@
8940 "version": "0.9.3",
8941 "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.3.tgz",
8942 "integrity": "sha512-JjCoypp+jKn1ttEFExxhetCKeJt9zhAgAve5FXHixTvFDW/5aEktX9bufBKLRRMdU7bNtpLfcGu94B3cdEJgjg==",
9367 - "dev": true,
8943 "dependencies": {
8944 "@aashutoshrathi/word-wrap": "^1.2.3",
8945 "deep-is": "^0.1.3",
@@ -9387,7 +8962,6 @@
8962 "version": "3.1.0",
8963 "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
8964 "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
9390 - "dev": true,
8965 "dependencies": {
8966 "yocto-queue": "^0.1.0"
8967 },
@@ -9402,7 +8976,6 @@
8976 "version": "5.0.0",
8977 "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
8978 "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
9405 - "dev": true,
8979 "dependencies": {
8980 "p-limit": "^3.0.2"
8981 },
@@ -9429,9 +9002,9 @@
9002 }
9003 },
9004 "node_modules/pacote": {
9432 - "version": "17.0.5",
9433 - "resolved": "https://registry.npmjs.org/pacote/-/pacote-17.0.5.tgz",
9434 - "integrity": "sha512-TAE0m20zSDMnchPja9vtQjri19X3pZIyRpm2TJVeI+yU42leJBBDTRYhOcWFsPhaMxf+3iwQkFiKz16G9AEeeA==",
9005 + "version": "17.0.6",
9006 + "resolved": "https://registry.npmjs.org/pacote/-/pacote-17.0.6.tgz",
9007 + "integrity": "sha512-cJKrW21VRE8vVTRskJo78c/RCvwJCn1f4qgfxL4w77SOWrTCRcmfkYHlHtS0gqpgjv3zhXflRtgsrUCX5xwNnQ==",
9008 "dev": true,
9009 "dependencies": {
9010 "@npmcli/git": "^5.0.0",
@@ -9449,7 +9022,7 @@
9022 "promise-retry": "^2.0.1",
9023 "read-package-json": "^7.0.0",
9024 "read-package-json-fast": "^3.0.0",
9452 - "sigstore": "^2.0.0",
9025 + "sigstore": "^2.2.0",
9026 "ssri": "^10.0.0",
9027 "tar": "^6.1.11"
9028 },
@@ -9464,7 +9037,6 @@
9037 "version": "1.0.1",
9038 "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
9039 "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
9467 - "dev": true,
9040 "dependencies": {
9041 "callsites": "^3.0.0"
9042 },
@@ -9497,6 +9069,18 @@
9069 "url": "https://github.com/inikulin/parse5?sponsor=1"
9070 }
9071 },
9072 + "node_modules/parse5/node_modules/entities": {
9073 + "version": "4.5.0",
9074 + "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
9075 + "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
9076 + "dev": true,
9077 + "engines": {
9078 + "node": ">=0.12"
9079 + },
9080 + "funding": {
9081 + "url": "https://github.com/fb55/entities?sponsor=1"
9082 + }
9083 + },
9084 "node_modules/parseurl": {
9085 "version": "1.3.3",
9086 "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
@@ -9524,7 +9108,6 @@
9108 "version": "4.0.0",
9109 "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
9110 "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
9527 - "dev": true,
9111 "engines": {
9112 "node": ">=8"
9113 }
@@ -9533,7 +9116,6 @@
9116 "version": "1.0.1",
9117 "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
9118 "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
9536 - "dev": true,
9119 "engines": {
9120 "node": ">=0.10.0"
9121 }
@@ -9542,7 +9124,6 @@
9124 "version": "3.1.1",
9125 "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
9126 "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
9545 - "dev": true,
9127 "engines": {
9128 "node": ">=8"
9129 }
@@ -9588,7 +9169,6 @@
9169 "version": "4.0.0",
9170 "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
9171 "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
9591 - "dev": true,
9172 "engines": {
9173 "node": ">=8"
9174 }
@@ -9596,8 +9176,7 @@
9176 "node_modules/pathe": {
9177 "version": "1.1.2",
9178 "resolved": "https://registry.npmjs.org/pathe/-/pathe-1.1.2.tgz",
9599 - "integrity": "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ==",
9600 - "dev": true
9179 + "integrity": "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="
9180 },
9181 "node_modules/pathval": {
9182 "version": "1.1.1",
@@ -9638,7 +9217,6 @@
9217 "version": "2.3.1",
9218 "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
9219 "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
9641 - "dev": true,
9220 "engines": {
9221 "node": ">=8.6"
9222 },
@@ -9738,7 +9316,6 @@
9316 "version": "1.0.3",
9317 "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-1.0.3.tgz",
9318 "integrity": "sha512-nN7pYi0AQqJnoLPC9eHFQ8AcyaixBUOwvqc5TDnIKCMEE6I0y8P7OKA7fPexsXGCGxQDl/cmrLAp26LhcwxZ4A==",
9741 - "dev": true,
9319 "dependencies": {
9320 "jsonc-parser": "^3.2.0",
9321 "mlly": "^1.2.0",
@@ -9907,7 +9484,6 @@
9484 "version": "6.0.15",
9485 "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.15.tgz",
9486 "integrity": "sha512-rEYkQOMUCEMhsKbK66tbEU9QVIxbhN18YiniAwA7XQYTVBqrBy+P2p5JcdqsHgKM2zWylp8d7J6eszocfds5Sw==",
9910 - "dev": true,
9487 "dependencies": {
9488 "cssesc": "^3.0.0",
9489 "util-deprecate": "^1.0.2"
@@ -9926,16 +9502,14 @@
9502 "version": "1.2.1",
9503 "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
9504 "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
9929 - "dev": true,
9505 "engines": {
9506 "node": ">= 0.8.0"
9507 }
9508 },
9509 "node_modules/prettier": {
9935 - "version": "3.2.1",
9936 - "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.2.1.tgz",
9937 - "integrity": "sha512-qSUWshj1IobVbKc226Gw2pync27t0Kf0EdufZa9j7uBSJay1CC+B3K5lAAZoqgX3ASiKuWsk6OmzKRetXNObWg==",
9938 - "dev": true,
9510 + "version": "3.2.4",
9511 + "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.2.4.tgz",
9512 + "integrity": "sha512-FWu1oLHKCrtpO1ypU6J0SbK2d9Ckwysq6bHj/uaCP26DxrPpppCLQRGVuqAxSTvhF00AcvDRyYrLNW7ocBhFFQ==",
9513 "bin": {
9514 "prettier": "bin/prettier.cjs"
9515 },
@@ -9950,7 +9524,6 @@
9524 "version": "1.0.0",
9525 "resolved": "https://registry.npmjs.org/prettier-linter-helpers/-/prettier-linter-helpers-1.0.0.tgz",
9526 "integrity": "sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==",
9953 - "dev": true,
9527 "dependencies": {
9528 "fast-diff": "^1.1.2"
9529 },
@@ -10093,7 +9666,6 @@
9666 "version": "2.3.1",
9667 "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
9668 "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
10096 - "dev": true,
9669 "engines": {
9670 "node": ">=6"
9671 }
@@ -10123,7 +9695,6 @@
9695 "version": "1.2.3",
9696 "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
9697 "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
10126 - "dev": true,
9698 "funding": [
9699 {
9700 "type": "github",
@@ -10218,39 +9789,6 @@
9789 "node": "^16.14.0 || >=18.0.0"
9790 }
9791 },
10221 - "node_modules/read-package-json/node_modules/semver": {
10222 - "version": "7.5.4",
10223 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
10224 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
10225 - "dev": true,
10226 - "dependencies": {
10227 - "lru-cache": "^6.0.0"
10228 - },
10229 - "bin": {
10230 - "semver": "bin/semver.js"
10231 - },
10232 - "engines": {
10233 - "node": ">=10"
10234 - }
10235 - },
10236 - "node_modules/read-package-json/node_modules/semver/node_modules/lru-cache": {
10237 - "version": "6.0.0",
10238 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
10239 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
10240 - "dev": true,
10241 - "dependencies": {
10242 - "yallist": "^4.0.0"
10243 - },
10244 - "engines": {
10245 - "node": ">=10"
10246 - }
10247 - },
10248 - "node_modules/read-package-json/node_modules/yallist": {
10249 - "version": "4.0.0",
10250 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
10251 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
10252 - "dev": true
10253 - },
9792 "node_modules/read-pkg": {
9793 "version": "3.0.0",
9794 "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-3.0.0.tgz",
@@ -10467,15 +10005,6 @@
10005 "node": ">=0.10.0"
10006 }
10007 },
10470 - "node_modules/require-from-string": {
10471 - "version": "2.0.2",
10472 - "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
10473 - "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
10474 - "dev": true,
10475 - "engines": {
10476 - "node": ">=0.10.0"
10477 - }
10478 - },
10008 "node_modules/requires-port": {
10009 "version": "1.0.0",
10010 "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
@@ -10503,7 +10032,6 @@
10032 "version": "4.0.0",
10033 "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
10034 "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
10506 - "dev": true,
10035 "engines": {
10036 "node": ">=4"
10037 }
@@ -10592,7 +10120,6 @@
10120 "version": "1.0.4",
10121 "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz",
10122 "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
10595 - "dev": true,
10123 "engines": {
10124 "iojs": ">=1.0.0",
10125 "node": ">=0.10.0"
@@ -10608,7 +10135,6 @@
10135 "version": "3.0.2",
10136 "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
10137 "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
10611 - "dev": true,
10138 "dependencies": {
10139 "glob": "^7.1.3"
10140 },
@@ -10623,7 +10149,6 @@
10149 "version": "1.1.11",
10150 "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
10151 "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
10626 - "dev": true,
10152 "dependencies": {
10153 "balanced-match": "^1.0.0",
10154 "concat-map": "0.0.1"
@@ -10633,7 +10158,6 @@
10158 "version": "7.2.3",
10159 "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
10160 "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
10636 - "dev": true,
10161 "dependencies": {
10162 "fs.realpath": "^1.0.0",
10163 "inflight": "^1.0.4",
@@ -10653,7 +10177,6 @@
10177 "version": "3.1.2",
10178 "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
10179 "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
10656 - "dev": true,
10180 "dependencies": {
10181 "brace-expansion": "^1.1.7"
10182 },
@@ -10805,7 +10328,6 @@
10328 "version": "1.2.0",
10329 "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
10330 "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
10808 - "dev": true,
10331 "funding": [
10332 {
10333 "type": "github",
@@ -10834,13 +10356,13 @@
10356 }
10357 },
10358 "node_modules/safe-array-concat": {
10837 - "version": "1.0.1",
10838 - "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.0.1.tgz",
10839 - "integrity": "sha512-6XbUAseYE2KtOuGueyeobCySj9L4+66Tn6KQMOPQJrAJEowYKW/YR/MGJZl7FdydUdaFu4LYyDZjxf4/Nmo23Q==",
10359 + "version": "1.1.0",
10360 + "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.1.0.tgz",
10361 + "integrity": "sha512-ZdQ0Jeb9Ofti4hbt5lX3T2JcAamT9hfzYU1MNB+z/jaEbB6wfFfPIR/zEORmZqobkCCJhSjodobH6WHNmJ97dg==",
10362 "dev": true,
10363 "dependencies": {
10842 - "call-bind": "^1.0.2",
10843 - "get-intrinsic": "^1.2.1",
10364 + "call-bind": "^1.0.5",
10365 + "get-intrinsic": "^1.2.2",
10366 "has-symbols": "^1.0.3",
10367 "isarray": "^2.0.5"
10368 },
@@ -10895,9 +10417,9 @@
10417 "dev": true
10418 },
10419 "node_modules/sass": {
10898 - "version": "1.69.7",
10899 - "resolved": "https://registry.npmjs.org/sass/-/sass-1.69.7.tgz",
10900 - "integrity": "sha512-rzj2soDeZ8wtE2egyLXgOOHQvaC2iosZrkF6v3EUG+tBwEvhqUCzm0VP3k9gHF9LXbSrRhT5SksoI56Iw8NPnQ==",
10420 + "version": "1.70.0",
10421 + "resolved": "https://registry.npmjs.org/sass/-/sass-1.70.0.tgz",
10422 + "integrity": "sha512-uUxNQ3zAHeAx5nRFskBnrWzDUJrrvpCPD5FNAoRvTi0WwremlheES3tg+56PaVtCs5QDRX5CBLxxKMDJMEa1WQ==",
10423 "dev": true,
10424 "dependencies": {
10425 "chokidar": ">=3.0.0 <4.0.0",
@@ -10938,24 +10460,46 @@
10460 "integrity": "sha512-MW8Qs6vbzo0pHmDpFSYPna+lwpZ6Zk1ancbajw/7E8TKtHdV+1DfZZD+kKJEhG/cAoB/i+LiT+5msZOqj0DwRA=="
10461 },
10462 "node_modules/semver": {
10941 - "version": "6.3.1",
10942 - "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
10943 - "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
10944 - "dev": true,
10463 + "version": "7.5.4",
10464 + "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
10465 + "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
10466 + "dependencies": {
10467 + "lru-cache": "^6.0.0"
10468 + },
10469 "bin": {
10470 "semver": "bin/semver.js"
10471 + },
10472 + "engines": {
10473 + "node": ">=10"
10474 + }
10475 + },
10476 + "node_modules/semver/node_modules/lru-cache": {
10477 + "version": "6.0.0",
10478 + "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
10479 + "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
10480 + "dependencies": {
10481 + "yallist": "^4.0.0"
10482 + },
10483 + "engines": {
10484 + "node": ">=10"
10485 }
10486 },
10487 + "node_modules/semver/node_modules/yallist": {
10488 + "version": "4.0.0",
10489 + "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
10490 + "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
10491 + },
10492 "node_modules/set-function-length": {
10950 - "version": "1.1.1",
10951 - "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.1.1.tgz",
10952 - "integrity": "sha512-VoaqjbBJKiWtg4yRcKBQ7g7wnGnLV3M8oLvVWwOk2PdYY6PEFegR1vezXR0tw6fZGF9csVakIRjrJiy2veSBFQ==",
10493 + "version": "1.2.0",
10494 + "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.0.tgz",
10495 + "integrity": "sha512-4DBHDoyHlM1IRPGYcoxexgh67y4ueR53FKV1yyxwFMY7aCqcN/38M1+SwZ/qJQ8iLv7+ck385ot4CcisOAPT9w==",
10496 "dev": true,
10497 "dependencies": {
10498 "define-data-property": "^1.1.1",
10956 - "get-intrinsic": "^1.2.1",
10499 + "function-bind": "^1.1.2",
10500 + "get-intrinsic": "^1.2.2",
10501 "gopd": "^1.0.1",
10958 - "has-property-descriptors": "^1.0.0"
10502 + "has-property-descriptors": "^1.0.1"
10503 },
10504 "engines": {
10505 "node": ">= 0.4"
@@ -10985,7 +10529,6 @@
10529 "version": "2.0.0",
10530 "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
10531 "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
10988 - "dev": true,
10532 "dependencies": {
10533 "shebang-regex": "^3.0.0"
10534 },
@@ -10997,7 +10540,6 @@
10540 "version": "3.0.0",
10541 "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
10542 "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
11000 - "dev": true,
10543 "engines": {
10544 "node": ">=8"
10545 }
@@ -11038,15 +10580,17 @@
10580 "dev": true
10581 },
10582 "node_modules/sigstore": {
11041 - "version": "2.1.0",
11042 - "resolved": "https://registry.npmjs.org/sigstore/-/sigstore-2.1.0.tgz",
11043 - "integrity": "sha512-kPIj+ZLkyI3QaM0qX8V/nSsweYND3W448pwkDgS6CQ74MfhEkIR8ToK5Iyx46KJYRjseVcD3Rp9zAmUAj6ZjPw==",
10583 + "version": "2.2.0",
10584 + "resolved": "https://registry.npmjs.org/sigstore/-/sigstore-2.2.0.tgz",
10585 + "integrity": "sha512-fcU9clHwEss2/M/11FFM8Jwc4PjBgbhXoNskoK5guoK0qGQBSeUbQZRJ+B2fDFIvhyf0gqCaPrel9mszbhAxug==",
10586 "dev": true,
10587 "dependencies": {
11046 - "@sigstore/bundle": "^2.1.0",
10588 + "@sigstore/bundle": "^2.1.1",
10589 + "@sigstore/core": "^0.2.0",
10590 "@sigstore/protobuf-specs": "^0.2.1",
11048 - "@sigstore/sign": "^2.1.0",
11049 - "@sigstore/tuf": "^2.1.0"
10591 + "@sigstore/sign": "^2.2.1",
10592 + "@sigstore/tuf": "^2.3.0",
10593 + "@sigstore/verify": "^0.1.0"
10594 },
10595 "engines": {
10596 "node": "^16.14.0 || >=18.0.0"
@@ -11076,7 +10620,6 @@
10620 "version": "3.0.0",
10621 "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
10622 "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
11079 - "dev": true,
10623 "engines": {
10624 "node": ">=8"
10625 }
@@ -11457,7 +11000,6 @@
11000 "version": "6.0.1",
11001 "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
11002 "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
11460 - "dev": true,
11003 "dependencies": {
11004 "ansi-regex": "^5.0.1"
11005 },
@@ -11500,7 +11042,6 @@
11042 "version": "3.1.1",
11043 "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
11044 "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
11503 - "dev": true,
11045 "engines": {
11046 "node": ">=8"
11047 },
@@ -11708,7 +11249,6 @@
11249 "version": "0.8.8",
11250 "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.8.8.tgz",
11251 "integrity": "sha512-HwOKAP7Wc5aRGYdKH+dw0PRRpbO841v2DENBtjnR5HFWoiNByAl7vrx3p0G/rCyYXQsrxqtX48TImFtPcIHSpQ==",
11711 - "dev": true,
11252 "dependencies": {
11253 "@pkgr/core": "^0.1.0",
11254 "tslib": "^2.6.2"
@@ -11723,8 +11263,7 @@
11263 "node_modules/synckit/node_modules/tslib": {
11264 "version": "2.6.2",
11265 "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.6.2.tgz",
11726 - "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q==",
11727 - "dev": true
11266 + "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
11267 },
11268 "node_modules/tailwind-config-viewer": {
11269 "version": "1.7.3",
@@ -11954,18 +11493,6 @@
11493 "url": "https://github.com/sponsors/sindresorhus"
11494 }
11495 },
11957 - "node_modules/taze/node_modules/lru-cache": {
11958 - "version": "6.0.0",
11959 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
11960 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
11961 - "dev": true,
11962 - "dependencies": {
11963 - "yallist": "^4.0.0"
11964 - },
11965 - "engines": {
11966 - "node": ">=10"
11967 - }
11968 - },
11496 "node_modules/taze/node_modules/mimic-fn": {
11497 "version": "4.0.0",
11498 "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-4.0.0.tgz",
@@ -12020,21 +11547,6 @@
11547 "url": "https://github.com/sponsors/sindresorhus"
11548 }
11549 },
12023 - "node_modules/taze/node_modules/semver": {
12024 - "version": "7.5.4",
12025 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
12026 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
12027 - "dev": true,
12028 - "dependencies": {
12029 - "lru-cache": "^6.0.0"
12030 - },
12031 - "bin": {
12032 - "semver": "bin/semver.js"
12033 - },
12034 - "engines": {
12035 - "node": ">=10"
12036 - }
12037 - },
11550 "node_modules/taze/node_modules/signal-exit": {
11551 "version": "4.1.0",
11552 "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
@@ -12059,17 +11571,10 @@
11571 "url": "https://github.com/sponsors/sindresorhus"
11572 }
11573 },
12062 - "node_modules/taze/node_modules/yallist": {
12063 - "version": "4.0.0",
12064 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
12065 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
12066 - "dev": true
12067 - },
11574 "node_modules/text-table": {
11575 "version": "0.2.0",
11576 "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
12071 - "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
12072 - "dev": true
11577 + "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw=="
11578 },
11579 "node_modules/thenify": {
11580 "version": "3.3.1",
@@ -12108,15 +11613,15 @@
11613 "dev": true
11614 },
11615 "node_modules/tinybench": {
12111 - "version": "2.5.1",
12112 - "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.5.1.tgz",
12113 - "integrity": "sha512-65NKvSuAVDP/n4CqH+a9w2kTlLReS9vhsAP06MWx+/89nMinJyB2icyl58RIcqCmIggpojIGeuJGhjU1aGMBSg==",
11616 + "version": "2.6.0",
11617 + "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.6.0.tgz",
11618 + "integrity": "sha512-N8hW3PG/3aOoZAN5V/NSAEDz0ZixDSSt5b/a05iqtpgfLWMSVuCo7w0k2vVvEjdrIoeGqZzweX2WlyioNIHchA==",
11619 "dev": true
11620 },
11621 "node_modules/tinypool": {
12117 - "version": "0.8.1",
12118 - "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-0.8.1.tgz",
12119 - "integrity": "sha512-zBTCK0cCgRROxvs9c0CGK838sPkeokNGdQVUUwHAbynHFlmyJYj825f/oRs528HaIJ97lo0pLIlDUzwN+IorWg==",
11622 + "version": "0.8.2",
11623 + "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-0.8.2.tgz",
11624 + "integrity": "sha512-SUszKYe5wgsxnNOVlBYO6IC+8VGWdVGZWAqUxp3UErNBtptZvWbwyUOyzNL59zigz2rCA92QiL3wvG+JDSdJdQ==",
11625 "dev": true,
11626 "engines": {
11627 "node": ">=14.0.0"
@@ -12168,7 +11673,6 @@
11673 "version": "5.0.1",
11674 "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
11675 "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
12171 - "dev": true,
11676 "dependencies": {
11677 "is-number": "^7.0.0"
11678 },
@@ -12239,7 +11743,6 @@
11743 "version": "1.0.3",
11744 "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-1.0.3.tgz",
11745 "integrity": "sha512-wNMeqtMz5NtwpT/UZGY5alT+VoKdSsOOP/kqHFcUW1P/VRhH2wJ48+DN2WwUliNbQ976ETwDL0Ifd2VVvgonvg==",
12242 - "dev": true,
11746 "engines": {
11747 "node": ">=16.13.0"
11748 },
@@ -12352,7 +11855,6 @@
11855 "version": "0.4.0",
11856 "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
11857 "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
12355 - "dev": true,
11858 "dependencies": {
11859 "prelude-ls": "^1.2.1"
11860 },
@@ -12370,10 +11872,9 @@
11872 }
11873 },
11874 "node_modules/type-fest": {
12373 - "version": "0.21.3",
12374 - "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
12375 - "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
12376 - "dev": true,
11875 + "version": "0.20.2",
11876 + "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
11877 + "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
11878 "engines": {
11879 "node": ">=10"
11880 },
@@ -12463,7 +11964,6 @@
11964 "version": "5.2.2",
11965 "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.2.2.tgz",
11966 "integrity": "sha512-mI4WrpHsbCIcwT9cF4FZvr80QUeKvsUsUvKDoR+X/7XHQH98xYD8YHZg7ANtz2GtZt/CBq2QJ0thkGJMHfqc1w==",
12466 - "devOptional": true,
11967 "bin": {
11968 "tsc": "bin/tsc",
11969 "tsserver": "bin/tsserver"
@@ -12472,11 +11972,15 @@
11972 "node": ">=14.17"
11973 }
11974 },
11975 + "node_modules/uc.micro": {
11976 + "version": "1.0.6",
11977 + "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-1.0.6.tgz",
11978 + "integrity": "sha512-8Y75pvTYkLJW2hWQHXxoqRgV7qb9B+9vFEtidML+7koHUFapnVJAZ6cKs+Qjz5Aw3aZWHMC6u0wJE3At+nSGwA=="
11979 + },
11980 "node_modules/ufo": {
11981 "version": "1.3.2",
11982 "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.3.2.tgz",
12478 - "integrity": "sha512-o+ORpgGwaYQXgqGDwd+hkS4PuZ3QnmqMMxRuajK/a38L6fTpcE5GPIfrf+L/KemFzfUpeUQc1rRS1iDBozvnFA==",
12479 - "dev": true
11983 + "integrity": "sha512-o+ORpgGwaYQXgqGDwd+hkS4PuZ3QnmqMMxRuajK/a38L6fTpcE5GPIfrf+L/KemFzfUpeUQc1rRS1iDBozvnFA=="
11984 },
11985 "node_modules/unbox-primitive": {
11986 "version": "1.0.2",
@@ -12497,7 +12001,6 @@
12001 "version": "0.3.11",
12002 "resolved": "https://registry.npmjs.org/unconfig/-/unconfig-0.3.11.tgz",
12003 "integrity": "sha512-bV/nqePAKv71v3HdVUn6UefbsDKQWRX+bJIkiSm0+twIds6WiD2bJLWWT3i214+J/B4edufZpG2w7Y63Vbwxow==",
12500 - "dev": true,
12004 "dependencies": {
12005 "@antfu/utils": "^0.7.6",
12006 "defu": "^6.1.2",
@@ -12639,7 +12142,6 @@
12142 "version": "4.4.1",
12143 "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
12144 "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
12642 - "dev": true,
12145 "dependencies": {
12146 "punycode": "^2.1.0"
12147 }
@@ -12657,8 +12159,7 @@
12159 "node_modules/util-deprecate": {
12160 "version": "1.0.2",
12161 "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
12660 - "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
12661 - "dev": true
12162 + "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="
12163 },
12164 "node_modules/uuid": {
12165 "version": "8.3.2",
@@ -12740,9 +12241,9 @@
12241 }
12242 },
12243 "node_modules/vite": {
12743 - "version": "5.0.11",
12744 - "resolved": "https://registry.npmjs.org/vite/-/vite-5.0.11.tgz",
12745 - "integrity": "sha512-XBMnDjZcNAw/G1gEiskiM1v6yzM4GE5aMGvhWTlHAYYhxb7S3/V1s3m2LDHa8Vh6yIWYYB0iJwsEaS523c4oYA==",
12244 + "version": "5.0.12",
12245 + "resolved": "https://registry.npmjs.org/vite/-/vite-5.0.12.tgz",
12246 + "integrity": "sha512-4hsnEkG3q0N4Tzf1+t6NdN9dg/L3BM+q8SWgbSPnJvrgH2kgdyzfVJwbR1ic69/4uMJJ/3dqDZZE5/WwqW8U1w==",
12247 "dev": true,
12248 "dependencies": {
12249 "esbuild": "^0.19.3",
@@ -12795,9 +12296,9 @@
12296 }
12297 },
12298 "node_modules/vite-bundle-analyzer": {
12798 - "version": "0.6.1",
12799 - "resolved": "https://registry.npmjs.org/vite-bundle-analyzer/-/vite-bundle-analyzer-0.6.1.tgz",
12800 - "integrity": "sha512-uVQAZMkAzukKJdoBd4iXQSyFdDV5Akntsxak9xVzsngFG/yxe1tqDI+lbEAlzLPb4PtIyPtbRP7wgUhiR2sUyQ==",
12299 + "version": "0.7.0",
12300 + "resolved": "https://registry.npmjs.org/vite-bundle-analyzer/-/vite-bundle-analyzer-0.7.0.tgz",
12301 + "integrity": "sha512-CaYVmRmlIupjutl50Ggl1tY5VNoAUyRZuMlqxBwAQxsysdHsJMHi66unwsonWmM3EmBbPSALvD5K1zgA1rviRA==",
12302 "dev": true,
12303 "dependencies": {
12304 "fast-glob": "^3.3.1",
@@ -12853,9 +12354,9 @@
12354 }
12355 },
12356 "node_modules/vite-node": {
12856 - "version": "1.2.0",
12857 - "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-1.2.0.tgz",
12858 - "integrity": "sha512-ETnQTHeAbbOxl7/pyBck9oAPZZZo+kYnFt1uQDD+hPReOc+wCjXw4r4jHriBRuVDB5isHmPXxrfc1yJnfBERqg==",
12357 + "version": "1.2.1",
12358 + "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-1.2.1.tgz",
12359 + "integrity": "sha512-fNzHmQUSOY+y30naohBvSW7pPn/xn3Ib/uqm+5wAJQJiqQsU0NBR78XdRJb04l4bOFKjpTWld0XAfkKlrDbySg==",
12360 "dev": true,
12361 "dependencies": {
12362 "cac": "^6.7.14",
@@ -12887,17 +12388,17 @@
12388 }
12389 },
12390 "node_modules/vitest": {
12890 - "version": "1.2.0",
12891 - "resolved": "https://registry.npmjs.org/vitest/-/vitest-1.2.0.tgz",
12892 - "integrity": "sha512-Ixs5m7BjqvLHXcibkzKRQUvD/XLw0E3rvqaCMlrm/0LMsA0309ZqYvTlPzkhh81VlEyVZXFlwWnkhb6/UMtcaQ==",
12391 + "version": "1.2.1",
12392 + "resolved": "https://registry.npmjs.org/vitest/-/vitest-1.2.1.tgz",
12393 + "integrity": "sha512-TRph8N8rnSDa5M2wKWJCMnztCZS9cDcgVTQ6tsTFTG/odHJ4l5yNVqvbeDJYJRZ6is3uxaEpFs8LL6QM+YFSdA==",
12394 "dev": true,
12395 "dependencies": {
12895 - "@vitest/expect": "1.2.0",
12896 - "@vitest/runner": "1.2.0",
12897 - "@vitest/snapshot": "1.2.0",
12898 - "@vitest/spy": "1.2.0",
12899 - "@vitest/utils": "1.2.0",
12900 - "acorn-walk": "^8.3.1",
12396 + "@vitest/expect": "1.2.1",
12397 + "@vitest/runner": "1.2.1",
12398 + "@vitest/snapshot": "1.2.1",
12399 + "@vitest/spy": "1.2.1",
12400 + "@vitest/utils": "1.2.1",
12401 + "acorn-walk": "^8.3.2",
12402 "cac": "^6.7.14",
12403 "chai": "^4.3.10",
12404 "debug": "^4.3.4",
@@ -12911,7 +12412,7 @@
12412 "tinybench": "^2.5.1",
12413 "tinypool": "^0.8.1",
12414 "vite": "^5.0.0",
12914 - "vite-node": "1.2.0",
12415 + "vite-node": "1.2.1",
12416 "why-is-node-running": "^2.2.2"
12417 },
12418 "bin": {
@@ -13114,15 +12615,15 @@
12615 }
12616 },
12617 "node_modules/vue": {
13117 - "version": "3.4.11",
13118 - "resolved": "https://registry.npmjs.org/vue/-/vue-3.4.11.tgz",
13119 - "integrity": "sha512-iaA98z14ZrrVJlclpHX/HCNeacbMOLdX5foYN7/vt4cHFhDkBRzojjbLQZ2UDRAeNV1v4V5I21+QpdCXWlpG5Q==",
12618 + "version": "3.4.15",
12619 + "resolved": "https://registry.npmjs.org/vue/-/vue-3.4.15.tgz",
12620 + "integrity": "sha512-jC0GH4KkWLWJOEQjOpkqU1bQsBwf4R1rsFtw5GQJbjHVKWDzO6P0nWWBTmjp1xSemAioDFj1jdaK1qa3DnMQoQ==",
12621 "dependencies": {
13121 - "@vue/compiler-dom": "3.4.11",
13122 - "@vue/compiler-sfc": "3.4.11",
13123 - "@vue/runtime-dom": "3.4.11",
13124 - "@vue/server-renderer": "3.4.11",
13125 - "@vue/shared": "3.4.11"
12622 + "@vue/compiler-dom": "3.4.15",
12623 + "@vue/compiler-sfc": "3.4.15",
12624 + "@vue/runtime-dom": "3.4.15",
12625 + "@vue/server-renderer": "3.4.15",
12626 + "@vue/shared": "3.4.15"
12627 },
12628 "peerDependencies": {
12629 "typescript": "*"
@@ -13160,7 +12661,6 @@
12661 "version": "9.4.0",
12662 "resolved": "https://registry.npmjs.org/vue-eslint-parser/-/vue-eslint-parser-9.4.0.tgz",
12663 "integrity": "sha512-7KsNBb6gHFA75BtneJsoK/dbZ281whUIwFYdQxA68QrCrGMXYzUMbPDHGcOQ0OocIVKrWSKWXZ4mL7tonCXoUw==",
13163 - "dev": true,
12664 "dependencies": {
12665 "debug": "^4.3.4",
12666 "eslint-scope": "^7.1.1",
@@ -13180,39 +12680,6 @@
12680 "eslint": ">=6.0.0"
12681 }
12682 },
13183 - "node_modules/vue-eslint-parser/node_modules/lru-cache": {
13184 - "version": "6.0.0",
13185 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
13186 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
13187 - "dev": true,
13188 - "dependencies": {
13189 - "yallist": "^4.0.0"
13190 - },
13191 - "engines": {
13192 - "node": ">=10"
13193 - }
13194 - },
13195 - "node_modules/vue-eslint-parser/node_modules/semver": {
13196 - "version": "7.5.4",
13197 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
13198 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
13199 - "dev": true,
13200 - "dependencies": {
13201 - "lru-cache": "^6.0.0"
13202 - },
13203 - "bin": {
13204 - "semver": "bin/semver.js"
13205 - },
13206 - "engines": {
13207 - "node": ">=10"
13208 - }
13209 - },
13210 - "node_modules/vue-eslint-parser/node_modules/yallist": {
13211 - "version": "4.0.0",
13212 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
13213 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
13214 - "dev": true
13215 - },
12683 "node_modules/vue-highlight-words": {
12684 "version": "3.0.1",
12685 "resolved": "https://registry.npmjs.org/vue-highlight-words/-/vue-highlight-words-3.0.1.tgz",
@@ -13292,39 +12759,6 @@
12759 "typescript": "*"
12760 }
12761 },
13295 - "node_modules/vue-tsc/node_modules/lru-cache": {
13296 - "version": "6.0.0",
13297 - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
13298 - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
13299 - "dev": true,
13300 - "dependencies": {
13301 - "yallist": "^4.0.0"
13302 - },
13303 - "engines": {
13304 - "node": ">=10"
13305 - }
13306 - },
13307 - "node_modules/vue-tsc/node_modules/semver": {
13308 - "version": "7.5.4",
13309 - "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
13310 - "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
13311 - "dev": true,
13312 - "dependencies": {
13313 - "lru-cache": "^6.0.0"
13314 - },
13315 - "bin": {
13316 - "semver": "bin/semver.js"
13317 - },
13318 - "engines": {
13319 - "node": ">=10"
13320 - }
13321 - },
13322 - "node_modules/vue-tsc/node_modules/yallist": {
13323 - "version": "4.0.0",
13324 - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
13325 - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
13326 - "dev": true
13327 - },
12762 "node_modules/vue3-apexcharts": {
12763 "version": "1.4.4",
12764 "resolved": "https://registry.npmjs.org/vue3-apexcharts/-/vue3-apexcharts-1.4.4.tgz",
@@ -13470,7 +12904,6 @@
12904 "version": "2.0.2",
12905 "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
12906 "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
13473 - "dev": true,
12907 "dependencies": {
12908 "isexe": "^2.0.0"
12909 },
@@ -13665,8 +13098,7 @@
13098 "node_modules/wrappy": {
13099 "version": "1.0.2",
13100 "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
13668 - "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
13669 - "dev": true
13101 + "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
13102 },
13103 "node_modules/ws": {
13104 "version": "8.16.0",
@@ -13693,7 +13125,6 @@
13125 "version": "4.0.0",
13126 "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-4.0.0.tgz",
13127 "integrity": "sha512-ICP2e+jsHvAj2E2lIHxa5tjXRlKDJo4IdvPvCXbXQGdzSfmSpNVyIKMvoZHjDY9DP0zV17iI85o90vRFXNccRw==",
13696 - "dev": true,
13128 "engines": {
13129 "node": ">=12"
13130 }
@@ -13787,7 +13218,6 @@
13218 "version": "0.1.0",
13219 "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
13220 "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
13790 - "dev": true,
13221 "engines": {
13222 "node": ">=10"
13223 },
package.json
+16 -14
@@ -32,13 +32,14 @@
32 },
33 "dependencies": {
34 "@ajoelp/json-to-formdata": "^1.5.0",
35 + "@f3ve/vue-markdown-it": "^0.2.0",
36 "@fontsource/jetbrains-mono": "^5.0.18",
37 "@fontsource/lexend": "^5.0.18",
38 "@fontsource/public-sans": "^5.0.16",
39 "@popperjs/core": "^2.11.8",
39 - "@vueuse/components": "^10.7.1",
40 - "@vueuse/core": "^10.7.1",
41 - "apexcharts": "^3.45.1",
40 + "@vueuse/components": "^10.7.2",
41 + "@vueuse/core": "^10.7.2",
42 + "apexcharts": "^3.45.2",
43 "bytes": "^3.1.2",
44 "colord": "^2.9.3",
45 "crypto-js": "^4.2.0",
@@ -48,6 +49,7 @@
49 "jose": "^5.2.0",
50 "js-md5": "^0.8.3",
51 "lodash": "^4.17.21",
52 + "markdown-it-highlightjs": "^4.0.1",
53 "mitt": "^3.0.1",
54 "naive-ui": "^2.37.3",
55 "password-validator": "^5.3.0",
@@ -55,7 +57,7 @@
57 "pinia-plugin-persistedstate": "^3.2.1",
58 "secure-ls": "^1.2.6",
59 "validator": "^13.11.0",
58 - "vue": "^3.4.11",
60 + "vue": "^3.4.15",
61 "vue-advanced-cropper": "^2.8.8",
62 "vue-highlight-words": "^3.0.1",
63 "vue-i18n": "^9.9.0",
@@ -73,7 +75,7 @@
75 "@types/inquirer": "^9.0.7",
76 "@types/jsdom": "^21.1.6",
77 "@types/lodash": "^4.14.202",
76 - "@types/node": "^20.11.0",
78 + "@types/node": "^20.11.5",
79 "@types/validator": "^13.11.8",
80 "@vitejs/plugin-vue": "^5.0.3",
81 "@vitejs/plugin-vue-jsx": "^3.1.0",
@@ -81,19 +83,19 @@
83 "@vue/eslint-config-typescript": "^12.0.0",
84 "@vue/test-utils": "^2.4.3",
85 "@vue/tsconfig": "^0.5.1",
84 - "autoprefixer": "^10.4.16",
85 - "cypress": "^13.6.2",
86 + "autoprefixer": "^10.4.17",
87 + "cypress": "^13.6.3",
88 "eslint": "^8.56.0",
89 "eslint-plugin-cypress": "^2.15.1",
88 - "eslint-plugin-vue": "^9.20.0",
90 + "eslint-plugin-vue": "^9.20.1",
91 "fs-extra": "^11.2.0",
90 - "jsdom": "^23.2.0",
92 + "jsdom": "^24.0.0",
93 "json5": "^2.2.3",
94 "npm-run-all": "^4.1.5",
95 "picocolors": "^1.0.0",
96 "postcss": "^8.4.33",
95 - "prettier": "^3.2.1",
96 - "sass": "^1.69.7",
97 + "prettier": "^3.2.4",
98 + "sass": "^1.70.0",
99 "start-server-and-test": "^2.0.3",
100 "tailwind-config-viewer": "^1.7.3",
101 "tailwindcss": "^3.4.1",
@@ -101,11 +103,11 @@
103 "ts-node": "^10.9.2",
104 "typescript": "~5.2.2",
105 "unplugin-vue-components": "^0.26.0",
104 - "vite": "^5.0.11",
105 - "vite-bundle-analyzer": "^0.6.1",
106 + "vite": "^5.0.12",
107 + "vite-bundle-analyzer": "^0.7.0",
108 "vite-bundle-visualizer": "^1.0.0",
109 "vite-svg-loader": "^5.1.0",
108 - "vitest": "^1.2.0",
110 + "vitest": "^1.2.1",
111 "vue-tsc": "^1.8.27"
112 },
113 "engines": {
src/api/index.ts
+3 -1
@@ -12,6 +12,7 @@ import askSocfortress from "./askSocfortress"
12 import customers from "./customers"
13 import logs from "./logs"
14 import flow from "./flow"
15 +import integrations from "./integrations"
16
17 export default {
18 agents,
@@ -27,5 +28,6 @@ export default {
28 askSocfortress,
29 customers,
30 logs,
30 - flow
31 + flow,
32 + integrations
33 }
src/api/integrations.ts new
+59
@@ -0,0 +1,59 @@
1 +import { type FlaskBaseResponse } from "@/types/flask.d"
2 +import { HttpClient } from "./httpClient"
3 +import type { AvailableIntegration, CustomerIntegration } from "@/types/integrations"
4 +
5 +export interface NewIntegration {
6 + customer_code: string
7 + customer_name: string
8 + integration_name: string
9 + integration_auth_keys: {
10 + auth_key_name: string
11 + auth_value: string
12 + }[]
13 +}
14 +
15 +export interface NewIntegrationPayload {
16 + customer_code: string
17 + customer_name: string
18 + integration_name: string
19 + integration_config: {
20 + auth_type: string
21 + config_key: string
22 + config_value: string
23 + }
24 + integration_auth_keys: {
25 + auth_key_name: string
26 + auth_value: string
27 + }[]
28 +}
29 +
30 +export default {
31 + getAvailableIntegrations() {
32 + return HttpClient.get<FlaskBaseResponse & { available_integrations: AvailableIntegration[] }>(
33 + `/integrations/available_integrations`
34 + )
35 + },
36 + getCustomerIntegrations(customerCode: string) {
37 + return HttpClient.get<FlaskBaseResponse & { available_integrations: CustomerIntegration[] }>(
38 + `/integrations/customer_integrations/${customerCode}`
39 + )
40 + },
41 + createIntegration(props: NewIntegration) {
42 + const payload: NewIntegrationPayload = {
43 + ...props,
44 + integration_config: {
45 + auth_type: "Wazuh",
46 + config_key: "endpoint",
47 + config_value: "not applicable"
48 + }
49 + }
50 + return HttpClient.post<FlaskBaseResponse>(`/integrations/create_integration`, payload)
51 + },
52 +
53 + office365Provision(customerCode: string, integrationName: string) {
54 + return HttpClient.post<FlaskBaseResponse>(`/office365/provision`, {
55 + customer_code: customerCode,
56 + integration_name: integrationName
57 + })
58 + }
59 +}
src/assets/images/office365/0-azure-app-new-registration.png
Binary files /dev/null and b/src/assets/images/office365/0-azure-app-new-registration.png differ
src/assets/images/office365/1-azure-wazuh-app-register-application.png
Binary files /dev/null and b/src/assets/images/office365/1-azure-wazuh-app-register-application.png differ
src/assets/images/office365/2-azure-wazuh-app-overview.png
Binary files /dev/null and b/src/assets/images/office365/2-azure-wazuh-app-overview.png differ
src/assets/images/office365/3-azure-wazuh-app-create-password-copy-value.png
Binary files /dev/null and b/src/assets/images/office365/3-azure-wazuh-app-create-password-copy-value.png differ
src/assets/images/office365/3-azure-wazuh-app-create-password.png
Binary files /dev/null and b/src/assets/images/office365/3-azure-wazuh-app-create-password.png differ
src/assets/images/office365/4-azure-wazuh-app-configure-permissions-admin-consent.png
Binary files /dev/null and b/src/assets/images/office365/4-azure-wazuh-app-configure-permissions-admin-consent.png differ
src/assets/images/office365/4-azure-wazuh-app-configure-permissions.png
Binary files /dev/null and b/src/assets/images/office365/4-azure-wazuh-app-configure-permissions.png differ
src/assets/scss/hljs.scss new
+62
@@ -0,0 +1,62 @@
1 +.hljs {
2 + color: var(--fg-color);
3 +}
4 +.hljs-comment,
5 +.hljs-quote {
6 + color: var(--fg-secondary-color);
7 + font-style: italic;
8 +}
9 +.hljs-doctag,
10 +.hljs-keyword,
11 +.hljs-formula {
12 + color: var(--secondary4-color);
13 +}
14 +.hljs-section,
15 +.hljs-name,
16 +.hljs-selector-tag,
17 +.hljs-deletion,
18 +.hljs-subst {
19 + color: var(--secondary2-color);
20 +}
21 +.hljs-literal {
22 + color: var(--secondary1-color);
23 +}
24 +.hljs-string,
25 +.hljs-regexp,
26 +.hljs-addition,
27 +.hljs-attribute,
28 +.hljs-meta .hljs-string {
29 + color: var(--success-color);
30 +}
31 +.hljs-attr,
32 +.hljs-variable,
33 +.hljs-template-variable,
34 +.hljs-type,
35 +.hljs-selector-class,
36 +.hljs-selector-attr,
37 +.hljs-selector-pseudo,
38 +.hljs-number {
39 + color: #c28d06;
40 +}
41 +.hljs-symbol,
42 +.hljs-bullet,
43 +.hljs-link,
44 +.hljs-meta,
45 +.hljs-selector-id,
46 +.hljs-title {
47 + color: var(--secondary1-color);
48 +}
49 +.hljs-built_in,
50 +.hljs-title.class_,
51 +.hljs-class .hljs-title {
52 + color: var(--secondary2-color);
53 +}
54 +.hljs-emphasis {
55 + font-style: italic;
56 +}
57 +.hljs-strong {
58 + font-weight: bold;
59 +}
60 +.hljs-link {
61 + text-decoration: underline;
62 +}
src/components/AuthForm/index.vue
+21 -3
@@ -36,13 +36,17 @@ import SignUp from "./SignUp.vue"
36 import Logo from "@/layouts/common/Logo.vue"
37 import { NButton } from "naive-ui"
38 import { ref, onBeforeMount, computed } from "vue"
39 +import { useRouter } from "vue-router"
40
41 export type FormType = "signin" | "signup" | "forgotpassword"
42
43 const props = defineProps<{
44 type?: FormType
45 + useOnlyRouter?: boolean
46 }>()
47
48 +const router = useRouter()
49 +
50 const typeRef = ref<FormType>("signin")
51
52 const isDark = computed<boolean>(() => useThemeStore().isThemeDark)
@@ -55,15 +59,29 @@ const title = computed<string>(() =>
59 )
60
61 function gotoSignIn() {
58 - typeRef.value = "signin"
62 + if (!props.useOnlyRouter) {
63 + typeRef.value = "signin"
64 + }
65 + router.replace({ name: "Login" })
66 }
67 function gotoSignUp() {
61 - typeRef.value = "signup"
68 + if (!props.useOnlyRouter) {
69 + typeRef.value = "signup"
70 + }
71 + router.replace({ name: "Register" })
72 }
73 function gotoForgotPassword() {
64 - typeRef.value = "forgotpassword"
74 + if (!props.useOnlyRouter) {
75 + typeRef.value = "forgotpassword"
76 + }
77 }
78
79 +onBeforeMount(() => {
80 + if (props.type) {
81 + typeRef.value = props.type
82 + }
83 +})
84 +
85 onBeforeMount(() => {
86 if (props.type) {
87 typeRef.value = props.type
src/components/customers/CustomerAgents.vue
+1 -1
@@ -1,6 +1,6 @@
1 <template>
2 <n-spin :show="loading">
3 - <div class="customer-agents flex flex-col gap-2 p-6 pt-4">
3 + <div class="customer-agents flex flex-col gap-2">
4 <AgentCard
5 v-for="agent in list"
6 :key="agent.agent_id"
src/components/customers/CustomerItem.vue
+21 -7
@@ -104,7 +104,7 @@
104 segmented
105 >
106 <Transition :name="`slide-tabs-${selectedTabsGroup === 'customer' ? 'left' : 'right'}`">
107 - <n-tabs type="line" animated :tabs-padding="24" v-if="selectedTabsGroup === 'customer'">
107 + <n-tabs type="line" animated :tabs-padding="24" v-if="selectedTabsGroup === 'customer'" class="h-full">
108 <n-tab-pane name="Info" tab="Info" display-directive="show:lazy">
109 <CustomerInfo
110 :customer="customerInfo"
@@ -123,6 +123,12 @@
123 @submitted="customerMeta = $event"
124 />
125 </n-tab-pane>
126 + <n-tab-pane name="Integrations" tab="Integrations" display-directive="show:lazy">
127 + <CustomerIntegrations
128 + :customerCode="customer.customer_code"
129 + :customerName="customer.customer_name"
130 + />
131 + </n-tab-pane>
132 <template #suffix>
133 <div class="pr-8 hover:text-primary-color cursor-pointer" @click="selectedTabsGroup = 'agents'">
134 Agents
@@ -140,12 +146,16 @@
146 </template>
147 <n-tab-pane name="Agents" tab="Agents" display-directive="show:lazy">
148 <n-scrollbar style="max-height: 470px" trigger="none">
143 - <CustomerAgents :customer="customerInfo" v-if="customerInfo" />
149 + <div class="p-6 pt-2">
150 + <CustomerAgents :customer="customerInfo" v-if="customerInfo" />
151 + </div>
152 </n-scrollbar>
153 </n-tab-pane>
154 <n-tab-pane name="Healthcheck Wazuh" tab="Healthcheck Wazuh" display-directive="show:lazy">
155 <n-scrollbar style="max-height: 470px" trigger="none">
148 - <CustomerHealthcheckList source="wazuh" :customerCode="customer.customer_code" />
156 + <div class="p-6 pt-2">
157 + <CustomerHealthcheckList source="wazuh" :customerCode="customer.customer_code" />
158 + </div>
159 </n-scrollbar>
160 </n-tab-pane>
161 <n-tab-pane
@@ -154,7 +164,9 @@
164 display-directive="show:lazy"
165 >
166 <n-scrollbar style="max-height: 470px" trigger="none">
157 - <CustomerHealthcheckList source="velociraptor" :customerCode="customer.customer_code" />
167 + <div class="p-6 pt-2">
168 + <CustomerHealthcheckList source="velociraptor" :customerCode="customer.customer_code" />
169 + </div>
170 </n-scrollbar>
171 </n-tab-pane>
172 </n-tabs>
@@ -170,9 +182,10 @@ import Icon from "@/components/common/Icon.vue"
182 import Badge from "@/components/common/Badge.vue"
183 import { computed, onBeforeMount, ref, toRefs, watch } from "vue"
184 import CustomerInfo from "./CustomerInfo.vue"
173 -import CustomerProvision from "./CustomerProvision.vue"
185 import CustomerAgents from "./CustomerAgents.vue"
175 -import CustomerHealthcheckList from "./CustomerHealthcheckList.vue"
186 +import CustomerProvision from "./provision/CustomerProvision.vue"
187 +import CustomerHealthcheckList from "./healthcheck/CustomerHealthcheckList.vue"
188 +import CustomerIntegrations from "./integrations/CustomerIntegrations.vue"
189 import Api from "@/api"
190 import { NAvatar, useMessage, NPopover, NModal, NTabs, NTabPane, NSpin, NScrollbar } from "naive-ui"
191 import type { Customer, CustomerMeta } from "@/types/customers.d"
@@ -300,7 +313,8 @@ onBeforeMount(() => {
313 }
314 }
315
303 - &.highlight {
316 + &.highlight,
317 + &:hover {
318 box-shadow: 0px 0px 0px 1px inset var(--primary-color);
319 }
320 }
src/components/customers/healthcheck/CustomerHealthcheckItem.vue renamed
src/components/customers/healthcheck/CustomerHealthcheckList.vue renamed
+4 -4
@@ -1,5 +1,5 @@
1 <template>
2 - <div class="flex p-6 pt-4 pb-0 justify-end">
2 + <div class="flex mb-6 justify-end">
3 <div>
4 <n-input-group>
5 <n-select
@@ -14,8 +14,8 @@
14 </div>
15 </div>
16 <n-spin :show="loading">
17 - <div class="customer-healthcheck-list">
18 - <div class="list flex flex-col gap-2 p-6 pt-4" v-if="healthyList.length">
17 + <div class="customer-healthcheck-list flex flex-col gap-6">
18 + <div class="list flex flex-col gap-2" v-if="healthyList.length">
19 <div class="title healthy flex items-center gap-2">
20 <Icon :name="CheckIcon" :size="16"></Icon>
21 Healthy
@@ -31,7 +31,7 @@
31 class="item-appear item-appear-bottom item-appear-005"
32 />
33 </div>
34 - <div class="list flex flex-col gap-2 p-6 pt-4" v-if="unhealthyList.length">
34 + <div class="list flex flex-col gap-2" v-if="unhealthyList.length">
35 <div class="title unhealthy flex items-center gap-2">
36 <Icon :name="AlertIcon" :size="16"></Icon>
37 Unhealthy
src/components/customers/integrations/CustomerIntegrationForm.vue new
+250
@@ -0,0 +1,250 @@
1 +<template>
2 + <div class="customer-integration-form flex flex-col gap-4">
3 + <div>
4 + <n-scrollbar x-scrollable trigger="none">
5 + <div class="px-7 pt-4 pb-2">
6 + <n-steps :current="current" size="small" :status="currentStatus">
7 + <n-step title="Choose Integration" />
8 + <n-step title="Set Auth Keys">
9 + <template #icon>
10 + <Icon :name="SkipIcon" v-if="!isAuthKeysStepEnabled"></Icon>
11 + </template>
12 + </n-step>
13 + </n-steps>
14 + </div>
15 + </n-scrollbar>
16 + </div>
17 +
18 + <div class="flex flex-col grow overflow-hidden">
19 + <Transition :name="`slide-form-${slideFormDirection}`">
20 + <div class="available-list grow overflow-hidden" v-if="current === 1">
21 + <n-scrollbar style="max-height: 355px" trigger="none">
22 + <IntegrationsList
23 + embedded
24 + hide-totals
25 + selectable
26 + :disabledIdsList="disabledIdsList"
27 + v-model:selected="selectedIntegration"
28 + class="px-7"
29 + />
30 + </n-scrollbar>
31 + </div>
32 + <div class="auth-key-form px-7 flex flex-wrap gap-3" v-else>
33 + <template v-for="ak of authKeysForm" :key="ak.key">
34 + <n-form-item :label="ak.key" required class="grow" v-if="ak.type === 'string'">
35 + <n-input v-model:value="ak.value" :placeholder="`Input ${ak.key}...`" clearable />
36 + </n-form-item>
37 + <n-form-item :label="ak.key" required class="grow" v-if="ak.type === 'selectType'">
38 + <n-select
39 + v-model:value="ak.value"
40 + :options="apiTypeOptions"
41 + :placeholder="`Input ${ak.key}...`"
42 + class="min-w-36"
43 + clearable
44 + />
45 + </n-form-item>
46 + </template>
47 + </div>
48 + </Transition>
49 + </div>
50 +
51 + <div class="flex justify-between gap-4 px-7 pb-4">
52 + <div class="flex gap-4">
53 + <n-button @click="close()">Close</n-button>
54 + </div>
55 + <div class="flex gap-4">
56 + <n-button @click="prev()" v-if="isPrevStepEnabled">
57 + <template #icon>
58 + <Icon :name="ArrowLeftIcon"></Icon>
59 + </template>
60 + Prev
61 + </n-button>
62 + <n-button @click="next()" v-if="isNextStepShown" :disabled="!isNextStepEnabled" icon-placement="right">
63 + <template #icon>
64 + <Icon :name="ArrowRightIcon"></Icon>
65 + </template>
66 + Next
67 + </n-button>
68 + <n-button
69 + type="primary"
70 + @click="submit()"
71 + :disabled="!isSubmitValid"
72 + :loading="loading"
73 + v-if="isSubmitEnabled"
74 + >
75 + Submit
76 + </n-button>
77 + </div>
78 + </div>
79 + </div>
80 +</template>
81 +
82 +<script setup lang="ts">
83 +import { ref, computed, watch } from "vue"
84 +import { useMessage, NFormItem, NInput, NSelect, NButton, NScrollbar, NSteps, NStep, type StepsProps } from "naive-ui"
85 +import Icon from "@/components/common/Icon.vue"
86 +import Api from "@/api"
87 +import IntegrationsList from "@/components/integrations/IntegrationsList.vue"
88 +import type { AvailableIntegration } from "@/types/integrations"
89 +import type { NewIntegration } from "@/api/integrations"
90 +
91 +interface AuthKeysInput {
92 + key: string
93 + value: string
94 + type: "selectType" | "string"
95 +}
96 +
97 +const { customerCode, customerName, disabledIdsList } = defineProps<{
98 + customerCode: string
99 + customerName: string
100 + disabledIdsList?: (string | number)[]
101 +}>()
102 +
103 +const emit = defineEmits<{
104 + (e: "update:loading", value: boolean): void
105 + (e: "close"): void
106 + (e: "submitted"): void
107 +}>()
108 +
109 +const SkipIcon = "carbon:subtract"
110 +const ArrowRightIcon = "carbon:arrow-right"
111 +const ArrowLeftIcon = "carbon:arrow-left"
112 +
113 +const message = useMessage()
114 +const current = ref<number>(1)
115 +const currentStatus = ref<StepsProps["status"]>("process")
116 +const slideFormDirection = ref<"right" | "left">("right")
117 +
118 +const selectedIntegration = ref<AvailableIntegration | null>(null)
119 +const authKeysForm = ref<AuthKeysInput[]>([])
120 +const apiTypeOptions = [
121 + { label: "Commercial", value: "commercial" },
122 + { label: "GCC", value: "gcc" },
123 + { label: "GCC-High", value: "gcc-high" }
124 +]
125 +
126 +watch(selectedIntegration, val => {
127 + authKeysForm.value = []
128 +
129 + if (val !== null) {
130 + for (const ak of val.auth_keys) {
131 + authKeysForm.value.push({
132 + key: ak.auth_key_name,
133 + value: ak.auth_key_name === "API_TYPE" ? apiTypeOptions[0].value : "",
134 + type: ak.auth_key_name === "API_TYPE" ? "selectType" : "string"
135 + })
136 + }
137 + }
138 +})
139 +
140 +const isAuthKeysStepEnabled = computed(() => selectedIntegration.value !== null)
141 +const isNextStepShown = computed(() => current.value === 1)
142 +const isNextStepEnabled = computed(() => isNextStepShown.value && isAuthKeysStepEnabled.value)
143 +const isPrevStepEnabled = computed(() => current.value > 1)
144 +const isSubmitEnabled = computed(() => current.value === 2)
145 +const isSubmitValid = computed(() => {
146 + if (!isSubmitEnabled.value) {
147 + return false
148 + }
149 +
150 + const keys = authKeysForm.value.length
151 + const valid = authKeysForm.value.filter(o => !!o.value).length
152 +
153 + return valid === keys
154 +})
155 +
156 +const loading = ref(false)
157 +
158 +function submit() {
159 + if (selectedIntegration.value) {
160 + currentStatus.value = "finish"
161 + loading.value = true
162 +
163 + const payload: NewIntegration = {
164 + customer_code: customerCode,
165 + customer_name: customerName,
166 + integration_name: selectedIntegration.value.integration_name,
167 + integration_auth_keys: authKeysForm.value.map(o => ({
168 + auth_key_name: o.key,
169 + auth_value: o.value
170 + }))
171 + }
172 +
173 + Api.integrations
174 + .createIntegration(payload)
175 + .then(res => {
176 + if (res.data.success) {
177 + emit("submitted")
178 + reset()
179 + message.success(res.data?.message || "Customer integration successfully created.")
180 + } else {
181 + message.warning(res.data?.message || "An error occurred. Please try again later.")
182 + }
183 + })
184 + .catch(err => {
185 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
186 + })
187 + .finally(() => {
188 + loading.value = false
189 + })
190 + }
191 +}
192 +
193 +function close() {
194 + reset()
195 + emit("close")
196 +}
197 +
198 +function reset() {
199 + currentStatus.value = "process"
200 + slideFormDirection.value = "right"
201 + current.value = 1
202 +
203 + selectedIntegration.value = null
204 + authKeysForm.value = []
205 +}
206 +
207 +function next() {
208 + currentStatus.value = "process"
209 + slideFormDirection.value = "right"
210 + current.value++
211 +}
212 +
213 +function prev() {
214 + currentStatus.value = "process"
215 + slideFormDirection.value = "left"
216 + current.value--
217 +}
218 +</script>
219 +
220 +<style lang="scss" scoped>
221 +.customer-integration-form {
222 + min-height: 480px;
223 + overflow: hidden;
224 +
225 + .slide-form-right-enter-active,
226 + .slide-form-right-leave-active,
227 + .slide-form-left-enter-active,
228 + .slide-form-left-leave-active {
229 + transition: all 0.2s ease-out;
230 + position: absolute;
231 + width: 100%;
232 + }
233 +
234 + .slide-form-left-enter-from {
235 + transform: translateX(-100%);
236 + }
237 +
238 + .slide-form-left-leave-to {
239 + transform: translateX(100%);
240 + }
241 +
242 + .slide-form-right-enter-from {
243 + transform: translateX(100%);
244 + }
245 +
246 + .slide-form-right-leave-to {
247 + transform: translateX(-100%);
248 + }
249 +}
250 +</style>
src/components/customers/integrations/CustomerIntegrationItem.vue new
+165
@@ -0,0 +1,165 @@
1 +<template>
2 + <div class="integration-item" :class="{ embedded }">
3 + <div class="px-4 py-3 flex flex-col gap-3">
4 + <div class="header-box flex justify-between items-center">
5 + <div class="id">#{{ integration.id }}</div>
6 + <div class="actions">
7 + <Badge type="cursor" @click.stop="showDetails = true">
8 + <template #iconLeft>
9 + <Icon :name="DetailsIcon" :size="14"></Icon>
10 + </template>
11 + <template #value>Details</template>
12 + </Badge>
13 + </div>
14 + </div>
15 + <div class="main-box flex items-center gap-3">
16 + <div class="content flex flex-col gap-1 grow">
17 + <div class="title">{{ serviceName }}</div>
18 + </div>
19 + <div class="actions-box">
20 + <template v-if="isOffice365">
21 + <n-button
22 + v-if="!integration.deployed"
23 + :loading="loadingOffice365Provision"
24 + @click="office365Provision()"
25 + type="success"
26 + size="small"
27 + secondary
28 + >
29 + <template #icon><Icon :name="DeployIcon"></Icon></template>
30 + Deploy Integration
31 + </n-button>
32 +
33 + <Badge type="active" v-else>
34 + <template #iconLeft>
35 + <Icon :name="DeployIcon" :size="13"></Icon>
36 + </template>
37 + <template #value>Deployed</template>
38 + </Badge>
39 + </template>
40 + </div>
41 + </div>
42 + </div>
43 +
44 + <n-modal
45 + v-model:show="showDetails"
46 + preset="card"
47 + :style="{ maxWidth: 'min(800px, 90vw)', minHeight: 'min(400px, 90vh)', overflow: 'hidden' }"
48 + :title="serviceName"
49 + :bordered="false"
50 + segmented
51 + >
52 + <div class="grid gap-2 grid-auto-flow-200">
53 + <KVCard v-for="ak of authKeys" :key="ak.key">
54 + <template #key>{{ ak.key }}</template>
55 + <template #value>{{ ak.value || "-" }}</template>
56 + </KVCard>
57 + </div>
58 + </n-modal>
59 + </div>
60 +</template>
61 +
62 +<script setup lang="ts">
63 +import Icon from "@/components/common/Icon.vue"
64 +import Badge from "@/components/common/Badge.vue"
65 +import { computed, ref, toRefs } from "vue"
66 +import { NModal, NButton, useMessage } from "naive-ui"
67 +import type { CustomerIntegration } from "@/types/integrations"
68 +import KVCard from "@/components/common/KVCard.vue"
69 +import _uniqBy from "lodash/uniqBy"
70 +import Api from "@/api"
71 +
72 +const props = defineProps<{
73 + integration: CustomerIntegration
74 + embedded?: boolean
75 +}>()
76 +const { integration, embedded } = toRefs(props)
77 +
78 +const emit = defineEmits<{
79 + (e: "deployed"): void
80 +}>()
81 +
82 +const DetailsIcon = "carbon:settings-adjust"
83 +const DeployIcon = "carbon:deploy"
84 +
85 +const loadingOffice365Provision = ref(false)
86 +const message = useMessage()
87 +const showDetails = ref(false)
88 +const serviceName = computed(() => integration.value.integration_service_name)
89 +const customerCode = computed(() => integration.value.customer_code)
90 +
91 +const authKeys = computed(() => {
92 + const keys: { key: string; value: string }[] = []
93 +
94 + for (const subscriptions of integration.value.integration_subscriptions) {
95 + for (const ak of subscriptions.integration_auth_keys) {
96 + keys.push({
97 + key: ak.auth_key_name,
98 + value: ak.auth_value
99 + })
100 + }
101 + }
102 +
103 + return _uniqBy(keys, "key")
104 +})
105 +
106 +const isOffice365 = computed(() => serviceName.value === "Office365")
107 +
108 +function office365Provision() {
109 + loadingOffice365Provision.value = true
110 +
111 + Api.integrations
112 + .office365Provision(customerCode.value, serviceName.value)
113 + .then(res => {
114 + if (res.data.success) {
115 + emit("deployed")
116 + message.success(res.data?.message || "Customer integration successfully deployed.")
117 + } else {
118 + message.warning(res.data?.message || "An error occurred. Please try again later.")
119 + }
120 + })
121 + .catch(err => {
122 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
123 + })
124 + .finally(() => {
125 + loadingOffice365Provision.value = false
126 + })
127 +}
128 +</script>
129 +
130 +<style lang="scss" scoped>
131 +.integration-item {
132 + border-radius: var(--border-radius);
133 + background-color: var(--bg-color);
134 + border: var(--border-small-050);
135 + transition: all 0.2s var(--bezier-ease);
136 +
137 + .header-box {
138 + font-size: 13px;
139 + .id {
140 + font-family: var(--font-family-mono);
141 + word-break: break-word;
142 + color: var(--fg-secondary-color);
143 + line-height: 1.2;
144 + }
145 + }
146 +
147 + .main-box {
148 + .content {
149 + word-break: break-word;
150 + }
151 +
152 + .actions-box {
153 + min-height: 30px;
154 + }
155 + }
156 +
157 + &.embedded {
158 + background-color: var(--bg-secondary-color);
159 + }
160 +
161 + &:hover {
162 + box-shadow: 0px 0px 0px 1px inset var(--primary-color);
163 + }
164 +}
165 +</style>
src/components/customers/integrations/CustomerIntegrations.vue new
+131
@@ -0,0 +1,131 @@
1 +<template>
2 + <div class="customer-integrations">
3 + <transition name="form-fade" mode="out-in">
4 + <div v-if="showForm">
5 + <CustomerIntegrationForm
6 + :customerCode="customerCode"
7 + :customerName="customerName"
8 + :disabledIdsList="disabledIntegrationsIds"
9 + @submitted="refreshList()"
10 + @close="closeForm()"
11 + />
12 + </div>
13 + <div v-else>
14 + <div class="flex items-center justify-between gap-4 px-7 pt-2">
15 + <n-button size="small" @click="openForm()" type="primary">
16 + <template #icon>
17 + <Icon :name="AddIcon" :size="14"></Icon>
18 + </template>
19 + Add Integration
20 + </n-button>
21 + </div>
22 +
23 + <n-spin :show="loadingIntegrations">
24 + <div class="list p-7 pt-4">
25 + <template v-if="integrationsList.length">
26 + <CustomerIntegrationItem
27 + v-for="integration of integrationsList"
28 + :key="integration.id"
29 + :integration="integration"
30 + @deployed="refreshList()"
31 + embedded
32 + class="item-appear item-appear-bottom item-appear-005 mb-2"
33 + />
34 + </template>
35 + <template v-else>
36 + <n-empty
37 + description="No integrations found"
38 + class="justify-center h-48"
39 + v-if="!loadingIntegrations"
40 + />
41 + </template>
42 + </div>
43 + </n-spin>
44 + </div>
45 + </transition>
46 + </div>
47 +</template>
48 +
49 +<script setup lang="ts">
50 +import { ref, onBeforeMount, computed } from "vue"
51 +import { useMessage, NSpin, NEmpty, NButton } from "naive-ui"
52 +import Icon from "@/components/common/Icon.vue"
53 +import Api from "@/api"
54 +import CustomerIntegrationForm from "./CustomerIntegrationForm.vue"
55 +import CustomerIntegrationItem from "./CustomerIntegrationItem.vue"
56 +import type { CustomerIntegration } from "@/types/integrations"
57 +
58 +const { customerCode } = defineProps<{
59 + customerCode: string
60 + customerName: string
61 +}>()
62 +
63 +const AddIcon = "carbon:add-alt"
64 +
65 +const message = useMessage()
66 +const showForm = ref(false)
67 +const loadingIntegrations = ref(false)
68 +const integrationsList = ref<CustomerIntegration[]>([])
69 +const disabledIntegrationsIds = computed(() => integrationsList.value.map(o => o.integration_service_id))
70 +
71 +function getCustomerIntegrations() {
72 + loadingIntegrations.value = true
73 +
74 + Api.integrations
75 + .getCustomerIntegrations(customerCode)
76 + .then(res => {
77 + if (res.data.success) {
78 + integrationsList.value = res.data?.available_integrations || []
79 + } else {
80 + message.warning(res.data?.message || "An error occurred. Please try again later.")
81 + }
82 + })
83 + .catch(err => {
84 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
85 + })
86 + .finally(() => {
87 + loadingIntegrations.value = false
88 + })
89 +}
90 +
91 +function openForm() {
92 + showForm.value = true
93 +}
94 +
95 +function closeForm() {
96 + showForm.value = false
97 +}
98 +
99 +function refreshList() {
100 + closeForm()
101 + getCustomerIntegrations()
102 +}
103 +
104 +onBeforeMount(() => {
105 + getCustomerIntegrations()
106 +})
107 +</script>
108 +
109 +<style lang="scss" scoped>
110 +.customer-integrations {
111 + .list {
112 + container-type: inline-size;
113 + min-height: 200px;
114 + }
115 +
116 + .form-fade-enter-active,
117 + .form-fade-leave-active {
118 + transition:
119 + opacity 0.2s ease-in-out,
120 + transform 0.3s ease-in-out;
121 + }
122 + .form-fade-enter-from {
123 + opacity: 0;
124 + transform: translateY(10px);
125 + }
126 + .form-fade-leave-to {
127 + opacity: 0;
128 + transform: translateY(-10px);
129 + }
130 +}
131 +</style>
src/components/customers/provision/CustomerProvision.vue renamed
+53 -32
@@ -1,41 +1,43 @@
1 <template>
2 <div class="customer-provision">
3 - <div v-if="editing">
4 - <CustomerProvisionWizard
5 - @submitted="submitted"
6 - :customerName="customerNameSanitized"
7 - :customerCode="customerCode"
8 - >
9 - <template #additionalActions>
10 - <n-button @click="editing = false">Close</n-button>
11 - </template>
12 - </CustomerProvisionWizard>
13 - </div>
14 - <template v-else>
15 - <div class="flex items-center justify-end gap-4 px-7 pt-2" v-if="customerMeta">
16 - <n-button size="small" type="error" ghost @click="handleDelete" :loading="loadingDelete">
17 - <template #icon>
18 - <Icon :name="DeleteIcon" :size="15"></Icon>
3 + <transition name="form-fade" mode="out-in">
4 + <div v-if="editing">
5 + <CustomerProvisionWizard
6 + @submitted="submitted"
7 + :customerName="customerNameSanitized"
8 + :customerCode="customerCode"
9 + >
10 + <template #additionalActions>
11 + <n-button @click="editing = false">Close</n-button>
12 </template>
20 - Decommission
21 - </n-button>
22 - </div>
23 - <div class="flex items-center justify-between gap-4 px-7 pt-2" v-else>
24 - <n-button size="small" @click="editing = true" type="primary">
25 - <template #icon>
26 - <Icon :name="AddIcon" :size="14"></Icon>
27 - </template>
28 - Create Provision
29 - </n-button>
13 + </CustomerProvisionWizard>
14 </div>
15 + <div v-else>
16 + <div class="flex items-center justify-end gap-4 px-7 pt-2" v-if="customerMeta">
17 + <n-button size="small" type="error" ghost @click="handleDelete" :loading="loadingDelete">
18 + <template #icon>
19 + <Icon :name="DeleteIcon" :size="15"></Icon>
20 + </template>
21 + Decommission
22 + </n-button>
23 + </div>
24 + <div class="flex items-center justify-between gap-4 px-7 pt-2" v-else>
25 + <n-button size="small" @click="editing = true" type="primary">
26 + <template #icon>
27 + <Icon :name="AddIcon" :size="14"></Icon>
28 + </template>
29 + Create Provision
30 + </n-button>
31 + </div>
32
32 - <div class="grid gap-2 grid-auto-flow-200 p-7 pt-4">
33 - <KVCard v-for="(value, key) of customerMeta" :key="key">
34 - <template #key>{{ key }}</template>
35 - <template #value>{{ value || "-" }}</template>
36 - </KVCard>
33 + <div class="grid gap-2 grid-auto-flow-200 p-7 pt-4">
34 + <KVCard v-for="(value, key) of customerMeta" :key="key">
35 + <template #key>{{ key }}</template>
36 + <template #value>{{ value || "-" }}</template>
37 + </KVCard>
38 + </div>
39 </div>
38 - </template>
40 + </transition>
41 </div>
42 </template>
43
@@ -113,3 +115,22 @@ function handleDelete() {
115 })
116 }
117 </script>
118 +
119 +<style lang="scss" scoped>
120 +.customer-provision {
121 + .form-fade-enter-active,
122 + .form-fade-leave-active {
123 + transition:
124 + opacity 0.2s ease-in-out,
125 + transform 0.3s ease-in-out;
126 + }
127 + .form-fade-enter-from {
128 + opacity: 0;
129 + transform: translateY(10px);
130 + }
131 + .form-fade-leave-to {
132 + opacity: 0;
133 + transform: translateY(-10px);
134 + }
135 +}
136 +</style>
src/components/customers/provision/CustomerProvisionWizard.vue renamed
src/components/integrations/IntegrationItem.vue new
+137
@@ -0,0 +1,137 @@
1 +<template>
2 + <div class="integration-item" :class="{ embedded, selectable, disabled }">
3 + <div class="px-4 py-3 flex flex-col gap-2">
4 + <div class="header-box flex justify-between items-center">
5 + <div class="flex items-center gap-2 cursor-pointer">
6 + <div class="check-box mr-2" v-if="selectable">
7 + <n-radio size="large" v-model:checked="checked" />
8 + </div>
9 + <div class="id">#{{ integration.id }}</div>
10 + </div>
11 + <div class="actions">
12 + <Badge type="cursor" @click.stop="showDetails = true">
13 + <template #iconLeft>
14 + <Icon :name="DetailsIcon" :size="14"></Icon>
15 + </template>
16 + <template #value>Details</template>
17 + </Badge>
18 + </div>
19 + </div>
20 + <div class="main-box flex items-center gap-3">
21 + <div class="content flex flex-col gap-1 grow">
22 + <div class="title">{{ integration.integration_name }}</div>
23 + <div class="description">
24 + {{ integration.description }}
25 + </div>
26 + </div>
27 + </div>
28 +
29 + <div class="badges-box flex flex-wrap items-center gap-3 mt-2">
30 + <code class="py-1">Auth Keys:</code>
31 + <Badge v-for="authKey of integration.auth_keys" :key="authKey.auth_key_name">
32 + <template #value>{{ authKey.auth_key_name }}</template>
33 + </Badge>
34 + </div>
35 + </div>
36 +
37 + <n-modal
38 + v-model:show="showDetails"
39 + preset="card"
40 + :style="{ maxWidth: 'min(800px, 90vw)', minHeight: 'min(400px, 90vh)', overflow: 'hidden' }"
41 + :title="integration.integration_name"
42 + :bordered="false"
43 + segmented
44 + >
45 + <vue-markdown-it
46 + :source="integration.integration_details"
47 + preset="commonmark"
48 + :plugins="[markdownItHighlightjs]"
49 + class="integration-details scrollbar-styled"
50 + />
51 + </n-modal>
52 + </div>
53 +</template>
54 +
55 +<script setup lang="ts">
56 +import Icon from "@/components/common/Icon.vue"
57 +import Badge from "@/components/common/Badge.vue"
58 +import { ref, toRefs } from "vue"
59 +import { NModal, NRadio } from "naive-ui"
60 +import type { AvailableIntegration } from "@/types/integrations"
61 +import markdownItHighlightjs from "markdown-it-highlightjs"
62 +import "@/assets/scss/hljs.scss"
63 +import { VueMarkdownIt } from "@f3ve/vue-markdown-it"
64 +
65 +const props = defineProps<{
66 + integration: AvailableIntegration
67 + embedded?: boolean
68 + checked?: boolean
69 + selectable?: boolean
70 + disabled?: boolean
71 +}>()
72 +const { integration, embedded, checked, selectable, disabled } = toRefs(props)
73 +
74 +const DetailsIcon = "carbon:settings-adjust"
75 +
76 +const showDetails = ref(false)
77 +</script>
78 +
79 +<style lang="scss" scoped>
80 +.integration-item {
81 + border-radius: var(--border-radius);
82 + background-color: var(--bg-color);
83 + border: var(--border-small-050);
84 + transition: all 0.2s var(--bezier-ease);
85 +
86 + .header-box {
87 + font-size: 13px;
88 + .id {
89 + font-family: var(--font-family-mono);
90 + word-break: break-word;
91 + color: var(--fg-secondary-color);
92 + line-height: 1.2;
93 + }
94 + }
95 +
96 + .main-box {
97 + .content {
98 + word-break: break-word;
99 +
100 + .description {
101 + color: var(--fg-secondary-color);
102 + font-size: 13px;
103 + }
104 + }
105 + }
106 +
107 + &.embedded {
108 + background-color: var(--bg-secondary-color);
109 + }
110 +
111 + &.selectable {
112 + cursor: pointer;
113 + }
114 +
115 + &.disabled {
116 + cursor: not-allowed;
117 +
118 + & > div {
119 + opacity: 0.5;
120 + }
121 + }
122 +
123 + &:not(.disabled) {
124 + &:hover {
125 + box-shadow: 0px 0px 0px 1px inset var(--primary-color);
126 + }
127 + }
128 +}
129 +
130 +.integration-details {
131 + :deep() {
132 + & > * {
133 + margin-bottom: 15px;
134 + }
135 + }
136 +}
137 +</style>
src/components/integrations/IntegrationsList.vue new
+102
@@ -0,0 +1,102 @@
1 +<template>
2 + <div class="integrations-list">
3 + <div class="header mb-4 flex gap-2 justify-between items-center" v-if="!hideTotals">
4 + <div>
5 + Total:
6 + <strong class="font-mono">{{ totalIntegrations }}</strong>
7 + </div>
8 + </div>
9 + <n-spin :show="loadingIntegrations">
10 + <div class="list">
11 + <template v-if="integrationsList.length">
12 + <IntegrationItem
13 + v-for="integration of integrationsList"
14 + :key="integration.id"
15 + :integration="integration"
16 + :embedded="embedded"
17 + :selectable="isSelectable(integration)"
18 + :disabled="isDisabled(integration)"
19 + :checked="selectedIntegration?.id === integration.id"
20 + @click="setItem(integration)"
21 + class="item-appear item-appear-bottom item-appear-005 mb-2"
22 + />
23 + </template>
24 + <template v-else>
25 + <n-empty description="No items found" class="justify-center h-48" v-if="!loadingIntegrations" />
26 + </template>
27 + </div>
28 + </n-spin>
29 + </div>
30 +</template>
31 +
32 +<script setup lang="ts">
33 +import { ref, onBeforeMount, computed } from "vue"
34 +import { useMessage, NSpin, NEmpty } from "naive-ui"
35 +import Api from "@/api"
36 +import IntegrationItem from "./IntegrationItem.vue"
37 +import type { AvailableIntegration } from "@/types/integrations"
38 +
39 +const { embedded, hideTotals, selectable, disabledIdsList } = defineProps<{
40 + embedded?: boolean
41 + hideTotals?: boolean
42 + selectable?: boolean
43 + disabledIdsList?: (string | number)[]
44 +}>()
45 +
46 +const selectedIntegration = defineModel<AvailableIntegration | null>("selected", { default: null })
47 +
48 +const message = useMessage()
49 +const loadingIntegrations = ref(false)
50 +const integrationsList = ref<AvailableIntegration[]>([])
51 +
52 +const totalIntegrations = computed<number>(() => {
53 + return integrationsList.value.length || 0
54 +})
55 +
56 +function isDisabled(integration: AvailableIntegration) {
57 + return (disabledIdsList || []).includes(integration.id)
58 +}
59 +
60 +function isSelectable(integration: AvailableIntegration) {
61 + return selectable && !isDisabled(integration)
62 +}
63 +
64 +function setItem(integration: AvailableIntegration) {
65 + if (!isDisabled(integration)) {
66 + selectedIntegration.value = selectedIntegration.value?.id === integration.id ? null : integration
67 + }
68 +}
69 +
70 +function getAvailableIntegrations() {
71 + loadingIntegrations.value = true
72 +
73 + Api.integrations
74 + .getAvailableIntegrations()
75 + .then(res => {
76 + if (res.data.success) {
77 + integrationsList.value = res.data?.available_integrations || []
78 + } else {
79 + message.warning(res.data?.message || "An error occurred. Please try again later.")
80 + }
81 + })
82 + .catch(err => {
83 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
84 + })
85 + .finally(() => {
86 + loadingIntegrations.value = false
87 + })
88 +}
89 +
90 +onBeforeMount(() => {
91 + getAvailableIntegrations()
92 +})
93 +</script>
94 +
95 +<style lang="scss" scoped>
96 +.integrations-list {
97 + .list {
98 + container-type: inline-size;
99 + min-height: 200px;
100 + }
101 +}
102 +</style>
src/layouts/common/Navbar/items.tsx
+15
@@ -15,6 +15,7 @@ const HealthcheckIcon = "ph:heartbeat"
15 const CustomersIcon = "carbon:user-multiple"
16 const LogsIcon = "carbon:cloud-logging"
17 const UsersIcon = "carbon:group-security"
18 +const IntegrationsIcon = "carbon:ibm-cloud-direct-link-2-dedicated"
19
20 export default function getItems(mode: "vertical" | "horizontal", collapsed: boolean): MenuMixedOption[] {
21 return [
@@ -249,6 +250,20 @@ export default function getItems(mode: "vertical" | "horizontal", collapsed: boo
250 ),
251 key: "Users",
252 icon: renderIcon(UsersIcon)
253 + },
254 + {
255 + label: () =>
256 + h(
257 + RouterLink,
258 + {
259 + to: {
260 + name: "Integrations"
261 + }
262 + },
263 + { default: () => "Integrations" }
264 + ),
265 + key: "Integrations",
266 + icon: renderIcon(IntegrationsIcon)
267 }
268 ]
269 }
src/router/index.ts
+14
@@ -4,6 +4,7 @@ import Login from "@/views/Auth/Login.vue"
4 import { UserRole } from "@/types/auth.d"
5 import { Layout } from "@/types/theme.d"
6 import { authCheck } from "@/utils/auth"
7 +import type { FormType } from "@/components/AuthForm/index.vue"
8
9 const router = createRouter({
10 history: createWebHistory(import.meta.env.BASE_URL),
@@ -134,6 +135,12 @@ const router = createRouter({
135 component: () => import("@/views/Users.vue"),
136 meta: { title: "Users", auth: true, roles: UserRole.All }
137 },
138 + {
139 + path: "/integrations",
140 + name: "Integrations",
141 + component: () => import("@/views/Integrations.vue"),
142 + meta: { title: "Integrations", auth: true, roles: UserRole.All }
143 + },
144
145 {
146 path: "/profile",
@@ -147,6 +154,13 @@ const router = createRouter({
154 component: Login,
155 meta: { title: "Login", forceLayout: Layout.Blank, checkAuth: true }
156 },
157 + {
158 + path: "/register",
159 + name: "Register",
160 + component: () => import("@/views/Auth/Login.vue"),
161 + props: { formType: "signup" as FormType },
162 + meta: { title: "Register", forceLayout: Layout.Blank, checkAuth: true }
163 + },
164 {
165 path: "/logout",
166 name: "Logout",
src/types/integrations.d.ts new
+42
@@ -0,0 +1,42 @@
1 +export interface AvailableIntegration {
2 + id: number
3 + integration_name: string
4 + description: string
5 + integration_details: string
6 + auth_keys: IntegrationAuthKey[]
7 +}
8 +
9 +export interface IntegrationAuthKey {
10 + auth_key_name: string
11 +}
12 +
13 +export interface CustomerIntegration {
14 + customer_code: string
15 + id: number
16 + deployed: boolean
17 + customer_name: string
18 + integration_service_id: number
19 + integration_service_name: string
20 + integration_subscriptions: IntegrationSubscription[]
21 +}
22 +
23 +export interface IntegrationSubscription {
24 + id: number
25 + customer_id: number
26 + integration_service_id: number
27 + integration_service: IntegrationService
28 + integration_auth_keys: IntegrationAuthKeyFull[]
29 +}
30 +
31 +export interface IntegrationAuthKeyFull {
32 + id: number
33 + auth_key_name: string
34 + auth_value: string
35 + subscription_id: number
36 +}
37 +
38 +export interface IntegrationService {
39 + auth_type: string
40 + service_name: string
41 + id: number
42 +}
src/views/Auth/Login.vue
+9 -5
@@ -68,14 +68,20 @@
68 import { NButton } from "naive-ui"
69 import Icon from "@/components/common/Icon.vue"
70 import { Icon as Iconify } from "@iconify/vue"
71 -
71 import AuthForm from "@/components/AuthForm/index.vue"
73 -import { ref, computed, onBeforeMount } from "vue"
72 +import { ref, computed, onBeforeMount, toRefs } from "vue"
73 import { useRoute } from "vue-router"
74 import { useThemeStore } from "@/stores/theme"
75 import { useAuthStore } from "@/stores/auth"
76 import type { FormType } from "@/components/AuthForm/index.vue"
77
78 +type Align = "left" | "center" | "right"
79 +
80 +const props = defineProps<{
81 + formType?: FormType
82 +}>()
83 +const { formType } = toRefs(props)
84 +
85 const AlignLeft = "fluent:textbox-align-bottom-rotate-90-24-regular"
86 const AlignCenter = "fluent:textbox-align-middle-rotate-90-24-regular"
87 const AlignRight = "fluent:textbox-align-top-rotate-90-24-regular"
@@ -85,12 +91,10 @@ const AlignRightActive = "fluent:textbox-align-top-rotate-90-24-filled"
91 const Square = "fluent:square-24-filled"
92 const SquareActive = "fluent:checkbox-indeterminate-24-regular"
93
88 -type Align = "left" | "center" | "right"
89 -
94 const route = useRoute()
95 const align = ref<Align>("left")
96 const activeColor = ref("")
93 -const type = ref<FormType | undefined>(undefined)
97 +const type = ref<FormType | undefined>(formType.value || undefined)
98
99 const colors = computed(() => useThemeStore().secondaryColors)
100 const primaryColor = computed(() => useThemeStore().primaryColor)
src/views/Integrations.vue new
+9
@@ -0,0 +1,9 @@
1 +<template>
2 + <div class="page">
3 + <IntegrationsList />
4 + </div>
5 +</template>
6 +
7 +<script setup lang="ts">
8 +import IntegrationsList from "@/components/integrations/IntegrationsList.vue"
9 +</script>
vite.config.ts
+1 -1
@@ -20,7 +20,7 @@ export default defineConfig({
20 svgLoader(),
21 Components({
22 dirs: ["src/components/cards"],
23 - dts: "unplugin.components.d.ts"
23 + dts: "src/unplugin.components.d.ts"
24 })
25 // uncomment to enable analyzer after build
26 // analyzer()