@cryptotaxi247 / CoPilot / commits / 9a908ce4

Pre commits (#119)

* precommit-syntax changes * Add CoPilot documentation and fix session dependency * Update readme * Update license and README.md * some precommit fixes

taylor_socfortress committed Jan 27, 2024 at 12:34 UTC 9a908ce4a94f4d4e8cf51d0d0d05a6157edb1901
95 files changed +36972 -36509
.devcontainer/devcontainer.json
+3 -2
@@ -1,5 +1,3 @@
1 -// For format details, see https://aka.ms/devcontainer.json. For config options, see the
2 -// README at: https://github.com/devcontainers/templates/tree/main/src/docker-existing-dockerfile
1 {
2 "name": "Existing Dockerfile",
3 "build": {
@@ -16,6 +14,9 @@
14 "ghcr.io/akhildevelops/devcontainer-features/pip:0": {}
15 }
16
17 + // For format details, see https://aka.ms/devcontainer.json. For config options, see the
18 + // README at: https://github.com/devcontainers/templates/tree/main/src/docker-existing-dockerfile
19 +
20 // Features to add to the dev container. More info: https://containers.dev/features.
21 // "features": {},
22
.github/ISSUE_TEMPLATE/bug_report.md
+6 -5
@@ -1,10 +1,9 @@
1 ---
2 name: Bug report
3 about: Create a report to help us improve
4 -title: ''
5 -labels: ''
6 -assignees: ''
7 -
4 +title: ""
5 +labels: ""
6 +assignees: ""
7 ---
8
9 **Describe the bug**
@@ -12,6 +11,7 @@ A clear and concise description of what the bug is.
11
12 **To Reproduce**
13 Steps to reproduce the behavior:
14 +
15 1. Go to '...'
16 2. Click on '....'
17 3. Scroll down to '....'
@@ -23,7 +23,8 @@ A clear and concise description of what you expected to happen.
23 **Screenshots**
24 If applicable, add screenshots to help explain your problem.
25
26 -**Container Logs
26 +\*\*Container Logs
27 +
28 ```
29 cd /opt/CoPilot
30 docker compose logs
.github/ISSUE_TEMPLATE/feature_request.md
+3 -4
@@ -1,10 +1,9 @@
1 ---
2 name: Feature request
3 about: Suggest an idea for this project
4 -title: ''
5 -labels: ''
6 -assignees: ''
7 -
4 +title: ""
5 +labels: ""
6 +assignees: ""
7 ---
8
9 **Is your feature request related to a problem? Please describe.**
LICENSE
+661 -21
@@ -1,21 +1,661 @@
1 -MIT License
2 -
3 -Copyright (c) 2023 SOCFortress
4 -
5 -Permission is hereby granted, free of charge, to any person obtaining a copy
6 -of this software and associated documentation files (the "Software"), to deal
7 -in the Software without restriction, including without limitation the rights
8 -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 -copies of the Software, and to permit persons to whom the Software is
10 -furnished to do so, subject to the following conditions:
11 -
12 -The above copyright notice and this permission notice shall be included in all
13 -copies or substantial portions of the Software.
14 -
15 -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 -SOFTWARE.
1 + GNU AFFERO GENERAL PUBLIC LICENSE
2 + Version 3, 19 November 2007
3 +
4 + Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
5 + Everyone is permitted to copy and distribute verbatim copies
6 + of this license document, but changing it is not allowed.
7 +
8 + Preamble
9 +
10 + The GNU Affero General Public License is a free, copyleft license for
11 +software and other kinds of works, specifically designed to ensure
12 +cooperation with the community in the case of network server software.
13 +
14 + The licenses for most software and other practical works are designed
15 +to take away your freedom to share and change the works. By contrast,
16 +our General Public Licenses are intended to guarantee your freedom to
17 +share and change all versions of a program--to make sure it remains free
18 +software for all its users.
19 +
20 + When we speak of free software, we are referring to freedom, not
21 +price. Our General Public Licenses are designed to make sure that you
22 +have the freedom to distribute copies of free software (and charge for
23 +them if you wish), that you receive source code or can get it if you
24 +want it, that you can change the software or use pieces of it in new
25 +free programs, and that you know you can do these things.
26 +
27 + Developers that use our General Public Licenses protect your rights
28 +with two steps: (1) assert copyright on the software, and (2) offer
29 +you this License which gives you legal permission to copy, distribute
30 +and/or modify the software.
31 +
32 + A secondary benefit of defending all users' freedom is that
33 +improvements made in alternate versions of the program, if they
34 +receive widespread use, become available for other developers to
35 +incorporate. Many developers of free software are heartened and
36 +encouraged by the resulting cooperation. However, in the case of
37 +software used on network servers, this result may fail to come about.
38 +The GNU General Public License permits making a modified version and
39 +letting the public access it on a server without ever releasing its
40 +source code to the public.
41 +
42 + The GNU Affero General Public License is designed specifically to
43 +ensure that, in such cases, the modified source code becomes available
44 +to the community. It requires the operator of a network server to
45 +provide the source code of the modified version running there to the
46 +users of that server. Therefore, public use of a modified version, on
47 +a publicly accessible server, gives the public access to the source
48 +code of the modified version.
49 +
50 + An older license, called the Affero General Public License and
51 +published by Affero, was designed to accomplish similar goals. This is
52 +a different license, not a version of the Affero GPL, but Affero has
53 +released a new version of the Affero GPL which permits relicensing under
54 +this license.
55 +
56 + The precise terms and conditions for copying, distribution and
57 +modification follow.
58 +
59 + TERMS AND CONDITIONS
60 +
61 + 0. Definitions.
62 +
63 + "This License" refers to version 3 of the GNU Affero General Public License.
64 +
65 + "Copyright" also means copyright-like laws that apply to other kinds of
66 +works, such as semiconductor masks.
67 +
68 + "The Program" refers to any copyrightable work licensed under this
69 +License. Each licensee is addressed as "you". "Licensees" and
70 +"recipients" may be individuals or organizations.
71 +
72 + To "modify" a work means to copy from or adapt all or part of the work
73 +in a fashion requiring copyright permission, other than the making of an
74 +exact copy. The resulting work is called a "modified version" of the
75 +earlier work or a work "based on" the earlier work.
76 +
77 + A "covered work" means either the unmodified Program or a work based
78 +on the Program.
79 +
80 + To "propagate" a work means to do anything with it that, without
81 +permission, would make you directly or secondarily liable for
82 +infringement under applicable copyright law, except executing it on a
83 +computer or modifying a private copy. Propagation includes copying,
84 +distribution (with or without modification), making available to the
85 +public, and in some countries other activities as well.
86 +
87 + To "convey" a work means any kind of propagation that enables other
88 +parties to make or receive copies. Mere interaction with a user through
89 +a computer network, with no transfer of a copy, is not conveying.
90 +
91 + An interactive user interface displays "Appropriate Legal Notices"
92 +to the extent that it includes a convenient and prominently visible
93 +feature that (1) displays an appropriate copyright notice, and (2)
94 +tells the user that there is no warranty for the work (except to the
95 +extent that warranties are provided), that licensees may convey the
96 +work under this License, and how to view a copy of this License. If
97 +the interface presents a list of user commands or options, such as a
98 +menu, a prominent item in the list meets this criterion.
99 +
100 + 1. Source Code.
101 +
102 + The "source code" for a work means the preferred form of the work
103 +for making modifications to it. "Object code" means any non-source
104 +form of a work.
105 +
106 + A "Standard Interface" means an interface that either is an official
107 +standard defined by a recognized standards body, or, in the case of
108 +interfaces specified for a particular programming language, one that
109 +is widely used among developers working in that language.
110 +
111 + The "System Libraries" of an executable work include anything, other
112 +than the work as a whole, that (a) is included in the normal form of
113 +packaging a Major Component, but which is not part of that Major
114 +Component, and (b) serves only to enable use of the work with that
115 +Major Component, or to implement a Standard Interface for which an
116 +implementation is available to the public in source code form. A
117 +"Major Component", in this context, means a major essential component
118 +(kernel, window system, and so on) of the specific operating system
119 +(if any) on which the executable work runs, or a compiler used to
120 +produce the work, or an object code interpreter used to run it.
121 +
122 + The "Corresponding Source" for a work in object code form means all
123 +the source code needed to generate, install, and (for an executable
124 +work) run the object code and to modify the work, including scripts to
125 +control those activities. However, it does not include the work's
126 +System Libraries, or general-purpose tools or generally available free
127 +programs which are used unmodified in performing those activities but
128 +which are not part of the work. For example, Corresponding Source
129 +includes interface definition files associated with source files for
130 +the work, and the source code for shared libraries and dynamically
131 +linked subprograms that the work is specifically designed to require,
132 +such as by intimate data communication or control flow between those
133 +subprograms and other parts of the work.
134 +
135 + The Corresponding Source need not include anything that users
136 +can regenerate automatically from other parts of the Corresponding
137 +Source.
138 +
139 + The Corresponding Source for a work in source code form is that
140 +same work.
141 +
142 + 2. Basic Permissions.
143 +
144 + All rights granted under this License are granted for the term of
145 +copyright on the Program, and are irrevocable provided the stated
146 +conditions are met. This License explicitly affirms your unlimited
147 +permission to run the unmodified Program. The output from running a
148 +covered work is covered by this License only if the output, given its
149 +content, constitutes a covered work. This License acknowledges your
150 +rights of fair use or other equivalent, as provided by copyright law.
151 +
152 + You may make, run and propagate covered works that you do not
153 +convey, without conditions so long as your license otherwise remains
154 +in force. You may convey covered works to others for the sole purpose
155 +of having them make modifications exclusively for you, or provide you
156 +with facilities for running those works, provided that you comply with
157 +the terms of this License in conveying all material for which you do
158 +not control copyright. Those thus making or running the covered works
159 +for you must do so exclusively on your behalf, under your direction
160 +and control, on terms that prohibit them from making any copies of
161 +your copyrighted material outside their relationship with you.
162 +
163 + Conveying under any other circumstances is permitted solely under
164 +the conditions stated below. Sublicensing is not allowed; section 10
165 +makes it unnecessary.
166 +
167 + 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
168 +
169 + No covered work shall be deemed part of an effective technological
170 +measure under any applicable law fulfilling obligations under article
171 +11 of the WIPO copyright treaty adopted on 20 December 1996, or
172 +similar laws prohibiting or restricting circumvention of such
173 +measures.
174 +
175 + When you convey a covered work, you waive any legal power to forbid
176 +circumvention of technological measures to the extent such circumvention
177 +is effected by exercising rights under this License with respect to
178 +the covered work, and you disclaim any intention to limit operation or
179 +modification of the work as a means of enforcing, against the work's
180 +users, your or third parties' legal rights to forbid circumvention of
181 +technological measures.
182 +
183 + 4. Conveying Verbatim Copies.
184 +
185 + You may convey verbatim copies of the Program's source code as you
186 +receive it, in any medium, provided that you conspicuously and
187 +appropriately publish on each copy an appropriate copyright notice;
188 +keep intact all notices stating that this License and any
189 +non-permissive terms added in accord with section 7 apply to the code;
190 +keep intact all notices of the absence of any warranty; and give all
191 +recipients a copy of this License along with the Program.
192 +
193 + You may charge any price or no price for each copy that you convey,
194 +and you may offer support or warranty protection for a fee.
195 +
196 + 5. Conveying Modified Source Versions.
197 +
198 + You may convey a work based on the Program, or the modifications to
199 +produce it from the Program, in the form of source code under the
200 +terms of section 4, provided that you also meet all of these conditions:
201 +
202 + a) The work must carry prominent notices stating that you modified
203 + it, and giving a relevant date.
204 +
205 + b) The work must carry prominent notices stating that it is
206 + released under this License and any conditions added under section
207 + 7. This requirement modifies the requirement in section 4 to
208 + "keep intact all notices".
209 +
210 + c) You must license the entire work, as a whole, under this
211 + License to anyone who comes into possession of a copy. This
212 + License will therefore apply, along with any applicable section 7
213 + additional terms, to the whole of the work, and all its parts,
214 + regardless of how they are packaged. This License gives no
215 + permission to license the work in any other way, but it does not
216 + invalidate such permission if you have separately received it.
217 +
218 + d) If the work has interactive user interfaces, each must display
219 + Appropriate Legal Notices; however, if the Program has interactive
220 + interfaces that do not display Appropriate Legal Notices, your
221 + work need not make them do so.
222 +
223 + A compilation of a covered work with other separate and independent
224 +works, which are not by their nature extensions of the covered work,
225 +and which are not combined with it such as to form a larger program,
226 +in or on a volume of a storage or distribution medium, is called an
227 +"aggregate" if the compilation and its resulting copyright are not
228 +used to limit the access or legal rights of the compilation's users
229 +beyond what the individual works permit. Inclusion of a covered work
230 +in an aggregate does not cause this License to apply to the other
231 +parts of the aggregate.
232 +
233 + 6. Conveying Non-Source Forms.
234 +
235 + You may convey a covered work in object code form under the terms
236 +of sections 4 and 5, provided that you also convey the
237 +machine-readable Corresponding Source under the terms of this License,
238 +in one of these ways:
239 +
240 + a) Convey the object code in, or embodied in, a physical product
241 + (including a physical distribution medium), accompanied by the
242 + Corresponding Source fixed on a durable physical medium
243 + customarily used for software interchange.
244 +
245 + b) Convey the object code in, or embodied in, a physical product
246 + (including a physical distribution medium), accompanied by a
247 + written offer, valid for at least three years and valid for as
248 + long as you offer spare parts or customer support for that product
249 + model, to give anyone who possesses the object code either (1) a
250 + copy of the Corresponding Source for all the software in the
251 + product that is covered by this License, on a durable physical
252 + medium customarily used for software interchange, for a price no
253 + more than your reasonable cost of physically performing this
254 + conveying of source, or (2) access to copy the
255 + Corresponding Source from a network server at no charge.
256 +
257 + c) Convey individual copies of the object code with a copy of the
258 + written offer to provide the Corresponding Source. This
259 + alternative is allowed only occasionally and noncommercially, and
260 + only if you received the object code with such an offer, in accord
261 + with subsection 6b.
262 +
263 + d) Convey the object code by offering access from a designated
264 + place (gratis or for a charge), and offer equivalent access to the
265 + Corresponding Source in the same way through the same place at no
266 + further charge. You need not require recipients to copy the
267 + Corresponding Source along with the object code. If the place to
268 + copy the object code is a network server, the Corresponding Source
269 + may be on a different server (operated by you or a third party)
270 + that supports equivalent copying facilities, provided you maintain
271 + clear directions next to the object code saying where to find the
272 + Corresponding Source. Regardless of what server hosts the
273 + Corresponding Source, you remain obligated to ensure that it is
274 + available for as long as needed to satisfy these requirements.
275 +
276 + e) Convey the object code using peer-to-peer transmission, provided
277 + you inform other peers where the object code and Corresponding
278 + Source of the work are being offered to the general public at no
279 + charge under subsection 6d.
280 +
281 + A separable portion of the object code, whose source code is excluded
282 +from the Corresponding Source as a System Library, need not be
283 +included in conveying the object code work.
284 +
285 + A "User Product" is either (1) a "consumer product", which means any
286 +tangible personal property which is normally used for personal, family,
287 +or household purposes, or (2) anything designed or sold for incorporation
288 +into a dwelling. In determining whether a product is a consumer product,
289 +doubtful cases shall be resolved in favor of coverage. For a particular
290 +product received by a particular user, "normally used" refers to a
291 +typical or common use of that class of product, regardless of the status
292 +of the particular user or of the way in which the particular user
293 +actually uses, or expects or is expected to use, the product. A product
294 +is a consumer product regardless of whether the product has substantial
295 +commercial, industrial or non-consumer uses, unless such uses represent
296 +the only significant mode of use of the product.
297 +
298 + "Installation Information" for a User Product means any methods,
299 +procedures, authorization keys, or other information required to install
300 +and execute modified versions of a covered work in that User Product from
301 +a modified version of its Corresponding Source. The information must
302 +suffice to ensure that the continued functioning of the modified object
303 +code is in no case prevented or interfered with solely because
304 +modification has been made.
305 +
306 + If you convey an object code work under this section in, or with, or
307 +specifically for use in, a User Product, and the conveying occurs as
308 +part of a transaction in which the right of possession and use of the
309 +User Product is transferred to the recipient in perpetuity or for a
310 +fixed term (regardless of how the transaction is characterized), the
311 +Corresponding Source conveyed under this section must be accompanied
312 +by the Installation Information. But this requirement does not apply
313 +if neither you nor any third party retains the ability to install
314 +modified object code on the User Product (for example, the work has
315 +been installed in ROM).
316 +
317 + The requirement to provide Installation Information does not include a
318 +requirement to continue to provide support service, warranty, or updates
319 +for a work that has been modified or installed by the recipient, or for
320 +the User Product in which it has been modified or installed. Access to a
321 +network may be denied when the modification itself materially and
322 +adversely affects the operation of the network or violates the rules and
323 +protocols for communication across the network.
324 +
325 + Corresponding Source conveyed, and Installation Information provided,
326 +in accord with this section must be in a format that is publicly
327 +documented (and with an implementation available to the public in
328 +source code form), and must require no special password or key for
329 +unpacking, reading or copying.
330 +
331 + 7. Additional Terms.
332 +
333 + "Additional permissions" are terms that supplement the terms of this
334 +License by making exceptions from one or more of its conditions.
335 +Additional permissions that are applicable to the entire Program shall
336 +be treated as though they were included in this License, to the extent
337 +that they are valid under applicable law. If additional permissions
338 +apply only to part of the Program, that part may be used separately
339 +under those permissions, but the entire Program remains governed by
340 +this License without regard to the additional permissions.
341 +
342 + When you convey a copy of a covered work, you may at your option
343 +remove any additional permissions from that copy, or from any part of
344 +it. (Additional permissions may be written to require their own
345 +removal in certain cases when you modify the work.) You may place
346 +additional permissions on material, added by you to a covered work,
347 +for which you have or can give appropriate copyright permission.
348 +
349 + Notwithstanding any other provision of this License, for material you
350 +add to a covered work, you may (if authorized by the copyright holders of
351 +that material) supplement the terms of this License with terms:
352 +
353 + a) Disclaiming warranty or limiting liability differently from the
354 + terms of sections 15 and 16 of this License; or
355 +
356 + b) Requiring preservation of specified reasonable legal notices or
357 + author attributions in that material or in the Appropriate Legal
358 + Notices displayed by works containing it; or
359 +
360 + c) Prohibiting misrepresentation of the origin of that material, or
361 + requiring that modified versions of such material be marked in
362 + reasonable ways as different from the original version; or
363 +
364 + d) Limiting the use for publicity purposes of names of licensors or
365 + authors of the material; or
366 +
367 + e) Declining to grant rights under trademark law for use of some
368 + trade names, trademarks, or service marks; or
369 +
370 + f) Requiring indemnification of licensors and authors of that
371 + material by anyone who conveys the material (or modified versions of
372 + it) with contractual assumptions of liability to the recipient, for
373 + any liability that these contractual assumptions directly impose on
374 + those licensors and authors.
375 +
376 + All other non-permissive additional terms are considered "further
377 +restrictions" within the meaning of section 10. If the Program as you
378 +received it, or any part of it, contains a notice stating that it is
379 +governed by this License along with a term that is a further
380 +restriction, you may remove that term. If a license document contains
381 +a further restriction but permits relicensing or conveying under this
382 +License, you may add to a covered work material governed by the terms
383 +of that license document, provided that the further restriction does
384 +not survive such relicensing or conveying.
385 +
386 + If you add terms to a covered work in accord with this section, you
387 +must place, in the relevant source files, a statement of the
388 +additional terms that apply to those files, or a notice indicating
389 +where to find the applicable terms.
390 +
391 + Additional terms, permissive or non-permissive, may be stated in the
392 +form of a separately written license, or stated as exceptions;
393 +the above requirements apply either way.
394 +
395 + 8. Termination.
396 +
397 + You may not propagate or modify a covered work except as expressly
398 +provided under this License. Any attempt otherwise to propagate or
399 +modify it is void, and will automatically terminate your rights under
400 +this License (including any patent licenses granted under the third
401 +paragraph of section 11).
402 +
403 + However, if you cease all violation of this License, then your
404 +license from a particular copyright holder is reinstated (a)
405 +provisionally, unless and until the copyright holder explicitly and
406 +finally terminates your license, and (b) permanently, if the copyright
407 +holder fails to notify you of the violation by some reasonable means
408 +prior to 60 days after the cessation.
409 +
410 + Moreover, your license from a particular copyright holder is
411 +reinstated permanently if the copyright holder notifies you of the
412 +violation by some reasonable means, this is the first time you have
413 +received notice of violation of this License (for any work) from that
414 +copyright holder, and you cure the violation prior to 30 days after
415 +your receipt of the notice.
416 +
417 + Termination of your rights under this section does not terminate the
418 +licenses of parties who have received copies or rights from you under
419 +this License. If your rights have been terminated and not permanently
420 +reinstated, you do not qualify to receive new licenses for the same
421 +material under section 10.
422 +
423 + 9. Acceptance Not Required for Having Copies.
424 +
425 + You are not required to accept this License in order to receive or
426 +run a copy of the Program. Ancillary propagation of a covered work
427 +occurring solely as a consequence of using peer-to-peer transmission
428 +to receive a copy likewise does not require acceptance. However,
429 +nothing other than this License grants you permission to propagate or
430 +modify any covered work. These actions infringe copyright if you do
431 +not accept this License. Therefore, by modifying or propagating a
432 +covered work, you indicate your acceptance of this License to do so.
433 +
434 + 10. Automatic Licensing of Downstream Recipients.
435 +
436 + Each time you convey a covered work, the recipient automatically
437 +receives a license from the original licensors, to run, modify and
438 +propagate that work, subject to this License. You are not responsible
439 +for enforcing compliance by third parties with this License.
440 +
441 + An "entity transaction" is a transaction transferring control of an
442 +organization, or substantially all assets of one, or subdividing an
443 +organization, or merging organizations. If propagation of a covered
444 +work results from an entity transaction, each party to that
445 +transaction who receives a copy of the work also receives whatever
446 +licenses to the work the party's predecessor in interest had or could
447 +give under the previous paragraph, plus a right to possession of the
448 +Corresponding Source of the work from the predecessor in interest, if
449 +the predecessor has it or can get it with reasonable efforts.
450 +
451 + You may not impose any further restrictions on the exercise of the
452 +rights granted or affirmed under this License. For example, you may
453 +not impose a license fee, royalty, or other charge for exercise of
454 +rights granted under this License, and you may not initiate litigation
455 +(including a cross-claim or counterclaim in a lawsuit) alleging that
456 +any patent claim is infringed by making, using, selling, offering for
457 +sale, or importing the Program or any portion of it.
458 +
459 + 11. Patents.
460 +
461 + A "contributor" is a copyright holder who authorizes use under this
462 +License of the Program or a work on which the Program is based. The
463 +work thus licensed is called the contributor's "contributor version".
464 +
465 + A contributor's "essential patent claims" are all patent claims
466 +owned or controlled by the contributor, whether already acquired or
467 +hereafter acquired, that would be infringed by some manner, permitted
468 +by this License, of making, using, or selling its contributor version,
469 +but do not include claims that would be infringed only as a
470 +consequence of further modification of the contributor version. For
471 +purposes of this definition, "control" includes the right to grant
472 +patent sublicenses in a manner consistent with the requirements of
473 +this License.
474 +
475 + Each contributor grants you a non-exclusive, worldwide, royalty-free
476 +patent license under the contributor's essential patent claims, to
477 +make, use, sell, offer for sale, import and otherwise run, modify and
478 +propagate the contents of its contributor version.
479 +
480 + In the following three paragraphs, a "patent license" is any express
481 +agreement or commitment, however denominated, not to enforce a patent
482 +(such as an express permission to practice a patent or covenant not to
483 +sue for patent infringement). To "grant" such a patent license to a
484 +party means to make such an agreement or commitment not to enforce a
485 +patent against the party.
486 +
487 + If you convey a covered work, knowingly relying on a patent license,
488 +and the Corresponding Source of the work is not available for anyone
489 +to copy, free of charge and under the terms of this License, through a
490 +publicly available network server or other readily accessible means,
491 +then you must either (1) cause the Corresponding Source to be so
492 +available, or (2) arrange to deprive yourself of the benefit of the
493 +patent license for this particular work, or (3) arrange, in a manner
494 +consistent with the requirements of this License, to extend the patent
495 +license to downstream recipients. "Knowingly relying" means you have
496 +actual knowledge that, but for the patent license, your conveying the
497 +covered work in a country, or your recipient's use of the covered work
498 +in a country, would infringe one or more identifiable patents in that
499 +country that you have reason to believe are valid.
500 +
501 + If, pursuant to or in connection with a single transaction or
502 +arrangement, you convey, or propagate by procuring conveyance of, a
503 +covered work, and grant a patent license to some of the parties
504 +receiving the covered work authorizing them to use, propagate, modify
505 +or convey a specific copy of the covered work, then the patent license
506 +you grant is automatically extended to all recipients of the covered
507 +work and works based on it.
508 +
509 + A patent license is "discriminatory" if it does not include within
510 +the scope of its coverage, prohibits the exercise of, or is
511 +conditioned on the non-exercise of one or more of the rights that are
512 +specifically granted under this License. You may not convey a covered
513 +work if you are a party to an arrangement with a third party that is
514 +in the business of distributing software, under which you make payment
515 +to the third party based on the extent of your activity of conveying
516 +the work, and under which the third party grants, to any of the
517 +parties who would receive the covered work from you, a discriminatory
518 +patent license (a) in connection with copies of the covered work
519 +conveyed by you (or copies made from those copies), or (b) primarily
520 +for and in connection with specific products or compilations that
521 +contain the covered work, unless you entered into that arrangement,
522 +or that patent license was granted, prior to 28 March 2007.
523 +
524 + Nothing in this License shall be construed as excluding or limiting
525 +any implied license or other defenses to infringement that may
526 +otherwise be available to you under applicable patent law.
527 +
528 + 12. No Surrender of Others' Freedom.
529 +
530 + If conditions are imposed on you (whether by court order, agreement or
531 +otherwise) that contradict the conditions of this License, they do not
532 +excuse you from the conditions of this License. If you cannot convey a
533 +covered work so as to satisfy simultaneously your obligations under this
534 +License and any other pertinent obligations, then as a consequence you may
535 +not convey it at all. For example, if you agree to terms that obligate you
536 +to collect a royalty for further conveying from those to whom you convey
537 +the Program, the only way you could satisfy both those terms and this
538 +License would be to refrain entirely from conveying the Program.
539 +
540 + 13. Remote Network Interaction; Use with the GNU General Public License.
541 +
542 + Notwithstanding any other provision of this License, if you modify the
543 +Program, your modified version must prominently offer all users
544 +interacting with it remotely through a computer network (if your version
545 +supports such interaction) an opportunity to receive the Corresponding
546 +Source of your version by providing access to the Corresponding Source
547 +from a network server at no charge, through some standard or customary
548 +means of facilitating copying of software. This Corresponding Source
549 +shall include the Corresponding Source for any work covered by version 3
550 +of the GNU General Public License that is incorporated pursuant to the
551 +following paragraph.
552 +
553 + Notwithstanding any other provision of this License, you have
554 +permission to link or combine any covered work with a work licensed
555 +under version 3 of the GNU General Public License into a single
556 +combined work, and to convey the resulting work. The terms of this
557 +License will continue to apply to the part which is the covered work,
558 +but the work with which it is combined will remain governed by version
559 +3 of the GNU General Public License.
560 +
561 + 14. Revised Versions of this License.
562 +
563 + The Free Software Foundation may publish revised and/or new versions of
564 +the GNU Affero General Public License from time to time. Such new versions
565 +will be similar in spirit to the present version, but may differ in detail to
566 +address new problems or concerns.
567 +
568 + Each version is given a distinguishing version number. If the
569 +Program specifies that a certain numbered version of the GNU Affero General
570 +Public License "or any later version" applies to it, you have the
571 +option of following the terms and conditions either of that numbered
572 +version or of any later version published by the Free Software
573 +Foundation. If the Program does not specify a version number of the
574 +GNU Affero General Public License, you may choose any version ever published
575 +by the Free Software Foundation.
576 +
577 + If the Program specifies that a proxy can decide which future
578 +versions of the GNU Affero General Public License can be used, that proxy's
579 +public statement of acceptance of a version permanently authorizes you
580 +to choose that version for the Program.
581 +
582 + Later license versions may give you additional or different
583 +permissions. However, no additional obligations are imposed on any
584 +author or copyright holder as a result of your choosing to follow a
585 +later version.
586 +
587 + 15. Disclaimer of Warranty.
588 +
589 + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
590 +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
591 +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
592 +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
593 +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
594 +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
595 +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
596 +ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
597 +
598 + 16. Limitation of Liability.
599 +
600 + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
601 +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
602 +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
603 +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
604 +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
605 +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
606 +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
607 +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
608 +SUCH DAMAGES.
609 +
610 + 17. Interpretation of Sections 15 and 16.
611 +
612 + If the disclaimer of warranty and limitation of liability provided
613 +above cannot be given local legal effect according to their terms,
614 +reviewing courts shall apply local law that most closely approximates
615 +an absolute waiver of all civil liability in connection with the
616 +Program, unless a warranty or assumption of liability accompanies a
617 +copy of the Program in return for a fee.
618 +
619 + END OF TERMS AND CONDITIONS
620 +
621 + How to Apply These Terms to Your New Programs
622 +
623 + If you develop a new program, and you want it to be of the greatest
624 +possible use to the public, the best way to achieve this is to make it
625 +free software which everyone can redistribute and change under these terms.
626 +
627 + To do so, attach the following notices to the program. It is safest
628 +to attach them to the start of each source file to most effectively
629 +state the exclusion of warranty; and each file should have at least
630 +the "copyright" line and a pointer to where the full notice is found.
631 +
632 + <one line to give the program's name and a brief idea of what it does.>
633 + Copyright (C) <year> <name of author>
634 +
635 + This program is free software: you can redistribute it and/or modify
636 + it under the terms of the GNU Affero General Public License as published
637 + by the Free Software Foundation, either version 3 of the License, or
638 + (at your option) any later version.
639 +
640 + This program is distributed in the hope that it will be useful,
641 + but WITHOUT ANY WARRANTY; without even the implied warranty of
642 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
643 + GNU Affero General Public License for more details.
644 +
645 + You should have received a copy of the GNU Affero General Public License
646 + along with this program. If not, see <https://www.gnu.org/licenses/>.
647 +
648 +Also add information on how to contact you by electronic and paper mail.
649 +
650 + If your software can interact with users remotely through a computer
651 +network, you should also make sure that it provides a way for users to
652 +get its source. For example, if your program is a web application, its
653 +interface could display a "Source" link that leads users to an archive
654 +of the code. There are many ways you could offer source, and different
655 +solutions will be better for different programs; see section 13 for the
656 +specific requirements.
657 +
658 + You should also get your employer (if you work as a programmer) or school,
659 +if any, to sign a "copyright disclaimer" for the program, if necessary.
660 +For more information on this, and how to apply and follow the GNU AGPL, see
661 +<https://www.gnu.org/licenses/>.
README.md
+68 -3
@@ -4,13 +4,78 @@
4
5 SOCFortress CoPilot
6
7 -
7 [![Medium](https://img.shields.io/badge/Medium-12100E?style=for-the-badge&logo=medium&logoColor=white)](https://socfortress.medium.com/)
8 [![YouTube](https://img.shields.io/badge/YouTube-%23FF0000.svg?style=for-the-badge&logo=YouTube&logoColor=white)](https://www.youtube.com/@taylorwalton_socfortress/videos)
9 [![Discord Shield](https://discordapp.com/api/guilds/871419379999469568/widget.png?style=shield)](https://discord.gg/UN3pNBzaEQ)
10
12 -
13 -
11 </h1><h4 align="center">
12
13 [SOCFortress CoPilot](https://www.socfortress.co) focuses on providing a single pane of glass for all your security operations needs. Simplify your open source security stack with a single platform focused on making open source security tools easier to use and more accessible.
14 +
15 +![demo_timeline](src/assets/images/copilot_gif.gif)
16 +
17 +## Table of contents
18 +
19 +- [Getting Started](#getting-started)
20 + - [Running Copilot](#runnning-copilot)
21 +- [Connectors](#connectors)
22 +- [Help](#help)
23 +- [License](#license)
24 +- [Sponsoring](#sponsoring)
25 +
26 +## Getting started
27 +
28 +Copilot's true power comes from the ability to integrate with your existing security stack. We have built in integrations with the following tools:
29 +
30 +- [Wazuh](https://wazuh.com/)
31 +- [Graylog](https://www.graylog.org/)
32 +- [DFIR-IRIS](https://dfir-iris.org/)
33 +- [Velociraptor](https://docs.velociraptor.app/)
34 +- [Grafana](https://grafana.com/)
35 +- [InfluxDB](https://www.influxdata.com/)
36 +
37 +❗️ **Note:** Copilot is currently in beta. We are actively working on adding more integrations and features. If you have any suggestions or feedback, please let us know!
38 +
39 +### Running Copilot
40 +
41 +To ease the installation and upgrades, Copilot is shipped in a single docker container. To run Copilot, you will need to have [Docker](https://docs.docker.com/get-docker/) and [Docker Compose](https://docs.docker.com/compose/install/) installed.
42 +
43 +❗ **WARNING:** Copilot is not intended to be exposed to the internet. It is recommended for internal use only.
44 +
45 +```bash
46 +# Clone the CoPilot repository
47 +git clone https://github.com/socfortress/CoPilot
48 +cd CoPilot
49 +
50 +# Copy the environment file
51 +cp .env.example .env
52 +
53 +# Make your changes to the .env file
54 +
55 +# Run Copilot
56 +docker compose up
57 +```
58 +
59 +Copilot shall be available on the host interface, port 5173, protocol HTTP - `http://<your_instance_ip>:5173`.
60 +By default, an `admin` account is created. The password is printed in stdout the very first time Copilot is started. It won't be printed anymore after that.
61 +`Admin user password` can be searched in the logs of the `copilot` docker to find the password. You will use the `plain` password to login to the web interface.
62 +
63 +🚀 **YouTube Tutorial:** [SOCFortress CoPilot - Getting Started](TODO)
64 +
65 +## Connectors
66 +
67 +Copilot is designed to be a single pane of glass for your security operations. Think of it as a hub for all your security tools. Copilot Connectors are the glue that binds your security tools to Copilot. We take advantage of the APIs and webhooks provided by your security tools to provide a seamless integration.
68 +
69 +## Help
70 +
71 +You can reach us on [Discord](https://discord.gg/UN3pNBzaEQ) or by [📧](mailto:info@socfortress.co) if you have any question, issue or idea!
72 +
73 +Check out our full video tutorial series on ![YouTube](https://img.shields.io/badge/YouTube-%23FF0000.svg?style=for-the-badge&logo=YouTube&logoColor=white)
74 +
75 +## License
76 +
77 +The contents of this repository is available under [AGPL-3.0 license](LICENSE.txt).
78 +
79 +## Sponsoring
80 +
81 +If you like this project and want to support it, you can consider becoming a sponsor to help us continue maintaining it and adding new features.
backend/app/agents/dfir_iris/schema/cases.py
+3 -1
@@ -1,6 +1,8 @@
1 -from pydantic import BaseModel
1 from typing import List
2
3 +from pydantic import BaseModel
4 +
5 +
6 class AssetCaseIDResponse(BaseModel):
7 message: str
8 success: bool
backend/app/agents/dfir_iris/services/cases.py
+4 -7
@@ -1,14 +1,11 @@
1 -from fastapi import HTTPException
2 -from loguru import logger
1 from typing import List
2
3 +from fastapi import HTTPException
4 +from loguru import logger
5
6 -from app.connectors.dfir_iris.services.cases import get_all_cases
6 from app.agents.dfir_iris.schema.cases import AssetCaseIDResponse
8 -
9 -from app.connectors.dfir_iris.services.cases import get_all_cases
7 from app.connectors.dfir_iris.services.assets import get_case_assets
11 -
8 +from app.connectors.dfir_iris.services.cases import get_all_cases
9
10 # async def collect_agent_soc_cases(agent_id: int) -> AssetCaseIDResponse:
11 # """
@@ -37,6 +34,7 @@ from app.connectors.dfir_iris.services.assets import get_case_assets
34 # cases = AssetCaseID(case_ids=case_ids)
35 # return AssetCaseIDResponse(case_ids=cases, success=True, message="Successfully retrieved cases for agent")
36
37 +
38 async def collect_agent_soc_cases(agent_id: int) -> AssetCaseIDResponse:
39 """
40 Get all cases for the given agent ID.
@@ -91,4 +89,3 @@ async def is_agent_in_case(case_id: int, agent_id: int) -> bool:
89 logger.info(f"Found case with agent: {agent_id} in case: {case_id}")
90 return True
91 return False
94 -
backend/app/agents/routes/agents.py
+3 -2
@@ -8,6 +8,7 @@ from sqlalchemy import delete
8 from sqlalchemy.ext.asyncio import AsyncSession
9 from sqlalchemy.future import select
10
11 +from app.agents.dfir_iris.services.cases import collect_agent_soc_cases
12 from app.agents.schema.agents import AgentModifyResponse
13 from app.agents.schema.agents import AgentsResponse
14 from app.agents.schema.agents import OutdatedVelociraptorAgentsResponse
@@ -20,7 +21,6 @@ from app.agents.velociraptor.services.agents import delete_agent_velociraptor
21 from app.agents.wazuh.schema.agents import WazuhAgentVulnerabilitiesResponse
22 from app.agents.wazuh.services.agents import delete_agent_wazuh
23 from app.agents.wazuh.services.vulnerabilities import collect_agent_vulnerabilities
23 -from app.agents.dfir_iris.services.cases import collect_agent_soc_cases
24
25 # App specific imports
26 from app.auth.routes.auth import AuthHandler
@@ -292,9 +292,10 @@ async def get_agent_vulnerabilities(agent_id: str) -> WazuhAgentVulnerabilitiesR
292 logger.info(f"Fetching agent {agent_id} vulnerabilities")
293 return await collect_agent_vulnerabilities(agent_id)
294
295 +
296 @agents_router.get(
297 "/{agent_id}/soc_cases",
297 - #response_model=SocCasesResponse,
298 + # response_model=SocCasesResponse,
299 description="Get SOC cases for agent",
300 dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
301 )
backend/app/auth/models/users.py
+11 -7
@@ -1,18 +1,19 @@
1 import datetime
2 import random
3 +import re
4 import string
5 from enum import Enum
6 from typing import Optional
6 -import re
7
8 import bcrypt
9 +from fastapi import HTTPException
10 from pydantic import BaseModel
11 from pydantic import EmailStr
12 from pydantic import validator
13 from sqlmodel import Field
14 from sqlmodel import Relationship
15 from sqlmodel import SQLModel
15 -from fastapi import HTTPException
16 +
17
18 class Role(SQLModel, table=True):
19 id: Optional[int] = Field(primary_key=True)
@@ -124,29 +125,32 @@ class Password(BaseModel):
125 # Return the Password object with both the plain and hashed password
126 return cls(length=length, hashed=hashed_password.decode("utf-8"), plain=password)
127
128 +
129 # ! PASSWORD RESET TOKEN GENERATION NOT USING FOR NOW! #
130 class PasswordResetRequest(BaseModel):
131 username: str
132
133 +
134 class PasswordResetToken(BaseModel):
135 username: str
136 reset_token: str
137 new_password: str
138
136 - @validator('new_password')
139 + @validator("new_password")
140 def validate_password(cls, password):
141 if len(password) < 8 or len(password) > 256:
142 raise ValueError("Password length must be between 8 and 256 characters.")
140 - if not re.search(r'[a-z]', password):
143 + if not re.search(r"[a-z]", password):
144 raise ValueError("Password must contain at least one lowercase letter.")
142 - if not re.search(r'[A-Z]', password):
145 + if not re.search(r"[A-Z]", password):
146 raise ValueError("Password must contain at least one uppercase letter.")
144 - if not re.search(r'\d', password):
147 + if not re.search(r"\d", password):
148 raise ValueError("Password must contain at least one digit.")
146 - if not re.search(r'[@$!%*?&#]', password):
149 + if not re.search(r"[@$!%*?&#]", password):
150 raise ValueError("Password must contain at least one special character.")
151 return password
152
153 +
154 class PasswordReset(BaseModel):
155 username: str
156 new_password: str = Field(
backend/app/auth/routes/auth.py
+24 -5
@@ -5,14 +5,16 @@ from fastapi import Depends
5 from fastapi import HTTPException
6 from fastapi import Security
7 from fastapi import status
8 -from starlette.status import HTTP_401_UNAUTHORIZED
8 from fastapi.security import OAuth2PasswordRequestForm
9 from loguru import logger
10 from sqlalchemy.ext.asyncio import AsyncSession
11 +from starlette.status import HTTP_401_UNAUTHORIZED
12
13 +from app.auth.models.users import PasswordReset
14 +from app.auth.models.users import PasswordResetToken
15 from app.auth.models.users import User
16 from app.auth.models.users import UserInput
15 -from app.auth.models.users import UserLogin, PasswordReset, PasswordResetToken
17 +from app.auth.models.users import UserLogin
18 from app.auth.schema.auth import Token
19 from app.auth.schema.auth import UserLoginResponse
20 from app.auth.schema.auth import UserResponse
@@ -114,7 +116,12 @@ async def login(user: UserLogin):
116
117
118 # Get all users
117 -@auth_router.get("/users", response_model=UserBaseResponse, description="Get all users", dependencies=[Security(AuthHandler().require_any_scope("analyst","admin"))],)
119 +@auth_router.get(
120 + "/users",
121 + response_model=UserBaseResponse,
122 + description="Get all users",
123 + dependencies=[Security(AuthHandler().require_any_scope("analyst", "admin"))],
124 +)
125 async def get_users(session: AsyncSession = Depends(get_db)):
126 """
127 Retrieve all users from the database.
@@ -132,6 +139,7 @@ async def get_users(session: AsyncSession = Depends(get_db)):
139 users = await select_all_users()
140 return UserBaseResponse(users=users, message="Users retrieved successfully", success=True)
141
142 +
143 # ! TODO: HAVE LOGIC TO HANDLE PASSWORD RESET VIA A TOKEN BUT NOT IMPLEMENTED YET ! #
144 @auth_router.post("/reset-token", status_code=200, description="Request password reset", include_in_schema=False)
145 async def request_password_reset(password_reset_request: PasswordResetToken, session: AsyncSession = Depends(get_db)):
@@ -174,8 +182,14 @@ async def request_password_reset(password_reset_request: PasswordResetToken, ses
182 # await session.commit()
183 # return {"message": "Password reset successfully", "success": True}
184
185 +
186 # Reset a user's password via the username, must be an admin
178 -@auth_router.post("/reset-password", status_code=200, description="Reset user's password via username", dependencies=[Security(AuthHandler().require_any_scope("admin"))],)
187 +@auth_router.post(
188 + "/reset-password",
189 + status_code=200,
190 + description="Reset user's password via username",
191 + dependencies=[Security(AuthHandler().require_any_scope("admin"))],
192 +)
193 async def reset_password_via_username(request: PasswordReset, session: AsyncSession = Depends(get_db)):
194 """
195 Reset a user's password via the username. Must be an admin.
@@ -198,7 +212,12 @@ async def reset_password_via_username(request: PasswordReset, session: AsyncSess
212
213
214 # Reset a users password for themselves. The user must be logged in and the token decoded to get the username
201 -@auth_router.post("/reset-password/me", status_code=200, description="Reset user's password", dependencies=[Security(AuthHandler().require_any_scope("analyst","admin"))],)
215 +@auth_router.post(
216 + "/reset-password/me",
217 + status_code=200,
218 + description="Reset user's password",
219 + dependencies=[Security(AuthHandler().require_any_scope("analyst", "admin"))],
220 +)
221 async def reset_password_me(request: PasswordReset, token: str = Depends(AuthHandler().security), session: AsyncSession = Depends(get_db)):
222 """
223 Reset a user's password.
backend/app/auth/utils.py
-2
@@ -27,7 +27,6 @@ class AuthHandler:
27 def verify_password(self, plain_password, hashed_password):
28 return self.pwd_context.verify(plain_password, hashed_password)
29
30 -
30 # ! TODO: HAVE LOGIC TO HANDLE PASSWORD RESET VIA A TOKEN BUT NOT IMPLEMENTED YET ! #
31 def generate_reset_token(self, username: str, expires_delta: timedelta = timedelta(minutes=30)):
32 """
@@ -45,7 +44,6 @@ class AuthHandler:
44 encoded_jwt = jwt.encode(to_encode, self.secret, algorithm="HS256")
45 return encoded_jwt
46
48 -
47 # ! TODO: HAVE LOGIC TO HANDLE PASSWORD RESET VIA A TOKEN BUT NOT IMPLEMENTED YET ! #
48 # def verify_reset_token(self, token: str, username: str):
49 # """
backend/app/connectors/dfir_iris/routes/alerts.py
+13 -4
@@ -7,12 +7,17 @@ from loguru import logger
7 from app.auth.utils import AuthHandler
8 from app.connectors.dfir_iris.schema.alerts import AlertResponse
9 from app.connectors.dfir_iris.schema.alerts import AlertsResponse
10 -from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse, FilterAlertsRequest, CaseCreationResponse, DeleteAlertResponse, DeleteMultipleAlertsRequest
10 +from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse
11 +from app.connectors.dfir_iris.schema.alerts import CaseCreationResponse
12 +from app.connectors.dfir_iris.schema.alerts import DeleteAlertResponse
13 +from app.connectors.dfir_iris.schema.alerts import DeleteMultipleAlertsRequest
14 +from app.connectors.dfir_iris.schema.alerts import FilterAlertsRequest
15 from app.connectors.dfir_iris.services.alerts import bookmark_alert
16 +from app.connectors.dfir_iris.services.alerts import create_case
17 +from app.connectors.dfir_iris.services.alerts import delete_alert
18 from app.connectors.dfir_iris.services.alerts import get_alert
19 from app.connectors.dfir_iris.services.alerts import get_alerts
14 -from app.connectors.dfir_iris.services.alerts import create_case
15 -from app.connectors.dfir_iris.services.alerts import get_bookmarked_alerts, delete_alert
20 +from app.connectors.dfir_iris.services.alerts import get_bookmarked_alerts
21 from app.connectors.dfir_iris.utils.universal import check_alert_exists
22
23 # App specific imports
@@ -112,7 +117,7 @@ async def get_all_alerts_assigned_to_user(user_id: int) -> AlertsResponse:
117 AlertsResponse: The response containing the fetched alerts assigned to the user.
118 """
119 logger.info(f"Fetching all alerts assigned to user {user_id}")
115 - alerts = (await get_alerts(request=FilterAlertsRequest(alert_owner_id=user_id,per_page=1000))).alerts
120 + alerts = (await get_alerts(request=FilterAlertsRequest(alert_owner_id=user_id, per_page=1000))).alerts
121 alerts_assigned_to_user = []
122 for alert in alerts:
123 if alert["alert_owner_id"] == user_id:
@@ -120,6 +125,7 @@ async def get_all_alerts_assigned_to_user(user_id: int) -> AlertsResponse:
125
126 return AlertsResponse(success=True, message="Successfully fetched alerts assigned to user", alerts=alerts_assigned_to_user)
127
128 +
129 @dfir_iris_alerts_router.post(
130 "/create_case/{alert_id}",
131 response_model=CaseCreationResponse,
@@ -159,6 +165,7 @@ async def bookmark_alert_route(alert_id: str = Depends(verify_alert_exists)) ->
165 logger.info(f"Bookmarking alert {alert_id}")
166 return await bookmark_alert(alert_id, bookmarked=True)
167
168 +
169 @dfir_iris_alerts_router.delete(
170 "/bookmark/{alert_id}",
171 response_model=AlertResponse,
@@ -201,6 +208,7 @@ async def delete_multiple_alerts_route(request: DeleteMultipleAlertsRequest) ->
208 await delete_alert(int(alert_id))
209 return DeleteAlertResponse(success=True, message="Successfully deleted alerts.")
210
211 +
212 @dfir_iris_alerts_router.delete(
213 "/purge",
214 response_model=DeleteAlertResponse,
@@ -220,6 +228,7 @@ async def purge_alerts_route() -> DeleteAlertResponse:
228 await delete_alert(int(alert["alert_id"]))
229 return DeleteAlertResponse(success=True, message="Successfully deleted alerts.")
230
231 +
232 @dfir_iris_alerts_router.delete(
233 "/{alert_id}",
234 response_model=DeleteAlertResponse,
backend/app/connectors/dfir_iris/routes/cases.py
+12 -2
@@ -7,17 +7,23 @@ from fastapi import Security
7 from loguru import logger
8
9 from app.auth.utils import AuthHandler
10 -from app.connectors.dfir_iris.schema.cases import CaseOlderThanBody, PurgeCaseResponse, ClosedCaseResponse, ReopenedCaseResponse
10 +from app.connectors.dfir_iris.schema.cases import CaseOlderThanBody
11 from app.connectors.dfir_iris.schema.cases import CaseResponse
12 from app.connectors.dfir_iris.schema.cases import CasesBreachedResponse
13 +from app.connectors.dfir_iris.schema.cases import ClosedCaseResponse
14 +from app.connectors.dfir_iris.schema.cases import PurgeCaseResponse
15 +from app.connectors.dfir_iris.schema.cases import ReopenedCaseResponse
16 from app.connectors.dfir_iris.schema.cases import SingleCaseBody
17 from app.connectors.dfir_iris.schema.cases import SingleCaseResponse
18 from app.connectors.dfir_iris.schema.cases import TimeUnit
19 +from app.connectors.dfir_iris.services.cases import close_case
20 +from app.connectors.dfir_iris.services.cases import delete_single_case
21 from app.connectors.dfir_iris.services.cases import get_all_cases
22 from app.connectors.dfir_iris.services.cases import get_cases_older_than
23 from app.connectors.dfir_iris.services.cases import get_single_case
24 +from app.connectors.dfir_iris.services.cases import purge_cases
25 +from app.connectors.dfir_iris.services.cases import reopen_case
26 from app.connectors.dfir_iris.utils.universal import check_case_exists
20 -from app.connectors.dfir_iris.services.cases import purge_cases, delete_single_case, close_case, reopen_case
27
28
29 async def verify_case_exists(case_id: int) -> int:
@@ -99,6 +105,7 @@ async def get_cases_older_than_route(case_older_than_body: CaseOlderThanBody = D
105 logger.info(f"Fetching all cases older than {case_older_than_body.older_than} ({case_older_than_body.time_unit.value})")
106 return await get_cases_older_than(case_older_than_body)
107
108 +
109 @dfir_iris_cases_router.delete(
110 "/purge",
111 response_model=PurgeCaseResponse,
@@ -115,6 +122,7 @@ async def purge_cases_route() -> PurgeCaseResponse:
122 logger.info("Purging all cases")
123 return await purge_cases()
124
125 +
126 @dfir_iris_cases_router.delete(
127 "/purge/{case_id}",
128 response_model=PurgeCaseResponse,
@@ -156,6 +164,7 @@ async def get_single_case_route(case_id: int = Depends(verify_case_exists)) -> S
164 single_case_body = SingleCaseBody(case_id=case_id)
165 return await get_single_case(single_case_body.case_id)
166
167 +
168 @dfir_iris_cases_router.put(
169 "/close/{case_id}",
170 response_model=ClosedCaseResponse,
@@ -176,6 +185,7 @@ async def close_single_case_route(case_id: int = Depends(verify_case_exists)) ->
185 single_case_body = SingleCaseBody(case_id=case_id)
186 return await close_case(single_case_body.case_id)
187
188 +
189 @dfir_iris_cases_router.put(
190 "/open/{case_id}",
191 response_model=ReopenedCaseResponse,
backend/app/connectors/dfir_iris/schema/alerts.py
+7 -1
@@ -1,8 +1,8 @@
1 +from enum import Enum
2 from typing import Any
3 from typing import Dict
4 from typing import List
5 from typing import Optional
5 -from enum import Enum
6
7 from pydantic import BaseModel
8 from pydantic import Field
@@ -25,17 +25,21 @@ class BookmarkedAlertsResponse(BaseModel):
25 message: str
26 success: bool
27
28 +
29 class DeleteMultipleAlertsRequest(BaseModel):
30 alert_ids: List[str] = Field([], description="The IDs of the alerts to delete.")
31
32 +
33 class DeleteAlertResponse(BaseModel):
34 message: str
35 success: bool
36
37 +
38 class SortOrder(Enum):
39 desc = "desc"
40 asc = "asc"
41
42 +
43 class FilterAlertsRequest(BaseModel):
44 per_page: int = Field(1000, description="The number of alerts to return per page.")
45 page: int = Field(1, description="The page number to return.")
@@ -49,6 +53,7 @@ class CaseModificationHistory(BaseModel):
53 user_id: int
54 action: str
55
56 +
57 class CaseData(BaseModel):
58 owner_id: int
59 case_soc_id: str
@@ -69,6 +74,7 @@ class CaseData(BaseModel):
74 case_uuid: str
75 case_customer: int
76
77 +
78 class CaseCreationResponse(BaseModel):
79 success: bool
80 case: CaseData
backend/app/connectors/dfir_iris/schema/assets.py
+2
@@ -9,11 +9,13 @@ class AssetState(BaseModel):
9 object_last_update: str
10 object_state: int
11
12 +
13 class AssetIocLink(BaseModel):
14 ioc_id: int
15 ioc_value: str
16 asset_id: int
17
18 +
19 class Asset(BaseModel):
20 analysis_status: str
21 analysis_status_id: int
backend/app/connectors/dfir_iris/schema/cases.py
+9 -2
@@ -1,10 +1,10 @@
1 +from datetime import date
2 from datetime import timedelta
3 from enum import Enum
4 from typing import Dict
5 from typing import List
6 from typing import Optional
7 from typing import Union
7 -from datetime import date
8
9 from pydantic import BaseModel
10 from pydantic import Field
@@ -35,15 +35,18 @@ class CaseResponse(BaseModel):
35 message: str
36 success: bool
37
38 +
39 class PurgeCaseResponse(BaseModel):
40 message: str
41 success: bool
42
43 +
44 class ModificationHistoryItem(BaseModel):
45 action: str
46 user: str
47 user_id: int
48
49 +
50 class SingleCaseModel(BaseModel):
51 case_description: str
52 case_id: int
@@ -99,11 +102,13 @@ class CasesBreachedResponse(BaseModel):
102 message: str
103 success: bool
104
105 +
106 class CaseModificationHistoryItem(BaseModel):
107 user: str
108 user_id: int
109 action: str
110
111 +
112 class CaseData(BaseModel):
113 owner_id: int
114 case_soc_id: str
@@ -124,11 +129,13 @@ class CaseData(BaseModel):
129 case_uuid: str
130 case_customer: int
131
132 +
133 class ClosedCaseResponse(BaseModel):
134 success: bool
135 case: CaseData
136 message: str
137
138 +
139 class ReopenedCaseData(BaseModel):
140 owner_id: int
141 case_soc_id: str
@@ -149,8 +156,8 @@ class ReopenedCaseData(BaseModel):
156 case_uuid: str
157 case_customer: int
158
159 +
160 class ReopenedCaseResponse(BaseModel):
161 success: bool
162 case: ReopenedCaseData
163 message: str
156 -
backend/app/connectors/dfir_iris/services/alerts.py
+20 -14
@@ -1,11 +1,14 @@
1 +from fastapi import HTTPException
2 +from loguru import logger
3 +
4 from app.connectors.dfir_iris.schema.alerts import AlertResponse
5 from app.connectors.dfir_iris.schema.alerts import AlertsResponse
3 -from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse, FilterAlertsRequest, CaseCreationResponse, DeleteAlertResponse
6 +from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse
7 +from app.connectors.dfir_iris.schema.alerts import CaseCreationResponse
8 +from app.connectors.dfir_iris.schema.alerts import DeleteAlertResponse
9 +from app.connectors.dfir_iris.schema.alerts import FilterAlertsRequest
10 from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
11 from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
6 -from loguru import logger
7 -from fastapi import HTTPException
8 -
12
13
14 async def get_alerts(request: FilterAlertsRequest) -> AlertsResponse:
@@ -28,6 +31,7 @@ async def get_alerts(request: FilterAlertsRequest) -> AlertsResponse:
31 logger.error(f"Error fetching alerts: {e}")
32 raise HTTPException(status_code=500, detail=f"Error fetching alerts: {e}")
33
34 +
35 def construct_params(request: FilterAlertsRequest) -> dict:
36 """
37 Constructs the parameters for the alert filtering request.
@@ -39,10 +43,10 @@ def construct_params(request: FilterAlertsRequest) -> dict:
43 dict: A dictionary of parameters for the alert filtering request.
44 """
45 params = {
42 - 'page': request.page,
43 - 'per_page': request.per_page,
44 - 'sort': request.sort,
45 - 'alert_title': request.alert_title,
46 + "page": request.page,
47 + "per_page": request.per_page,
48 + "sort": request.sort,
49 + "alert_title": request.alert_title,
50 # Add more parameters here as needed
51 }
52
@@ -50,7 +54,6 @@ def construct_params(request: FilterAlertsRequest) -> dict:
54 return {k: v for k, v in params.items() if v is not None}
55
56
53 -
57 async def get_alert(alert_id: str) -> AlertResponse:
58 """
59 Retrieves an alert by its ID.
@@ -68,6 +71,7 @@ async def get_alert(alert_id: str) -> AlertResponse:
71 result = await fetch_and_validate_data(client, alert.get_alert, alert_id)
72 return AlertResponse(success=True, message="Successfully fetched alert", alert=result["data"])
73
74 +
75 async def create_case(alert_id: str) -> CaseCreationResponse:
76 """
77 Creates a case for an alert.
@@ -87,6 +91,7 @@ async def create_case(alert_id: str) -> CaseCreationResponse:
91 logger.info(f"Successfully created case for alert: {result}")
92 return CaseCreationResponse(success=True, message="Successfully created case for alert", case=result["data"])
93
94 +
95 def construct_case_creation_params(alert_details: dict) -> dict:
96 """
97 Constructs the parameters for the case creation request.
@@ -98,16 +103,17 @@ def construct_case_creation_params(alert_details: dict) -> dict:
103 dict: A dictionary of parameters for the case creation request.
104 """
105 params = {
101 - 'case_title': alert_details["alert_title"],
102 - 'case_tags': alert_details["alert_tags"],
103 - 'escalation_note': 'Case created from CoPilot',
104 - 'iocs_import_list': [ioc['ioc_uuid'] for ioc in alert_details["iocs"]],
105 - 'assets_import_list': [asset['asset_uuid'] for asset in alert_details["assets"]],
106 + "case_title": alert_details["alert_title"],
107 + "case_tags": alert_details["alert_tags"],
108 + "escalation_note": "Case created from CoPilot",
109 + "iocs_import_list": [ioc["ioc_uuid"] for ioc in alert_details["iocs"]],
110 + "assets_import_list": [asset["asset_uuid"] for asset in alert_details["assets"]],
111 }
112
113 # Replace None values with the string "None"
114 return {k: v if v is not None else "None" for k, v in params.items()}
115
116 +
117 async def bookmark_alert(alert_id: str, bookmarked: bool) -> AlertResponse:
118 """
119 Bookmarks or removes bookmark from an alert.
backend/app/connectors/dfir_iris/services/cases.py
+7 -2
@@ -6,9 +6,12 @@ from dfir_iris_client.case import Case
6 from fastapi import HTTPException
7 from loguru import logger
8
9 -from app.connectors.dfir_iris.schema.cases import CaseOlderThanBody, PurgeCaseResponse, ClosedCaseResponse, ReopenedCaseResponse
9 +from app.connectors.dfir_iris.schema.cases import CaseOlderThanBody
10 from app.connectors.dfir_iris.schema.cases import CaseResponse
11 from app.connectors.dfir_iris.schema.cases import CasesBreachedResponse
12 +from app.connectors.dfir_iris.schema.cases import ClosedCaseResponse
13 +from app.connectors.dfir_iris.schema.cases import PurgeCaseResponse
14 +from app.connectors.dfir_iris.schema.cases import ReopenedCaseResponse
15 from app.connectors.dfir_iris.schema.cases import SingleCaseBody
16 from app.connectors.dfir_iris.schema.cases import SingleCaseResponse
17 from app.connectors.dfir_iris.utils.universal import create_dfir_iris_client
@@ -130,6 +133,7 @@ async def get_single_case(case_id: SingleCaseBody) -> SingleCaseResponse:
133 result = await fetch_and_parse_data(dfir_iris_client, case.get_case, case_id)
134 return SingleCaseResponse(success=True, message="Successfully fetched single case", case=result["data"])
135
136 +
137 async def close_case(case_id: SingleCaseBody) -> ClosedCaseResponse:
138 """
139 Closes a single case from DFIR-IRIS based on the provided case ID.
@@ -170,6 +174,7 @@ async def reopen_case(case_id: SingleCaseBody) -> ReopenedCaseResponse:
174 logger.info(f"Successfully opened case: {result}")
175 return ReopenedCaseResponse(success=True, case=result["data"], message="Successfully opened case")
176
177 +
178 ############# ! DELETE ACTIONS ! #############
179 async def purge_cases() -> PurgeCaseResponse:
180 """
@@ -237,6 +242,7 @@ async def purge_case(client, case, case_id) -> PurgeCaseResponse:
242 logger.error(error_message)
243 raise HTTPException(status_code=500, detail=error_message)
244
245 +
246 async def delete_single_case(case_id: SingleCaseBody) -> PurgeCaseResponse:
247 """
248 Deletes a single case from DFIR-IRIS based on the provided case ID.
@@ -254,4 +260,3 @@ async def delete_single_case(case_id: SingleCaseBody) -> PurgeCaseResponse:
260 case = Case(session=dfir_iris_client)
261 result = await fetch_and_parse_data(dfir_iris_client, case.delete_case, case_id)
262 return PurgeCaseResponse(success=True, message="Successfully deleted single case")
257 -
backend/app/connectors/event_shipper/utils/universal.py
+4 -2
@@ -1,12 +1,13 @@
1 -from loguru import logger
1 from typing import Optional
2
3 import asyncgelf
4 +from loguru import logger
5
6 from app.connectors.utils import get_connector_info_from_db
7 from app.db.db_session import AsyncSessionLocal
8 from app.db.db_session import get_db_session
9
10 +
11 class GelfLogger:
12 def __init__(self, host: str, port: str, compress: Optional[bool] = False):
13 self.host = host
@@ -35,7 +36,8 @@ class GelfLogger:
36 response = await handler.tcp_handler(message)
37 return response
38
39 +
40 async def create_gelf_logger():
41 async with get_db_session() as session:
42 connector_info = await get_connector_info_from_db("Event Shipper", session)
41 - return GelfLogger(host=connector_info['connector_url'], port=str(connector_info['connector_extra_data']))
43 + return GelfLogger(host=connector_info["connector_url"], port=str(connector_info["connector_extra_data"]))
backend/app/connectors/grafana/dashboards/Office365/active_directory.json
+4171 -4254
@@ -1,4256 +1,4173 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "9.3.6",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "displayMode": "auto",
261 - "inspect": false
262 - },
263 - "mappings": [],
264 - "thresholds": {
265 - "mode": "absolute",
266 - "steps": [
267 - {
268 - "color": "red",
269 - "value": null
270 - }
271 - ]
272 - }
273 - },
274 - "overrides": [
275 - {
276 - "matcher": {
277 - "id": "byName",
278 - "options": "Count"
279 - },
280 - "properties": [
281 - {
282 - "id": "displayName",
283 - "value": "EVENTS"
284 - },
285 - {
286 - "id": "unit",
287 - "value": "short"
288 - },
289 - {
290 - "id": "decimals",
291 - "value": -1
292 - },
293 - {
294 - "id": "custom.align"
295 - },
296 - {
297 - "id": "thresholds",
298 - "value": {
299 - "mode": "absolute",
300 - "steps": [
301 - {
302 - "color": "red",
303 - "value": null
304 - }
305 - ]
306 - }
307 - }
308 - ]
309 - }
310 - ]
311 - },
312 - "gridPos": {
313 - "h": 7,
314 - "w": 6,
315 - "x": 8,
316 - "y": 0
317 - },
318 - "id": 54,
319 - "options": {
320 - "footer": {
321 - "fields": "",
322 - "reducer": [
323 - "sum"
324 - ],
325 - "show": false
326 - },
327 - "showHeader": true
328 - },
329 - "pluginVersion": "9.3.6",
330 - "targets": [
331 - {
332 - "bucketAggs": [
333 - {
334 - "fake": true,
335 - "field": "data_office365_Operation",
336 - "id": "4",
337 - "settings": {
338 - "min_doc_count": 1,
339 - "order": "desc",
340 - "orderBy": "_count",
341 - "size": "0"
342 - },
343 - "type": "terms"
344 - }
345 - ],
346 - "datasource": {
347 - "type": "elasticsearch",
348 - "uid": "replace_datasource_uid"
349 - },
350 - "metrics": [
351 - {
352 - "field": "select field",
353 - "id": "1",
354 - "type": "count"
355 - }
356 - ],
357 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
358 - "refId": "A",
359 - "timeField": "timestamp"
360 - }
361 - ],
362 - "title": "EVENTS BY OPERATION",
363 - "transformations": [
364 - {
365 - "id": "merge",
366 - "options": {
367 - "reducers": []
368 - }
369 - },
370 - {
371 - "id": "organize",
372 - "options": {
373 - "excludeByName": {},
374 - "indexByName": {},
375 - "renameByName": {
376 - "Count": "EVENTS",
377 - "data_office365_Operation": "OPERATION"
378 - }
379 - }
380 - }
381 - ],
382 - "type": "table"
383 - },
384 - {
385 - "datasource": {
386 - "type": "elasticsearch",
387 - "uid": "replace_datasource_uid"
388 - },
389 - "fieldConfig": {
390 - "defaults": {
391 - "mappings": [
392 - {
393 - "options": {
394 - "match": "null",
395 - "result": {
396 - "text": "N/A"
397 - }
398 - },
399 - "type": "special"
400 - }
401 - ],
402 - "thresholds": {
403 - "mode": "absolute",
404 - "steps": [
405 - {
406 - "color": "blue",
407 - "value": null
408 - }
409 - ]
410 - },
411 - "unit": "locale"
412 - },
413 - "overrides": []
414 - },
415 - "gridPos": {
416 - "h": 7,
417 - "w": 4,
418 - "x": 14,
419 - "y": 0
420 - },
421 - "id": 59,
422 - "links": [],
423 - "options": {
424 - "colorMode": "value",
425 - "graphMode": "area",
426 - "justifyMode": "auto",
427 - "orientation": "horizontal",
428 - "reduceOptions": {
429 - "calcs": [
430 - "sum"
431 - ],
432 - "fields": "",
433 - "values": false
434 - },
435 - "text": {},
436 - "textMode": "auto"
437 - },
438 - "pluginVersion": "9.3.6",
439 - "targets": [
440 - {
441 - "bucketAggs": [
442 - {
443 - "$$hashKey": "object:331",
444 - "field": "timestamp",
445 - "id": "2",
446 - "settings": {
447 - "interval": "auto",
448 - "min_doc_count": 0,
449 - "trimEdges": 0
450 - },
451 - "type": "date_histogram"
452 - }
453 - ],
454 - "datasource": {
455 - "type": "elasticsearch",
456 - "uid": "replace_datasource_uid"
457 - },
458 - "metrics": [
459 - {
460 - "$$hashKey": "object:329",
461 - "field": "select field",
462 - "id": "1",
463 - "type": "count"
464 - }
465 - ],
466 - "query": "data_office365_Operation:\"Add device.\" OR data_office365_Operation:\"Add registered owner to device.\" OR data_office365_Operation:\"Add registered users to device.\"",
467 - "refId": "A",
468 - "timeField": "timestamp"
469 - }
470 - ],
471 - "title": "DEVICE EVENTS (Total)",
472 - "type": "stat"
473 - },
474 - {
475 - "datasource": {
476 - "type": "elasticsearch",
477 - "uid": "replace_datasource_uid"
478 - },
479 - "fieldConfig": {
480 - "defaults": {
481 - "color": {
482 - "mode": "thresholds"
483 - },
484 - "custom": {
485 - "align": "auto",
486 - "displayMode": "auto",
487 - "inspect": false
488 - },
489 - "mappings": [],
490 - "thresholds": {
491 - "mode": "absolute",
492 - "steps": [
493 - {
494 - "color": "red",
495 - "value": null
496 - }
497 - ]
498 - }
499 - },
500 - "overrides": [
501 - {
502 - "matcher": {
503 - "id": "byName",
504 - "options": "Count"
505 - },
506 - "properties": [
507 - {
508 - "id": "displayName",
509 - "value": "EVENTS"
510 - },
511 - {
512 - "id": "unit",
513 - "value": "short"
514 - },
515 - {
516 - "id": "decimals",
517 - "value": -1
518 - },
519 - {
520 - "id": "custom.align"
521 - },
522 - {
523 - "id": "thresholds",
524 - "value": {
525 - "mode": "absolute",
526 - "steps": [
527 - {
528 - "color": "red",
529 - "value": null
530 - }
531 - ]
532 - }
533 - }
534 - ]
535 - }
536 - ]
537 - },
538 - "gridPos": {
539 - "h": 7,
540 - "w": 6,
541 - "x": 18,
542 - "y": 0
543 - },
544 - "id": 60,
545 - "options": {
546 - "footer": {
547 - "fields": "",
548 - "reducer": [
549 - "sum"
550 - ],
551 - "show": false
552 - },
553 - "showHeader": true
554 - },
555 - "pluginVersion": "9.3.6",
556 - "targets": [
557 - {
558 - "bucketAggs": [
559 - {
560 - "fake": true,
561 - "field": "data_office365_Operation",
562 - "id": "4",
563 - "settings": {
564 - "min_doc_count": 1,
565 - "order": "desc",
566 - "orderBy": "_count",
567 - "size": "0"
568 - },
569 - "type": "terms"
570 - }
571 - ],
572 - "datasource": {
573 - "type": "elasticsearch",
574 - "uid": "replace_datasource_uid"
575 - },
576 - "metrics": [
577 - {
578 - "field": "select field",
579 - "id": "1",
580 - "type": "count"
581 - }
582 - ],
583 - "query": "data_office365_Operation:\"Add device.\" OR data_office365_Operation:\"Add registered owner to device.\" OR data_office365_Operation:\"Add registered users to device.\"",
584 - "refId": "A",
585 - "timeField": "timestamp"
586 - }
587 - ],
588 - "title": "DEVICE EVENTS BY OPERATION",
589 - "transformations": [
590 - {
591 - "id": "merge",
592 - "options": {
593 - "reducers": []
594 - }
595 - },
596 - {
597 - "id": "organize",
598 - "options": {
599 - "excludeByName": {},
600 - "indexByName": {},
601 - "renameByName": {
602 - "Count": "EVENTS",
603 - "data_office365_Operation": "OPERATION"
604 - }
605 - }
606 - }
607 - ],
608 - "type": "table"
609 - },
610 - {
611 - "datasource": {
612 - "type": "elasticsearch",
613 - "uid": "replace_datasource_uid"
614 - },
615 - "fieldConfig": {
616 - "defaults": {
617 - "mappings": [
618 - {
619 - "options": {
620 - "match": "null",
621 - "result": {
622 - "text": "N/A"
623 - }
624 - },
625 - "type": "special"
626 - }
627 - ],
628 - "thresholds": {
629 - "mode": "absolute",
630 - "steps": [
631 - {
632 - "color": "blue",
633 - "value": null
634 - }
635 - ]
636 - },
637 - "unit": "locale"
638 - },
639 - "overrides": []
640 - },
641 - "gridPos": {
642 - "h": 7,
643 - "w": 4,
644 - "x": 0,
645 - "y": 7
646 - },
647 - "id": 65,
648 - "links": [],
649 - "options": {
650 - "colorMode": "value",
651 - "graphMode": "area",
652 - "justifyMode": "auto",
653 - "orientation": "horizontal",
654 - "reduceOptions": {
655 - "calcs": [
656 - "sum"
657 - ],
658 - "fields": "",
659 - "values": false
660 - },
661 - "text": {},
662 - "textMode": "auto"
663 - },
664 - "pluginVersion": "9.3.6",
665 - "targets": [
666 - {
667 - "bucketAggs": [
668 - {
669 - "$$hashKey": "object:331",
670 - "field": "timestamp",
671 - "id": "2",
672 - "settings": {
673 - "interval": "auto",
674 - "min_doc_count": 0,
675 - "trimEdges": 0
676 - },
677 - "type": "date_histogram"
678 - }
679 - ],
680 - "datasource": {
681 - "type": "elasticsearch",
682 - "uid": "replace_datasource_uid"
683 - },
684 - "metrics": [
685 - {
686 - "$$hashKey": "object:329",
687 - "field": "select field",
688 - "id": "1",
689 - "type": "count"
690 - }
691 - ],
692 - "query": "data_office365_Operation:\"Add user.\"",
693 - "refId": "A",
694 - "timeField": "timestamp"
695 - }
696 - ],
697 - "title": "USERS ADDED EVENTS (Total)",
698 - "type": "stat"
699 - },
700 - {
701 - "datasource": {
702 - "type": "elasticsearch",
703 - "uid": "replace_datasource_uid"
704 - },
705 - "fieldConfig": {
706 - "defaults": {
707 - "color": {
708 - "mode": "palette-classic"
709 - },
710 - "custom": {
711 - "hideFrom": {
712 - "legend": false,
713 - "tooltip": false,
714 - "viz": false
715 - }
716 - },
717 - "mappings": []
718 - },
719 - "overrides": [
720 - {
721 - "matcher": {
722 - "id": "byName",
723 - "options": "Count"
724 - },
725 - "properties": [
726 - {
727 - "id": "displayName",
728 - "value": "EVENTS"
729 - },
730 - {
731 - "id": "unit",
732 - "value": "short"
733 - },
734 - {
735 - "id": "decimals",
736 - "value": -1
737 - }
738 - ]
739 - },
740 - {
741 - "matcher": {
742 - "id": "byName",
743 - "options": "Failure"
744 - },
745 - "properties": [
746 - {
747 - "id": "color",
748 - "value": {
749 - "fixedColor": "orange",
750 - "mode": "fixed"
751 - }
752 - }
753 - ]
754 - }
755 - ]
756 - },
757 - "gridPos": {
758 - "h": 7,
759 - "w": 4,
760 - "x": 4,
761 - "y": 7
762 - },
763 - "id": 66,
764 - "options": {
765 - "legend": {
766 - "displayMode": "table",
767 - "placement": "bottom",
768 - "showLegend": true
769 - },
770 - "pieType": "donut",
771 - "reduceOptions": {
772 - "calcs": [
773 - "sum"
774 - ],
775 - "fields": "",
776 - "values": false
777 - },
778 - "tooltip": {
779 - "mode": "single",
780 - "sort": "none"
781 - }
782 - },
783 - "pluginVersion": "8.5.1",
784 - "targets": [
785 - {
786 - "bucketAggs": [
787 - {
788 - "fake": true,
789 - "field": "data_office365_ResultStatus",
790 - "id": "4",
791 - "settings": {
792 - "min_doc_count": 1,
793 - "order": "desc",
794 - "orderBy": "_count",
795 - "size": "10"
796 - },
797 - "type": "terms"
798 - },
799 - {
800 - "field": "data_office365_CreationTime",
801 - "id": "5",
802 - "settings": {
803 - "interval": "auto",
804 - "min_doc_count": "0",
805 - "timeZone": "utc",
806 - "trimEdges": "0"
807 - },
808 - "type": "date_histogram"
809 - }
810 - ],
811 - "datasource": {
812 - "type": "elasticsearch",
813 - "uid": "replace_datasource_uid"
814 - },
815 - "metrics": [
816 - {
817 - "field": "select field",
818 - "id": "1",
819 - "type": "count"
820 - }
821 - ],
822 - "query": "data_office365_Operation:\"Add user.\" AND rule_level:$rule_level",
823 - "refId": "A",
824 - "timeField": "timestamp"
825 - }
826 - ],
827 - "title": "USERS ADDED EVENTS (Results)",
828 - "transformations": [],
829 - "type": "piechart"
830 - },
831 - {
832 - "datasource": {
833 - "type": "elasticsearch",
834 - "uid": "replace_datasource_uid"
835 - },
836 - "fieldConfig": {
837 - "defaults": {
838 - "color": {
839 - "mode": "thresholds"
840 - },
841 - "custom": {
842 - "align": "auto",
843 - "displayMode": "auto",
844 - "inspect": false
845 - },
846 - "mappings": [],
847 - "thresholds": {
848 - "mode": "absolute",
849 - "steps": [
850 - {
851 - "color": "red",
852 - "value": null
853 - }
854 - ]
855 - }
856 - },
857 - "overrides": [
858 - {
859 - "matcher": {
860 - "id": "byName",
861 - "options": "Count"
862 - },
863 - "properties": [
864 - {
865 - "id": "displayName",
866 - "value": "EVENTS"
867 - },
868 - {
869 - "id": "unit",
870 - "value": "short"
871 - },
872 - {
873 - "id": "decimals",
874 - "value": -1
875 - },
876 - {
877 - "id": "custom.align"
878 - },
879 - {
880 - "id": "thresholds",
881 - "value": {
882 - "mode": "absolute",
883 - "steps": [
884 - {
885 - "color": "red",
886 - "value": null
887 - }
888 - ]
889 - }
890 - }
891 - ]
892 - },
893 - {
894 - "matcher": {
895 - "id": "byName",
896 - "options": "data_office365_ResultStatus"
897 - },
898 - "properties": [
899 - {
900 - "id": "custom.displayMode",
901 - "value": "color-text"
902 - },
903 - {
904 - "id": "mappings",
905 - "value": [
906 - {
907 - "options": {
908 - "Failure": {
909 - "color": "orange",
910 - "index": 0
911 - },
912 - "Success": {
913 - "color": "green",
914 - "index": 1
915 - }
916 - },
917 - "type": "value"
918 - }
919 - ]
920 - }
921 - ]
922 - }
923 - ]
924 - },
925 - "gridPos": {
926 - "h": 7,
927 - "w": 6,
928 - "x": 8,
929 - "y": 7
930 - },
931 - "id": 67,
932 - "options": {
933 - "footer": {
934 - "fields": "",
935 - "reducer": [
936 - "sum"
937 - ],
938 - "show": false
939 - },
940 - "showHeader": true
941 - },
942 - "pluginVersion": "9.3.6",
943 - "targets": [
944 - {
945 - "bucketAggs": [
946 - {
947 - "fake": true,
948 - "field": "data_office365_ResultStatus",
949 - "id": "4",
950 - "settings": {
951 - "min_doc_count": 1,
952 - "order": "desc",
953 - "orderBy": "_count",
954 - "size": "0"
955 - },
956 - "type": "terms"
957 - }
958 - ],
959 - "datasource": {
960 - "type": "elasticsearch",
961 - "uid": "replace_datasource_uid"
962 - },
963 - "metrics": [
964 - {
965 - "field": "select field",
966 - "id": "1",
967 - "type": "count"
968 - }
969 - ],
970 - "query": "data_office365_Operation:\"Add user.\" AND rule_level:$rule_level",
971 - "refId": "A",
972 - "timeField": "timestamp"
973 - }
974 - ],
975 - "title": "USERS ADDED EVENTS (Results)",
976 - "transformations": [
977 - {
978 - "id": "merge",
979 - "options": {
980 - "reducers": []
981 - }
982 - },
983 - {
984 - "id": "organize",
985 - "options": {
986 - "excludeByName": {},
987 - "indexByName": {},
988 - "renameByName": {
989 - "Count": "EVENTS",
990 - "data_office365_Operation": "OPERATION",
991 - "data_office365_ResultStatus": "RESULT"
992 - }
993 - }
994 - }
995 - ],
996 - "type": "table"
997 - },
998 - {
999 - "datasource": {
1000 - "type": "elasticsearch",
1001 - "uid": "replace_datasource_uid"
1002 - },
1003 - "fieldConfig": {
1004 - "defaults": {
1005 - "color": {
1006 - "mode": "thresholds"
1007 - },
1008 - "custom": {
1009 - "align": "auto",
1010 - "displayMode": "auto",
1011 - "inspect": false
1012 - },
1013 - "mappings": [],
1014 - "thresholds": {
1015 - "mode": "absolute",
1016 - "steps": [
1017 - {
1018 - "color": "red",
1019 - "value": null
1020 - }
1021 - ]
1022 - }
1023 - },
1024 - "overrides": [
1025 - {
1026 - "matcher": {
1027 - "id": "byName",
1028 - "options": "Count"
1029 - },
1030 - "properties": [
1031 - {
1032 - "id": "displayName",
1033 - "value": "EVENTS"
1034 - },
1035 - {
1036 - "id": "unit",
1037 - "value": "short"
1038 - },
1039 - {
1040 - "id": "decimals",
1041 - "value": -1
1042 - },
1043 - {
1044 - "id": "custom.align"
1045 - },
1046 - {
1047 - "id": "thresholds",
1048 - "value": {
1049 - "mode": "absolute",
1050 - "steps": [
1051 - {
1052 - "color": "red",
1053 - "value": null
1054 - }
1055 - ]
1056 - }
1057 - }
1058 - ]
1059 - },
1060 - {
1061 - "matcher": {
1062 - "id": "byName",
1063 - "options": "RESULT"
1064 - },
1065 - "properties": [
1066 - {
1067 - "id": "custom.displayMode",
1068 - "value": "color-text"
1069 - },
1070 - {
1071 - "id": "mappings",
1072 - "value": [
1073 - {
1074 - "options": {
1075 - "Failure": {
1076 - "color": "orange",
1077 - "index": 0
1078 - },
1079 - "Success": {
1080 - "color": "green",
1081 - "index": 1
1082 - }
1083 - },
1084 - "type": "value"
1085 - }
1086 - ]
1087 - }
1088 - ]
1089 - }
1090 - ]
1091 - },
1092 - "gridPos": {
1093 - "h": 7,
1094 - "w": 10,
1095 - "x": 14,
1096 - "y": 7
1097 - },
1098 - "id": 68,
1099 - "options": {
1100 - "footer": {
1101 - "fields": "",
1102 - "reducer": [
1103 - "sum"
1104 - ],
1105 - "show": false
1106 - },
1107 - "showHeader": true
1108 - },
1109 - "pluginVersion": "9.3.6",
1110 - "targets": [
1111 - {
1112 - "bucketAggs": [
1113 - {
1114 - "fake": true,
1115 - "field": "data_office365_ObjectId",
1116 - "id": "4",
1117 - "settings": {
1118 - "min_doc_count": 1,
1119 - "order": "desc",
1120 - "orderBy": "_count",
1121 - "size": "0"
1122 - },
1123 - "type": "terms"
1124 - },
1125 - {
1126 - "field": "data_office365_ResultStatus",
1127 - "id": "5",
1128 - "settings": {
1129 - "min_doc_count": "1",
1130 - "order": "desc",
1131 - "orderBy": "_count",
1132 - "size": "10"
1133 - },
1134 - "type": "terms"
1135 - }
1136 - ],
1137 - "datasource": {
1138 - "type": "elasticsearch",
1139 - "uid": "replace_datasource_uid"
1140 - },
1141 - "metrics": [
1142 - {
1143 - "field": "select field",
1144 - "id": "1",
1145 - "type": "count"
1146 - }
1147 - ],
1148 - "query": "data_office365_Operation:\"Add user.\" AND rule_level:$rule_level",
1149 - "refId": "A",
1150 - "timeField": "timestamp"
1151 - }
1152 - ],
1153 - "title": "USERS ADDED EVENTS (Accounts)",
1154 - "transformations": [
1155 - {
1156 - "id": "merge",
1157 - "options": {
1158 - "reducers": []
1159 - }
1160 - },
1161 - {
1162 - "id": "organize",
1163 - "options": {
1164 - "excludeByName": {},
1165 - "indexByName": {},
1166 - "renameByName": {
1167 - "Count": "EVENTS",
1168 - "data_office365_ObjectId": "ACCOUNT",
1169 - "data_office365_Operation": "OPERATION",
1170 - "data_office365_ResultStatus": "RESULT"
1171 - }
1172 - }
1173 - }
1174 - ],
1175 - "type": "table"
1176 - },
1177 - {
1178 - "datasource": {
1179 - "type": "elasticsearch",
1180 - "uid": "replace_datasource_uid"
1181 - },
1182 - "fieldConfig": {
1183 - "defaults": {
1184 - "mappings": [
1185 - {
1186 - "options": {
1187 - "match": "null",
1188 - "result": {
1189 - "text": "N/A"
1190 - }
1191 - },
1192 - "type": "special"
1193 - }
1194 - ],
1195 - "thresholds": {
1196 - "mode": "absolute",
1197 - "steps": [
1198 - {
1199 - "color": "orange",
1200 - "value": null
1201 - }
1202 - ]
1203 - },
1204 - "unit": "locale"
1205 - },
1206 - "overrides": []
1207 - },
1208 - "gridPos": {
1209 - "h": 7,
1210 - "w": 4,
1211 - "x": 0,
1212 - "y": 14
1213 - },
1214 - "id": 69,
1215 - "links": [],
1216 - "options": {
1217 - "colorMode": "value",
1218 - "graphMode": "area",
1219 - "justifyMode": "auto",
1220 - "orientation": "horizontal",
1221 - "reduceOptions": {
1222 - "calcs": [
1223 - "sum"
1224 - ],
1225 - "fields": "",
1226 - "values": false
1227 - },
1228 - "text": {},
1229 - "textMode": "auto"
1230 - },
1231 - "pluginVersion": "9.3.6",
1232 - "targets": [
1233 - {
1234 - "bucketAggs": [
1235 - {
1236 - "$$hashKey": "object:331",
1237 - "field": "timestamp",
1238 - "id": "2",
1239 - "settings": {
1240 - "interval": "auto",
1241 - "min_doc_count": 0,
1242 - "trimEdges": 0
1243 - },
1244 - "type": "date_histogram"
1245 - }
1246 - ],
1247 - "datasource": {
1248 - "type": "elasticsearch",
1249 - "uid": "replace_datasource_uid"
1250 - },
1251 - "metrics": [
1252 - {
1253 - "$$hashKey": "object:329",
1254 - "field": "select field",
1255 - "id": "1",
1256 - "type": "count"
1257 - }
1258 - ],
1259 - "query": "data_office365_Operation:UserLoggedIn AND (data_office365_UserId:*#EXT# OR data_office365_UserId:*gmail.com)",
1260 - "refId": "A",
1261 - "timeField": "timestamp"
1262 - }
1263 - ],
1264 - "title": "EXTERNAL USERS LOGIN (Total)",
1265 - "type": "stat"
1266 - },
1267 - {
1268 - "datasource": {
1269 - "type": "elasticsearch",
1270 - "uid": "replace_datasource_uid"
1271 - },
1272 - "fieldConfig": {
1273 - "defaults": {
1274 - "color": {
1275 - "mode": "thresholds"
1276 - },
1277 - "custom": {
1278 - "align": "auto",
1279 - "displayMode": "auto",
1280 - "inspect": false
1281 - },
1282 - "mappings": [],
1283 - "thresholds": {
1284 - "mode": "absolute",
1285 - "steps": [
1286 - {
1287 - "color": "red",
1288 - "value": null
1289 - }
1290 - ]
1291 - }
1292 - },
1293 - "overrides": [
1294 - {
1295 - "matcher": {
1296 - "id": "byName",
1297 - "options": "Count"
1298 - },
1299 - "properties": [
1300 - {
1301 - "id": "displayName",
1302 - "value": "EVENTS"
1303 - },
1304 - {
1305 - "id": "unit",
1306 - "value": "short"
1307 - },
1308 - {
1309 - "id": "decimals",
1310 - "value": -1
1311 - },
1312 - {
1313 - "id": "custom.align"
1314 - },
1315 - {
1316 - "id": "thresholds",
1317 - "value": {
1318 - "mode": "absolute",
1319 - "steps": [
1320 - {
1321 - "color": "red",
1322 - "value": null
1323 - }
1324 - ]
1325 - }
1326 - }
1327 - ]
1328 - },
1329 - {
1330 - "matcher": {
1331 - "id": "byName",
1332 - "options": "data_office365_ResultStatus"
1333 - },
1334 - "properties": [
1335 - {
1336 - "id": "custom.displayMode",
1337 - "value": "color-text"
1338 - },
1339 - {
1340 - "id": "mappings",
1341 - "value": [
1342 - {
1343 - "options": {
1344 - "Failure": {
1345 - "color": "orange",
1346 - "index": 0
1347 - }
1348 - },
1349 - "type": "value"
1350 - }
1351 - ]
1352 - }
1353 - ]
1354 - }
1355 - ]
1356 - },
1357 - "gridPos": {
1358 - "h": 7,
1359 - "w": 5,
1360 - "x": 4,
1361 - "y": 14
1362 - },
1363 - "id": 70,
1364 - "options": {
1365 - "footer": {
1366 - "fields": "",
1367 - "reducer": [
1368 - "sum"
1369 - ],
1370 - "show": false
1371 - },
1372 - "showHeader": true
1373 - },
1374 - "pluginVersion": "9.3.6",
1375 - "targets": [
1376 - {
1377 - "bucketAggs": [
1378 - {
1379 - "fake": true,
1380 - "field": "data_office365_ResultStatus",
1381 - "id": "4",
1382 - "settings": {
1383 - "min_doc_count": 1,
1384 - "order": "desc",
1385 - "orderBy": "_count",
1386 - "size": "0"
1387 - },
1388 - "type": "terms"
1389 - }
1390 - ],
1391 - "datasource": {
1392 - "type": "elasticsearch",
1393 - "uid": "replace_datasource_uid"
1394 - },
1395 - "metrics": [
1396 - {
1397 - "field": "select field",
1398 - "id": "1",
1399 - "type": "count"
1400 - }
1401 - ],
1402 - "query": "data_office365_Operation:UserLoggedIn AND (data_office365_UserId:*#EXT# OR data_office365_UserId:*gmail.com) AND rule_level:$rule_level",
1403 - "refId": "A",
1404 - "timeField": "timestamp"
1405 - }
1406 - ],
1407 - "title": "EXTERNAL USERS LOGIN (Results)",
1408 - "transformations": [
1409 - {
1410 - "id": "merge",
1411 - "options": {
1412 - "reducers": []
1413 - }
1414 - },
1415 - {
1416 - "id": "organize",
1417 - "options": {
1418 - "excludeByName": {},
1419 - "indexByName": {},
1420 - "renameByName": {
1421 - "Count": "EVENTS",
1422 - "data_office365_Operation": "OPERATION",
1423 - "data_office365_ResultStatus": "RESULT"
1424 - }
1425 - }
1426 - }
1427 - ],
1428 - "type": "table"
1429 - },
1430 - {
1431 - "datasource": {
1432 - "type": "elasticsearch",
1433 - "uid": "replace_datasource_uid"
1434 - },
1435 - "fieldConfig": {
1436 - "defaults": {
1437 - "color": {
1438 - "mode": "thresholds"
1439 - },
1440 - "custom": {
1441 - "align": "auto",
1442 - "displayMode": "auto",
1443 - "inspect": false
1444 - },
1445 - "mappings": [],
1446 - "thresholds": {
1447 - "mode": "absolute",
1448 - "steps": [
1449 - {
1450 - "color": "red",
1451 - "value": null
1452 - }
1453 - ]
1454 - }
1455 - },
1456 - "overrides": [
1457 - {
1458 - "matcher": {
1459 - "id": "byName",
1460 - "options": "Count"
1461 - },
1462 - "properties": [
1463 - {
1464 - "id": "displayName",
1465 - "value": "EVENTS"
1466 - },
1467 - {
1468 - "id": "unit",
1469 - "value": "short"
1470 - },
1471 - {
1472 - "id": "decimals",
1473 - "value": -1
1474 - },
1475 - {
1476 - "id": "custom.align"
1477 - },
1478 - {
1479 - "id": "thresholds",
1480 - "value": {
1481 - "mode": "absolute",
1482 - "steps": [
1483 - {
1484 - "color": "red",
1485 - "value": null
1486 - }
1487 - ]
1488 - }
1489 - }
1490 - ]
1491 - },
1492 - {
1493 - "matcher": {
1494 - "id": "byName",
1495 - "options": "RESULT"
1496 - },
1497 - "properties": [
1498 - {
1499 - "id": "custom.displayMode",
1500 - "value": "color-text"
1501 - },
1502 - {
1503 - "id": "mappings",
1504 - "value": [
1505 - {
1506 - "options": {
1507 - "Failure": {
1508 - "color": "orange",
1509 - "index": 0
1510 - }
1511 - },
1512 - "type": "value"
1513 - }
1514 - ]
1515 - }
1516 - ]
1517 - }
1518 - ]
1519 - },
1520 - "gridPos": {
1521 - "h": 7,
1522 - "w": 6,
1523 - "x": 9,
1524 - "y": 14
1525 - },
1526 - "id": 71,
1527 - "options": {
1528 - "footer": {
1529 - "fields": "",
1530 - "reducer": [
1531 - "sum"
1532 - ],
1533 - "show": false
1534 - },
1535 - "showHeader": true
1536 - },
1537 - "pluginVersion": "9.3.6",
1538 - "targets": [
1539 - {
1540 - "bucketAggs": [
1541 - {
1542 - "fake": true,
1543 - "field": "data_office365_UserId",
1544 - "id": "4",
1545 - "settings": {
1546 - "min_doc_count": 1,
1547 - "order": "desc",
1548 - "orderBy": "_count",
1549 - "size": "0"
1550 - },
1551 - "type": "terms"
1552 - },
1553 - {
1554 - "field": "data_office365_ResultStatus",
1555 - "id": "5",
1556 - "settings": {
1557 - "min_doc_count": "1",
1558 - "order": "desc",
1559 - "orderBy": "_count",
1560 - "size": "10"
1561 - },
1562 - "type": "terms"
1563 - }
1564 - ],
1565 - "datasource": {
1566 - "type": "elasticsearch",
1567 - "uid": "replace_datasource_uid"
1568 - },
1569 - "metrics": [
1570 - {
1571 - "field": "select field",
1572 - "id": "1",
1573 - "type": "count"
1574 - }
1575 - ],
1576 - "query": "data_office365_Operation:UserLoggedIn AND (data_office365_UserId:*#EXT# OR data_office365_UserId:*gmail.com) AND rule_level:$rule_level",
1577 - "refId": "A",
1578 - "timeField": "timestamp"
1579 - }
1580 - ],
1581 - "title": "EXTERNAL USERS LOGIN (Accounts)",
1582 - "transformations": [
1583 - {
1584 - "id": "merge",
1585 - "options": {
1586 - "reducers": []
1587 - }
1588 - },
1589 - {
1590 - "id": "organize",
1591 - "options": {
1592 - "excludeByName": {},
1593 - "indexByName": {},
1594 - "renameByName": {
1595 - "Count": "EVENTS",
1596 - "data_office365_ObjectId": "ACCOUNT",
1597 - "data_office365_Operation": "OPERATION",
1598 - "data_office365_ResultStatus": "RESULT",
1599 - "data_office365_UserId": "ACCOUNT"
1600 - }
1601 - }
1602 - }
1603 - ],
1604 - "type": "table"
1605 - },
1606 - {
1607 - "datasource": {
1608 - "type": "elasticsearch",
1609 - "uid": "replace_datasource_uid"
1610 - },
1611 - "fieldConfig": {
1612 - "defaults": {
1613 - "mappings": [
1614 - {
1615 - "options": {
1616 - "match": "null",
1617 - "result": {
1618 - "text": "N/A"
1619 - }
1620 - },
1621 - "type": "special"
1622 - }
1623 - ],
1624 - "thresholds": {
1625 - "mode": "absolute",
1626 - "steps": [
1627 - {
1628 - "color": "orange",
1629 - "value": null
1630 - }
1631 - ]
1632 - },
1633 - "unit": "locale"
1634 - },
1635 - "overrides": []
1636 - },
1637 - "gridPos": {
1638 - "h": 7,
1639 - "w": 4,
1640 - "x": 15,
1641 - "y": 14
1642 - },
1643 - "id": 73,
1644 - "links": [],
1645 - "options": {
1646 - "colorMode": "value",
1647 - "graphMode": "area",
1648 - "justifyMode": "auto",
1649 - "orientation": "horizontal",
1650 - "reduceOptions": {
1651 - "calcs": [
1652 - "sum"
1653 - ],
1654 - "fields": "",
1655 - "values": false
1656 - },
1657 - "text": {},
1658 - "textMode": "auto"
1659 - },
1660 - "pluginVersion": "9.3.6",
1661 - "targets": [
1662 - {
1663 - "bucketAggs": [
1664 - {
1665 - "$$hashKey": "object:331",
1666 - "field": "timestamp",
1667 - "id": "2",
1668 - "settings": {
1669 - "interval": "auto",
1670 - "min_doc_count": 0,
1671 - "trimEdges": 0
1672 - },
1673 - "type": "date_histogram"
1674 - }
1675 - ],
1676 - "datasource": {
1677 - "type": "elasticsearch",
1678 - "uid": "replace_datasource_uid"
1679 - },
1680 - "metrics": [
1681 - {
1682 - "$$hashKey": "object:329",
1683 - "field": "select field",
1684 - "id": "1",
1685 - "type": "count"
1686 - }
1687 - ],
1688 - "query": "data_office365_Operation:UserLoggedIn AND data_office365_ResultStatus:Success AND data_office365_ExtendedProperties_UserAuthenticationMethod:1",
1689 - "refId": "A",
1690 - "timeField": "timestamp"
1691 - }
1692 - ],
1693 - "title": "USERS LOGGEDIN NON MFA (Total)",
1694 - "type": "stat"
1695 - },
1696 - {
1697 - "datasource": {
1698 - "type": "elasticsearch",
1699 - "uid": "replace_datasource_uid"
1700 - },
1701 - "fieldConfig": {
1702 - "defaults": {
1703 - "color": {
1704 - "mode": "thresholds"
1705 - },
1706 - "custom": {
1707 - "align": "auto",
1708 - "displayMode": "auto",
1709 - "inspect": false
1710 - },
1711 - "mappings": [],
1712 - "thresholds": {
1713 - "mode": "absolute",
1714 - "steps": [
1715 - {
1716 - "color": "red",
1717 - "value": null
1718 - }
1719 - ]
1720 - }
1721 - },
1722 - "overrides": [
1723 - {
1724 - "matcher": {
1725 - "id": "byName",
1726 - "options": "Count"
1727 - },
1728 - "properties": [
1729 - {
1730 - "id": "displayName",
1731 - "value": "EVENTS"
1732 - },
1733 - {
1734 - "id": "unit",
1735 - "value": "short"
1736 - },
1737 - {
1738 - "id": "decimals",
1739 - "value": -1
1740 - },
1741 - {
1742 - "id": "custom.align"
1743 - },
1744 - {
1745 - "id": "thresholds",
1746 - "value": {
1747 - "mode": "absolute",
1748 - "steps": [
1749 - {
1750 - "color": "red",
1751 - "value": null
1752 - }
1753 - ]
1754 - }
1755 - }
1756 - ]
1757 - },
1758 - {
1759 - "matcher": {
1760 - "id": "byName",
1761 - "options": "RESULT"
1762 - },
1763 - "properties": [
1764 - {
1765 - "id": "custom.displayMode",
1766 - "value": "color-text"
1767 - },
1768 - {
1769 - "id": "mappings",
1770 - "value": [
1771 - {
1772 - "options": {
1773 - "Success": {
1774 - "color": "orange",
1775 - "index": 0
1776 - }
1777 - },
1778 - "type": "value"
1779 - }
1780 - ]
1781 - }
1782 - ]
1783 - }
1784 - ]
1785 - },
1786 - "gridPos": {
1787 - "h": 7,
1788 - "w": 5,
1789 - "x": 19,
1790 - "y": 14
1791 - },
1792 - "id": 74,
1793 - "options": {
1794 - "footer": {
1795 - "fields": "",
1796 - "reducer": [
1797 - "sum"
1798 - ],
1799 - "show": false
1800 - },
1801 - "showHeader": true
1802 - },
1803 - "pluginVersion": "9.3.6",
1804 - "targets": [
1805 - {
1806 - "bucketAggs": [
1807 - {
1808 - "fake": true,
1809 - "field": "data_office365_UserId",
1810 - "id": "4",
1811 - "settings": {
1812 - "min_doc_count": 1,
1813 - "order": "desc",
1814 - "orderBy": "_count",
1815 - "size": "0"
1816 - },
1817 - "type": "terms"
1818 - },
1819 - {
1820 - "field": "data_office365_ResultStatus",
1821 - "id": "5",
1822 - "settings": {
1823 - "min_doc_count": "1",
1824 - "order": "desc",
1825 - "orderBy": "_count",
1826 - "size": "10"
1827 - },
1828 - "type": "terms"
1829 - }
1830 - ],
1831 - "datasource": {
1832 - "type": "elasticsearch",
1833 - "uid": "replace_datasource_uid"
1834 - },
1835 - "metrics": [
1836 - {
1837 - "field": "select field",
1838 - "id": "1",
1839 - "type": "count"
1840 - }
1841 - ],
1842 - "query": "data_office365_Operation:UserLoggedIn AND data_office365_ResultStatus:Success AND data_office365_ExtendedProperties_UserAuthenticationMethod:1",
1843 - "refId": "A",
1844 - "timeField": "timestamp"
1845 - }
1846 - ],
1847 - "title": "USERS LOGGEDIN NON MFA (Accounts)",
1848 - "transformations": [
1849 - {
1850 - "id": "merge",
1851 - "options": {
1852 - "reducers": []
1853 - }
1854 - },
1855 - {
1856 - "id": "organize",
1857 - "options": {
1858 - "excludeByName": {},
1859 - "indexByName": {},
1860 - "renameByName": {
1861 - "Count": "EVENTS",
1862 - "data_office365_ObjectId": "ACCOUNT",
1863 - "data_office365_Operation": "OPERATION",
1864 - "data_office365_ResultStatus": "RESULT",
1865 - "data_office365_UserId": "ACCOUNT"
1866 - }
1867 - }
1868 - }
1869 - ],
1870 - "type": "table"
1871 - },
1872 - {
1873 - "datasource": {
1874 - "type": "elasticsearch",
1875 - "uid": "replace_datasource_uid"
1876 - },
1877 - "fieldConfig": {
1878 - "defaults": {
1879 - "mappings": [
1880 - {
1881 - "options": {
1882 - "match": "null",
1883 - "result": {
1884 - "text": "N/A"
1885 - }
1886 - },
1887 - "type": "special"
1888 - }
1889 - ],
1890 - "thresholds": {
1891 - "mode": "absolute",
1892 - "steps": [
1893 - {
1894 - "color": "orange",
1895 - "value": null
1896 - }
1897 - ]
1898 - },
1899 - "unit": "locale"
1900 - },
1901 - "overrides": []
1902 - },
1903 - "gridPos": {
1904 - "h": 7,
1905 - "w": 4,
1906 - "x": 0,
1907 - "y": 21
1908 - },
1909 - "id": 61,
1910 - "links": [],
1911 - "options": {
1912 - "colorMode": "value",
1913 - "graphMode": "area",
1914 - "justifyMode": "auto",
1915 - "orientation": "horizontal",
1916 - "reduceOptions": {
1917 - "calcs": [
1918 - "sum"
1919 - ],
1920 - "fields": "",
1921 - "values": false
1922 - },
1923 - "text": {},
1924 - "textMode": "auto"
1925 - },
1926 - "pluginVersion": "9.3.6",
1927 - "targets": [
1928 - {
1929 - "bucketAggs": [
1930 - {
1931 - "field": "timestamp",
1932 - "id": "2",
1933 - "settings": {
1934 - "interval": "auto",
1935 - "min_doc_count": 0,
1936 - "trimEdges": 0
1937 - },
1938 - "type": "date_histogram"
1939 - }
1940 - ],
1941 - "datasource": {
1942 - "type": "elasticsearch",
1943 - "uid": "replace_datasource_uid"
1944 - },
1945 - "metrics": [
1946 - {
1947 - "field": "select field",
1948 - "id": "1",
1949 - "type": "count"
1950 - }
1951 - ],
1952 - "query": "data_office365_Operation:UserLoggedIn AND !data_office365_ActorIpAddress_country_code:COMPANY_COUNTRY_CODE",
1953 - "refId": "A",
1954 - "timeField": "timestamp"
1955 - }
1956 - ],
1957 - "title": "AUTHS NON TRUSTED SOURCE",
1958 - "type": "stat"
1959 - },
1960 - {
1961 - "circleMaxSize": 30,
1962 - "circleMinSize": 2,
1963 - "colors": [
1964 - "rgba(245, 54, 54, 0.9)",
1965 - "rgba(237, 129, 40, 0.89)",
1966 - "rgba(50, 172, 45, 0.97)"
1967 - ],
1968 - "datasource": {
1969 - "type": "elasticsearch",
1970 - "uid": "replace_datasource_uid"
1971 - },
1972 - "decimals": 0,
1973 - "esMetric": "Count",
1974 - "gridPos": {
1975 - "h": 14,
1976 - "w": 10,
1977 - "x": 4,
1978 - "y": 21
1979 - },
1980 - "hideEmpty": false,
1981 - "hideZero": false,
1982 - "id": 62,
1983 - "initialZoom": 1,
1984 - "locationData": "countries",
1985 - "mapCenter": "(0°, 0°)",
1986 - "mapCenterLatitude": 0,
1987 - "mapCenterLongitude": 0,
1988 - "maxDataPoints": 1,
1989 - "mouseWheelZoom": false,
1990 - "showLegend": true,
1991 - "stickyLabels": false,
1992 - "tableQueryOptions": {
1993 - "geohashField": "geohash",
1994 - "latitudeField": "latitude",
1995 - "longitudeField": "longitude",
1996 - "metricField": "metric",
1997 - "queryType": "geohash"
1998 - },
1999 - "targets": [
2000 - {
2001 - "bucketAggs": [
2002 - {
2003 - "fake": true,
2004 - "field": "data_office365_ActorIpAddress_country_code",
2005 - "id": "3",
2006 - "settings": {
2007 - "min_doc_count": 1,
2008 - "order": "desc",
2009 - "orderBy": "_term",
2010 - "size": "0"
2011 - },
2012 - "type": "terms"
2013 - },
2014 - {
2015 - "field": "timestamp",
2016 - "id": "2",
2017 - "settings": {
2018 - "interval": "auto",
2019 - "min_doc_count": 0,
2020 - "trimEdges": 0
2021 - },
2022 - "type": "date_histogram"
2023 - }
2024 - ],
2025 - "datasource": {
2026 - "type": "elasticsearch",
2027 - "uid": "replace_datasource_uid"
2028 - },
2029 - "metrics": [
2030 - {
2031 - "field": "select field",
2032 - "id": "1",
2033 - "type": "count"
2034 - }
2035 - ],
2036 - "query": "data_office365_Operation:UserLoggedIn AND !data_office365_ActorIpAddress_country_code:COMPANY_COUNTRY_CODE",
2037 - "refId": "A",
2038 - "timeField": "timestamp"
2039 - }
2040 - ],
2041 - "thresholds": "0,10",
2042 - "title": "AUTHS NON TRUSTED SOURCE BY COUNTRY",
2043 - "type": "grafana-worldmap-panel",
2044 - "unitPlural": "",
2045 - "unitSingle": "",
2046 - "valueName": "total"
2047 - },
2048 - {
2049 - "datasource": {
2050 - "type": "elasticsearch",
2051 - "uid": "replace_datasource_uid"
2052 - },
2053 - "fieldConfig": {
2054 - "defaults": {
2055 - "color": {
2056 - "mode": "thresholds"
2057 - },
2058 - "custom": {
2059 - "align": "auto",
2060 - "displayMode": "auto",
2061 - "inspect": false
2062 - },
2063 - "mappings": [],
2064 - "thresholds": {
2065 - "mode": "absolute",
2066 - "steps": [
2067 - {
2068 - "color": "orange",
2069 - "value": null
2070 - }
2071 - ]
2072 - }
2073 - },
2074 - "overrides": [
2075 - {
2076 - "matcher": {
2077 - "id": "byName",
2078 - "options": "Count"
2079 - },
2080 - "properties": [
2081 - {
2082 - "id": "displayName",
2083 - "value": "EVENTS"
2084 - },
2085 - {
2086 - "id": "unit",
2087 - "value": "short"
2088 - },
2089 - {
2090 - "id": "decimals",
2091 - "value": -1
2092 - },
2093 - {
2094 - "id": "custom.align"
2095 - },
2096 - {
2097 - "id": "custom.displayMode",
2098 - "value": "color-text"
2099 - }
2100 - ]
2101 - },
2102 - {
2103 - "matcher": {
2104 - "id": "byName",
2105 - "options": "AD ACCOUNT"
2106 - },
2107 - "properties": [
2108 - {
2109 - "id": "custom.width",
2110 - "value": 377
2111 - },
2112 - {
2113 - "id": "custom.displayMode",
2114 - "value": "color-text"
2115 - }
2116 - ]
2117 - },
2118 - {
2119 - "matcher": {
2120 - "id": "byName",
2121 - "options": "SRC IP"
2122 - },
2123 - "properties": [
2124 - {
2125 - "id": "custom.width",
2126 - "value": 166
2127 - },
2128 - {
2129 - "id": "custom.displayMode",
2130 - "value": "color-text"
2131 - }
2132 - ]
2133 - },
2134 - {
2135 - "matcher": {
2136 - "id": "byName",
2137 - "options": "COUNTRY"
2138 - },
2139 - "properties": [
2140 - {
2141 - "id": "custom.displayMode",
2142 - "value": "color-text"
2143 - }
2144 - ]
2145 - }
2146 - ]
2147 - },
2148 - "gridPos": {
2149 - "h": 14,
2150 - "w": 10,
2151 - "x": 14,
2152 - "y": 21
2153 - },
2154 - "id": 63,
2155 - "options": {
2156 - "footer": {
2157 - "fields": "",
2158 - "reducer": [
2159 - "sum"
2160 - ],
2161 - "show": false
2162 - },
2163 - "showHeader": true,
2164 - "sortBy": []
2165 - },
2166 - "pluginVersion": "9.3.6",
2167 - "targets": [
2168 - {
2169 - "bucketAggs": [
2170 - {
2171 - "fake": true,
2172 - "field": "data_office365_UserId",
2173 - "id": "4",
2174 - "settings": {
2175 - "min_doc_count": 1,
2176 - "order": "desc",
2177 - "orderBy": "_count",
2178 - "size": "0"
2179 - },
2180 - "type": "terms"
2181 - },
2182 - {
2183 - "field": "data_office365_ActorIpAddress",
2184 - "id": "5",
2185 - "settings": {
2186 - "min_doc_count": "1",
2187 - "order": "desc",
2188 - "orderBy": "_term",
2189 - "size": "10"
2190 - },
2191 - "type": "terms"
2192 - },
2193 - {
2194 - "field": "data_office365_ActorIpAddress_country_code",
2195 - "id": "6",
2196 - "settings": {
2197 - "min_doc_count": "1",
2198 - "order": "desc",
2199 - "orderBy": "_term",
2200 - "size": "10"
2201 - },
2202 - "type": "terms"
2203 - }
2204 - ],
2205 - "datasource": {
2206 - "type": "elasticsearch",
2207 - "uid": "replace_datasource_uid"
2208 - },
2209 - "metrics": [
2210 - {
2211 - "field": "select field",
2212 - "id": "1",
2213 - "type": "count"
2214 - }
2215 - ],
2216 - "query": "data_office365_Operation:UserLoggedIn AND !data_office365_ActorIpAddress_country_code:COMPANY_COUNTRY_CODE",
2217 - "refId": "A",
2218 - "timeField": "timestamp"
2219 - }
2220 - ],
2221 - "title": "AUTHS NON TRUSTED SOURCE BY ACCOUNT",
2222 - "transformations": [
2223 - {
2224 - "id": "merge",
2225 - "options": {
2226 - "reducers": []
2227 - }
2228 - },
2229 - {
2230 - "id": "organize",
2231 - "options": {
2232 - "excludeByName": {},
2233 - "indexByName": {},
2234 - "renameByName": {
2235 - "Count": "AUTH EVENTS",
2236 - "data_office365_ActorIpAddress": "SRC IP",
2237 - "data_office365_ActorIpAddress_country_code": "COUNTRY",
2238 - "data_office365_LogonError": "ERROR",
2239 - "data_office365_Operation": "WORKLOAD",
2240 - "data_office365_UserId": "AD ACCOUNT"
2241 - }
2242 - }
2243 - }
2244 - ],
2245 - "type": "table"
2246 - },
2247 - {
2248 - "datasource": {
2249 - "type": "elasticsearch",
2250 - "uid": "replace_datasource_uid"
2251 - },
2252 - "fieldConfig": {
2253 - "defaults": {
2254 - "mappings": [
2255 - {
2256 - "options": {
2257 - "match": "null",
2258 - "result": {
2259 - "text": "N/A"
2260 - }
2261 - },
2262 - "type": "special"
2263 - }
2264 - ],
2265 - "thresholds": {
2266 - "mode": "absolute",
2267 - "steps": [
2268 - {
2269 - "color": "orange",
2270 - "value": null
2271 - }
2272 - ]
2273 - },
2274 - "unit": "locale"
2275 - },
2276 - "overrides": []
2277 - },
2278 - "gridPos": {
2279 - "h": 7,
2280 - "w": 4,
2281 - "x": 0,
2282 - "y": 28
2283 - },
2284 - "id": 64,
2285 - "links": [],
2286 - "options": {
2287 - "colorMode": "value",
2288 - "graphMode": "area",
2289 - "justifyMode": "auto",
2290 - "orientation": "horizontal",
2291 - "reduceOptions": {
2292 - "calcs": [
2293 - "sum"
2294 - ],
2295 - "fields": "",
2296 - "values": false
2297 - },
2298 - "text": {},
2299 - "textMode": "auto"
2300 - },
2301 - "pluginVersion": "9.3.6",
2302 - "targets": [
2303 - {
2304 - "bucketAggs": [
2305 - {
2306 - "field": "timestamp",
2307 - "id": "2",
2308 - "settings": {
2309 - "interval": "365d",
2310 - "min_doc_count": 0,
2311 - "trimEdges": 0
2312 - },
2313 - "type": "date_histogram"
2314 - }
2315 - ],
2316 - "datasource": {
2317 - "type": "elasticsearch",
2318 - "uid": "replace_datasource_uid"
2319 - },
2320 - "metrics": [
2321 - {
2322 - "field": "data_office365_UserId",
2323 - "id": "1",
2324 - "type": "cardinality"
2325 - }
2326 - ],
2327 - "query": "data_office365_Operation:UserLoggedIn AND !data_office365_ActorIpAddress_country_code:COMPANY_COUNTRY_CODE",
2328 - "refId": "A",
2329 - "timeField": "timestamp"
2330 - }
2331 - ],
2332 - "title": "AUTHS NON TRUSTED - ACCOUNTS",
2333 - "type": "stat"
2334 - },
2335 - {
2336 - "datasource": {
2337 - "type": "elasticsearch",
2338 - "uid": "replace_datasource_uid"
2339 - },
2340 - "fieldConfig": {
2341 - "defaults": {
2342 - "color": {
2343 - "mode": "thresholds"
2344 - },
2345 - "mappings": [
2346 - {
2347 - "options": {
2348 - "match": "null",
2349 - "result": {
2350 - "text": "N/A"
2351 - }
2352 - },
2353 - "type": "special"
2354 - }
2355 - ],
2356 - "max": 15,
2357 - "min": 0,
2358 - "thresholds": {
2359 - "mode": "absolute",
2360 - "steps": [
2361 - {
2362 - "color": "#299c46",
2363 - "value": null
2364 - },
2365 - {
2366 - "color": "rgba(237, 129, 40, 0.89)",
2367 - "value": 8
2368 - },
2369 - {
2370 - "color": "#d44a3a",
2371 - "value": 12
2372 - }
2373 - ]
2374 - },
2375 - "unit": "none"
2376 - },
2377 - "overrides": []
2378 - },
2379 - "gridPos": {
2380 - "h": 7,
2381 - "w": 4,
2382 - "x": 0,
2383 - "y": 35
2384 - },
2385 - "id": 16,
2386 - "links": [],
2387 - "options": {
2388 - "orientation": "horizontal",
2389 - "reduceOptions": {
2390 - "calcs": [
2391 - "max"
2392 - ],
2393 - "fields": "",
2394 - "values": false
2395 - },
2396 - "showThresholdLabels": false,
2397 - "showThresholdMarkers": true,
2398 - "text": {}
2399 - },
2400 - "pluginVersion": "9.3.6",
2401 - "targets": [
2402 - {
2403 - "bucketAggs": [
2404 - {
2405 - "field": "timestamp",
2406 - "id": "2",
2407 - "settings": {
2408 - "interval": "auto",
2409 - "min_doc_count": 0,
2410 - "trimEdges": 0
2411 - },
2412 - "type": "date_histogram"
2413 - }
2414 - ],
2415 - "datasource": {
2416 - "type": "elasticsearch",
2417 - "uid": "replace_datasource_uid"
2418 - },
2419 - "metrics": [
2420 - {
2421 - "field": "rule_level",
2422 - "id": "1",
2423 - "meta": {},
2424 - "settings": {},
2425 - "type": "max"
2426 - }
2427 - ],
2428 - "query": "data_office365_Operation:$operation",
2429 - "refId": "A",
2430 - "timeField": "timestamp"
2431 - }
2432 - ],
2433 - "title": "MAX SEVERITY (0 - 15)",
2434 - "type": "gauge"
2435 - },
2436 - {
2437 - "datasource": {
2438 - "type": "elasticsearch",
2439 - "uid": "replace_datasource_uid"
2440 - },
2441 - "fieldConfig": {
2442 - "defaults": {
2443 - "color": {
2444 - "mode": "palette-classic"
2445 - },
2446 - "custom": {
2447 - "axisCenteredZero": false,
2448 - "axisColorMode": "text",
2449 - "axisLabel": "",
2450 - "axisPlacement": "auto",
2451 - "barAlignment": 0,
2452 - "drawStyle": "bars",
2453 - "fillOpacity": 0,
2454 - "gradientMode": "none",
2455 - "hideFrom": {
2456 - "legend": false,
2457 - "tooltip": false,
2458 - "viz": false
2459 - },
2460 - "lineInterpolation": "linear",
2461 - "lineWidth": 1,
2462 - "pointSize": 5,
2463 - "scaleDistribution": {
2464 - "type": "linear"
2465 - },
2466 - "showPoints": "auto",
2467 - "spanNulls": false,
2468 - "stacking": {
2469 - "group": "A",
2470 - "mode": "none"
2471 - },
2472 - "thresholdsStyle": {
2473 - "mode": "off"
2474 - }
2475 - },
2476 - "mappings": [],
2477 - "thresholds": {
2478 - "mode": "absolute",
2479 - "steps": [
2480 - {
2481 - "color": "green",
2482 - "value": null
2483 - },
2484 - {
2485 - "color": "red",
2486 - "value": 80
2487 - }
2488 - ]
2489 - }
2490 - },
2491 - "overrides": []
2492 - },
2493 - "gridPos": {
2494 - "h": 13,
2495 - "w": 20,
2496 - "x": 4,
2497 - "y": 35
2498 - },
2499 - "id": 76,
2500 - "options": {
2501 - "legend": {
2502 - "calcs": [],
2503 - "displayMode": "table",
2504 - "placement": "right",
2505 - "showLegend": true
2506 - },
2507 - "tooltip": {
2508 - "mode": "single",
2509 - "sort": "none"
2510 - }
2511 - },
2512 - "targets": [
2513 - {
2514 - "alias": "",
2515 - "bucketAggs": [
2516 - {
2517 - "field": "data_office365_Operation",
2518 - "id": "3",
2519 - "settings": {
2520 - "min_doc_count": "1",
2521 - "order": "desc",
2522 - "orderBy": "_count",
2523 - "size": "10"
2524 - },
2525 - "type": "terms"
2526 - },
2527 - {
2528 - "field": "data_office365_CreationTime",
2529 - "id": "2",
2530 - "settings": {
2531 - "interval": "5m"
2532 - },
2533 - "type": "date_histogram"
2534 - }
2535 - ],
2536 - "datasource": {
2537 - "type": "elasticsearch",
2538 - "uid": "replace_datasource_uid"
2539 - },
2540 - "metrics": [
2541 - {
2542 - "id": "1",
2543 - "type": "count"
2544 - }
2545 - ],
2546 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
2547 - "refId": "A",
2548 - "timeField": "timestamp"
2549 - }
2550 - ],
2551 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
2552 - "transparent": true,
2553 - "type": "timeseries"
2554 - },
2555 - {
2556 - "datasource": {
2557 - "type": "elasticsearch",
2558 - "uid": "replace_datasource_uid"
2559 - },
2560 - "fieldConfig": {
2561 - "defaults": {
2562 - "mappings": [
2563 - {
2564 - "options": {
2565 - "match": "null",
2566 - "result": {
2567 - "text": "N/A"
2568 - }
2569 - },
2570 - "type": "special"
2571 - }
2572 - ],
2573 - "thresholds": {
2574 - "mode": "absolute",
2575 - "steps": [
2576 - {
2577 - "color": "blue",
2578 - "value": null
2579 - }
2580 - ]
2581 - },
2582 - "unit": "locale"
2583 - },
2584 - "overrides": []
2585 - },
2586 - "gridPos": {
2587 - "h": 6,
2588 - "w": 4,
2589 - "x": 0,
2590 - "y": 42
2591 - },
2592 - "id": 51,
2593 - "links": [],
2594 - "options": {
2595 - "colorMode": "value",
2596 - "graphMode": "area",
2597 - "justifyMode": "auto",
2598 - "orientation": "horizontal",
2599 - "reduceOptions": {
2600 - "calcs": [
2601 - "sum"
2602 - ],
2603 - "fields": "",
2604 - "values": false
2605 - },
2606 - "text": {},
2607 - "textMode": "auto"
2608 - },
2609 - "pluginVersion": "9.3.6",
2610 - "targets": [
2611 - {
2612 - "bucketAggs": [
2613 - {
2614 - "$$hashKey": "object:331",
2615 - "field": "timestamp",
2616 - "id": "2",
2617 - "settings": {
2618 - "interval": "auto",
2619 - "min_doc_count": 0,
2620 - "trimEdges": 0
2621 - },
2622 - "type": "date_histogram"
2623 - }
2624 - ],
2625 - "datasource": {
2626 - "type": "elasticsearch",
2627 - "uid": "replace_datasource_uid"
2628 - },
2629 - "metrics": [
2630 - {
2631 - "$$hashKey": "object:329",
2632 - "field": "select field",
2633 - "id": "1",
2634 - "type": "count"
2635 - }
2636 - ],
2637 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
2638 - "refId": "A",
2639 - "timeField": "timestamp"
2640 - }
2641 - ],
2642 - "title": "EVENTS (Total)",
2643 - "type": "stat"
2644 - },
2645 - {
2646 - "datasource": {
2647 - "type": "elasticsearch",
2648 - "uid": "replace_datasource_uid"
2649 - },
2650 - "fieldConfig": {
2651 - "defaults": {
2652 - "mappings": [
2653 - {
2654 - "options": {
2655 - "match": "null",
2656 - "result": {
2657 - "text": "N/A"
2658 - }
2659 - },
2660 - "type": "special"
2661 - }
2662 - ],
2663 - "thresholds": {
2664 - "mode": "absolute",
2665 - "steps": [
2666 - {
2667 - "color": "red",
2668 - "value": null
2669 - }
2670 - ]
2671 - },
2672 - "unit": "locale"
2673 - },
2674 - "overrides": []
2675 - },
2676 - "gridPos": {
2677 - "h": 6,
2678 - "w": 4,
2679 - "x": 0,
2680 - "y": 48
2681 - },
2682 - "id": 52,
2683 - "links": [],
2684 - "options": {
2685 - "colorMode": "value",
2686 - "graphMode": "area",
2687 - "justifyMode": "auto",
2688 - "orientation": "horizontal",
2689 - "reduceOptions": {
2690 - "calcs": [
2691 - "sum"
2692 - ],
2693 - "fields": "",
2694 - "values": false
2695 - },
2696 - "text": {},
2697 - "textMode": "auto"
2698 - },
2699 - "pluginVersion": "9.3.6",
2700 - "targets": [
2701 - {
2702 - "bucketAggs": [
2703 - {
2704 - "$$hashKey": "object:331",
2705 - "field": "timestamp",
2706 - "id": "2",
2707 - "settings": {
2708 - "interval": "auto",
2709 - "min_doc_count": 0,
2710 - "trimEdges": 0
2711 - },
2712 - "type": "date_histogram"
2713 - }
2714 - ],
2715 - "datasource": {
2716 - "type": "elasticsearch",
2717 - "uid": "replace_datasource_uid"
2718 - },
2719 - "metrics": [
2720 - {
2721 - "$$hashKey": "object:329",
2722 - "field": "select field",
2723 - "id": "1",
2724 - "type": "count"
2725 - }
2726 - ],
2727 - "query": "data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
2728 - "refId": "A",
2729 - "timeField": "timestamp"
2730 - }
2731 - ],
2732 - "title": "AZURE AD - FAILED AUTHS",
2733 - "type": "stat"
2734 - },
2735 - {
2736 - "circleMaxSize": 30,
2737 - "circleMinSize": 2,
2738 - "colors": [
2739 - "rgba(245, 54, 54, 0.9)",
2740 - "rgba(237, 129, 40, 0.89)",
2741 - "rgba(50, 172, 45, 0.97)"
2742 - ],
2743 - "datasource": {
2744 - "type": "elasticsearch",
2745 - "uid": "replace_datasource_uid"
2746 - },
2747 - "decimals": 0,
2748 - "esMetric": "Count",
2749 - "gridPos": {
2750 - "h": 12,
2751 - "w": 10,
2752 - "x": 4,
2753 - "y": 48
2754 - },
2755 - "hideEmpty": false,
2756 - "hideZero": false,
2757 - "id": 50,
2758 - "initialZoom": 1,
2759 - "locationData": "countries",
2760 - "mapCenter": "(0°, 0°)",
2761 - "mapCenterLatitude": 0,
2762 - "mapCenterLongitude": 0,
2763 - "maxDataPoints": 1,
2764 - "mouseWheelZoom": false,
2765 - "showLegend": true,
2766 - "stickyLabels": false,
2767 - "tableQueryOptions": {
2768 - "geohashField": "geohash",
2769 - "latitudeField": "latitude",
2770 - "longitudeField": "longitude",
2771 - "metricField": "metric",
2772 - "queryType": "geohash"
2773 - },
2774 - "targets": [
2775 - {
2776 - "bucketAggs": [
2777 - {
2778 - "fake": true,
2779 - "field": "data_office365_ActorIpAddress_country_code",
2780 - "id": "3",
2781 - "settings": {
2782 - "min_doc_count": 1,
2783 - "order": "desc",
2784 - "orderBy": "_term",
2785 - "size": "0"
2786 - },
2787 - "type": "terms"
2788 - },
2789 - {
2790 - "field": "timestamp",
2791 - "id": "2",
2792 - "settings": {
2793 - "interval": "auto",
2794 - "min_doc_count": 0,
2795 - "trimEdges": 0
2796 - },
2797 - "type": "date_histogram"
2798 - }
2799 - ],
2800 - "datasource": {
2801 - "type": "elasticsearch",
2802 - "uid": "replace_datasource_uid"
2803 - },
2804 - "metrics": [
2805 - {
2806 - "field": "select field",
2807 - "id": "1",
2808 - "type": "count"
2809 - }
2810 - ],
2811 - "query": "data_office365_Workload:AzureActiveDirectory AND rule_level:$rule_level",
2812 - "refId": "A",
2813 - "timeField": "timestamp"
2814 - }
2815 - ],
2816 - "thresholds": "0,10",
2817 - "title": "AZURE AD - ALL AUTH EVENTS BY COUNTRY",
2818 - "type": "grafana-worldmap-panel",
2819 - "unitPlural": "",
2820 - "unitSingle": "",
2821 - "valueName": "total"
2822 - },
2823 - {
2824 - "datasource": {
2825 - "type": "elasticsearch",
2826 - "uid": "replace_datasource_uid"
2827 - },
2828 - "fieldConfig": {
2829 - "defaults": {
2830 - "color": {
2831 - "mode": "thresholds"
2832 - },
2833 - "custom": {
2834 - "align": "auto",
2835 - "displayMode": "auto",
2836 - "filterable": true,
2837 - "inspect": false
2838 - },
2839 - "mappings": [],
2840 - "thresholds": {
2841 - "mode": "absolute",
2842 - "steps": [
2843 - {
2844 - "color": "orange",
2845 - "value": null
2846 - }
2847 - ]
2848 - }
2849 - },
2850 - "overrides": [
2851 - {
2852 - "matcher": {
2853 - "id": "byName",
2854 - "options": "Count"
2855 - },
2856 - "properties": [
2857 - {
2858 - "id": "displayName",
2859 - "value": "EVENTS"
2860 - },
2861 - {
2862 - "id": "unit",
2863 - "value": "short"
2864 - },
2865 - {
2866 - "id": "decimals",
2867 - "value": -1
2868 - },
2869 - {
2870 - "id": "custom.align"
2871 - },
2872 - {
2873 - "id": "custom.displayMode",
2874 - "value": "color-text"
2875 - }
2876 - ]
2877 - },
2878 - {
2879 - "matcher": {
2880 - "id": "byName",
2881 - "options": "AD ACCOUNT"
2882 - },
2883 - "properties": [
2884 - {
2885 - "id": "custom.width",
2886 - "value": 377
2887 - },
2888 - {
2889 - "id": "custom.displayMode",
2890 - "value": "color-text"
2891 - }
2892 - ]
2893 - },
2894 - {
2895 - "matcher": {
2896 - "id": "byName",
2897 - "options": "data_office365_LogonError"
2898 - },
2899 - "properties": [
2900 - {
2901 - "id": "custom.width",
2902 - "value": 326
2903 - },
2904 - {
2905 - "id": "custom.displayMode",
2906 - "value": "color-text"
2907 - },
2908 - {
2909 - "id": "links",
2910 - "value": [
2911 - {
2912 - "targetBlank": true,
2913 - "title": "MICROSOFT LOGON ERROR",
2914 - "url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-aadsts-error-codes"
2915 - }
2916 - ]
2917 - }
2918 - ]
2919 - }
2920 - ]
2921 - },
2922 - "gridPos": {
2923 - "h": 32,
2924 - "w": 10,
2925 - "x": 14,
2926 - "y": 48
2927 - },
2928 - "id": 58,
2929 - "options": {
2930 - "footer": {
2931 - "fields": "",
2932 - "reducer": [
2933 - "sum"
2934 - ],
2935 - "show": false
2936 - },
2937 - "showHeader": true,
2938 - "sortBy": []
2939 - },
2940 - "pluginVersion": "9.3.6",
2941 - "targets": [
2942 - {
2943 - "bucketAggs": [
2944 - {
2945 - "fake": true,
2946 - "field": "data_office365_UserId",
2947 - "id": "4",
2948 - "settings": {
2949 - "min_doc_count": 1,
2950 - "order": "desc",
2951 - "orderBy": "_count",
2952 - "size": "0"
2953 - },
2954 - "type": "terms"
2955 - },
2956 - {
2957 - "field": "data_office365_LogonError",
2958 - "id": "5",
2959 - "settings": {
2960 - "min_doc_count": "1",
2961 - "order": "desc",
2962 - "orderBy": "_term",
2963 - "size": "10"
2964 - },
2965 - "type": "terms"
2966 - },
2967 - {
2968 - "field": "data_office365_ActorIpAddress_country_code",
2969 - "id": "6",
2970 - "settings": {
2971 - "min_doc_count": "1",
2972 - "order": "desc",
2973 - "orderBy": "1",
2974 - "size": "0"
2975 - },
2976 - "type": "terms"
2977 - }
2978 - ],
2979 - "datasource": {
2980 - "type": "elasticsearch",
2981 - "uid": "replace_datasource_uid"
2982 - },
2983 - "metrics": [
2984 - {
2985 - "field": "select field",
2986 - "id": "1",
2987 - "type": "count"
2988 - }
2989 - ],
2990 - "query": "data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
2991 - "refId": "A",
2992 - "timeField": "timestamp"
2993 - }
2994 - ],
2995 - "title": "FAILED AUTHS BY ACCOUNT AND ERROR",
2996 - "transformations": [
2997 - {
2998 - "id": "merge",
2999 - "options": {
3000 - "reducers": []
3001 - }
3002 - },
3003 - {
3004 - "id": "organize",
3005 - "options": {
3006 - "excludeByName": {},
3007 - "indexByName": {},
3008 - "renameByName": {
3009 - "Count": "EVENTS",
3010 - "data_office365_ActorIpAddress_country_code": "COUNTRY",
3011 - "data_office365_LogonError": "ERROR",
3012 - "data_office365_Operation": "WORKLOAD",
3013 - "data_office365_UserId": "AD ACCOUNT"
3014 - }
3015 - }
3016 - }
3017 - ],
3018 - "type": "table"
3019 - },
3020 - {
3021 - "datasource": {
3022 - "type": "elasticsearch",
3023 - "uid": "replace_datasource_uid"
3024 - },
3025 - "fieldConfig": {
3026 - "defaults": {
3027 - "mappings": [
3028 - {
3029 - "options": {
3030 - "match": "null",
3031 - "result": {
3032 - "text": "N/A"
3033 - }
3034 - },
3035 - "type": "special"
3036 - }
3037 - ],
3038 - "thresholds": {
3039 - "mode": "absolute",
3040 - "steps": [
3041 - {
3042 - "color": "blue",
3043 - "value": null
3044 - }
3045 - ]
3046 - },
3047 - "unit": "locale"
3048 - },
3049 - "overrides": []
3050 - },
3051 - "gridPos": {
3052 - "h": 6,
3053 - "w": 4,
3054 - "x": 0,
3055 - "y": 54
3056 - },
3057 - "id": 18,
3058 - "links": [],
3059 - "options": {
3060 - "colorMode": "value",
3061 - "graphMode": "area",
3062 - "justifyMode": "auto",
3063 - "orientation": "horizontal",
3064 - "reduceOptions": {
3065 - "calcs": [
3066 - "sum"
3067 - ],
3068 - "fields": "",
3069 - "values": false
3070 - },
3071 - "text": {},
3072 - "textMode": "auto"
3073 - },
3074 - "pluginVersion": "9.3.6",
3075 - "targets": [
3076 - {
3077 - "bucketAggs": [
3078 - {
3079 - "$$hashKey": "object:331",
3080 - "field": "timestamp",
3081 - "id": "2",
3082 - "settings": {
3083 - "interval": "auto",
3084 - "min_doc_count": 0,
3085 - "trimEdges": 0
3086 - },
3087 - "type": "date_histogram"
3088 - }
3089 - ],
3090 - "datasource": {
3091 - "type": "elasticsearch",
3092 - "uid": "replace_datasource_uid"
3093 - },
3094 - "metrics": [
3095 - {
3096 - "$$hashKey": "object:329",
3097 - "field": "select field",
3098 - "id": "1",
3099 - "type": "count"
3100 - }
3101 - ],
3102 - "query": "data_office365_Operation:UserLoggedIn AND rule_level:$rule_level",
3103 - "refId": "A",
3104 - "timeField": "timestamp"
3105 - }
3106 - ],
3107 - "title": "AZURE AD - TOTAL AUTHS",
3108 - "type": "stat"
3109 - },
3110 - {
3111 - "datasource": {
3112 - "type": "elasticsearch",
3113 - "uid": "replace_datasource_uid"
3114 - },
3115 - "fieldConfig": {
3116 - "defaults": {
3117 - "color": {
3118 - "mode": "thresholds"
3119 - },
3120 - "mappings": [],
3121 - "thresholds": {
3122 - "mode": "absolute",
3123 - "steps": [
3124 - {
3125 - "color": "green",
3126 - "value": null
3127 - },
3128 - {
3129 - "color": "red",
3130 - "value": 80
3131 - }
3132 - ]
3133 - }
3134 - },
3135 - "overrides": []
3136 - },
3137 - "gridPos": {
3138 - "h": 10,
3139 - "w": 14,
3140 - "x": 0,
3141 - "y": 60
3142 - },
3143 - "id": 57,
3144 - "options": {
3145 - "displayMode": "gradient",
3146 - "minVizHeight": 10,
3147 - "minVizWidth": 0,
3148 - "orientation": "horizontal",
3149 - "reduceOptions": {
3150 - "calcs": [
3151 - "sum"
3152 - ],
3153 - "fields": "",
3154 - "values": false
3155 - },
3156 - "showUnfilled": true
3157 - },
3158 - "pluginVersion": "9.3.6",
3159 - "targets": [
3160 - {
3161 - "alias": "",
3162 - "bucketAggs": [
3163 - {
3164 - "field": "data_office365_LogonError",
3165 - "id": "2",
3166 - "settings": {
3167 - "min_doc_count": "1",
3168 - "order": "desc",
3169 - "orderBy": "_count",
3170 - "size": "15"
3171 - },
3172 - "type": "terms"
3173 - },
3174 - {
3175 - "field": "timestamp",
3176 - "id": "3",
3177 - "settings": {
3178 - "interval": "auto",
3179 - "min_doc_count": "1",
3180 - "timeZone": "utc",
3181 - "trimEdges": "0"
3182 - },
3183 - "type": "date_histogram"
3184 - }
3185 - ],
3186 - "datasource": {
3187 - "type": "elasticsearch",
3188 - "uid": "replace_datasource_uid"
3189 - },
3190 - "metrics": [
3191 - {
3192 - "id": "1",
3193 - "type": "count"
3194 - }
3195 - ],
3196 - "query": "",
3197 - "refId": "A",
3198 - "timeField": "timestamp"
3199 - }
3200 - ],
3201 - "title": "FAILED AUTHS BY ERROR (Top 15)",
3202 - "type": "bargauge"
3203 - },
3204 - {
3205 - "datasource": {
3206 - "type": "elasticsearch",
3207 - "uid": "replace_datasource_uid"
3208 - },
3209 - "fieldConfig": {
3210 - "defaults": {
3211 - "color": {
3212 - "mode": "thresholds"
3213 - },
3214 - "mappings": [],
3215 - "thresholds": {
3216 - "mode": "absolute",
3217 - "steps": [
3218 - {
3219 - "color": "green",
3220 - "value": null
3221 - },
3222 - {
3223 - "color": "red",
3224 - "value": 80
3225 - }
3226 - ]
3227 - }
3228 - },
3229 - "overrides": []
3230 - },
3231 - "gridPos": {
3232 - "h": 10,
3233 - "w": 14,
3234 - "x": 0,
3235 - "y": 70
3236 - },
3237 - "id": 72,
3238 - "options": {
3239 - "displayMode": "gradient",
3240 - "minVizHeight": 10,
3241 - "minVizWidth": 0,
3242 - "orientation": "horizontal",
3243 - "reduceOptions": {
3244 - "calcs": [
3245 - "sum"
3246 - ],
3247 - "fields": "",
3248 - "values": false
3249 - },
3250 - "showUnfilled": true
3251 - },
3252 - "pluginVersion": "9.3.6",
3253 - "targets": [
3254 - {
3255 - "alias": "",
3256 - "bucketAggs": [
3257 - {
3258 - "field": "data_office365_ExtendedProperties_UserAgent",
3259 - "id": "2",
3260 - "settings": {
3261 - "min_doc_count": "1",
3262 - "order": "desc",
3263 - "orderBy": "_count",
3264 - "size": "15"
3265 - },
3266 - "type": "terms"
3267 - },
3268 - {
3269 - "field": "timestamp",
3270 - "id": "3",
3271 - "settings": {
3272 - "interval": "auto",
3273 - "min_doc_count": "1",
3274 - "timeZone": "utc",
3275 - "trimEdges": "0"
3276 - },
3277 - "type": "date_histogram"
3278 - }
3279 - ],
3280 - "datasource": {
3281 - "type": "elasticsearch",
3282 - "uid": "replace_datasource_uid"
3283 - },
3284 - "metrics": [
3285 - {
3286 - "id": "1",
3287 - "type": "count"
3288 - }
3289 - ],
3290 - "query": "data_office365_Operation:UserLoggedIn AND data_office365_ResultStatus:Success",
3291 - "refId": "A",
3292 - "timeField": "timestamp"
3293 - }
3294 - ],
3295 - "title": "SUCCESSFUL AUTHS BY USER AGENT (Top 15)",
3296 - "type": "bargauge"
3297 - },
3298 - {
3299 - "datasource": {
3300 - "type": "elasticsearch",
3301 - "uid": "replace_datasource_uid"
3302 - },
3303 - "fieldConfig": {
3304 - "defaults": {
3305 - "color": {
3306 - "mode": "thresholds"
3307 - },
3308 - "custom": {
3309 - "align": "auto",
3310 - "displayMode": "auto",
3311 - "filterable": true,
3312 - "inspect": false
3313 - },
3314 - "mappings": [],
3315 - "thresholds": {
3316 - "mode": "absolute",
3317 - "steps": [
3318 - {
3319 - "color": "green",
3320 - "value": null
3321 - },
3322 - {
3323 - "color": "red",
3324 - "value": 80
3325 - }
3326 - ]
3327 - }
3328 - },
3329 - "overrides": [
3330 - {
3331 - "matcher": {
3332 - "id": "byName",
3333 - "options": "rule_level"
3334 - },
3335 - "properties": [
3336 - {
3337 - "id": "displayName",
3338 - "value": "RULE LEVEL"
3339 - },
3340 - {
3341 - "id": "unit",
3342 - "value": "short"
3343 - },
3344 - {
3345 - "id": "decimals",
3346 - "value": -1
3347 - },
3348 - {
3349 - "id": "custom.displayMode",
3350 - "value": "color-background"
3351 - },
3352 - {
3353 - "id": "custom.align"
3354 - },
3355 - {
3356 - "id": "thresholds",
3357 - "value": {
3358 - "mode": "absolute",
3359 - "steps": [
3360 - {
3361 - "color": "#37872D",
3362 - "value": null
3363 - },
3364 - {
3365 - "color": "rgba(237, 129, 40, 0.89)",
3366 - "value": 7
3367 - },
3368 - {
3369 - "color": "rgba(245, 54, 54, 0.9)",
3370 - "value": 12
3371 - }
3372 - ]
3373 - }
3374 - }
3375 - ]
3376 - },
3377 - {
3378 - "matcher": {
3379 - "id": "byName",
3380 - "options": "Date/Time"
3381 - },
3382 - "properties": [
3383 - {
3384 - "id": "custom.width",
3385 - "value": 242
3386 - }
3387 - ]
3388 - },
3389 - {
3390 - "matcher": {
3391 - "id": "byName",
3392 - "options": "MITRE TACTIC"
3393 - },
3394 - "properties": [
3395 - {
3396 - "id": "custom.width",
3397 - "value": 332
3398 - }
3399 - ]
3400 - },
3401 - {
3402 - "matcher": {
3403 - "id": "byName",
3404 - "options": "IP ADDRESS"
3405 - },
3406 - "properties": [
3407 - {
3408 - "id": "custom.width",
3409 - "value": 163
3410 - }
3411 - ]
3412 - },
3413 - {
3414 - "matcher": {
3415 - "id": "byName",
3416 - "options": "MITRE TECHNIQUE"
3417 - },
3418 - "properties": [
3419 - {
3420 - "id": "custom.width",
3421 - "value": 312
3422 - }
3423 - ]
3424 - },
3425 - {
3426 - "matcher": {
3427 - "id": "byName",
3428 - "options": "EVENT ID"
3429 - },
3430 - "properties": [
3431 - {
3432 - "id": "links",
3433 - "value": [
3434 - {
3435 - "targetBlank": true,
3436 - "title": "VIEW EVENT DETAILS",
3437 - "url": "https://grafana.company.local/explore?left=%5B%22now-6h%22,%22now%22,%22O365%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
3438 - }
3439 - ]
3440 - },
3441 - {
3442 - "id": "custom.width",
3443 - "value": 336
3444 - }
3445 - ]
3446 - },
3447 - {
3448 - "matcher": {
3449 - "id": "byName",
3450 - "options": "RESULT"
3451 - },
3452 - "properties": [
3453 - {
3454 - "id": "custom.width",
3455 - "value": 118
3456 - },
3457 - {
3458 - "id": "mappings",
3459 - "value": [
3460 - {
3461 - "options": {
3462 - "Failed": {
3463 - "color": "orange",
3464 - "index": 1
3465 - },
3466 - "Success": {
3467 - "color": "green",
3468 - "index": 0
3469 - }
3470 - },
3471 - "type": "value"
3472 - }
3473 - ]
3474 - },
3475 - {
3476 - "id": "custom.displayMode",
3477 - "value": "color-text"
3478 - }
3479 - ]
3480 - },
3481 - {
3482 - "matcher": {
3483 - "id": "byName",
3484 - "options": "SRC IP"
3485 - },
3486 - "properties": [
3487 - {
3488 - "id": "custom.width",
3489 - "value": 265
3490 - }
3491 - ]
3492 - },
3493 - {
3494 - "matcher": {
3495 - "id": "byName",
3496 - "options": "ACCOUNT"
3497 - },
3498 - "properties": [
3499 - {
3500 - "id": "custom.width",
3501 - "value": 343
3502 - }
3503 - ]
3504 - },
3505 - {
3506 - "matcher": {
3507 - "id": "byName",
3508 - "options": "EVENT TIME"
3509 - },
3510 - "properties": [
3511 - {
3512 - "id": "custom.width",
3513 - "value": 195
3514 - }
3515 - ]
3516 - }
3517 - ]
3518 - },
3519 - "gridPos": {
3520 - "h": 16,
3521 - "w": 24,
3522 - "x": 0,
3523 - "y": 80
3524 - },
3525 - "id": 27,
3526 - "options": {
3527 - "footer": {
3528 - "enablePagination": true,
3529 - "fields": "",
3530 - "reducer": [
3531 - "sum"
3532 - ],
3533 - "show": false
3534 - },
3535 - "showHeader": true,
3536 - "sortBy": []
3537 - },
3538 - "pluginVersion": "9.3.6",
3539 - "targets": [
3540 - {
3541 - "bucketAggs": [],
3542 - "datasource": {
3543 - "type": "elasticsearch",
3544 - "uid": "replace_datasource_uid"
3545 - },
3546 - "metrics": [
3547 - {
3548 - "id": "1",
3549 - "settings": {
3550 - "size": "250"
3551 - },
3552 - "type": "raw_data"
3553 - }
3554 - ],
3555 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
3556 - "refId": "A",
3557 - "timeField": "timestamp"
3558 - }
3559 - ],
3560 - "title": "EVENTS",
3561 - "transformations": [
3562 - {
3563 - "id": "organize",
3564 - "options": {
3565 - "excludeByName": {
3566 - "@metadata_beat": true,
3567 - "@metadata_type": true,
3568 - "@metadata_version": true,
3569 - "IMPHASH": true,
3570 - "MD5": true,
3571 - "SHA1": true,
3572 - "SHA256": true,
3573 - "_id": false,
3574 - "_index": true,
3575 - "_type": true,
3576 - "agent_ephemeral_id": true,
3577 - "agent_hostname": true,
3578 - "agent_id": true,
3579 - "agent_ip_city_name": true,
3580 - "agent_ip_country_code": true,
3581 - "agent_ip_geolocation": true,
3582 - "agent_name": true,
3583 - "agent_type": true,
3584 - "agent_version": true,
3585 - "beats_type": true,
3586 - "cluster_name": true,
3587 - "cluster_node": true,
3588 - "collector_node_id": true,
3589 - "data_alert_action": true,
3590 - "data_alert_category": true,
3591 - "data_alert_gid": true,
3592 - "data_alert_rev": true,
3593 - "data_alert_severity": true,
3594 - "data_alert_signature": true,
3595 - "data_alert_signature_id": true,
3596 - "data_app_proto": true,
3597 - "data_audit_auid": true,
3598 - "data_audit_command": true,
3599 - "data_audit_euid": true,
3600 - "data_audit_exe": true,
3601 - "data_audit_gid": true,
3602 - "data_audit_id": true,
3603 - "data_audit_pid": true,
3604 - "data_audit_res": true,
3605 - "data_audit_session": true,
3606 - "data_audit_type": true,
3607 - "data_audit_uid": true,
3608 - "data_dest_ip": true,
3609 - "data_dest_port": true,
3610 - "data_dstuser": true,
3611 - "data_event_type": true,
3612 - "data_extra_data": true,
3613 - "data_file": true,
3614 - "data_flow_bytes_toclient": true,
3615 - "data_flow_bytes_toserver": true,
3616 - "data_flow_id": true,
3617 - "data_flow_pkts_toclient": true,
3618 - "data_flow_pkts_toserver": true,
3619 - "data_flow_start": true,
3620 - "data_http_http_content_type": true,
3621 - "data_http_http_port": true,
3622 - "data_http_length": true,
3623 - "data_http_status": true,
3624 - "data_http_url": true,
3625 - "data_id": true,
3626 - "data_in_iface": true,
3627 - "data_integration": true,
3628 - "data_label": true,
3629 - "data_metadata_flowbits": true,
3630 - "data_metadata_flowints_http_anomaly_count": true,
3631 - "data_metadata_flowints_tcp_retransmission_count": true,
3632 - "data_office365_Actor": true,
3633 - "data_office365_ActorContextId": true,
3634 - "data_office365_ActorIpAddress": false,
3635 - "data_office365_ActorIpAddress_city_name": true,
3636 - "data_office365_ActorIpAddress_country_code": true,
3637 - "data_office365_ActorIpAddress_geolocation": true,
3638 - "data_office365_ApplicationId": true,
3639 - "data_office365_AzureActiveDirectoryEventType": true,
3640 - "data_office365_ClientIP": true,
3641 - "data_office365_ClientIP_city_name": true,
3642 - "data_office365_ClientIP_country_code": true,
3643 - "data_office365_ClientIP_geolocation": true,
3644 - "data_office365_CreationTime": false,
3645 - "data_office365_DeviceProperties": true,
3646 - "data_office365_ErrorNumber": true,
3647 - "data_office365_ExtendedProperties": true,
3648 - "data_office365_Id": true,
3649 - "data_office365_InterSystemsId": true,
3650 - "data_office365_IntraSystemId": true,
3651 - "data_office365_LogonError": true,
3652 - "data_office365_ModifiedProperties": true,
3653 - "data_office365_ObjectId": true,
3654 - "data_office365_Operation": true,
3655 - "data_office365_OrganizationId": true,
3656 - "data_office365_RecordType": true,
3657 - "data_office365_ResultStatus": false,
3658 - "data_office365_Subscription": true,
3659 - "data_office365_Target": true,
3660 - "data_office365_TargetContextId": true,
3661 - "data_office365_UserId": false,
3662 - "data_office365_UserKey": true,
3663 - "data_office365_UserType": true,
3664 - "data_office365_Version": true,
3665 - "data_office365_Workload": true,
3666 - "data_osquery_action": true,
3667 - "data_osquery_calendarTime": true,
3668 - "data_osquery_columns_address": true,
3669 - "data_osquery_columns_address_city_name": true,
3670 - "data_osquery_columns_address_country_code": true,
3671 - "data_osquery_columns_address_geolocation": true,
3672 - "data_osquery_columns_cmdline": true,
3673 - "data_osquery_columns_cwd": true,
3674 - "data_osquery_columns_description": true,
3675 - "data_osquery_columns_directory": true,
3676 - "data_osquery_columns_disk_bytes_read": true,
3677 - "data_osquery_columns_disk_bytes_written": true,
3678 - "data_osquery_columns_egid": true,
3679 - "data_osquery_columns_euid": true,
3680 - "data_osquery_columns_family": true,
3681 - "data_osquery_columns_fd": true,
3682 - "data_osquery_columns_gid": true,
3683 - "data_osquery_columns_gid_signed": true,
3684 - "data_osquery_columns_host": true,
3685 - "data_osquery_columns_interface": true,
3686 - "data_osquery_columns_local_address": true,
3687 - "data_osquery_columns_local_address_city_name": true,
3688 - "data_osquery_columns_local_address_country_code": true,
3689 - "data_osquery_columns_local_address_geolocation": true,
3690 - "data_osquery_columns_local_port": true,
3691 - "data_osquery_columns_mac": true,
3692 - "data_osquery_columns_name": true,
3693 - "data_osquery_columns_net_namespace": true,
3694 - "data_osquery_columns_nice": true,
3695 - "data_osquery_columns_on_disk": true,
3696 - "data_osquery_columns_parent": true,
3697 - "data_osquery_columns_path": true,
3698 - "data_osquery_columns_pgroup": true,
3699 - "data_osquery_columns_pid": true,
3700 - "data_osquery_columns_port": true,
3701 - "data_osquery_columns_protocol": true,
3702 - "data_osquery_columns_remote_address": true,
3703 - "data_osquery_columns_remote_address_city_name": true,
3704 - "data_osquery_columns_remote_address_country_code": true,
3705 - "data_osquery_columns_remote_address_geolocation": true,
3706 - "data_osquery_columns_remote_port": true,
3707 - "data_osquery_columns_resident_size": true,
3708 - "data_osquery_columns_root": true,
3709 - "data_osquery_columns_sgid": true,
3710 - "data_osquery_columns_shell": true,
3711 - "data_osquery_columns_socket": true,
3712 - "data_osquery_columns_start_time": true,
3713 - "data_osquery_columns_state": true,
3714 - "data_osquery_columns_suid": true,
3715 - "data_osquery_columns_system_time": true,
3716 - "data_osquery_columns_threads": true,
3717 - "data_osquery_columns_time_utc": true,
3718 - "data_osquery_columns_total_size": true,
3719 - "data_osquery_columns_tty": true,
3720 - "data_osquery_columns_type": true,
3721 - "data_osquery_columns_uid": true,
3722 - "data_osquery_columns_uid_signed": true,
3723 - "data_osquery_columns_user": true,
3724 - "data_osquery_columns_user_time": true,
3725 - "data_osquery_columns_username": true,
3726 - "data_osquery_columns_wired_size": true,
3727 - "data_osquery_counter": true,
3728 - "data_osquery_decorations_host_uuid": true,
3729 - "data_osquery_decorations_hostname": true,
3730 - "data_osquery_epoch": true,
3731 - "data_osquery_hostIdentifier": true,
3732 - "data_osquery_name": true,
3733 - "data_osquery_numerics": true,
3734 - "data_osquery_unixTime": true,
3735 - "data_proto": true,
3736 - "data_sca_check_command": true,
3737 - "data_sca_check_compliance_cis": true,
3738 - "data_sca_check_compliance_cis_csc": true,
3739 - "data_sca_check_compliance_gdpr_IV": true,
3740 - "data_sca_check_compliance_gpg_13": true,
3741 - "data_sca_check_compliance_hipaa": true,
3742 - "data_sca_check_compliance_nist_800_53": true,
3743 - "data_sca_check_compliance_pci_dss": true,
3744 - "data_sca_check_compliance_tsc": true,
3745 - "data_sca_check_description": true,
3746 - "data_sca_check_id": true,
3747 - "data_sca_check_previous_result": true,
3748 - "data_sca_check_rationale": true,
3749 - "data_sca_check_remediation": true,
3750 - "data_sca_check_result": true,
3751 - "data_sca_check_title": true,
3752 - "data_sca_description": true,
3753 - "data_sca_failed": true,
3754 - "data_sca_file": true,
3755 - "data_sca_invalid": true,
3756 - "data_sca_passed": true,
3757 - "data_sca_policy": true,
3758 - "data_sca_policy_id": true,
3759 - "data_sca_scan_id": true,
3760 - "data_sca_score": true,
3761 - "data_sca_total_checks": true,
3762 - "data_sca_type": true,
3763 - "data_script": true,
3764 - "data_src_ip": true,
3765 - "data_src_ip_city_name": true,
3766 - "data_src_ip_country_code": true,
3767 - "data_src_ip_geolocation": true,
3768 - "data_src_port": true,
3769 - "data_srcip": true,
3770 - "data_srcip_city_name": true,
3771 - "data_srcip_country_code": true,
3772 - "data_srcip_geolocation": true,
3773 - "data_srcuser": true,
3774 - "data_timestamp": true,
3775 - "data_title": true,
3776 - "data_tls_session_resumed": true,
3777 - "data_tls_version": true,
3778 - "data_tx_id": true,
3779 - "data_type": true,
3780 - "data_win_eventXML_binaryData": true,
3781 - "data_win_eventXML_binaryDataSize": true,
3782 - "data_win_eventXML_param1": true,
3783 - "data_win_eventdata_authenticationPackageName": true,
3784 - "data_win_eventdata_callTrace": true,
3785 - "data_win_eventdata_commandLine": true,
3786 - "data_win_eventdata_company": true,
3787 - "data_win_eventdata_creationUtcTime": true,
3788 - "data_win_eventdata_currentDirectory": true,
3789 - "data_win_eventdata_description": true,
3790 - "data_win_eventdata_destinationHostname": true,
3791 - "data_win_eventdata_destinationIp": true,
3792 - "data_win_eventdata_destinationIp_city_name": true,
3793 - "data_win_eventdata_destinationIp_country_code": true,
3794 - "data_win_eventdata_destinationIp_geolocation": true,
3795 - "data_win_eventdata_destinationIsIpv6": true,
3796 - "data_win_eventdata_destinationPort": true,
3797 - "data_win_eventdata_destinationPortName": true,
3798 - "data_win_eventdata_details": true,
3799 - "data_win_eventdata_elevatedToken": true,
3800 - "data_win_eventdata_eventType": true,
3801 - "data_win_eventdata_fileVersion": true,
3802 - "data_win_eventdata_fileVersion_city_name": true,
3803 - "data_win_eventdata_fileVersion_country_code": true,
3804 - "data_win_eventdata_fileVersion_geolocation": true,
3805 - "data_win_eventdata_grantedAccess": true,
3806 - "data_win_eventdata_hashes": true,
3807 - "data_win_eventdata_image": true,
3808 - "data_win_eventdata_imageLoaded": true,
3809 - "data_win_eventdata_impersonationLevel": true,
3810 - "data_win_eventdata_initiated": true,
3811 - "data_win_eventdata_integrityLevel": true,
3812 - "data_win_eventdata_ipAddress": true,
3813 - "data_win_eventdata_ipPort": true,
3814 - "data_win_eventdata_keyLength": true,
3815 - "data_win_eventdata_logonGuid": true,
3816 - "data_win_eventdata_logonId": true,
3817 - "data_win_eventdata_logonProcessName": true,
3818 - "data_win_eventdata_logonType": true,
3819 - "data_win_eventdata_originalFileName": true,
3820 - "data_win_eventdata_param1": true,
3821 - "data_win_eventdata_param2": true,
3822 - "data_win_eventdata_param3": true,
3823 - "data_win_eventdata_param4": true,
3824 - "data_win_eventdata_parentCommandLine": true,
3825 - "data_win_eventdata_parentImage": true,
3826 - "data_win_eventdata_parentProcessGuid": true,
3827 - "data_win_eventdata_parentProcessId": true,
3828 - "data_win_eventdata_processGuid": true,
3829 - "data_win_eventdata_processId": true,
3830 - "data_win_eventdata_processName": true,
3831 - "data_win_eventdata_product": true,
3832 - "data_win_eventdata_protocol": true,
3833 - "data_win_eventdata_queryName": true,
3834 - "data_win_eventdata_queryResults": true,
3835 - "data_win_eventdata_queryStatus": true,
3836 - "data_win_eventdata_ruleName": true,
3837 - "data_win_eventdata_serviceName": true,
3838 - "data_win_eventdata_serviceSid": true,
3839 - "data_win_eventdata_signature": true,
3840 - "data_win_eventdata_signatureStatus": true,
3841 - "data_win_eventdata_signed": true,
3842 - "data_win_eventdata_sourceHostname": true,
3843 - "data_win_eventdata_sourceImage": true,
3844 - "data_win_eventdata_sourceIp": true,
3845 - "data_win_eventdata_sourceIp_city_name": true,
3846 - "data_win_eventdata_sourceIp_country_code": true,
3847 - "data_win_eventdata_sourceIp_geolocation": true,
3848 - "data_win_eventdata_sourceIsIpv6": true,
3849 - "data_win_eventdata_sourcePort": true,
3850 - "data_win_eventdata_sourceProcessGUID": true,
3851 - "data_win_eventdata_sourceProcessId": true,
3852 - "data_win_eventdata_sourceThreadId": true,
3853 - "data_win_eventdata_status": true,
3854 - "data_win_eventdata_subjectDomainName": true,
3855 - "data_win_eventdata_subjectLogonId": true,
3856 - "data_win_eventdata_subjectUserName": true,
3857 - "data_win_eventdata_subjectUserSid": true,
3858 - "data_win_eventdata_targetDomainName": true,
3859 - "data_win_eventdata_targetFilename": true,
3860 - "data_win_eventdata_targetImage": true,
3861 - "data_win_eventdata_targetLinkedLogonId": true,
3862 - "data_win_eventdata_targetLogonId": true,
3863 - "data_win_eventdata_targetObject": true,
3864 - "data_win_eventdata_targetProcessGUID": true,
3865 - "data_win_eventdata_targetProcessId": true,
3866 - "data_win_eventdata_targetUserName": true,
3867 - "data_win_eventdata_targetUserSid": true,
3868 - "data_win_eventdata_terminalSessionId": true,
3869 - "data_win_eventdata_ticketEncryptionType": true,
3870 - "data_win_eventdata_ticketOptions": true,
3871 - "data_win_eventdata_user": true,
3872 - "data_win_eventdata_utcTime": true,
3873 - "data_win_eventdata_virtualAccount": true,
3874 - "data_win_system_channel": true,
3875 - "data_win_system_computer": true,
3876 - "data_win_system_eventID": true,
3877 - "data_win_system_eventRecordID": true,
3878 - "data_win_system_eventSourceName": true,
3879 - "data_win_system_keywords": true,
3880 - "data_win_system_level": true,
3881 - "data_win_system_message": true,
3882 - "data_win_system_opcode": true,
3883 - "data_win_system_processID": true,
3884 - "data_win_system_providerGuid": true,
3885 - "data_win_system_providerName": true,
3886 - "data_win_system_severityValue": true,
3887 - "data_win_system_systemTime": true,
3888 - "data_win_system_task": true,
3889 - "data_win_system_threadID": true,
3890 - "data_win_system_version": true,
3891 - "decoder_name": true,
3892 - "decoder_parent": true,
3893 - "dns_query": true,
3894 - "dns_query_threat_indicated": true,
3895 - "dst_ip": true,
3896 - "dst_ip_city_name": true,
3897 - "dst_ip_country_code": true,
3898 - "dst_ip_geolocation": true,
3899 - "dst_ip_threat_indicated": true,
3900 - "dst_port": true,
3901 - "ecs_version": true,
3902 - "error": true,
3903 - "event_hash": true,
3904 - "file_path": true,
3905 - "firewall_rule_name": true,
3906 - "full_log": false,
3907 - "gl2_accounted_message_size": true,
3908 - "gl2_message_id": true,
3909 - "gl2_processing_error": true,
3910 - "gl2_remote_ip": true,
3911 - "gl2_remote_port": true,
3912 - "gl2_source_collector": true,
3913 - "gl2_source_input": true,
3914 - "gl2_source_node": true,
3915 - "hash_md5": true,
3916 - "hash_sha1": true,
3917 - "hash_sha256": true,
3918 - "highlight": true,
3919 - "host_architecture": true,
3920 - "host_containerized": true,
3921 - "host_hostname": true,
3922 - "host_id": true,
3923 - "host_ip": true,
3924 - "host_mac": true,
3925 - "host_name": true,
3926 - "host_os_codename": true,
3927 - "host_os_kernel": true,
3928 - "host_os_name": true,
3929 - "host_os_platform": true,
3930 - "host_os_version": true,
3931 - "hostname": true,
3932 - "id": true,
3933 - "input_type": true,
3934 - "level": true,
3935 - "location": true,
3936 - "log_file_path": true,
3937 - "log_offset": true,
3938 - "manager_name": true,
3939 - "message": true,
3940 - "module": true,
3941 - "parent_process_cmd_line": true,
3942 - "parent_process_id": true,
3943 - "parent_process_image": true,
3944 - "pid": true,
3945 - "predecoder_hostname": true,
3946 - "predecoder_program_name": true,
3947 - "predecoder_timestamp": true,
3948 - "previous_log": true,
3949 - "previous_output": true,
3950 - "process_cmd_line": true,
3951 - "process_id": true,
3952 - "process_image": true,
3953 - "process_name": true,
3954 - "protocol": true,
3955 - "rule_cis": true,
3956 - "rule_cis_csc": true,
3957 - "rule_firedtimes": true,
3958 - "rule_gdpr": true,
3959 - "rule_gdpr_IV": true,
3960 - "rule_gpg13": true,
3961 - "rule_gpg_13": true,
3962 - "rule_group1": true,
3963 - "rule_group2": true,
3964 - "rule_groups": true,
3965 - "rule_hipaa": true,
3966 - "rule_id": true,
3967 - "rule_info": true,
3968 - "rule_mail": true,
3969 - "rule_mitre_id": true,
3970 - "rule_mitre_tactic": false,
3971 - "rule_nist_800_53": true,
3972 - "rule_pci_dss": true,
3973 - "rule_tsc": true,
3974 - "scanid": true,
3975 - "service": true,
3976 - "software_package": true,
3977 - "software_vendor": true,
3978 - "sort": true,
3979 - "source": true,
3980 - "source_reserved_ip": true,
3981 - "src_ip": true,
3982 - "src_ip_city_name": true,
3983 - "src_ip_country_code": true,
3984 - "src_ip_geolocation": true,
3985 - "src_port": true,
3986 - "streams": true,
3987 - "syscheck_attrs_after": true,
3988 - "syscheck_audit_effective_user_id": true,
3989 - "syscheck_audit_effective_user_name": true,
3990 - "syscheck_audit_group_id": true,
3991 - "syscheck_audit_group_name": true,
3992 - "syscheck_audit_login_user_id": true,
3993 - "syscheck_audit_login_user_name": true,
3994 - "syscheck_audit_process_cwd": true,
3995 - "syscheck_audit_process_id": true,
3996 - "syscheck_audit_process_name": true,
3997 - "syscheck_audit_process_parent_cwd": true,
3998 - "syscheck_audit_process_parent_name": true,
3999 - "syscheck_audit_process_ppid": true,
4000 - "syscheck_audit_user_id": true,
4001 - "syscheck_audit_user_name": true,
4002 - "syscheck_changed_attributes": true,
4003 - "syscheck_event": true,
4004 - "syscheck_gid_after": true,
4005 - "syscheck_gname_after": true,
4006 - "syscheck_hard_links": true,
4007 - "syscheck_inode_after": true,
4008 - "syscheck_inode_before": true,
4009 - "syscheck_md5_after": true,
4010 - "syscheck_md5_before": true,
4011 - "syscheck_mode": true,
4012 - "syscheck_mtime_after": true,
4013 - "syscheck_mtime_before": true,
4014 - "syscheck_path": true,
4015 - "syscheck_perm_after": true,
4016 - "syscheck_perm_before": true,
4017 - "syscheck_sha1_after": true,
4018 - "syscheck_sha1_before": true,
4019 - "syscheck_sha256_after": true,
4020 - "syscheck_sha256_before": true,
4021 - "syscheck_size_after": true,
4022 - "syscheck_size_before": true,
4023 - "syscheck_uid_after": true,
4024 - "syscheck_uname_after": true,
4025 - "syscheck_win_perm_after": true,
4026 - "syscheck_win_perm_after_0_allowed": true,
4027 - "syscheck_win_perm_after_0_name": true,
4028 - "syscheck_win_perm_after_1_allowed": true,
4029 - "syscheck_win_perm_after_1_name": true,
4030 - "syscheck_win_perm_after_2_allowed": true,
4031 - "syscheck_win_perm_after_2_name": true,
4032 - "syscheck_win_perm_after_3_allowed": true,
4033 - "syscheck_win_perm_after_3_name": true,
4034 - "syslog_customer": true,
4035 - "syslog_level": true,
4036 - "syslog_tag": true,
4037 - "syslog_type": true,
4038 - "sysmon_event_description": true,
4039 - "threat_ids": true,
4040 - "threat_indicated": true,
4041 - "threat_names": true,
4042 - "time": true,
4043 - "timestamp": true,
4044 - "true": true,
4045 - "user_name": true,
4046 - "win_registry_key": true,
4047 - "win_system_eventID": true,
4048 - "windows_auth_package": true,
4049 - "windows_domain": true,
4050 - "windows_event_id": true,
4051 - "windows_event_severity": true,
4052 - "windows_logon_type": true
4053 - },
4054 - "indexByName": {
4055 - "_id": 2,
4056 - "_index": 10,
4057 - "_type": 11,
4058 - "agent_id": 12,
4059 - "agent_name": 5,
4060 - "cluster_name": 13,
4061 - "cluster_node": 14,
4062 - "data_office365_Actor": 15,
4063 - "data_office365_ActorContextId": 16,
4064 - "data_office365_ActorIpAddress": 4,
4065 - "data_office365_ActorIpAddress_city_name": 17,
4066 - "data_office365_ActorIpAddress_country_code": 18,
4067 - "data_office365_ActorIpAddress_geolocation": 19,
4068 - "data_office365_ApplicationId": 20,
4069 - "data_office365_AzureActiveDirectoryEventType": 21,
4070 - "data_office365_ClientIP": 22,
4071 - "data_office365_ClientIP_city_name": 23,
4072 - "data_office365_ClientIP_country_code": 24,
4073 - "data_office365_ClientIP_geolocation": 25,
4074 - "data_office365_CreationTime": 0,
4075 - "data_office365_DeviceProperties": 26,
4076 - "data_office365_ErrorNumber": 27,
4077 - "data_office365_ExtendedProperties": 28,
4078 - "data_office365_Id": 29,
4079 - "data_office365_InterSystemsId": 30,
4080 - "data_office365_IntraSystemId": 31,
4081 - "data_office365_LogonError": 32,
4082 - "data_office365_ModifiedProperties": 33,
4083 - "data_office365_ObjectId": 34,
4084 - "data_office365_Operation": 42,
4085 - "data_office365_OrganizationId": 35,
4086 - "data_office365_RecordType": 36,
4087 - "data_office365_ResultStatus": 6,
4088 - "data_office365_Target": 37,
4089 - "data_office365_TargetContextId": 38,
4090 - "data_office365_UserId": 3,
4091 - "data_office365_UserKey": 39,
4092 - "data_office365_UserType": 40,
4093 - "data_office365_Version": 41,
4094 - "data_office365_Workload": 66,
4095 - "decoder_name": 43,
4096 - "gl2_accounted_message_size": 44,
4097 - "gl2_message_id": 45,
4098 - "gl2_processing_error": 46,
4099 - "gl2_remote_ip": 47,
4100 - "gl2_remote_port": 48,
4101 - "gl2_source_input": 49,
4102 - "gl2_source_node": 50,
4103 - "highlight": 51,
4104 - "id": 52,
4105 - "location": 53,
4106 - "manager_name": 54,
4107 - "message": 55,
4108 - "rule_description": 7,
4109 - "rule_firedtimes": 56,
4110 - "rule_group1": 57,
4111 - "rule_groups": 58,
4112 - "rule_id": 9,
4113 - "rule_level": 8,
4114 - "rule_mail": 59,
4115 - "sort": 60,
4116 - "source": 61,
4117 - "streams": 62,
4118 - "syslog_level": 63,
4119 - "syslog_type": 64,
4120 - "timestamp": 1,
4121 - "true": 65
4122 - },
4123 - "renameByName": {
4124 - "_id": "EVENT ID",
4125 - "agent_name": "",
4126 - "data_office365_ActorIpAddress": "SRC IP",
4127 - "data_office365_CreationTime": "EVENT TIME",
4128 - "data_office365_DeviceProperties_BrowserType": "BROWSER",
4129 - "data_office365_DeviceProperties_DisplayName": "HOSTNAME",
4130 - "data_office365_DeviceProperties_OS": "OS",
4131 - "data_office365_ExtendedProperties_RequestType": "REQ TYPE",
4132 - "data_office365_ExtendedProperties_ResultStatusDetail": "RESULT",
4133 - "data_office365_ExtendedProperties_UserAgent": "AGENT",
4134 - "data_office365_ExtendedProperties_UserAuthenticationMethod": "AUTH METHOD",
4135 - "data_office365_ResultStatus": "RESULT",
4136 - "data_office365_UserId": "ACCOUNT",
4137 - "rule_description": "DESCRIPTION",
4138 - "rule_id": "RULE ID",
4139 - "rule_level": "LEVEL",
4140 - "rule_mitre_tactic": "MITRE TACTIC",
4141 - "rule_mitre_technique": "MITRE TECHNIQUE",
4142 - "timestamp": "Date/Time"
4143 - }
4144 - }
4145 - }
4146 - ],
4147 - "transparent": true,
4148 - "type": "table"
4149 - }
4150 - ],
4151 - "refresh": false,
4152 - "schemaVersion": 37,
4153 - "style": "dark",
4154 - "tags": [
4155 - "O365"
4156 - ],
4157 - "templating": {
4158 - "list": [
4159 - {
4160 - "datasource": {
4161 - "type": "elasticsearch",
4162 - "uid": "replace_datasource_uid"
4163 - },
4164 - "filters": [],
4165 - "hide": 0,
4166 - "label": "",
4167 - "name": "Filters",
4168 - "skipUrlSync": false,
4169 - "type": "adhoc"
4170 - },
4171 - {
4172 - "current": {
4173 - "selected": false,
4174 - "text": "All",
4175 - "value": "$__all"
4176 - },
4177 - "datasource": {
4178 - "type": "elasticsearch",
4179 - "uid": "replace_datasource_uid"
4180 - },
4181 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:AzureActiveDirectory\"}",
4182 - "hide": 0,
4183 - "includeAll": true,
4184 - "label": "Operation",
4185 - "multi": false,
4186 - "name": "operation",
4187 - "options": [],
4188 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:AzureActiveDirectory\"}",
4189 - "refresh": 2,
4190 - "regex": "",
4191 - "skipUrlSync": false,
4192 - "sort": 1,
4193 - "tagValuesQuery": "",
4194 - "tagsQuery": "",
4195 - "type": "query",
4196 - "useTags": false
4197 - },
4198 - {
4199 - "current": {
4200 - "selected": false,
4201 - "text": "All",
4202 - "value": "$__all"
4203 - },
4204 - "datasource": {
4205 - "type": "elasticsearch",
4206 - "uid": "replace_datasource_uid"
4207 - },
4208 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
4209 - "hide": 0,
4210 - "includeAll": true,
4211 - "label": "Rule Level",
4212 - "multi": false,
4213 - "name": "rule_level",
4214 - "options": [],
4215 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
4216 - "refresh": 2,
4217 - "regex": "",
4218 - "skipUrlSync": false,
4219 - "sort": 0,
4220 - "type": "query"
4221 - }
4222 - ]
4223 - },
4224 - "time": {
4225 - "from": "now-24h",
4226 - "to": "now"
4227 - },
4228 - "timepicker": {
4229 - "refresh_intervals": [
4230 - "5s",
4231 - "10s",
4232 - "30s",
4233 - "1m",
4234 - "5m",
4235 - "15m",
4236 - "30m",
4237 - "1h",
4238 - "2h",
4239 - "1d"
4240 - ],
4241 - "time_options": [
4242 - "5m",
4243 - "15m",
4244 - "1h",
4245 - "6h",
4246 - "12h",
4247 - "24h",
4248 - "2d",
4249 - "7d",
4250 - "30d"
4251 - ]
4252 - },
4253 - "timezone": "",
4254 - "title": "O365 - ACTIVE DIRECTORY",
4255 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "9.3.6",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "displayMode": "auto",
255 + "inspect": false
256 + },
257 + "mappings": [],
258 + "thresholds": {
259 + "mode": "absolute",
260 + "steps": [
261 + {
262 + "color": "red",
263 + "value": null
264 + }
265 + ]
266 + }
267 + },
268 + "overrides": [
269 + {
270 + "matcher": {
271 + "id": "byName",
272 + "options": "Count"
273 + },
274 + "properties": [
275 + {
276 + "id": "displayName",
277 + "value": "EVENTS"
278 + },
279 + {
280 + "id": "unit",
281 + "value": "short"
282 + },
283 + {
284 + "id": "decimals",
285 + "value": -1
286 + },
287 + {
288 + "id": "custom.align"
289 + },
290 + {
291 + "id": "thresholds",
292 + "value": {
293 + "mode": "absolute",
294 + "steps": [
295 + {
296 + "color": "red",
297 + "value": null
298 + }
299 + ]
300 + }
301 + }
302 + ]
303 + }
304 + ]
305 + },
306 + "gridPos": {
307 + "h": 7,
308 + "w": 6,
309 + "x": 8,
310 + "y": 0
311 + },
312 + "id": 54,
313 + "options": {
314 + "footer": {
315 + "fields": "",
316 + "reducer": ["sum"],
317 + "show": false
318 + },
319 + "showHeader": true
320 + },
321 + "pluginVersion": "9.3.6",
322 + "targets": [
323 + {
324 + "bucketAggs": [
325 + {
326 + "fake": true,
327 + "field": "data_office365_Operation",
328 + "id": "4",
329 + "settings": {
330 + "min_doc_count": 1,
331 + "order": "desc",
332 + "orderBy": "_count",
333 + "size": "0"
334 + },
335 + "type": "terms"
336 + }
337 + ],
338 + "datasource": {
339 + "type": "elasticsearch",
340 + "uid": "replace_datasource_uid"
341 + },
342 + "metrics": [
343 + {
344 + "field": "select field",
345 + "id": "1",
346 + "type": "count"
347 + }
348 + ],
349 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
350 + "refId": "A",
351 + "timeField": "timestamp"
352 + }
353 + ],
354 + "title": "EVENTS BY OPERATION",
355 + "transformations": [
356 + {
357 + "id": "merge",
358 + "options": {
359 + "reducers": []
360 + }
361 + },
362 + {
363 + "id": "organize",
364 + "options": {
365 + "excludeByName": {},
366 + "indexByName": {},
367 + "renameByName": {
368 + "Count": "EVENTS",
369 + "data_office365_Operation": "OPERATION"
370 + }
371 + }
372 + }
373 + ],
374 + "type": "table"
375 + },
376 + {
377 + "datasource": {
378 + "type": "elasticsearch",
379 + "uid": "replace_datasource_uid"
380 + },
381 + "fieldConfig": {
382 + "defaults": {
383 + "mappings": [
384 + {
385 + "options": {
386 + "match": "null",
387 + "result": {
388 + "text": "N/A"
389 + }
390 + },
391 + "type": "special"
392 + }
393 + ],
394 + "thresholds": {
395 + "mode": "absolute",
396 + "steps": [
397 + {
398 + "color": "blue",
399 + "value": null
400 + }
401 + ]
402 + },
403 + "unit": "locale"
404 + },
405 + "overrides": []
406 + },
407 + "gridPos": {
408 + "h": 7,
409 + "w": 4,
410 + "x": 14,
411 + "y": 0
412 + },
413 + "id": 59,
414 + "links": [],
415 + "options": {
416 + "colorMode": "value",
417 + "graphMode": "area",
418 + "justifyMode": "auto",
419 + "orientation": "horizontal",
420 + "reduceOptions": {
421 + "calcs": ["sum"],
422 + "fields": "",
423 + "values": false
424 + },
425 + "text": {},
426 + "textMode": "auto"
427 + },
428 + "pluginVersion": "9.3.6",
429 + "targets": [
430 + {
431 + "bucketAggs": [
432 + {
433 + "$$hashKey": "object:331",
434 + "field": "timestamp",
435 + "id": "2",
436 + "settings": {
437 + "interval": "auto",
438 + "min_doc_count": 0,
439 + "trimEdges": 0
440 + },
441 + "type": "date_histogram"
442 + }
443 + ],
444 + "datasource": {
445 + "type": "elasticsearch",
446 + "uid": "replace_datasource_uid"
447 + },
448 + "metrics": [
449 + {
450 + "$$hashKey": "object:329",
451 + "field": "select field",
452 + "id": "1",
453 + "type": "count"
454 + }
455 + ],
456 + "query": "data_office365_Operation:\"Add device.\" OR data_office365_Operation:\"Add registered owner to device.\" OR data_office365_Operation:\"Add registered users to device.\"",
457 + "refId": "A",
458 + "timeField": "timestamp"
459 + }
460 + ],
461 + "title": "DEVICE EVENTS (Total)",
462 + "type": "stat"
463 + },
464 + {
465 + "datasource": {
466 + "type": "elasticsearch",
467 + "uid": "replace_datasource_uid"
468 + },
469 + "fieldConfig": {
470 + "defaults": {
471 + "color": {
472 + "mode": "thresholds"
473 + },
474 + "custom": {
475 + "align": "auto",
476 + "displayMode": "auto",
477 + "inspect": false
478 + },
479 + "mappings": [],
480 + "thresholds": {
481 + "mode": "absolute",
482 + "steps": [
483 + {
484 + "color": "red",
485 + "value": null
486 + }
487 + ]
488 + }
489 + },
490 + "overrides": [
491 + {
492 + "matcher": {
493 + "id": "byName",
494 + "options": "Count"
495 + },
496 + "properties": [
497 + {
498 + "id": "displayName",
499 + "value": "EVENTS"
500 + },
501 + {
502 + "id": "unit",
503 + "value": "short"
504 + },
505 + {
506 + "id": "decimals",
507 + "value": -1
508 + },
509 + {
510 + "id": "custom.align"
511 + },
512 + {
513 + "id": "thresholds",
514 + "value": {
515 + "mode": "absolute",
516 + "steps": [
517 + {
518 + "color": "red",
519 + "value": null
520 + }
521 + ]
522 + }
523 + }
524 + ]
525 + }
526 + ]
527 + },
528 + "gridPos": {
529 + "h": 7,
530 + "w": 6,
531 + "x": 18,
532 + "y": 0
533 + },
534 + "id": 60,
535 + "options": {
536 + "footer": {
537 + "fields": "",
538 + "reducer": ["sum"],
539 + "show": false
540 + },
541 + "showHeader": true
542 + },
543 + "pluginVersion": "9.3.6",
544 + "targets": [
545 + {
546 + "bucketAggs": [
547 + {
548 + "fake": true,
549 + "field": "data_office365_Operation",
550 + "id": "4",
551 + "settings": {
552 + "min_doc_count": 1,
553 + "order": "desc",
554 + "orderBy": "_count",
555 + "size": "0"
556 + },
557 + "type": "terms"
558 + }
559 + ],
560 + "datasource": {
561 + "type": "elasticsearch",
562 + "uid": "replace_datasource_uid"
563 + },
564 + "metrics": [
565 + {
566 + "field": "select field",
567 + "id": "1",
568 + "type": "count"
569 + }
570 + ],
571 + "query": "data_office365_Operation:\"Add device.\" OR data_office365_Operation:\"Add registered owner to device.\" OR data_office365_Operation:\"Add registered users to device.\"",
572 + "refId": "A",
573 + "timeField": "timestamp"
574 + }
575 + ],
576 + "title": "DEVICE EVENTS BY OPERATION",
577 + "transformations": [
578 + {
579 + "id": "merge",
580 + "options": {
581 + "reducers": []
582 + }
583 + },
584 + {
585 + "id": "organize",
586 + "options": {
587 + "excludeByName": {},
588 + "indexByName": {},
589 + "renameByName": {
590 + "Count": "EVENTS",
591 + "data_office365_Operation": "OPERATION"
592 + }
593 + }
594 + }
595 + ],
596 + "type": "table"
597 + },
598 + {
599 + "datasource": {
600 + "type": "elasticsearch",
601 + "uid": "replace_datasource_uid"
602 + },
603 + "fieldConfig": {
604 + "defaults": {
605 + "mappings": [
606 + {
607 + "options": {
608 + "match": "null",
609 + "result": {
610 + "text": "N/A"
611 + }
612 + },
613 + "type": "special"
614 + }
615 + ],
616 + "thresholds": {
617 + "mode": "absolute",
618 + "steps": [
619 + {
620 + "color": "blue",
621 + "value": null
622 + }
623 + ]
624 + },
625 + "unit": "locale"
626 + },
627 + "overrides": []
628 + },
629 + "gridPos": {
630 + "h": 7,
631 + "w": 4,
632 + "x": 0,
633 + "y": 7
634 + },
635 + "id": 65,
636 + "links": [],
637 + "options": {
638 + "colorMode": "value",
639 + "graphMode": "area",
640 + "justifyMode": "auto",
641 + "orientation": "horizontal",
642 + "reduceOptions": {
643 + "calcs": ["sum"],
644 + "fields": "",
645 + "values": false
646 + },
647 + "text": {},
648 + "textMode": "auto"
649 + },
650 + "pluginVersion": "9.3.6",
651 + "targets": [
652 + {
653 + "bucketAggs": [
654 + {
655 + "$$hashKey": "object:331",
656 + "field": "timestamp",
657 + "id": "2",
658 + "settings": {
659 + "interval": "auto",
660 + "min_doc_count": 0,
661 + "trimEdges": 0
662 + },
663 + "type": "date_histogram"
664 + }
665 + ],
666 + "datasource": {
667 + "type": "elasticsearch",
668 + "uid": "replace_datasource_uid"
669 + },
670 + "metrics": [
671 + {
672 + "$$hashKey": "object:329",
673 + "field": "select field",
674 + "id": "1",
675 + "type": "count"
676 + }
677 + ],
678 + "query": "data_office365_Operation:\"Add user.\"",
679 + "refId": "A",
680 + "timeField": "timestamp"
681 + }
682 + ],
683 + "title": "USERS ADDED EVENTS (Total)",
684 + "type": "stat"
685 + },
686 + {
687 + "datasource": {
688 + "type": "elasticsearch",
689 + "uid": "replace_datasource_uid"
690 + },
691 + "fieldConfig": {
692 + "defaults": {
693 + "color": {
694 + "mode": "palette-classic"
695 + },
696 + "custom": {
697 + "hideFrom": {
698 + "legend": false,
699 + "tooltip": false,
700 + "viz": false
701 + }
702 + },
703 + "mappings": []
704 + },
705 + "overrides": [
706 + {
707 + "matcher": {
708 + "id": "byName",
709 + "options": "Count"
710 + },
711 + "properties": [
712 + {
713 + "id": "displayName",
714 + "value": "EVENTS"
715 + },
716 + {
717 + "id": "unit",
718 + "value": "short"
719 + },
720 + {
721 + "id": "decimals",
722 + "value": -1
723 + }
724 + ]
725 + },
726 + {
727 + "matcher": {
728 + "id": "byName",
729 + "options": "Failure"
730 + },
731 + "properties": [
732 + {
733 + "id": "color",
734 + "value": {
735 + "fixedColor": "orange",
736 + "mode": "fixed"
737 + }
738 + }
739 + ]
740 + }
741 + ]
742 + },
743 + "gridPos": {
744 + "h": 7,
745 + "w": 4,

This file is too large to show in full.

backend/app/connectors/grafana/dashboards/Office365/applications.json
+2360 -2407
@@ -1,2409 +1,2362 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "10.0.3",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Workload:$workload",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "pie",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Workload",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY WORKLOAD (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "cellOptions": {
261 - "type": "auto"
262 - },
263 - "inspect": false
264 - },
265 - "mappings": [],
266 - "thresholds": {
267 - "mode": "absolute",
268 - "steps": [
269 - {
270 - "color": "red",
271 - "value": null
272 - }
273 - ]
274 - }
275 - },
276 - "overrides": [
277 - {
278 - "matcher": {
279 - "id": "byName",
280 - "options": "Count"
281 - },
282 - "properties": [
283 - {
284 - "id": "displayName",
285 - "value": "EVENTS"
286 - },
287 - {
288 - "id": "unit",
289 - "value": "short"
290 - },
291 - {
292 - "id": "decimals",
293 - "value": -1
294 - },
295 - {
296 - "id": "custom.align"
297 - },
298 - {
299 - "id": "thresholds",
300 - "value": {
301 - "mode": "absolute",
302 - "steps": [
303 - {
304 - "color": "red",
305 - "value": null
306 - }
307 - ]
308 - }
309 - }
310 - ]
311 - }
312 - ]
313 - },
314 - "gridPos": {
315 - "h": 7,
316 - "w": 6,
317 - "x": 8,
318 - "y": 0
319 - },
320 - "id": 54,
321 - "options": {
322 - "cellHeight": "sm",
323 - "footer": {
324 - "countRows": false,
325 - "fields": "",
326 - "reducer": [
327 - "sum"
328 - ],
329 - "show": false
330 - },
331 - "showHeader": true
332 - },
333 - "pluginVersion": "10.0.3",
334 - "targets": [
335 - {
336 - "bucketAggs": [
337 - {
338 - "fake": true,
339 - "field": "data_office365_Workload",
340 - "id": "4",
341 - "settings": {
342 - "min_doc_count": 1,
343 - "order": "desc",
344 - "orderBy": "_count",
345 - "size": "0"
346 - },
347 - "type": "terms"
348 - }
349 - ],
350 - "datasource": {
351 - "type": "elasticsearch",
352 - "uid": "replace_datasource_uid"
353 - },
354 - "metrics": [
355 - {
356 - "field": "select field",
357 - "id": "1",
358 - "type": "count"
359 - }
360 - ],
361 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
362 - "refId": "A",
363 - "timeField": "timestamp"
364 - }
365 - ],
366 - "title": "EVENTS BY WORKLOAD",
367 - "transformations": [
368 - {
369 - "id": "merge",
370 - "options": {
371 - "reducers": []
372 - }
373 - },
374 - {
375 - "id": "organize",
376 - "options": {
377 - "excludeByName": {},
378 - "indexByName": {},
379 - "renameByName": {
380 - "Count": "EVENTS",
381 - "data_office365_Operation": "OPERATION",
382 - "data_office365_Workload": "WORKLOAD"
383 - }
384 - }
385 - }
386 - ],
387 - "type": "table"
388 - },
389 - {
390 - "datasource": {
391 - "type": "elasticsearch",
392 - "uid": "replace_datasource_uid"
393 - },
394 - "fieldConfig": {
395 - "defaults": {
396 - "color": {
397 - "mode": "palette-classic"
398 - },
399 - "custom": {
400 - "hideFrom": {
401 - "legend": false,
402 - "tooltip": false,
403 - "viz": false
404 - }
405 - },
406 - "mappings": []
407 - },
408 - "overrides": [
409 - {
410 - "matcher": {
411 - "id": "byName",
412 - "options": "Count"
413 - },
414 - "properties": [
415 - {
416 - "id": "displayName",
417 - "value": "EVENTS"
418 - },
419 - {
420 - "id": "unit",
421 - "value": "short"
422 - },
423 - {
424 - "id": "decimals",
425 - "value": -1
426 - }
427 - ]
428 - }
429 - ]
430 - },
431 - "gridPos": {
432 - "h": 7,
433 - "w": 4,
434 - "x": 14,
435 - "y": 0
436 - },
437 - "id": 61,
438 - "options": {
439 - "legend": {
440 - "displayMode": "list",
441 - "placement": "bottom",
442 - "showLegend": false
443 - },
444 - "pieType": "donut",
445 - "reduceOptions": {
446 - "calcs": [
447 - "sum"
448 - ],
449 - "fields": "",
450 - "values": false
451 - },
452 - "tooltip": {
453 - "mode": "single",
454 - "sort": "none"
455 - }
456 - },
457 - "pluginVersion": "8.5.1",
458 - "targets": [
459 - {
460 - "bucketAggs": [
461 - {
462 - "fake": true,
463 - "field": "data_office365_Operation",
464 - "id": "4",
465 - "settings": {
466 - "min_doc_count": 1,
467 - "order": "desc",
468 - "orderBy": "_count",
469 - "size": "10"
470 - },
471 - "type": "terms"
472 - },
473 - {
474 - "field": "data_office365_CreationTime",
475 - "id": "5",
476 - "settings": {
477 - "interval": "auto",
478 - "min_doc_count": "0",
479 - "timeZone": "utc",
480 - "trimEdges": "0"
481 - },
482 - "type": "date_histogram"
483 - }
484 - ],
485 - "datasource": {
486 - "type": "elasticsearch",
487 - "uid": "replace_datasource_uid"
488 - },
489 - "metrics": [
490 - {
491 - "field": "select field",
492 - "id": "1",
493 - "type": "count"
494 - }
495 - ],
496 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
497 - "refId": "A",
498 - "timeField": "timestamp"
499 - }
500 - ],
501 - "title": "EVENTS BY OPERATION (Top 10)",
502 - "transformations": [],
503 - "type": "piechart"
504 - },
505 - {
506 - "datasource": {
507 - "type": "elasticsearch",
508 - "uid": "replace_datasource_uid"
509 - },
510 - "fieldConfig": {
511 - "defaults": {
512 - "color": {
513 - "mode": "thresholds"
514 - },
515 - "custom": {
516 - "align": "auto",
517 - "cellOptions": {
518 - "type": "auto"
519 - },
520 - "inspect": false
521 - },
522 - "mappings": [],
523 - "thresholds": {
524 - "mode": "absolute",
525 - "steps": [
526 - {
527 - "color": "red",
528 - "value": null
529 - }
530 - ]
531 - }
532 - },
533 - "overrides": [
534 - {
535 - "matcher": {
536 - "id": "byName",
537 - "options": "Count"
538 - },
539 - "properties": [
540 - {
541 - "id": "displayName",
542 - "value": "EVENTS"
543 - },
544 - {
545 - "id": "unit",
546 - "value": "short"
547 - },
548 - {
549 - "id": "decimals",
550 - "value": -1
551 - },
552 - {
553 - "id": "custom.align"
554 - },
555 - {
556 - "id": "thresholds",
557 - "value": {
558 - "mode": "absolute",
559 - "steps": [
560 - {
561 - "color": "red",
562 - "value": null
563 - }
564 - ]
565 - }
566 - }
567 - ]
568 - }
569 - ]
570 - },
571 - "gridPos": {
572 - "h": 7,
573 - "w": 6,
574 - "x": 18,
575 - "y": 0
576 - },
577 - "id": 62,
578 - "options": {
579 - "cellHeight": "sm",
580 - "footer": {
581 - "countRows": false,
582 - "fields": "",
583 - "reducer": [
584 - "sum"
585 - ],
586 - "show": false
587 - },
588 - "showHeader": true
589 - },
590 - "pluginVersion": "10.0.3",
591 - "targets": [
592 - {
593 - "bucketAggs": [
594 - {
595 - "fake": true,
596 - "field": "data_office365_Operation",
597 - "id": "4",
598 - "settings": {
599 - "min_doc_count": 1,
600 - "order": "desc",
601 - "orderBy": "_count",
602 - "size": "0"
603 - },
604 - "type": "terms"
605 - }
606 - ],
607 - "datasource": {
608 - "type": "elasticsearch",
609 - "uid": "replace_datasource_uid"
610 - },
611 - "metrics": [
612 - {
613 - "field": "select field",
614 - "id": "1",
615 - "type": "count"
616 - }
617 - ],
618 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
619 - "refId": "A",
620 - "timeField": "timestamp"
621 - }
622 - ],
623 - "title": "EVENTS BY OPERATION",
624 - "transformations": [
625 - {
626 - "id": "merge",
627 - "options": {
628 - "reducers": []
629 - }
630 - },
631 - {
632 - "id": "organize",
633 - "options": {
634 - "excludeByName": {},
635 - "indexByName": {},
636 - "renameByName": {
637 - "Count": "EVENTS",
638 - "data_office365_Operation": "OPERATION",
639 - "data_office365_Workload": "WORKLOAD"
640 - }
641 - }
642 - }
643 - ],
644 - "type": "table"
645 - },
646 - {
647 - "datasource": {
648 - "type": "elasticsearch",
649 - "uid": "replace_datasource_uid"
650 - },
651 - "fieldConfig": {
652 - "defaults": {
653 - "color": {
654 - "mode": "thresholds"
655 - },
656 - "mappings": [
657 - {
658 - "options": {
659 - "match": "null",
660 - "result": {
661 - "text": "N/A"
662 - }
663 - },
664 - "type": "special"
665 - }
666 - ],
667 - "max": 15,
668 - "min": 0,
669 - "thresholds": {
670 - "mode": "absolute",
671 - "steps": [
672 - {
673 - "color": "#299c46",
674 - "value": null
675 - },
676 - {
677 - "color": "rgba(237, 129, 40, 0.89)",
678 - "value": 8
679 - },
680 - {
681 - "color": "#d44a3a",
682 - "value": 12
683 - }
684 - ]
685 - },
686 - "unit": "none"
687 - },
688 - "overrides": []
689 - },
690 - "gridPos": {
691 - "h": 7,
692 - "w": 4,
693 - "x": 0,
694 - "y": 7
695 - },
696 - "id": 16,
697 - "links": [],
698 - "options": {
699 - "orientation": "horizontal",
700 - "reduceOptions": {
701 - "calcs": [
702 - "max"
703 - ],
704 - "fields": "",
705 - "values": false
706 - },
707 - "showThresholdLabels": false,
708 - "showThresholdMarkers": true,
709 - "text": {}
710 - },
711 - "pluginVersion": "10.0.3",
712 - "targets": [
713 - {
714 - "bucketAggs": [
715 - {
716 - "field": "timestamp",
717 - "id": "2",
718 - "settings": {
719 - "interval": "auto",
720 - "min_doc_count": 0,
721 - "trimEdges": 0
722 - },
723 - "type": "date_histogram"
724 - }
725 - ],
726 - "datasource": {
727 - "type": "elasticsearch",
728 - "uid": "replace_datasource_uid"
729 - },
730 - "metrics": [
731 - {
732 - "field": "rule_level",
733 - "id": "1",
734 - "meta": {},
735 - "settings": {},
736 - "type": "max"
737 - }
738 - ],
739 - "query": "data_office365_Workload:$workload",
740 - "refId": "A",
741 - "timeField": "timestamp"
742 - }
743 - ],
744 - "title": "MAX SEVERITY (0 - 15)",
745 - "type": "gauge"
746 - },
747 - {
748 - "datasource": {
749 - "type": "elasticsearch",
750 - "uid": "replace_datasource_uid"
751 - },
752 - "fieldConfig": {
753 - "defaults": {
754 - "color": {
755 - "mode": "palette-classic"
756 - },
757 - "custom": {
758 - "axisCenteredZero": false,
759 - "axisColorMode": "text",
760 - "axisLabel": "",
761 - "axisPlacement": "auto",
762 - "barAlignment": 0,
763 - "drawStyle": "bars",
764 - "fillOpacity": 0,
765 - "gradientMode": "none",
766 - "hideFrom": {
767 - "legend": false,
768 - "tooltip": false,
769 - "viz": false
770 - },
771 - "lineInterpolation": "linear",
772 - "lineWidth": 1,
773 - "pointSize": 5,
774 - "scaleDistribution": {
775 - "type": "linear"
776 - },
777 - "showPoints": "auto",
778 - "spanNulls": false,
779 - "stacking": {
780 - "group": "A",
781 - "mode": "normal"
782 - },
783 - "thresholdsStyle": {
784 - "mode": "off"
785 - }
786 - },
787 - "mappings": [],
788 - "thresholds": {
789 - "mode": "absolute",
790 - "steps": [
791 - {
792 - "color": "green",
793 - "value": null
794 - },
795 - {
796 - "color": "red",
797 - "value": 80
798 - }
799 - ]
800 - }
801 - },
802 - "overrides": []
803 - },
804 - "gridPos": {
805 - "h": 13,
806 - "w": 20,
807 - "x": 4,
808 - "y": 7
809 - },
810 - "id": 68,
811 - "options": {
812 - "legend": {
813 - "calcs": [],
814 - "displayMode": "table",
815 - "placement": "right",
816 - "showLegend": true
817 - },
818 - "tooltip": {
819 - "mode": "single",
820 - "sort": "none"
821 - }
822 - },
823 - "targets": [
824 - {
825 - "alias": "",
826 - "bucketAggs": [
827 - {
828 - "field": "data_office365_Operation",
829 - "id": "3",
830 - "settings": {
831 - "min_doc_count": "1",
832 - "order": "desc",
833 - "orderBy": "_count",
834 - "size": "10"
835 - },
836 - "type": "terms"
837 - },
838 - {
839 - "field": "timestamp",
840 - "id": "2",
841 - "settings": {
842 - "interval": "auto"
843 - },
844 - "type": "date_histogram"
845 - }
846 - ],
847 - "datasource": {
848 - "type": "elasticsearch",
849 - "uid": "replace_datasource_uid"
850 - },
851 - "metrics": [
852 - {
853 - "id": "1",
854 - "type": "count"
855 - }
856 - ],
857 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
858 - "refId": "A",
859 - "timeField": "timestamp"
860 - }
861 - ],
862 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
863 - "transparent": true,
864 - "type": "timeseries"
865 - },
866 - {
867 - "datasource": {
868 - "type": "elasticsearch",
869 - "uid": "replace_datasource_uid"
870 - },
871 - "fieldConfig": {
872 - "defaults": {
873 - "mappings": [
874 - {
875 - "options": {
876 - "match": "null",
877 - "result": {
878 - "text": "N/A"
879 - }
880 - },
881 - "type": "special"
882 - }
883 - ],
884 - "thresholds": {
885 - "mode": "absolute",
886 - "steps": [
887 - {
888 - "color": "blue",
889 - "value": null
890 - }
891 - ]
892 - },
893 - "unit": "locale"
894 - },
895 - "overrides": []
896 - },
897 - "gridPos": {
898 - "h": 6,
899 - "w": 4,
900 - "x": 0,
901 - "y": 14
902 - },
903 - "id": 51,
904 - "links": [],
905 - "options": {
906 - "colorMode": "value",
907 - "graphMode": "area",
908 - "justifyMode": "auto",
909 - "orientation": "horizontal",
910 - "reduceOptions": {
911 - "calcs": [
912 - "sum"
913 - ],
914 - "fields": "",
915 - "values": false
916 - },
917 - "text": {},
918 - "textMode": "auto"
919 - },
920 - "pluginVersion": "10.0.3",
921 - "targets": [
922 - {
923 - "bucketAggs": [
924 - {
925 - "$$hashKey": "object:331",
926 - "field": "timestamp",
927 - "id": "2",
928 - "settings": {
929 - "interval": "auto",
930 - "min_doc_count": 0,
931 - "trimEdges": 0
932 - },
933 - "type": "date_histogram"
934 - }
935 - ],
936 - "datasource": {
937 - "type": "elasticsearch",
938 - "uid": "replace_datasource_uid"
939 - },
940 - "metrics": [
941 - {
942 - "$$hashKey": "object:329",
943 - "field": "select field",
944 - "id": "1",
945 - "type": "count"
946 - }
947 - ],
948 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
949 - "refId": "A",
950 - "timeField": "timestamp"
951 - }
952 - ],
953 - "title": "EVENTS (Total)",
954 - "type": "stat"
955 - },
956 - {
957 - "circleMaxSize": 30,
958 - "circleMinSize": 2,
959 - "colors": [
960 - "rgba(245, 54, 54, 0.9)",
961 - "rgba(237, 129, 40, 0.89)",
962 - "rgba(50, 172, 45, 0.97)"
963 - ],
964 - "datasource": {
965 - "type": "elasticsearch",
966 - "uid": "replace_datasource_uid"
967 - },
968 - "decimals": 0,
969 - "esMetric": "Count",
970 - "gridPos": {
971 - "h": 12,
972 - "w": 10,
973 - "x": 0,
974 - "y": 20
975 - },
976 - "hideEmpty": false,
977 - "hideZero": false,
978 - "id": 64,
979 - "initialZoom": 1,
980 - "locationData": "countries",
981 - "mapCenter": "(0°, 0°)",
982 - "mapCenterLatitude": 0,
983 - "mapCenterLongitude": 0,
984 - "maxDataPoints": 1,
985 - "mouseWheelZoom": false,
986 - "showLegend": true,
987 - "stickyLabels": false,
988 - "tableQueryOptions": {
989 - "geohashField": "geohash",
990 - "latitudeField": "latitude",
991 - "longitudeField": "longitude",
992 - "metricField": "metric",
993 - "queryType": "geohash"
994 - },
995 - "targets": [
996 - {
997 - "bucketAggs": [
998 - {
999 - "fake": true,
1000 - "field": "data_office365_ClientIP_country_code",
1001 - "id": "3",
1002 - "settings": {
1003 - "min_doc_count": 1,
1004 - "order": "desc",
1005 - "orderBy": "_term",
1006 - "size": "0"
1007 - },
1008 - "type": "terms"
1009 - },
1010 - {
1011 - "field": "timestamp",
1012 - "id": "2",
1013 - "settings": {
1014 - "interval": "auto",
1015 - "min_doc_count": 0,
1016 - "trimEdges": 0
1017 - },
1018 - "type": "date_histogram"
1019 - }
1020 - ],
1021 - "datasource": {
1022 - "type": "elasticsearch",
1023 - "uid": "replace_datasource_uid"
1024 - },
1025 - "metrics": [
1026 - {
1027 - "field": "select field",
1028 - "id": "1",
1029 - "type": "count"
1030 - }
1031 - ],
1032 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1033 - "refId": "A",
1034 - "timeField": "timestamp"
1035 - }
1036 - ],
1037 - "thresholds": "0,10",
1038 - "title": "APPLICATIONS ACCESS BY SRC COUNTRY",
1039 - "type": "grafana-worldmap-panel",
1040 - "unitPlural": "",
1041 - "unitSingle": "",
1042 - "valueName": "total"
1043 - },
1044 - {
1045 - "datasource": {
1046 - "type": "elasticsearch",
1047 - "uid": "replace_datasource_uid"
1048 - },
1049 - "fieldConfig": {
1050 - "defaults": {
1051 - "color": {
1052 - "mode": "thresholds"
1053 - },
1054 - "custom": {
1055 - "align": "auto",
1056 - "cellOptions": {
1057 - "type": "auto"
1058 - },
1059 - "inspect": false
1060 - },
1061 - "mappings": [],
1062 - "thresholds": {
1063 - "mode": "absolute",
1064 - "steps": [
1065 - {
1066 - "color": "orange",
1067 - "value": null
1068 - }
1069 - ]
1070 - }
1071 - },
1072 - "overrides": [
1073 - {
1074 - "matcher": {
1075 - "id": "byName",
1076 - "options": "Count"
1077 - },
1078 - "properties": [
1079 - {
1080 - "id": "displayName",
1081 - "value": "EVENTS"
1082 - },
1083 - {
1084 - "id": "unit",
1085 - "value": "short"
1086 - },
1087 - {
1088 - "id": "decimals",
1089 - "value": -1
1090 - },
1091 - {
1092 - "id": "custom.align"
1093 - }
1094 - ]
1095 - },
1096 - {
1097 - "matcher": {
1098 - "id": "byName",
1099 - "options": "AD ACCOUNT"
1100 - },
1101 - "properties": [
1102 - {
1103 - "id": "custom.width",
1104 - "value": 377
1105 - }
1106 - ]
1107 - },
1108 - {
1109 - "matcher": {
1110 - "id": "byName",
1111 - "options": "data_office365_LogonError"
1112 - },
1113 - "properties": [
1114 - {
1115 - "id": "custom.width",
1116 - "value": 326
1117 - },
1118 - {
1119 - "id": "custom.cellOptions",
1120 - "value": {
1121 - "type": "color-text"
1122 - }
1123 - }
1124 - ]
1125 - },
1126 - {
1127 - "matcher": {
1128 - "id": "byName",
1129 - "options": "COUNTRY"
1130 - },
1131 - "properties": [
1132 - {
1133 - "id": "custom.width",
1134 - "value": 207
1135 - }
1136 - ]
1137 - }
1138 - ]
1139 - },
1140 - "gridPos": {
1141 - "h": 12,
1142 - "w": 14,
1143 - "x": 10,
1144 - "y": 20
1145 - },
1146 - "id": 66,
1147 - "options": {
1148 - "cellHeight": "sm",
1149 - "footer": {
1150 - "countRows": false,
1151 - "fields": "",
1152 - "reducer": [
1153 - "sum"
1154 - ],
1155 - "show": false
1156 - },
1157 - "showHeader": true,
1158 - "sortBy": []
1159 - },
1160 - "pluginVersion": "10.0.3",
1161 - "targets": [
1162 - {
1163 - "bucketAggs": [
1164 - {
1165 - "fake": true,
1166 - "field": "data_office365_UserId",
1167 - "id": "4",
1168 - "settings": {
1169 - "min_doc_count": 1,
1170 - "order": "desc",
1171 - "orderBy": "_count",
1172 - "size": "0"
1173 - },
1174 - "type": "terms"
1175 - },
1176 - {
1177 - "field": "data_office365_Workload",
1178 - "id": "5",
1179 - "settings": {
1180 - "min_doc_count": "1",
1181 - "order": "desc",
1182 - "orderBy": "_term",
1183 - "size": "10"
1184 - },
1185 - "type": "terms"
1186 - },
1187 - {
1188 - "field": "data_office365_ClientIP_country_code",
1189 - "id": "6",
1190 - "settings": {
1191 - "min_doc_count": "1",
1192 - "order": "desc",
1193 - "orderBy": "_term",
1194 - "size": "10"
1195 - },
1196 - "type": "terms"
1197 - }
1198 - ],
1199 - "datasource": {
1200 - "type": "elasticsearch",
1201 - "uid": "replace_datasource_uid"
1202 - },
1203 - "metrics": [
1204 - {
1205 - "field": "select field",
1206 - "id": "1",
1207 - "type": "count"
1208 - }
1209 - ],
1210 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1211 - "refId": "A",
1212 - "timeField": "timestamp"
1213 - }
1214 - ],
1215 - "title": "APPS ACCESS BY ACCOUNT AND APP",
1216 - "transformations": [
1217 - {
1218 - "id": "merge",
1219 - "options": {
1220 - "reducers": []
1221 - }
1222 - },
1223 - {
1224 - "id": "organize",
1225 - "options": {
1226 - "excludeByName": {},
1227 - "indexByName": {},
1228 - "renameByName": {
1229 - "Count": "EVENTS",
1230 - "data_office365_ClientIP_country_code": "COUNTRY",
1231 - "data_office365_LogonError": "ERROR",
1232 - "data_office365_Operation": "WORKLOAD",
1233 - "data_office365_UserId": "AD ACCOUNT",
1234 - "data_office365_Workload": "WORKLOAD"
1235 - }
1236 - }
1237 - }
1238 - ],
1239 - "type": "table"
1240 - },
1241 - {
1242 - "datasource": {
1243 - "type": "elasticsearch",
1244 - "uid": "replace_datasource_uid"
1245 - },
1246 - "fieldConfig": {
1247 - "defaults": {
1248 - "color": {
1249 - "mode": "thresholds"
1250 - },
1251 - "custom": {
1252 - "align": "auto",
1253 - "cellOptions": {
1254 - "type": "auto"
1255 - },
1256 - "filterable": true,
1257 - "inspect": false
1258 - },
1259 - "mappings": [],
1260 - "thresholds": {
1261 - "mode": "absolute",
1262 - "steps": [
1263 - {
1264 - "color": "green"
1265 - },
1266 - {
1267 - "color": "red",
1268 - "value": 80
1269 - }
1270 - ]
1271 - }
1272 - },
1273 - "overrides": [
1274 - {
1275 - "matcher": {
1276 - "id": "byName",
1277 - "options": "rule_level"
1278 - },
1279 - "properties": [
1280 - {
1281 - "id": "displayName",
1282 - "value": "RULE LEVEL"
1283 - },
1284 - {
1285 - "id": "unit",
1286 - "value": "short"
1287 - },
1288 - {
1289 - "id": "decimals",
1290 - "value": -1
1291 - },
1292 - {
1293 - "id": "custom.cellOptions",
1294 - "value": {
1295 - "mode": "gradient",
1296 - "type": "color-background"
1297 - }
1298 - },
1299 - {
1300 - "id": "custom.align"
1301 - },
1302 - {
1303 - "id": "thresholds",
1304 - "value": {
1305 - "mode": "absolute",
1306 - "steps": [
1307 - {
1308 - "color": "#37872D"
1309 - },
1310 - {
1311 - "color": "rgba(237, 129, 40, 0.89)",
1312 - "value": 7
1313 - },
1314 - {
1315 - "color": "rgba(245, 54, 54, 0.9)",
1316 - "value": 12
1317 - }
1318 - ]
1319 - }
1320 - }
1321 - ]
1322 - },
1323 - {
1324 - "matcher": {
1325 - "id": "byName",
1326 - "options": "Date/Time"
1327 - },
1328 - "properties": [
1329 - {
1330 - "id": "custom.width",
1331 - "value": 242
1332 - }
1333 - ]
1334 - },
1335 - {
1336 - "matcher": {
1337 - "id": "byName",
1338 - "options": "MITRE TACTIC"
1339 - },
1340 - "properties": [
1341 - {
1342 - "id": "custom.width",
1343 - "value": 145
1344 - }
1345 - ]
1346 - },
1347 - {
1348 - "matcher": {
1349 - "id": "byName",
1350 - "options": "IP ADDRESS"
1351 - },
1352 - "properties": [
1353 - {
1354 - "id": "custom.width",
1355 - "value": 163
1356 - }
1357 - ]
1358 - },
1359 - {
1360 - "matcher": {
1361 - "id": "byName",
1362 - "options": "MITRE TECHNIQUE"
1363 - },
1364 - "properties": [
1365 - {
1366 - "id": "custom.width",
1367 - "value": 312
1368 - }
1369 - ]
1370 - },
1371 - {
1372 - "matcher": {
1373 - "id": "byName",
1374 - "options": "EVENT ID"
1375 - },
1376 - "properties": [
1377 - {
1378 - "id": "links",
1379 - "value": [
1380 - {
1381 - "targetBlank": true,
1382 - "title": "VIEW EVENT DETAILS",
1383 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1384 - }
1385 - ]
1386 - },
1387 - {
1388 - "id": "custom.width",
1389 - "value": 336
1390 - }
1391 - ]
1392 - },
1393 - {
1394 - "matcher": {
1395 - "id": "byName",
1396 - "options": "RESULT"
1397 - },
1398 - "properties": [
1399 - {
1400 - "id": "custom.width",
1401 - "value": 118
1402 - },
1403 - {
1404 - "id": "mappings",
1405 - "value": [
1406 - {
1407 - "options": {
1408 - "Failed": {
1409 - "color": "orange",
1410 - "index": 1
1411 - },
1412 - "Success": {
1413 - "color": "green",
1414 - "index": 0
1415 - }
1416 - },
1417 - "type": "value"
1418 - }
1419 - ]
1420 - },
1421 - {
1422 - "id": "custom.cellOptions",
1423 - "value": {
1424 - "type": "color-text"
1425 - }
1426 - }
1427 - ]
1428 - },
1429 - {
1430 - "matcher": {
1431 - "id": "byName",
1432 - "options": "SRC IP"
1433 - },
1434 - "properties": [
1435 - {
1436 - "id": "custom.width",
1437 - "value": 125
1438 - }
1439 - ]
1440 - },
1441 - {
1442 - "matcher": {
1443 - "id": "byName",
1444 - "options": "ACCOUNT"
1445 - },
1446 - "properties": [
1447 - {
1448 - "id": "custom.width",
1449 - "value": 343
1450 - }
1451 - ]
1452 - },
1453 - {
1454 - "matcher": {
1455 - "id": "byName",
1456 - "options": "EVENT TIME"
1457 - },
1458 - "properties": [
1459 - {
1460 - "id": "custom.width",
1461 - "value": 195
1462 - }
1463 - ]
1464 - }
1465 - ]
1466 - },
1467 - "gridPos": {
1468 - "h": 16,
1469 - "w": 24,
1470 - "x": 0,
1471 - "y": 32
1472 - },
1473 - "id": 27,
1474 - "options": {
1475 - "cellHeight": "sm",
1476 - "footer": {
1477 - "countRows": false,
1478 - "fields": "",
1479 - "reducer": [
1480 - "sum"
1481 - ],
1482 - "show": false
1483 - },
1484 - "showHeader": true,
1485 - "sortBy": []
1486 - },
1487 - "pluginVersion": "10.0.3",
1488 - "targets": [
1489 - {
1490 - "bucketAggs": [],
1491 - "datasource": {
1492 - "type": "elasticsearch",
1493 - "uid": "replace_datasource_uid"
1494 - },
1495 - "metrics": [
1496 - {
1497 - "id": "1",
1498 - "settings": {
1499 - "size": "250"
1500 - },
1501 - "type": "raw_data"
1502 - }
1503 - ],
1504 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1505 - "refId": "A",
1506 - "timeField": "timestamp"
1507 - }
1508 - ],
1509 - "title": "EVENTS",
1510 - "transformations": [
1511 - {
1512 - "id": "organize",
1513 - "options": {
1514 - "excludeByName": {
1515 - "@metadata_beat": true,
1516 - "@metadata_type": true,
1517 - "@metadata_version": true,
1518 - "IMPHASH": true,
1519 - "MD5": true,
1520 - "SHA1": true,
1521 - "SHA256": true,
1522 - "_id": false,
1523 - "_index": true,
1524 - "_type": true,
1525 - "agent_ephemeral_id": true,
1526 - "agent_hostname": true,
1527 - "agent_id": true,
1528 - "agent_ip_city_name": true,
1529 - "agent_ip_country_code": true,
1530 - "agent_ip_geolocation": true,
1531 - "agent_name": true,
1532 - "agent_type": true,
1533 - "agent_version": true,
1534 - "beats_type": true,
1535 - "cluster_name": true,
1536 - "cluster_node": true,
1537 - "collector_node_id": true,
1538 - "data_alert_action": true,
1539 - "data_alert_category": true,
1540 - "data_alert_gid": true,
1541 - "data_alert_rev": true,
1542 - "data_alert_severity": true,
1543 - "data_alert_signature": true,
1544 - "data_alert_signature_id": true,
1545 - "data_app_proto": true,
1546 - "data_audit_auid": true,
1547 - "data_audit_command": true,
1548 - "data_audit_euid": true,
1549 - "data_audit_exe": true,
1550 - "data_audit_gid": true,
1551 - "data_audit_id": true,
1552 - "data_audit_pid": true,
1553 - "data_audit_res": true,
1554 - "data_audit_session": true,
1555 - "data_audit_type": true,
1556 - "data_audit_uid": true,
1557 - "data_dest_ip": true,
1558 - "data_dest_port": true,
1559 - "data_dstuser": true,
1560 - "data_event_type": true,
1561 - "data_extra_data": true,
1562 - "data_file": true,
1563 - "data_flow_bytes_toclient": true,
1564 - "data_flow_bytes_toserver": true,
1565 - "data_flow_id": true,
1566 - "data_flow_pkts_toclient": true,
1567 - "data_flow_pkts_toserver": true,
1568 - "data_flow_start": true,
1569 - "data_http_http_content_type": true,
1570 - "data_http_http_port": true,
1571 - "data_http_length": true,
1572 - "data_http_status": true,
1573 - "data_http_url": true,
1574 - "data_id": true,
1575 - "data_in_iface": true,
1576 - "data_integration": true,
1577 - "data_metadata_flowbits": true,
1578 - "data_metadata_flowints_http_anomaly_count": true,
1579 - "data_metadata_flowints_tcp_retransmission_count": true,
1580 - "data_office365_Activity": true,
1581 - "data_office365_ActivityId": true,
1582 - "data_office365_ActivityParameters": true,
1583 - "data_office365_Actor": true,
1584 - "data_office365_ActorContextId": true,
1585 - "data_office365_ActorIpAddress": false,
1586 - "data_office365_ActorIpAddress_city_name": true,
1587 - "data_office365_ActorIpAddress_country_code": true,
1588 - "data_office365_ActorIpAddress_geolocation": true,
1589 - "data_office365_ActorUserId": true,
1590 - "data_office365_ActorYammerUserId": true,
1591 - "data_office365_AdditionalInfo": true,
1592 - "data_office365_AffectedItems": true,
1593 - "data_office365_AppAccessContext_AADSessionId": true,
1594 - "data_office365_AppAccessContext_APIId": true,
1595 - "data_office365_AppAccessContext_ClientAppId": true,
1596 - "data_office365_AppAccessContext_ClientAppName": true,
1597 - "data_office365_AppAccessContext_CorrelationId": true,
1598 - "data_office365_AppAccessContext_IssuedAtTime": true,
1599 - "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1600 - "data_office365_AppAccessContext_UniqueTokenId": true,
1601 - "data_office365_AppId": true,
1602 - "data_office365_AppName": true,
1603 - "data_office365_AppReportId": true,
1604 - "data_office365_Application": true,
1605 - "data_office365_ApplicationDisplayName": true,
1606 - "data_office365_ApplicationId": true,
1607 - "data_office365_ArtifactId": true,
1608 - "data_office365_ArtifactName": true,
1609 - "data_office365_AssertingApplicationId": true,
1610 - "data_office365_AuthenticationType": true,
1611 - "data_office365_AzureActiveDirectoryEventType": true,
1612 - "data_office365_BrowserName": true,
1613 - "data_office365_BrowserVersion": true,
1614 - "data_office365_BrowserVersion_city_name": true,
1615 - "data_office365_BrowserVersion_country_code": true,
1616 - "data_office365_BrowserVersion_geolocation": true,
1617 - "data_office365_CapacityId": true,
1618 - "data_office365_CapacityName": true,
1619 - "data_office365_ChatThreadId": true,
1620 - "data_office365_ClientAppId": true,
1621 - "data_office365_ClientIP": false,
1622 - "data_office365_ClientIPAddress": true,
1623 - "data_office365_ClientIPAddress_city_name": true,
1624 - "data_office365_ClientIPAddress_country_code": true,
1625 - "data_office365_ClientIPAddress_geolocation": true,
1626 - "data_office365_ClientIP_city_name": true,
1627 - "data_office365_ClientIP_country_code": true,
1628 - "data_office365_ClientIP_geolocation": true,
1629 - "data_office365_ClientIP_reserved_ip": true,
1630 - "data_office365_ClientInfoString": true,
1631 - "data_office365_ClientRequestId": true,
1632 - "data_office365_CmdletVersion": true,
1633 - "data_office365_CommunicationType": true,
1634 - "data_office365_ConsumptionMethod": true,
1635 - "data_office365_CorrelationId": true,
1636 - "data_office365_CreationTime": false,
1637 - "data_office365_CrossMailboxOperation": true,
1638 - "data_office365_CustomUniqueId": true,
1639 - "data_office365_CustomizedDoclib": true,
1640 - "data_office365_DashboardId": true,
1641 - "data_office365_DashboardName": true,
1642 - "data_office365_DataConnectivityMode": true,
1643 - "data_office365_DataflowAccessTokenRequestParameters_entityName": true,
1644 - "data_office365_DataflowAccessTokenRequestParameters_partitionUri": true,
1645 - "data_office365_DataflowAccessTokenRequestParameters_permissions": true,
1646 - "data_office365_DataflowAccessTokenRequestParameters_tokenLifetimeInMinutes": true,
1647 - "data_office365_DataflowId": true,
1648 - "data_office365_DataflowName": true,
1649 - "data_office365_DataflowType": true,
1650 - "data_office365_DatasetId": true,
1651 - "data_office365_DatasetName": true,
1652 - "data_office365_Datasets": true,
1653 - "data_office365_DatasourceId": true,
1654 - "data_office365_DestFolder_Id": true,
1655 - "data_office365_DestFolder_Path": true,
1656 - "data_office365_DestinationLocationType": true,
1657 - "data_office365_DeviceDisplayName": true,
1658 - "data_office365_DeviceDisplayName_city_name": true,
1659 - "data_office365_DeviceDisplayName_country_code": true,
1660 - "data_office365_DeviceDisplayName_geolocation": true,
1661 - "data_office365_DeviceName": true,
1662 - "data_office365_DeviceProperties": true,
1663 - "data_office365_DistributionMethod": true,
1664 - "data_office365_DoNotDistributeEvent": true,
1665 - "data_office365_EnforcementMode": true,
1666 - "data_office365_Entity": true,
1667 - "data_office365_ErrorNumber": true,
1668 - "data_office365_EventData": true,
1669 - "data_office365_EventSource": true,
1670 - "data_office365_ExtendedProperties": true,
1671 - "data_office365_ExternalAccess": true,
1672 - "data_office365_ExtraProperties": true,
1673 - "data_office365_FileExtension": true,
1674 - "data_office365_FileId": true,
1675 - "data_office365_FileName": true,
1676 - "data_office365_FileSize": true,
1677 - "data_office365_FileSizeBytes": true,
1678 - "data_office365_FileType": true,
1679 - "data_office365_Folder_Id": true,
1680 - "data_office365_Folder_Path": true,
1681 - "data_office365_FormId": true,
1682 - "data_office365_FormName": true,
1683 - "data_office365_FormsUserType": true,
1684 - "data_office365_FromApp": true,
1685 - "data_office365_GatewayId": true,
1686 - "data_office365_Hidden": true,
1687 - "data_office365_HighPriorityMediaProcessing": true,
1688 - "data_office365_Id": true,
1689 - "data_office365_ImplicitShare": true,
1690 - "data_office365_ImportDisplayName": true,
1691 - "data_office365_ImportId": true,
1692 - "data_office365_ImportSource": true,
1693 - "data_office365_ImportType": true,
1694 - "data_office365_InterSystemsId": true,
1695 - "data_office365_InternalLogonType": true,
1696 - "data_office365_IntraSystemId": true,
1697 - "data_office365_IsManagedDevice": true,
1698 - "data_office365_IsPolicyHit": true,
1699 - "data_office365_IsSuccess": true,
1700 - "data_office365_ItemCount": true,
1701 - "data_office365_ItemName": true,
1702 - "data_office365_ItemType": true,
1703 - "data_office365_Item_Id": true,
1704 - "data_office365_Item_InternetMessageId": true,
1705 - "data_office365_Item_IsRecord": true,
1706 - "data_office365_Item_ParentFolder_Id": true,
1707 - "data_office365_Item_ParentFolder_Path": true,
1708 - "data_office365_Item_SizeInBytes": true,
1709 - "data_office365_Item_Subject": true,
1710 - "data_office365_JitTriggered": true,
1711 - "data_office365_LastRefreshTime": true,
1712 - "data_office365_ListBaseTemplateType": true,
1713 - "data_office365_ListBaseType": true,
1714 - "data_office365_ListId": true,
1715 - "data_office365_ListItemUniqueId": true,
1716 - "data_office365_ListServerTemplate": true,
1717 - "data_office365_ListTitle": true,
1718 - "data_office365_LogonError": true,
1719 - "data_office365_LogonType": true,
1720 - "data_office365_LogonUserSid": true,
1721 - "data_office365_MDATPDeviceId": true,
1722 - "data_office365_MailboxGuid": true,
1723 - "data_office365_MailboxOwnerSid": true,
1724 - "data_office365_MailboxOwnerUPN": true,
1725 - "data_office365_MessageId": true,
1726 - "data_office365_MessageReactionType": true,
1727 - "data_office365_MessageVersion": true,
1728 - "data_office365_ModelsSnapshots": true,
1729 - "data_office365_ModifiedProperties": true,
1730 - "data_office365_ObjectId": true,
1731 - "data_office365_ObjectName": true,
1732 - "data_office365_Operation": false,
1733 - "data_office365_OrganizationId": true,
1734 - "data_office365_OrganizationName": true,
1735 - "data_office365_OriginatingServer": true,
1736 - "data_office365_Parameters": true,
1737 - "data_office365_ParticipantInfo_HasForeignTenantUsers": true,
1738 - "data_office365_ParticipantInfo_HasGuestUsers": true,
1739 - "data_office365_ParticipantInfo_HasOtherGuestUsers": true,
1740 - "data_office365_ParticipantInfo_HasUnauthenticatedUsers": true,
1741 - "data_office365_ParticipantInfo_ParticipatingTenantIds": true,
1742 - "data_office365_Platform": true,
1743 - "data_office365_RMSEncrypted": true,
1744 - "data_office365_RecordType": true,
1745 - "data_office365_RefreshType": true,
1746 - "data_office365_ReportId": true,
1747 - "data_office365_ReportName": true,
1748 - "data_office365_ReportType": true,
1749 - "data_office365_RequestId": true,
1750 - "data_office365_ResourceTenantId": true,
1751 - "data_office365_ResultDescription": true,
1752 - "data_office365_ResultStatus": false,
1753 - "data_office365_SRPolicyMatchDetails_SRPolicyId": true,
1754 - "data_office365_SRPolicyMatchDetails_SRPolicyName": true,
1755 - "data_office365_Schedules_Days": true,
1756 - "data_office365_Schedules_RefreshFrequency": true,
1757 - "data_office365_Schedules_Time": true,
1758 - "data_office365_Schedules_TimeZone": true,
1759 - "data_office365_Scope": true,
1760 - "data_office365_SearchQueryText": true,
1761 - "data_office365_SessionId": true,
1762 - "data_office365_Sha1": true,
1763 - "data_office365_Sha256": true,
1764 - "data_office365_ShareLinkId": true,
1765 - "data_office365_SharingAction": true,
1766 - "data_office365_Site": true,
1767 - "data_office365_SiteUrl": true,
1768 - "data_office365_SkypeForBusinessEventType": true,
1769 - "data_office365_Source": true,
1770 - "data_office365_SourceApp": true,
1771 - "data_office365_SourceFileExtension": true,
1772 - "data_office365_SourceFileName": true,
1773 - "data_office365_SourceLocationType": true,
1774 - "data_office365_SourceRelativeUrl": true,
1775 - "data_office365_Subscription": true,
1776 - "data_office365_TableName": true,
1777 - "data_office365_Target": true,
1778 - "data_office365_TargetContextId": true,
1779 - "data_office365_TargetFilePath": true,
1780 - "data_office365_TenantName": true,
1781 - "data_office365_ThreadID": true,
1782 - "data_office365_UserAgent": true,
1783 - "data_office365_UserId": false,
1784 - "data_office365_UserKey": true,
1785 - "data_office365_UserType": true,
1786 - "data_office365_Version": true,
1787 - "data_office365_VersionId": true,
1788 - "data_office365_WebId": true,
1789 - "data_office365_WorkSpaceName": true,
1790 - "data_office365_Workload": false,
1791 - "data_office365_WorkspaceId": true,
1792 - "data_office365_YammerNetworkId": true,
1793 - "data_osquery_action": true,
1794 - "data_osquery_calendarTime": true,
1795 - "data_osquery_columns_address": true,
1796 - "data_osquery_columns_address_city_name": true,
1797 - "data_osquery_columns_address_country_code": true,
1798 - "data_osquery_columns_address_geolocation": true,
1799 - "data_osquery_columns_cmdline": true,
1800 - "data_osquery_columns_cwd": true,
1801 - "data_osquery_columns_description": true,
1802 - "data_osquery_columns_directory": true,
1803 - "data_osquery_columns_disk_bytes_read": true,
1804 - "data_osquery_columns_disk_bytes_written": true,
1805 - "data_osquery_columns_egid": true,
1806 - "data_osquery_columns_euid": true,
1807 - "data_osquery_columns_family": true,
1808 - "data_osquery_columns_fd": true,
1809 - "data_osquery_columns_gid": true,
1810 - "data_osquery_columns_gid_signed": true,
1811 - "data_osquery_columns_host": true,
1812 - "data_osquery_columns_interface": true,
1813 - "data_osquery_columns_local_address": true,
1814 - "data_osquery_columns_local_address_city_name": true,
1815 - "data_osquery_columns_local_address_country_code": true,
1816 - "data_osquery_columns_local_address_geolocation": true,
1817 - "data_osquery_columns_local_port": true,
1818 - "data_osquery_columns_mac": true,
1819 - "data_osquery_columns_name": true,
1820 - "data_osquery_columns_net_namespace": true,
1821 - "data_osquery_columns_nice": true,
1822 - "data_osquery_columns_on_disk": true,
1823 - "data_osquery_columns_parent": true,
1824 - "data_osquery_columns_path": true,
1825 - "data_osquery_columns_pgroup": true,
1826 - "data_osquery_columns_pid": true,
1827 - "data_osquery_columns_port": true,
1828 - "data_osquery_columns_protocol": true,
1829 - "data_osquery_columns_remote_address": true,
1830 - "data_osquery_columns_remote_address_city_name": true,
1831 - "data_osquery_columns_remote_address_country_code": true,
1832 - "data_osquery_columns_remote_address_geolocation": true,
1833 - "data_osquery_columns_remote_port": true,
1834 - "data_osquery_columns_resident_size": true,
1835 - "data_osquery_columns_root": true,
1836 - "data_osquery_columns_sgid": true,
1837 - "data_osquery_columns_shell": true,
1838 - "data_osquery_columns_socket": true,
1839 - "data_osquery_columns_start_time": true,
1840 - "data_osquery_columns_state": true,
1841 - "data_osquery_columns_suid": true,
1842 - "data_osquery_columns_system_time": true,
1843 - "data_osquery_columns_threads": true,
1844 - "data_osquery_columns_time_utc": true,
1845 - "data_osquery_columns_total_size": true,
1846 - "data_osquery_columns_tty": true,
1847 - "data_osquery_columns_type": true,
1848 - "data_osquery_columns_uid": true,
1849 - "data_osquery_columns_uid_signed": true,
1850 - "data_osquery_columns_user": true,
1851 - "data_osquery_columns_user_time": true,
1852 - "data_osquery_columns_username": true,
1853 - "data_osquery_columns_wired_size": true,
1854 - "data_osquery_counter": true,
1855 - "data_osquery_decorations_host_uuid": true,
1856 - "data_osquery_decorations_hostname": true,
1857 - "data_osquery_epoch": true,
1858 - "data_osquery_hostIdentifier": true,
1859 - "data_osquery_name": true,
1860 - "data_osquery_numerics": true,
1861 - "data_osquery_unixTime": true,
1862 - "data_proto": true,
1863 - "data_sca_check_command": true,
1864 - "data_sca_check_compliance_cis": true,
1865 - "data_sca_check_compliance_cis_csc": true,
1866 - "data_sca_check_compliance_gdpr_IV": true,
1867 - "data_sca_check_compliance_gpg_13": true,
1868 - "data_sca_check_compliance_hipaa": true,
1869 - "data_sca_check_compliance_nist_800_53": true,
1870 - "data_sca_check_compliance_pci_dss": true,
1871 - "data_sca_check_compliance_tsc": true,
1872 - "data_sca_check_description": true,
1873 - "data_sca_check_id": true,
1874 - "data_sca_check_previous_result": true,
1875 - "data_sca_check_rationale": true,
1876 - "data_sca_check_remediation": true,
1877 - "data_sca_check_result": true,
1878 - "data_sca_check_title": true,
1879 - "data_sca_description": true,
1880 - "data_sca_failed": true,
1881 - "data_sca_file": true,
1882 - "data_sca_invalid": true,
1883 - "data_sca_passed": true,
1884 - "data_sca_policy": true,
1885 - "data_sca_policy_id": true,
1886 - "data_sca_scan_id": true,
1887 - "data_sca_score": true,
1888 - "data_sca_total_checks": true,
1889 - "data_sca_type": true,
1890 - "data_script": true,
1891 - "data_src_ip": true,
1892 - "data_src_ip_city_name": true,
1893 - "data_src_ip_country_code": true,
1894 - "data_src_ip_geolocation": true,
1895 - "data_src_port": true,
1896 - "data_srcip": true,
1897 - "data_srcip_city_name": true,
1898 - "data_srcip_country_code": true,
1899 - "data_srcip_geolocation": true,
1900 - "data_srcuser": true,
1901 - "data_timestamp": true,
1902 - "data_title": true,
1903 - "data_tls_session_resumed": true,
1904 - "data_tls_version": true,
1905 - "data_tx_id": true,
1906 - "data_type": true,
1907 - "data_win_eventXML_binaryData": true,
1908 - "data_win_eventXML_binaryDataSize": true,
1909 - "data_win_eventXML_param1": true,
1910 - "data_win_eventdata_authenticationPackageName": true,
1911 - "data_win_eventdata_callTrace": true,
1912 - "data_win_eventdata_commandLine": true,
1913 - "data_win_eventdata_company": true,
1914 - "data_win_eventdata_creationUtcTime": true,
1915 - "data_win_eventdata_currentDirectory": true,
1916 - "data_win_eventdata_description": true,
1917 - "data_win_eventdata_destinationHostname": true,
1918 - "data_win_eventdata_destinationIp": true,
1919 - "data_win_eventdata_destinationIp_city_name": true,
1920 - "data_win_eventdata_destinationIp_country_code": true,
1921 - "data_win_eventdata_destinationIp_geolocation": true,
1922 - "data_win_eventdata_destinationIsIpv6": true,
1923 - "data_win_eventdata_destinationPort": true,
1924 - "data_win_eventdata_destinationPortName": true,
1925 - "data_win_eventdata_details": true,
1926 - "data_win_eventdata_elevatedToken": true,
1927 - "data_win_eventdata_eventType": true,
1928 - "data_win_eventdata_fileVersion": true,
1929 - "data_win_eventdata_fileVersion_city_name": true,
1930 - "data_win_eventdata_fileVersion_country_code": true,
1931 - "data_win_eventdata_fileVersion_geolocation": true,
1932 - "data_win_eventdata_grantedAccess": true,
1933 - "data_win_eventdata_hashes": true,
1934 - "data_win_eventdata_image": true,
1935 - "data_win_eventdata_imageLoaded": true,
1936 - "data_win_eventdata_impersonationLevel": true,
1937 - "data_win_eventdata_initiated": true,
1938 - "data_win_eventdata_integrityLevel": true,
1939 - "data_win_eventdata_ipAddress": true,
1940 - "data_win_eventdata_ipPort": true,
1941 - "data_win_eventdata_keyLength": true,
1942 - "data_win_eventdata_logonGuid": true,
1943 - "data_win_eventdata_logonId": true,
1944 - "data_win_eventdata_logonProcessName": true,
1945 - "data_win_eventdata_logonType": true,
1946 - "data_win_eventdata_originalFileName": true,
1947 - "data_win_eventdata_param1": true,
1948 - "data_win_eventdata_param2": true,
1949 - "data_win_eventdata_param3": true,
1950 - "data_win_eventdata_param4": true,
1951 - "data_win_eventdata_parentCommandLine": true,
1952 - "data_win_eventdata_parentImage": true,
1953 - "data_win_eventdata_parentProcessGuid": true,
1954 - "data_win_eventdata_parentProcessId": true,
1955 - "data_win_eventdata_processGuid": true,
1956 - "data_win_eventdata_processId": true,
1957 - "data_win_eventdata_processName": true,
1958 - "data_win_eventdata_product": true,
1959 - "data_win_eventdata_protocol": true,
1960 - "data_win_eventdata_queryName": true,
1961 - "data_win_eventdata_queryResults": true,
1962 - "data_win_eventdata_queryStatus": true,
1963 - "data_win_eventdata_ruleName": true,
1964 - "data_win_eventdata_serviceName": true,
1965 - "data_win_eventdata_serviceSid": true,
1966 - "data_win_eventdata_signature": true,
1967 - "data_win_eventdata_signatureStatus": true,
1968 - "data_win_eventdata_signed": true,
1969 - "data_win_eventdata_sourceHostname": true,
1970 - "data_win_eventdata_sourceImage": true,
1971 - "data_win_eventdata_sourceIp": true,
1972 - "data_win_eventdata_sourceIp_city_name": true,
1973 - "data_win_eventdata_sourceIp_country_code": true,
1974 - "data_win_eventdata_sourceIp_geolocation": true,
1975 - "data_win_eventdata_sourceIsIpv6": true,
1976 - "data_win_eventdata_sourcePort": true,
1977 - "data_win_eventdata_sourceProcessGUID": true,
1978 - "data_win_eventdata_sourceProcessId": true,
1979 - "data_win_eventdata_sourceThreadId": true,
1980 - "data_win_eventdata_status": true,
1981 - "data_win_eventdata_subjectDomainName": true,
1982 - "data_win_eventdata_subjectLogonId": true,
1983 - "data_win_eventdata_subjectUserName": true,
1984 - "data_win_eventdata_subjectUserSid": true,
1985 - "data_win_eventdata_targetDomainName": true,
1986 - "data_win_eventdata_targetFilename": true,
1987 - "data_win_eventdata_targetImage": true,
1988 - "data_win_eventdata_targetLinkedLogonId": true,
1989 - "data_win_eventdata_targetLogonId": true,
1990 - "data_win_eventdata_targetObject": true,
1991 - "data_win_eventdata_targetProcessGUID": true,
1992 - "data_win_eventdata_targetProcessId": true,
1993 - "data_win_eventdata_targetUserName": true,
1994 - "data_win_eventdata_targetUserSid": true,
1995 - "data_win_eventdata_terminalSessionId": true,
1996 - "data_win_eventdata_ticketEncryptionType": true,
1997 - "data_win_eventdata_ticketOptions": true,
1998 - "data_win_eventdata_user": true,
1999 - "data_win_eventdata_utcTime": true,
2000 - "data_win_eventdata_virtualAccount": true,
2001 - "data_win_system_channel": true,
2002 - "data_win_system_computer": true,
2003 - "data_win_system_eventID": true,
2004 - "data_win_system_eventRecordID": true,
2005 - "data_win_system_eventSourceName": true,
2006 - "data_win_system_keywords": true,
2007 - "data_win_system_level": true,
2008 - "data_win_system_message": true,
2009 - "data_win_system_opcode": true,
2010 - "data_win_system_processID": true,
2011 - "data_win_system_providerGuid": true,
2012 - "data_win_system_providerName": true,
2013 - "data_win_system_severityValue": true,
2014 - "data_win_system_systemTime": true,
2015 - "data_win_system_task": true,
2016 - "data_win_system_threadID": true,
2017 - "data_win_system_version": true,
2018 - "decoder_name": true,
2019 - "decoder_parent": true,
2020 - "dns_query": true,
2021 - "dns_query_threat_indicated": true,
2022 - "dst_ip": true,
2023 - "dst_ip_city_name": true,
2024 - "dst_ip_country_code": true,
2025 - "dst_ip_geolocation": true,
2026 - "dst_ip_threat_indicated": true,
2027 - "dst_port": true,
2028 - "ecs_version": true,
2029 - "error": true,
2030 - "event_hash": true,
2031 - "file_path": true,
2032 - "firewall_rule_name": true,
2033 - "full_log": false,
2034 - "gl2_accounted_message_size": true,
2035 - "gl2_message_id": true,
2036 - "gl2_processing_error": true,
2037 - "gl2_remote_ip": true,
2038 - "gl2_remote_port": true,
2039 - "gl2_source_collector": true,
2040 - "gl2_source_input": true,
2041 - "gl2_source_node": true,
2042 - "hash_md5": true,
2043 - "hash_sha1": true,
2044 - "hash_sha256": true,
2045 - "highlight": true,
2046 - "host_architecture": true,
2047 - "host_containerized": true,
2048 - "host_hostname": true,
2049 - "host_id": true,
2050 - "host_ip": true,
2051 - "host_mac": true,
2052 - "host_name": true,
2053 - "host_os_codename": true,
2054 - "host_os_kernel": true,
2055 - "host_os_name": true,
2056 - "host_os_platform": true,
2057 - "host_os_version": true,
2058 - "hostname": true,
2059 - "id": true,
2060 - "input_type": true,
2061 - "level": true,
2062 - "location": true,
2063 - "log_file_path": true,
2064 - "log_offset": true,
2065 - "manager_name": true,
2066 - "message": true,
2067 - "module": true,
2068 - "msg_timestamp": true,
2069 - "parent_process_cmd_line": true,
2070 - "parent_process_id": true,
2071 - "parent_process_image": true,
2072 - "pid": true,
2073 - "predecoder_hostname": true,
2074 - "predecoder_program_name": true,
2075 - "predecoder_timestamp": true,
2076 - "previous_log": true,
2077 - "previous_output": true,
2078 - "process_cmd_line": true,
2079 - "process_id": true,
2080 - "process_image": true,
2081 - "process_name": true,
2082 - "protocol": true,
2083 - "rule_cis": true,
2084 - "rule_cis_csc": true,
2085 - "rule_description": true,
2086 - "rule_firedtimes": true,
2087 - "rule_gdpr": true,
2088 - "rule_gdpr_IV": true,
2089 - "rule_gpg13": true,
2090 - "rule_gpg_13": true,
2091 - "rule_group1": true,
2092 - "rule_group2": true,
2093 - "rule_group3": true,
2094 - "rule_groups": true,
2095 - "rule_hipaa": true,
2096 - "rule_id": true,
2097 - "rule_info": true,
2098 - "rule_mail": true,
2099 - "rule_mitre_id": true,
2100 - "rule_mitre_tactic": false,
2101 - "rule_nist_800_53": true,
2102 - "rule_pci_dss": true,
2103 - "rule_tsc": true,
2104 - "scanid": true,
2105 - "service": true,
2106 - "software_package": true,
2107 - "software_vendor": true,
2108 - "sort": true,
2109 - "source": true,
2110 - "source_reserved_ip": true,
2111 - "src_ip": true,
2112 - "src_ip_city_name": true,
2113 - "src_ip_country_code": true,
2114 - "src_ip_geolocation": true,
2115 - "src_port": true,
2116 - "streams": true,
2117 - "syscheck_attrs_after": true,
2118 - "syscheck_audit_effective_user_id": true,
2119 - "syscheck_audit_effective_user_name": true,
2120 - "syscheck_audit_group_id": true,
2121 - "syscheck_audit_group_name": true,
2122 - "syscheck_audit_login_user_id": true,
2123 - "syscheck_audit_login_user_name": true,
2124 - "syscheck_audit_process_cwd": true,
2125 - "syscheck_audit_process_id": true,
2126 - "syscheck_audit_process_name": true,
2127 - "syscheck_audit_process_parent_cwd": true,
2128 - "syscheck_audit_process_parent_name": true,
2129 - "syscheck_audit_process_ppid": true,
2130 - "syscheck_audit_user_id": true,
2131 - "syscheck_audit_user_name": true,
2132 - "syscheck_changed_attributes": true,
2133 - "syscheck_event": true,
2134 - "syscheck_gid_after": true,
2135 - "syscheck_gname_after": true,
2136 - "syscheck_hard_links": true,
2137 - "syscheck_inode_after": true,
2138 - "syscheck_inode_before": true,
2139 - "syscheck_md5_after": true,
2140 - "syscheck_md5_before": true,
2141 - "syscheck_mode": true,
2142 - "syscheck_mtime_after": true,
2143 - "syscheck_mtime_before": true,
2144 - "syscheck_path": true,
2145 - "syscheck_perm_after": true,
2146 - "syscheck_perm_before": true,
2147 - "syscheck_sha1_after": true,
2148 - "syscheck_sha1_before": true,
2149 - "syscheck_sha256_after": true,
2150 - "syscheck_sha256_before": true,
2151 - "syscheck_size_after": true,
2152 - "syscheck_size_before": true,
2153 - "syscheck_uid_after": true,
2154 - "syscheck_uname_after": true,
2155 - "syscheck_win_perm_after": true,
2156 - "syscheck_win_perm_after_0_allowed": true,
2157 - "syscheck_win_perm_after_0_name": true,
2158 - "syscheck_win_perm_after_1_allowed": true,
2159 - "syscheck_win_perm_after_1_name": true,
2160 - "syscheck_win_perm_after_2_allowed": true,
2161 - "syscheck_win_perm_after_2_name": true,
2162 - "syscheck_win_perm_after_3_allowed": true,
2163 - "syscheck_win_perm_after_3_name": true,
2164 - "syslog_customer": true,
2165 - "syslog_level": true,
2166 - "syslog_tag": true,
2167 - "syslog_type": true,
2168 - "sysmon_event_description": true,
2169 - "threat_ids": true,
2170 - "threat_indicated": true,
2171 - "threat_names": true,
2172 - "time": true,
2173 - "timestamp": true,
2174 - "true": true,
2175 - "user_name": true,
2176 - "win_registry_key": true,
2177 - "win_system_eventID": true,
2178 - "windows_auth_package": true,
2179 - "windows_domain": true,
2180 - "windows_event_id": true,
2181 - "windows_event_severity": true,
2182 - "windows_logon_type": true
2183 - },
2184 - "indexByName": {
2185 - "_id": 2,
2186 - "_index": 12,
2187 - "_type": 13,
2188 - "agent_id": 14,
2189 - "agent_name": 7,
2190 - "cluster_name": 15,
2191 - "cluster_node": 16,
2192 - "data_office365_Activity": 50,
2193 - "data_office365_ActivityId": 51,
2194 - "data_office365_ActivityParameters": 52,
2195 - "data_office365_ActorUserId": 53,
2196 - "data_office365_ActorYammerUserId": 54,
2197 - "data_office365_AdditionalInfo": 55,
2198 - "data_office365_AppAccessContext_AADSessionId": 56,
2199 - "data_office365_AppAccessContext_CorrelationId": 57,
2200 - "data_office365_AppAccessContext_UniqueTokenId": 58,
2201 - "data_office365_AppName": 59,
2202 - "data_office365_CapacityId": 60,
2203 - "data_office365_CapacityName": 61,
2204 - "data_office365_ClientIP": 4,
2205 - "data_office365_ClientIP_city_name": 17,
2206 - "data_office365_ClientIP_country_code": 18,
2207 - "data_office365_ClientIP_geolocation": 19,
2208 - "data_office365_ConsumptionMethod": 62,
2209 - "data_office365_CorrelationId": 63,
2210 - "data_office365_CreationTime": 0,
2211 - "data_office365_DashboardId": 64,
2212 - "data_office365_DashboardName": 65,
2213 - "data_office365_DatasetId": 66,
2214 - "data_office365_DatasetName": 67,
2215 - "data_office365_Datasets": 68,
2216 - "data_office365_DistributionMethod": 69,
2217 - "data_office365_Entity": 70,
2218 - "data_office365_EventSource": 71,
2219 - "data_office365_FileId": 72,
2220 - "data_office365_FileName": 73,
2221 - "data_office365_FormId": 74,
2222 - "data_office365_FormName": 75,
2223 - "data_office365_FormsUserType": 76,
2224 - "data_office365_Id": 20,
2225 - "data_office365_IsSuccess": 77,
2226 - "data_office365_ItemName": 78,
2227 - "data_office365_ItemType": 79,
2228 - "data_office365_ModelsSnapshots": 80,
2229 - "data_office365_ObjectId": 21,
2230 - "data_office365_Operation": 6,
2231 - "data_office365_OrganizationId": 22,
2232 - "data_office365_RecordType": 23,
2233 - "data_office365_ReportId": 81,
2234 - "data_office365_ReportName": 82,
2235 - "data_office365_ReportType": 83,
2236 - "data_office365_RequestId": 84,
2237 - "data_office365_ResultStatus": 8,
2238 - "data_office365_SourceApp": 85,
2239 - "data_office365_ThreadID": 86,
2240 - "data_office365_UserAgent": 87,
2241 - "data_office365_UserId": 3,
2242 - "data_office365_UserKey": 24,
2243 - "data_office365_UserType": 25,
2244 - "data_office365_Version": 26,
2245 - "data_office365_VersionId": 88,
2246 - "data_office365_WorkSpaceName": 89,
2247 - "data_office365_Workload": 5,
2248 - "data_office365_WorkspaceId": 90,
2249 - "data_office365_YammerNetworkId": 91,
2250 - "decoder_name": 27,
2251 - "gl2_accounted_message_size": 28,
2252 - "gl2_message_id": 29,
2253 - "gl2_processing_error": 30,
2254 - "gl2_remote_ip": 31,
2255 - "gl2_remote_port": 32,
2256 - "gl2_source_input": 33,
2257 - "gl2_source_node": 34,
2258 - "highlight": 35,
2259 - "id": 36,
2260 - "location": 37,
2261 - "manager_name": 38,
2262 - "message": 39,
2263 - "rule_description": 9,
2264 - "rule_firedtimes": 40,
2265 - "rule_group1": 41,
2266 - "rule_groups": 42,
2267 - "rule_id": 11,
2268 - "rule_level": 10,
2269 - "rule_mail": 43,
2270 - "sort": 44,
2271 - "source": 45,
2272 - "streams": 46,
2273 - "syslog_level": 47,
2274 - "syslog_type": 48,
2275 - "timestamp": 1,
2276 - "true": 49
2277 - },
2278 - "renameByName": {
2279 - "_id": "EVENT ID",
2280 - "agent_name": "",
2281 - "data_office365_ActorIpAddress": "SRC IP",
2282 - "data_office365_Application": "APP",
2283 - "data_office365_ClientIP": "SRC IP",
2284 - "data_office365_CreationTime": "EVENT TIME",
2285 - "data_office365_Operation": "OPERATION",
2286 - "data_office365_ResultStatus": "RESULT",
2287 - "data_office365_UserId": "ACCOUNT",
2288 - "data_office365_Workload": "WORKLOAD",
2289 - "decoder_name": "",
2290 - "rule_description": "DESCRIPTION",
2291 - "rule_id": "RULE ID",
2292 - "rule_level": "",
2293 - "rule_mitre_tactic": "MITRE TACTIC",
2294 - "rule_mitre_technique": "MITRE TECHNIQUE",
2295 - "timestamp": "Date/Time"
2296 - }
2297 - }
2298 - }
2299 - ],
2300 - "transparent": true,
2301 - "type": "table"
2302 - }
2303 - ],
2304 - "refresh": "",
2305 - "schemaVersion": 38,
2306 - "style": "dark",
2307 - "tags": [
2308 - "O365"
2309 - ],
2310 - "templating": {
2311 - "list": [
2312 - {
2313 - "datasource": {
2314 - "type": "elasticsearch",
2315 - "uid": "replace_datasource_uid"
2316 - },
2317 - "filters": [],
2318 - "hide": 0,
2319 - "label": "",
2320 - "name": "Filters",
2321 - "skipUrlSync": false,
2322 - "type": "adhoc"
2323 - },
2324 - {
2325 - "current": {
2326 - "selected": false,
2327 - "text": "All",
2328 - "value": "$__all"
2329 - },
2330 - "datasource": {
2331 - "type": "elasticsearch",
2332 - "uid": "replace_datasource_uid"
2333 - },
2334 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2335 - "hide": 0,
2336 - "includeAll": true,
2337 - "label": "Workload",
2338 - "multi": false,
2339 - "name": "workload",
2340 - "options": [],
2341 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2342 - "refresh": 2,
2343 - "regex": "",
2344 - "skipUrlSync": false,
2345 - "sort": 1,
2346 - "tagValuesQuery": "",
2347 - "tagsQuery": "",
2348 - "type": "query",
2349 - "useTags": false
2350 - },
2351 - {
2352 - "current": {
2353 - "selected": false,
2354 - "text": "All",
2355 - "value": "$__all"
2356 - },
2357 - "datasource": {
2358 - "type": "elasticsearch",
2359 - "uid": "replace_datasource_uid"
2360 - },
2361 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2362 - "hide": 0,
2363 - "includeAll": true,
2364 - "label": "Rule Level",
2365 - "multi": false,
2366 - "name": "rule_level",
2367 - "options": [],
2368 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2369 - "refresh": 2,
2370 - "regex": "",
2371 - "skipUrlSync": false,
2372 - "sort": 0,
2373 - "type": "query"
2374 - }
2375 - ]
2376 - },
2377 - "time": {
2378 - "from": "now-6h",
2379 - "to": "now"
2380 - },
2381 - "timepicker": {
2382 - "refresh_intervals": [
2383 - "5s",
2384 - "10s",
2385 - "30s",
2386 - "1m",
2387 - "5m",
2388 - "15m",
2389 - "30m",
2390 - "1h",
2391 - "2h",
2392 - "1d"
2393 - ],
2394 - "time_options": [
2395 - "5m",
2396 - "15m",
2397 - "1h",
2398 - "6h",
2399 - "12h",
2400 - "24h",
2401 - "2d",
2402 - "7d",
2403 - "30d"
2404 - ]
2405 - },
2406 - "timezone": "",
2407 - "title": "O365 - APPLICATIONS",
2408 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "10.0.3",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Workload:$workload",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "pie",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Workload",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY WORKLOAD (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "cellOptions": {
255 + "type": "auto"
256 + },
257 + "inspect": false
258 + },
259 + "mappings": [],
260 + "thresholds": {
261 + "mode": "absolute",
262 + "steps": [
263 + {
264 + "color": "red",
265 + "value": null
266 + }
267 + ]
268 + }
269 + },
270 + "overrides": [
271 + {
272 + "matcher": {
273 + "id": "byName",
274 + "options": "Count"
275 + },
276 + "properties": [
277 + {
278 + "id": "displayName",
279 + "value": "EVENTS"
280 + },
281 + {
282 + "id": "unit",
283 + "value": "short"
284 + },
285 + {
286 + "id": "decimals",
287 + "value": -1
288 + },
289 + {
290 + "id": "custom.align"
291 + },
292 + {
293 + "id": "thresholds",
294 + "value": {
295 + "mode": "absolute",
296 + "steps": [
297 + {
298 + "color": "red",
299 + "value": null
300 + }
301 + ]
302 + }
303 + }
304 + ]
305 + }
306 + ]
307 + },
308 + "gridPos": {
309 + "h": 7,
310 + "w": 6,
311 + "x": 8,
312 + "y": 0
313 + },
314 + "id": 54,
315 + "options": {
316 + "cellHeight": "sm",
317 + "footer": {
318 + "countRows": false,
319 + "fields": "",
320 + "reducer": ["sum"],
321 + "show": false
322 + },
323 + "showHeader": true
324 + },
325 + "pluginVersion": "10.0.3",
326 + "targets": [
327 + {
328 + "bucketAggs": [
329 + {
330 + "fake": true,
331 + "field": "data_office365_Workload",
332 + "id": "4",
333 + "settings": {
334 + "min_doc_count": 1,
335 + "order": "desc",
336 + "orderBy": "_count",
337 + "size": "0"
338 + },
339 + "type": "terms"
340 + }
341 + ],
342 + "datasource": {
343 + "type": "elasticsearch",
344 + "uid": "replace_datasource_uid"
345 + },
346 + "metrics": [
347 + {
348 + "field": "select field",
349 + "id": "1",
350 + "type": "count"
351 + }
352 + ],
353 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
354 + "refId": "A",
355 + "timeField": "timestamp"
356 + }
357 + ],
358 + "title": "EVENTS BY WORKLOAD",
359 + "transformations": [
360 + {
361 + "id": "merge",
362 + "options": {
363 + "reducers": []
364 + }
365 + },
366 + {
367 + "id": "organize",
368 + "options": {
369 + "excludeByName": {},
370 + "indexByName": {},
371 + "renameByName": {
372 + "Count": "EVENTS",
373 + "data_office365_Operation": "OPERATION",
374 + "data_office365_Workload": "WORKLOAD"
375 + }
376 + }
377 + }
378 + ],
379 + "type": "table"
380 + },
381 + {
382 + "datasource": {
383 + "type": "elasticsearch",
384 + "uid": "replace_datasource_uid"
385 + },
386 + "fieldConfig": {
387 + "defaults": {
388 + "color": {
389 + "mode": "palette-classic"
390 + },
391 + "custom": {
392 + "hideFrom": {
393 + "legend": false,
394 + "tooltip": false,
395 + "viz": false
396 + }
397 + },
398 + "mappings": []
399 + },
400 + "overrides": [
401 + {
402 + "matcher": {
403 + "id": "byName",
404 + "options": "Count"
405 + },
406 + "properties": [
407 + {
408 + "id": "displayName",
409 + "value": "EVENTS"
410 + },
411 + {
412 + "id": "unit",
413 + "value": "short"
414 + },
415 + {
416 + "id": "decimals",
417 + "value": -1
418 + }
419 + ]
420 + }
421 + ]
422 + },
423 + "gridPos": {
424 + "h": 7,
425 + "w": 4,
426 + "x": 14,
427 + "y": 0
428 + },
429 + "id": 61,
430 + "options": {
431 + "legend": {
432 + "displayMode": "list",
433 + "placement": "bottom",
434 + "showLegend": false
435 + },
436 + "pieType": "donut",
437 + "reduceOptions": {
438 + "calcs": ["sum"],
439 + "fields": "",
440 + "values": false
441 + },
442 + "tooltip": {
443 + "mode": "single",
444 + "sort": "none"
445 + }
446 + },
447 + "pluginVersion": "8.5.1",
448 + "targets": [
449 + {
450 + "bucketAggs": [
451 + {
452 + "fake": true,
453 + "field": "data_office365_Operation",
454 + "id": "4",
455 + "settings": {
456 + "min_doc_count": 1,
457 + "order": "desc",
458 + "orderBy": "_count",
459 + "size": "10"
460 + },
461 + "type": "terms"
462 + },
463 + {
464 + "field": "data_office365_CreationTime",
465 + "id": "5",
466 + "settings": {
467 + "interval": "auto",
468 + "min_doc_count": "0",
469 + "timeZone": "utc",
470 + "trimEdges": "0"
471 + },
472 + "type": "date_histogram"
473 + }
474 + ],
475 + "datasource": {
476 + "type": "elasticsearch",
477 + "uid": "replace_datasource_uid"
478 + },
479 + "metrics": [
480 + {
481 + "field": "select field",
482 + "id": "1",
483 + "type": "count"
484 + }
485 + ],
486 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
487 + "refId": "A",
488 + "timeField": "timestamp"
489 + }
490 + ],
491 + "title": "EVENTS BY OPERATION (Top 10)",
492 + "transformations": [],
493 + "type": "piechart"
494 + },
495 + {
496 + "datasource": {
497 + "type": "elasticsearch",
498 + "uid": "replace_datasource_uid"
499 + },
500 + "fieldConfig": {
501 + "defaults": {
502 + "color": {
503 + "mode": "thresholds"
504 + },
505 + "custom": {
506 + "align": "auto",
507 + "cellOptions": {
508 + "type": "auto"
509 + },
510 + "inspect": false
511 + },
512 + "mappings": [],
513 + "thresholds": {
514 + "mode": "absolute",
515 + "steps": [
516 + {
517 + "color": "red",
518 + "value": null
519 + }
520 + ]
521 + }
522 + },
523 + "overrides": [
524 + {
525 + "matcher": {
526 + "id": "byName",
527 + "options": "Count"
528 + },
529 + "properties": [
530 + {
531 + "id": "displayName",
532 + "value": "EVENTS"
533 + },
534 + {
535 + "id": "unit",
536 + "value": "short"
537 + },
538 + {
539 + "id": "decimals",
540 + "value": -1
541 + },
542 + {
543 + "id": "custom.align"
544 + },
545 + {
546 + "id": "thresholds",
547 + "value": {
548 + "mode": "absolute",
549 + "steps": [
550 + {
551 + "color": "red",
552 + "value": null
553 + }
554 + ]
555 + }
556 + }
557 + ]
558 + }
559 + ]
560 + },
561 + "gridPos": {
562 + "h": 7,
563 + "w": 6,
564 + "x": 18,
565 + "y": 0
566 + },
567 + "id": 62,
568 + "options": {
569 + "cellHeight": "sm",
570 + "footer": {
571 + "countRows": false,
572 + "fields": "",
573 + "reducer": ["sum"],
574 + "show": false
575 + },
576 + "showHeader": true
577 + },
578 + "pluginVersion": "10.0.3",
579 + "targets": [
580 + {
581 + "bucketAggs": [
582 + {
583 + "fake": true,
584 + "field": "data_office365_Operation",
585 + "id": "4",
586 + "settings": {
587 + "min_doc_count": 1,
588 + "order": "desc",
589 + "orderBy": "_count",
590 + "size": "0"
591 + },
592 + "type": "terms"
593 + }
594 + ],
595 + "datasource": {
596 + "type": "elasticsearch",
597 + "uid": "replace_datasource_uid"
598 + },
599 + "metrics": [
600 + {
601 + "field": "select field",
602 + "id": "1",
603 + "type": "count"
604 + }
605 + ],
606 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
607 + "refId": "A",
608 + "timeField": "timestamp"
609 + }
610 + ],
611 + "title": "EVENTS BY OPERATION",
612 + "transformations": [
613 + {
614 + "id": "merge",
615 + "options": {
616 + "reducers": []
617 + }
618 + },
619 + {
620 + "id": "organize",
621 + "options": {
622 + "excludeByName": {},
623 + "indexByName": {},
624 + "renameByName": {
625 + "Count": "EVENTS",
626 + "data_office365_Operation": "OPERATION",
627 + "data_office365_Workload": "WORKLOAD"
628 + }
629 + }
630 + }
631 + ],
632 + "type": "table"
633 + },
634 + {
635 + "datasource": {
636 + "type": "elasticsearch",
637 + "uid": "replace_datasource_uid"
638 + },
639 + "fieldConfig": {
640 + "defaults": {
641 + "color": {
642 + "mode": "thresholds"
643 + },
644 + "mappings": [
645 + {
646 + "options": {
647 + "match": "null",
648 + "result": {
649 + "text": "N/A"
650 + }
651 + },
652 + "type": "special"
653 + }
654 + ],
655 + "max": 15,
656 + "min": 0,
657 + "thresholds": {
658 + "mode": "absolute",
659 + "steps": [
660 + {
661 + "color": "#299c46",
662 + "value": null
663 + },
664 + {
665 + "color": "rgba(237, 129, 40, 0.89)",
666 + "value": 8
667 + },
668 + {
669 + "color": "#d44a3a",
670 + "value": 12
671 + }
672 + ]
673 + },
674 + "unit": "none"
675 + },
676 + "overrides": []
677 + },
678 + "gridPos": {
679 + "h": 7,
680 + "w": 4,
681 + "x": 0,
682 + "y": 7
683 + },
684 + "id": 16,
685 + "links": [],
686 + "options": {
687 + "orientation": "horizontal",
688 + "reduceOptions": {
689 + "calcs": ["max"],
690 + "fields": "",
691 + "values": false
692 + },
693 + "showThresholdLabels": false,
694 + "showThresholdMarkers": true,
695 + "text": {}
696 + },
697 + "pluginVersion": "10.0.3",
698 + "targets": [
699 + {
700 + "bucketAggs": [
701 + {
702 + "field": "timestamp",
703 + "id": "2",
704 + "settings": {
705 + "interval": "auto",
706 + "min_doc_count": 0,
707 + "trimEdges": 0
708 + },
709 + "type": "date_histogram"
710 + }
711 + ],
712 + "datasource": {
713 + "type": "elasticsearch",
714 + "uid": "replace_datasource_uid"
715 + },
716 + "metrics": [
717 + {
718 + "field": "rule_level",
719 + "id": "1",
720 + "meta": {},
721 + "settings": {},
722 + "type": "max"
723 + }
724 + ],
725 + "query": "data_office365_Workload:$workload",
726 + "refId": "A",
727 + "timeField": "timestamp"
728 + }
729 + ],
730 + "title": "MAX SEVERITY (0 - 15)",
731 + "type": "gauge"
732 + },
733 + {
734 + "datasource": {
735 + "type": "elasticsearch",
736 + "uid": "replace_datasource_uid"
737 + },
738 + "fieldConfig": {
739 + "defaults": {
740 + "color": {
741 + "mode": "palette-classic"
742 + },
743 + "custom": {
744 + "axisCenteredZero": false,
745 + "axisColorMode": "text",
746 + "axisLabel": "",
747 + "axisPlacement": "auto",
748 + "barAlignment": 0,
749 + "drawStyle": "bars",
750 + "fillOpacity": 0,
751 + "gradientMode": "none",
752 + "hideFrom": {
753 + "legend": false,
754 + "tooltip": false,
755 + "viz": false
756 + },
757 + "lineInterpolation": "linear",
758 + "lineWidth": 1,
759 + "pointSize": 5,
760 + "scaleDistribution": {
761 + "type": "linear"
762 + },
763 + "showPoints": "auto",
764 + "spanNulls": false,
765 + "stacking": {
766 + "group": "A",
767 + "mode": "normal"
768 + },
769 + "thresholdsStyle": {
770 + "mode": "off"
771 + }
772 + },
773 + "mappings": [],
774 + "thresholds": {
775 + "mode": "absolute",
776 + "steps": [
777 + {
778 + "color": "green",
779 + "value": null
780 + },
781 + {
782 + "color": "red",
783 + "value": 80
784 + }
785 + ]
786 + }
787 + },
788 + "overrides": []
789 + },
790 + "gridPos": {
791 + "h": 13,
792 + "w": 20,
793 + "x": 4,
794 + "y": 7
795 + },
796 + "id": 68,
797 + "options": {
798 + "legend": {
799 + "calcs": [],
800 + "displayMode": "table",
801 + "placement": "right",
802 + "showLegend": true
803 + },
804 + "tooltip": {
805 + "mode": "single",
806 + "sort": "none"
807 + }
808 + },
809 + "targets": [
810 + {
811 + "alias": "",
812 + "bucketAggs": [
813 + {
814 + "field": "data_office365_Operation",
815 + "id": "3",
816 + "settings": {
817 + "min_doc_count": "1",
818 + "order": "desc",
819 + "orderBy": "_count",
820 + "size": "10"
821 + },
822 + "type": "terms"
823 + },
824 + {
825 + "field": "timestamp",
826 + "id": "2",
827 + "settings": {
828 + "interval": "auto"
829 + },
830 + "type": "date_histogram"
831 + }
832 + ],
833 + "datasource": {
834 + "type": "elasticsearch",
835 + "uid": "replace_datasource_uid"
836 + },
837 + "metrics": [
838 + {
839 + "id": "1",
840 + "type": "count"
841 + }
842 + ],
843 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
844 + "refId": "A",
845 + "timeField": "timestamp"
846 + }
847 + ],
848 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
849 + "transparent": true,
850 + "type": "timeseries"
851 + },
852 + {
853 + "datasource": {
854 + "type": "elasticsearch",
855 + "uid": "replace_datasource_uid"
856 + },
857 + "fieldConfig": {
858 + "defaults": {
859 + "mappings": [
860 + {
861 + "options": {
862 + "match": "null",
863 + "result": {
864 + "text": "N/A"
865 + }
866 + },
867 + "type": "special"
868 + }
869 + ],
870 + "thresholds": {
871 + "mode": "absolute",
872 + "steps": [
873 + {
874 + "color": "blue",
875 + "value": null
876 + }
877 + ]
878 + },
879 + "unit": "locale"
880 + },
881 + "overrides": []
882 + },
883 + "gridPos": {
884 + "h": 6,
885 + "w": 4,
886 + "x": 0,
887 + "y": 14
888 + },
889 + "id": 51,
890 + "links": [],
891 + "options": {
892 + "colorMode": "value",
893 + "graphMode": "area",
894 + "justifyMode": "auto",
895 + "orientation": "horizontal",
896 + "reduceOptions": {
897 + "calcs": ["sum"],
898 + "fields": "",
899 + "values": false
900 + },
901 + "text": {},
902 + "textMode": "auto"
903 + },
904 + "pluginVersion": "10.0.3",
905 + "targets": [
906 + {
907 + "bucketAggs": [
908 + {
909 + "$$hashKey": "object:331",
910 + "field": "timestamp",
911 + "id": "2",
912 + "settings": {
913 + "interval": "auto",
914 + "min_doc_count": 0,
915 + "trimEdges": 0
916 + },
917 + "type": "date_histogram"
918 + }
919 + ],
920 + "datasource": {
921 + "type": "elasticsearch",
922 + "uid": "replace_datasource_uid"
923 + },
924 + "metrics": [
925 + {
926 + "$$hashKey": "object:329",
927 + "field": "select field",
928 + "id": "1",
929 + "type": "count"
930 + }
931 + ],
932 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
933 + "refId": "A",
934 + "timeField": "timestamp"
935 + }
936 + ],
937 + "title": "EVENTS (Total)",
938 + "type": "stat"
939 + },
940 + {
941 + "circleMaxSize": 30,
942 + "circleMinSize": 2,
943 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
944 + "datasource": {
945 + "type": "elasticsearch",
946 + "uid": "replace_datasource_uid"
947 + },
948 + "decimals": 0,
949 + "esMetric": "Count",
950 + "gridPos": {
951 + "h": 12,
952 + "w": 10,
953 + "x": 0,
954 + "y": 20
955 + },
956 + "hideEmpty": false,
957 + "hideZero": false,
958 + "id": 64,
959 + "initialZoom": 1,
960 + "locationData": "countries",
961 + "mapCenter": "(0°, 0°)",
962 + "mapCenterLatitude": 0,
963 + "mapCenterLongitude": 0,
964 + "maxDataPoints": 1,
965 + "mouseWheelZoom": false,
966 + "showLegend": true,
967 + "stickyLabels": false,
968 + "tableQueryOptions": {
969 + "geohashField": "geohash",
970 + "latitudeField": "latitude",
971 + "longitudeField": "longitude",
972 + "metricField": "metric",
973 + "queryType": "geohash"
974 + },
975 + "targets": [
976 + {
977 + "bucketAggs": [
978 + {
979 + "fake": true,
980 + "field": "data_office365_ClientIP_country_code",
981 + "id": "3",
982 + "settings": {
983 + "min_doc_count": 1,
984 + "order": "desc",
985 + "orderBy": "_term",
986 + "size": "0"
987 + },
988 + "type": "terms"
989 + },
990 + {
991 + "field": "timestamp",
992 + "id": "2",
993 + "settings": {
994 + "interval": "auto",
995 + "min_doc_count": 0,
996 + "trimEdges": 0
997 + },
998 + "type": "date_histogram"
999 + }
1000 + ],
1001 + "datasource": {
1002 + "type": "elasticsearch",
1003 + "uid": "replace_datasource_uid"
1004 + },
1005 + "metrics": [
1006 + {
1007 + "field": "select field",
1008 + "id": "1",
1009 + "type": "count"
1010 + }
1011 + ],
1012 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1013 + "refId": "A",
1014 + "timeField": "timestamp"
1015 + }
1016 + ],
1017 + "thresholds": "0,10",
1018 + "title": "APPLICATIONS ACCESS BY SRC COUNTRY",
1019 + "type": "grafana-worldmap-panel",
1020 + "unitPlural": "",
1021 + "unitSingle": "",
1022 + "valueName": "total"
1023 + },
1024 + {
1025 + "datasource": {
1026 + "type": "elasticsearch",
1027 + "uid": "replace_datasource_uid"
1028 + },
1029 + "fieldConfig": {
1030 + "defaults": {
1031 + "color": {
1032 + "mode": "thresholds"
1033 + },
1034 + "custom": {
1035 + "align": "auto",
1036 + "cellOptions": {
1037 + "type": "auto"
1038 + },
1039 + "inspect": false
1040 + },
1041 + "mappings": [],
1042 + "thresholds": {
1043 + "mode": "absolute",
1044 + "steps": [
1045 + {
1046 + "color": "orange",
1047 + "value": null
1048 + }
1049 + ]
1050 + }
1051 + },
1052 + "overrides": [
1053 + {
1054 + "matcher": {
1055 + "id": "byName",
1056 + "options": "Count"
1057 + },
1058 + "properties": [
1059 + {
1060 + "id": "displayName",
1061 + "value": "EVENTS"
1062 + },
1063 + {
1064 + "id": "unit",
1065 + "value": "short"
1066 + },
1067 + {
1068 + "id": "decimals",
1069 + "value": -1
1070 + },
1071 + {
1072 + "id": "custom.align"
1073 + }
1074 + ]
1075 + },
1076 + {
1077 + "matcher": {
1078 + "id": "byName",
1079 + "options": "AD ACCOUNT"
1080 + },
1081 + "properties": [
1082 + {
1083 + "id": "custom.width",
1084 + "value": 377
1085 + }
1086 + ]
1087 + },
1088 + {
1089 + "matcher": {
1090 + "id": "byName",
1091 + "options": "data_office365_LogonError"
1092 + },
1093 + "properties": [
1094 + {
1095 + "id": "custom.width",
1096 + "value": 326
1097 + },
1098 + {
1099 + "id": "custom.cellOptions",
1100 + "value": {
1101 + "type": "color-text"
1102 + }
1103 + }
1104 + ]
1105 + },
1106 + {
1107 + "matcher": {
1108 + "id": "byName",
1109 + "options": "COUNTRY"
1110 + },
1111 + "properties": [
1112 + {
1113 + "id": "custom.width",
1114 + "value": 207
1115 + }
1116 + ]
1117 + }
1118 + ]
1119 + },
1120 + "gridPos": {
1121 + "h": 12,
1122 + "w": 14,
1123 + "x": 10,
1124 + "y": 20
1125 + },
1126 + "id": 66,
1127 + "options": {
1128 + "cellHeight": "sm",
1129 + "footer": {
1130 + "countRows": false,
1131 + "fields": "",
1132 + "reducer": ["sum"],
1133 + "show": false
1134 + },
1135 + "showHeader": true,
1136 + "sortBy": []
1137 + },
1138 + "pluginVersion": "10.0.3",
1139 + "targets": [
1140 + {
1141 + "bucketAggs": [
1142 + {
1143 + "fake": true,
1144 + "field": "data_office365_UserId",
1145 + "id": "4",
1146 + "settings": {
1147 + "min_doc_count": 1,
1148 + "order": "desc",
1149 + "orderBy": "_count",
1150 + "size": "0"
1151 + },
1152 + "type": "terms"
1153 + },
1154 + {
1155 + "field": "data_office365_Workload",
1156 + "id": "5",
1157 + "settings": {
1158 + "min_doc_count": "1",
1159 + "order": "desc",
1160 + "orderBy": "_term",
1161 + "size": "10"
1162 + },
1163 + "type": "terms"
1164 + },
1165 + {
1166 + "field": "data_office365_ClientIP_country_code",
1167 + "id": "6",
1168 + "settings": {
1169 + "min_doc_count": "1",
1170 + "order": "desc",
1171 + "orderBy": "_term",
1172 + "size": "10"
1173 + },
1174 + "type": "terms"
1175 + }
1176 + ],
1177 + "datasource": {
1178 + "type": "elasticsearch",
1179 + "uid": "replace_datasource_uid"
1180 + },
1181 + "metrics": [
1182 + {
1183 + "field": "select field",
1184 + "id": "1",
1185 + "type": "count"
1186 + }
1187 + ],
1188 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1189 + "refId": "A",
1190 + "timeField": "timestamp"
1191 + }
1192 + ],
1193 + "title": "APPS ACCESS BY ACCOUNT AND APP",
1194 + "transformations": [
1195 + {
1196 + "id": "merge",
1197 + "options": {
1198 + "reducers": []
1199 + }
1200 + },
1201 + {
1202 + "id": "organize",
1203 + "options": {
1204 + "excludeByName": {},
1205 + "indexByName": {},
1206 + "renameByName": {
1207 + "Count": "EVENTS",
1208 + "data_office365_ClientIP_country_code": "COUNTRY",
1209 + "data_office365_LogonError": "ERROR",
1210 + "data_office365_Operation": "WORKLOAD",
1211 + "data_office365_UserId": "AD ACCOUNT",
1212 + "data_office365_Workload": "WORKLOAD"
1213 + }
1214 + }
1215 + }
1216 + ],
1217 + "type": "table"
1218 + },
1219 + {
1220 + "datasource": {
1221 + "type": "elasticsearch",
1222 + "uid": "replace_datasource_uid"
1223 + },
1224 + "fieldConfig": {
1225 + "defaults": {
1226 + "color": {
1227 + "mode": "thresholds"
1228 + },
1229 + "custom": {
1230 + "align": "auto",
1231 + "cellOptions": {
1232 + "type": "auto"
1233 + },
1234 + "filterable": true,
1235 + "inspect": false
1236 + },
1237 + "mappings": [],
1238 + "thresholds": {
1239 + "mode": "absolute",
1240 + "steps": [
1241 + {
1242 + "color": "green"
1243 + },
1244 + {
1245 + "color": "red",
1246 + "value": 80
1247 + }
1248 + ]
1249 + }
1250 + },
1251 + "overrides": [
1252 + {
1253 + "matcher": {
1254 + "id": "byName",
1255 + "options": "rule_level"
1256 + },
1257 + "properties": [
1258 + {
1259 + "id": "displayName",
1260 + "value": "RULE LEVEL"
1261 + },
1262 + {
1263 + "id": "unit",
1264 + "value": "short"
1265 + },
1266 + {
1267 + "id": "decimals",
1268 + "value": -1
1269 + },
1270 + {
1271 + "id": "custom.cellOptions",
1272 + "value": {
1273 + "mode": "gradient",
1274 + "type": "color-background"
1275 + }
1276 + },
1277 + {
1278 + "id": "custom.align"
1279 + },
1280 + {
1281 + "id": "thresholds",
1282 + "value": {
1283 + "mode": "absolute",
1284 + "steps": [
1285 + {
1286 + "color": "#37872D"
1287 + },
1288 + {
1289 + "color": "rgba(237, 129, 40, 0.89)",
1290 + "value": 7
1291 + },
1292 + {
1293 + "color": "rgba(245, 54, 54, 0.9)",
1294 + "value": 12
1295 + }
1296 + ]
1297 + }
1298 + }
1299 + ]
1300 + },
1301 + {
1302 + "matcher": {
1303 + "id": "byName",
1304 + "options": "Date/Time"
1305 + },
1306 + "properties": [
1307 + {
1308 + "id": "custom.width",
1309 + "value": 242
1310 + }
1311 + ]
1312 + },
1313 + {
1314 + "matcher": {
1315 + "id": "byName",
1316 + "options": "MITRE TACTIC"
1317 + },
1318 + "properties": [
1319 + {
1320 + "id": "custom.width",
1321 + "value": 145
1322 + }
1323 + ]
1324 + },
1325 + {
1326 + "matcher": {
1327 + "id": "byName",
1328 + "options": "IP ADDRESS"
1329 + },
1330 + "properties": [
1331 + {
1332 + "id": "custom.width",
1333 + "value": 163
1334 + }
1335 + ]
1336 + },
1337 + {
1338 + "matcher": {
1339 + "id": "byName",
1340 + "options": "MITRE TECHNIQUE"
1341 + },
1342 + "properties": [
1343 + {
1344 + "id": "custom.width",
1345 + "value": 312
1346 + }
1347 + ]
1348 + },
1349 + {
1350 + "matcher": {
1351 + "id": "byName",
1352 + "options": "EVENT ID"
1353 + },
1354 + "properties": [
1355 + {
1356 + "id": "links",
1357 + "value": [
1358 + {
1359 + "targetBlank": true,
1360 + "title": "VIEW EVENT DETAILS",
1361 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1362 + }
1363 + ]
1364 + },
1365 + {
1366 + "id": "custom.width",
1367 + "value": 336
1368 + }
1369 + ]
1370 + },
1371 + {
1372 + "matcher": {
1373 + "id": "byName",
1374 + "options": "RESULT"
1375 + },
1376 + "properties": [
1377 + {
1378 + "id": "custom.width",
1379 + "value": 118
1380 + },
1381 + {
1382 + "id": "mappings",
1383 + "value": [
1384 + {
1385 + "options": {
1386 + "Failed": {
1387 + "color": "orange",
1388 + "index": 1
1389 + },
1390 + "Success": {
1391 + "color": "green",
1392 + "index": 0
1393 + }
1394 + },
1395 + "type": "value"
1396 + }
1397 + ]
1398 + },
1399 + {
1400 + "id": "custom.cellOptions",
1401 + "value": {
1402 + "type": "color-text"
1403 + }
1404 + }
1405 + ]
1406 + },
1407 + {
1408 + "matcher": {
1409 + "id": "byName",
1410 + "options": "SRC IP"
1411 + },
1412 + "properties": [
1413 + {
1414 + "id": "custom.width",
1415 + "value": 125
1416 + }
1417 + ]
1418 + },
1419 + {
1420 + "matcher": {
1421 + "id": "byName",
1422 + "options": "ACCOUNT"
1423 + },
1424 + "properties": [
1425 + {
1426 + "id": "custom.width",
1427 + "value": 343
1428 + }
1429 + ]
1430 + },
1431 + {
1432 + "matcher": {
1433 + "id": "byName",
1434 + "options": "EVENT TIME"
1435 + },
1436 + "properties": [
1437 + {
1438 + "id": "custom.width",
1439 + "value": 195
1440 + }
1441 + ]
1442 + }
1443 + ]
1444 + },
1445 + "gridPos": {
1446 + "h": 16,
1447 + "w": 24,
1448 + "x": 0,
1449 + "y": 32
1450 + },
1451 + "id": 27,
1452 + "options": {
1453 + "cellHeight": "sm",
1454 + "footer": {
1455 + "countRows": false,
1456 + "fields": "",
1457 + "reducer": ["sum"],
1458 + "show": false
1459 + },
1460 + "showHeader": true,
1461 + "sortBy": []
1462 + },
1463 + "pluginVersion": "10.0.3",
1464 + "targets": [
1465 + {
1466 + "bucketAggs": [],
1467 + "datasource": {
1468 + "type": "elasticsearch",
1469 + "uid": "replace_datasource_uid"
1470 + },
1471 + "metrics": [
1472 + {
1473 + "id": "1",
1474 + "settings": {
1475 + "size": "250"
1476 + },
1477 + "type": "raw_data"
1478 + }
1479 + ],
1480 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1481 + "refId": "A",
1482 + "timeField": "timestamp"
1483 + }
1484 + ],
1485 + "title": "EVENTS",
1486 + "transformations": [
1487 + {
1488 + "id": "organize",
1489 + "options": {
1490 + "excludeByName": {
1491 + "@metadata_beat": true,
1492 + "@metadata_type": true,
1493 + "@metadata_version": true,
1494 + "IMPHASH": true,
1495 + "MD5": true,
1496 + "SHA1": true,
1497 + "SHA256": true,
1498 + "_id": false,
1499 + "_index": true,
1500 + "_type": true,
1501 + "agent_ephemeral_id": true,
1502 + "agent_hostname": true,
1503 + "agent_id": true,
1504 + "agent_ip_city_name": true,
1505 + "agent_ip_country_code": true,
1506 + "agent_ip_geolocation": true,
1507 + "agent_name": true,
1508 + "agent_type": true,
1509 + "agent_version": true,
1510 + "beats_type": true,
1511 + "cluster_name": true,
1512 + "cluster_node": true,
1513 + "collector_node_id": true,
1514 + "data_alert_action": true,
1515 + "data_alert_category": true,
1516 + "data_alert_gid": true,
1517 + "data_alert_rev": true,
1518 + "data_alert_severity": true,
1519 + "data_alert_signature": true,
1520 + "data_alert_signature_id": true,
1521 + "data_app_proto": true,
1522 + "data_audit_auid": true,
1523 + "data_audit_command": true,
1524 + "data_audit_euid": true,
1525 + "data_audit_exe": true,
1526 + "data_audit_gid": true,
1527 + "data_audit_id": true,
1528 + "data_audit_pid": true,
1529 + "data_audit_res": true,
1530 + "data_audit_session": true,
1531 + "data_audit_type": true,
1532 + "data_audit_uid": true,
1533 + "data_dest_ip": true,
1534 + "data_dest_port": true,
1535 + "data_dstuser": true,
1536 + "data_event_type": true,
1537 + "data_extra_data": true,
1538 + "data_file": true,
1539 + "data_flow_bytes_toclient": true,
1540 + "data_flow_bytes_toserver": true,
1541 + "data_flow_id": true,
1542 + "data_flow_pkts_toclient": true,
1543 + "data_flow_pkts_toserver": true,
1544 + "data_flow_start": true,
1545 + "data_http_http_content_type": true,
1546 + "data_http_http_port": true,
1547 + "data_http_length": true,
1548 + "data_http_status": true,
1549 + "data_http_url": true,
1550 + "data_id": true,
1551 + "data_in_iface": true,
1552 + "data_integration": true,
1553 + "data_metadata_flowbits": true,
1554 + "data_metadata_flowints_http_anomaly_count": true,
1555 + "data_metadata_flowints_tcp_retransmission_count": true,
1556 + "data_office365_Activity": true,
1557 + "data_office365_ActivityId": true,
1558 + "data_office365_ActivityParameters": true,
1559 + "data_office365_Actor": true,
1560 + "data_office365_ActorContextId": true,
1561 + "data_office365_ActorIpAddress": false,
1562 + "data_office365_ActorIpAddress_city_name": true,
1563 + "data_office365_ActorIpAddress_country_code": true,
1564 + "data_office365_ActorIpAddress_geolocation": true,
1565 + "data_office365_ActorUserId": true,
1566 + "data_office365_ActorYammerUserId": true,
1567 + "data_office365_AdditionalInfo": true,
1568 + "data_office365_AffectedItems": true,
1569 + "data_office365_AppAccessContext_AADSessionId": true,
1570 + "data_office365_AppAccessContext_APIId": true,
1571 + "data_office365_AppAccessContext_ClientAppId": true,
1572 + "data_office365_AppAccessContext_ClientAppName": true,
1573 + "data_office365_AppAccessContext_CorrelationId": true,
1574 + "data_office365_AppAccessContext_IssuedAtTime": true,
1575 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1576 + "data_office365_AppAccessContext_UniqueTokenId": true,
1577 + "data_office365_AppId": true,
1578 + "data_office365_AppName": true,
1579 + "data_office365_AppReportId": true,
1580 + "data_office365_Application": true,
1581 + "data_office365_ApplicationDisplayName": true,
1582 + "data_office365_ApplicationId": true,
1583 + "data_office365_ArtifactId": true,
1584 + "data_office365_ArtifactName": true,
1585 + "data_office365_AssertingApplicationId": true,
1586 + "data_office365_AuthenticationType": true,
1587 + "data_office365_AzureActiveDirectoryEventType": true,
1588 + "data_office365_BrowserName": true,
1589 + "data_office365_BrowserVersion": true,
1590 + "data_office365_BrowserVersion_city_name": true,
1591 + "data_office365_BrowserVersion_country_code": true,
1592 + "data_office365_BrowserVersion_geolocation": true,
1593 + "data_office365_CapacityId": true,
1594 + "data_office365_CapacityName": true,
1595 + "data_office365_ChatThreadId": true,
1596 + "data_office365_ClientAppId": true,
1597 + "data_office365_ClientIP": false,
1598 + "data_office365_ClientIPAddress": true,
1599 + "data_office365_ClientIPAddress_city_name": true,
1600 + "data_office365_ClientIPAddress_country_code": true,
1601 + "data_office365_ClientIPAddress_geolocation": true,
1602 + "data_office365_ClientIP_city_name": true,
1603 + "data_office365_ClientIP_country_code": true,
1604 + "data_office365_ClientIP_geolocation": true,
1605 + "data_office365_ClientIP_reserved_ip": true,
1606 + "data_office365_ClientInfoString": true,
1607 + "data_office365_ClientRequestId": true,
1608 + "data_office365_CmdletVersion": true,
1609 + "data_office365_CommunicationType": true,
1610 + "data_office365_ConsumptionMethod": true,
1611 + "data_office365_CorrelationId": true,
1612 + "data_office365_CreationTime": false,
1613 + "data_office365_CrossMailboxOperation": true,
1614 + "data_office365_CustomUniqueId": true,
1615 + "data_office365_CustomizedDoclib": true,
1616 + "data_office365_DashboardId": true,
1617 + "data_office365_DashboardName": true,
1618 + "data_office365_DataConnectivityMode": true,
1619 + "data_office365_DataflowAccessTokenRequestParameters_entityName": true,
1620 + "data_office365_DataflowAccessTokenRequestParameters_partitionUri": true,
1621 + "data_office365_DataflowAccessTokenRequestParameters_permissions": true,
1622 + "data_office365_DataflowAccessTokenRequestParameters_tokenLifetimeInMinutes": true,
1623 + "data_office365_DataflowId": true,
1624 + "data_office365_DataflowName": true,
1625 + "data_office365_DataflowType": true,
1626 + "data_office365_DatasetId": true,
1627 + "data_office365_DatasetName": true,
1628 + "data_office365_Datasets": true,
1629 + "data_office365_DatasourceId": true,
1630 + "data_office365_DestFolder_Id": true,
1631 + "data_office365_DestFolder_Path": true,
1632 + "data_office365_DestinationLocationType": true,
1633 + "data_office365_DeviceDisplayName": true,
1634 + "data_office365_DeviceDisplayName_city_name": true,
1635 + "data_office365_DeviceDisplayName_country_code": true,
1636 + "data_office365_DeviceDisplayName_geolocation": true,
1637 + "data_office365_DeviceName": true,
1638 + "data_office365_DeviceProperties": true,
1639 + "data_office365_DistributionMethod": true,
1640 + "data_office365_DoNotDistributeEvent": true,
1641 + "data_office365_EnforcementMode": true,
1642 + "data_office365_Entity": true,
1643 + "data_office365_ErrorNumber": true,
1644 + "data_office365_EventData": true,
1645 + "data_office365_EventSource": true,
1646 + "data_office365_ExtendedProperties": true,
1647 + "data_office365_ExternalAccess": true,
1648 + "data_office365_ExtraProperties": true,
1649 + "data_office365_FileExtension": true,
1650 + "data_office365_FileId": true,
1651 + "data_office365_FileName": true,
1652 + "data_office365_FileSize": true,
1653 + "data_office365_FileSizeBytes": true,
1654 + "data_office365_FileType": true,
1655 + "data_office365_Folder_Id": true,
1656 + "data_office365_Folder_Path": true,
1657 + "data_office365_FormId": true,
1658 + "data_office365_FormName": true,
1659 + "data_office365_FormsUserType": true,
1660 + "data_office365_FromApp": true,
1661 + "data_office365_GatewayId": true,
1662 + "data_office365_Hidden": true,
1663 + "data_office365_HighPriorityMediaProcessing": true,
1664 + "data_office365_Id": true,
1665 + "data_office365_ImplicitShare": true,
1666 + "data_office365_ImportDisplayName": true,
1667 + "data_office365_ImportId": true,
1668 + "data_office365_ImportSource": true,
1669 + "data_office365_ImportType": true,
1670 + "data_office365_InterSystemsId": true,
1671 + "data_office365_InternalLogonType": true,
1672 + "data_office365_IntraSystemId": true,
1673 + "data_office365_IsManagedDevice": true,
1674 + "data_office365_IsPolicyHit": true,
1675 + "data_office365_IsSuccess": true,
1676 + "data_office365_ItemCount": true,
1677 + "data_office365_ItemName": true,
1678 + "data_office365_ItemType": true,
1679 + "data_office365_Item_Id": true,
1680 + "data_office365_Item_InternetMessageId": true,
1681 + "data_office365_Item_IsRecord": true,
1682 + "data_office365_Item_ParentFolder_Id": true,
1683 + "data_office365_Item_ParentFolder_Path": true,
1684 + "data_office365_Item_SizeInBytes": true,
1685 + "data_office365_Item_Subject": true,
1686 + "data_office365_JitTriggered": true,
1687 + "data_office365_LastRefreshTime": true,
1688 + "data_office365_ListBaseTemplateType": true,
1689 + "data_office365_ListBaseType": true,
1690 + "data_office365_ListId": true,
1691 + "data_office365_ListItemUniqueId": true,
1692 + "data_office365_ListServerTemplate": true,
1693 + "data_office365_ListTitle": true,
1694 + "data_office365_LogonError": true,
1695 + "data_office365_LogonType": true,
1696 + "data_office365_LogonUserSid": true,
1697 + "data_office365_MDATPDeviceId": true,
1698 + "data_office365_MailboxGuid": true,
1699 + "data_office365_MailboxOwnerSid": true,
1700 + "data_office365_MailboxOwnerUPN": true,
1701 + "data_office365_MessageId": true,
1702 + "data_office365_MessageReactionType": true,
1703 + "data_office365_MessageVersion": true,
1704 + "data_office365_ModelsSnapshots": true,
1705 + "data_office365_ModifiedProperties": true,
1706 + "data_office365_ObjectId": true,
1707 + "data_office365_ObjectName": true,
1708 + "data_office365_Operation": false,
1709 + "data_office365_OrganizationId": true,
1710 + "data_office365_OrganizationName": true,
1711 + "data_office365_OriginatingServer": true,
1712 + "data_office365_Parameters": true,
1713 + "data_office365_ParticipantInfo_HasForeignTenantUsers": true,
1714 + "data_office365_ParticipantInfo_HasGuestUsers": true,
1715 + "data_office365_ParticipantInfo_HasOtherGuestUsers": true,
1716 + "data_office365_ParticipantInfo_HasUnauthenticatedUsers": true,
1717 + "data_office365_ParticipantInfo_ParticipatingTenantIds": true,
1718 + "data_office365_Platform": true,
1719 + "data_office365_RMSEncrypted": true,
1720 + "data_office365_RecordType": true,
1721 + "data_office365_RefreshType": true,
1722 + "data_office365_ReportId": true,
1723 + "data_office365_ReportName": true,
1724 + "data_office365_ReportType": true,
1725 + "data_office365_RequestId": true,
1726 + "data_office365_ResourceTenantId": true,
1727 + "data_office365_ResultDescription": true,
1728 + "data_office365_ResultStatus": false,
1729 + "data_office365_SRPolicyMatchDetails_SRPolicyId": true,
1730 + "data_office365_SRPolicyMatchDetails_SRPolicyName": true,
1731 + "data_office365_Schedules_Days": true,
1732 + "data_office365_Schedules_RefreshFrequency": true,
1733 + "data_office365_Schedules_Time": true,
1734 + "data_office365_Schedules_TimeZone": true,
1735 + "data_office365_Scope": true,
1736 + "data_office365_SearchQueryText": true,
1737 + "data_office365_SessionId": true,
1738 + "data_office365_Sha1": true,
1739 + "data_office365_Sha256": true,
1740 + "data_office365_ShareLinkId": true,
1741 + "data_office365_SharingAction": true,
1742 + "data_office365_Site": true,
1743 + "data_office365_SiteUrl": true,
1744 + "data_office365_SkypeForBusinessEventType": true,
1745 + "data_office365_Source": true,
1746 + "data_office365_SourceApp": true,
1747 + "data_office365_SourceFileExtension": true,
1748 + "data_office365_SourceFileName": true,
1749 + "data_office365_SourceLocationType": true,
1750 + "data_office365_SourceRelativeUrl": true,
1751 + "data_office365_Subscription": true,
1752 + "data_office365_TableName": true,
1753 + "data_office365_Target": true,
1754 + "data_office365_TargetContextId": true,
1755 + "data_office365_TargetFilePath": true,
1756 + "data_office365_TenantName": true,
1757 + "data_office365_ThreadID": true,
1758 + "data_office365_UserAgent": true,
1759 + "data_office365_UserId": false,
1760 + "data_office365_UserKey": true,
1761 + "data_office365_UserType": true,
1762 + "data_office365_Version": true,
1763 + "data_office365_VersionId": true,
1764 + "data_office365_WebId": true,
1765 + "data_office365_WorkSpaceName": true,
1766 + "data_office365_Workload": false,
1767 + "data_office365_WorkspaceId": true,
1768 + "data_office365_YammerNetworkId": true,
1769 + "data_osquery_action": true,
1770 + "data_osquery_calendarTime": true,
1771 + "data_osquery_columns_address": true,
1772 + "data_osquery_columns_address_city_name": true,
1773 + "data_osquery_columns_address_country_code": true,
1774 + "data_osquery_columns_address_geolocation": true,
1775 + "data_osquery_columns_cmdline": true,
1776 + "data_osquery_columns_cwd": true,
1777 + "data_osquery_columns_description": true,
1778 + "data_osquery_columns_directory": true,
1779 + "data_osquery_columns_disk_bytes_read": true,
1780 + "data_osquery_columns_disk_bytes_written": true,
1781 + "data_osquery_columns_egid": true,
1782 + "data_osquery_columns_euid": true,
1783 + "data_osquery_columns_family": true,
1784 + "data_osquery_columns_fd": true,
1785 + "data_osquery_columns_gid": true,
1786 + "data_osquery_columns_gid_signed": true,
1787 + "data_osquery_columns_host": true,
1788 + "data_osquery_columns_interface": true,
1789 + "data_osquery_columns_local_address": true,
1790 + "data_osquery_columns_local_address_city_name": true,
1791 + "data_osquery_columns_local_address_country_code": true,
1792 + "data_osquery_columns_local_address_geolocation": true,
1793 + "data_osquery_columns_local_port": true,
1794 + "data_osquery_columns_mac": true,
1795 + "data_osquery_columns_name": true,
1796 + "data_osquery_columns_net_namespace": true,
1797 + "data_osquery_columns_nice": true,
1798 + "data_osquery_columns_on_disk": true,
1799 + "data_osquery_columns_parent": true,
1800 + "data_osquery_columns_path": true,
1801 + "data_osquery_columns_pgroup": true,
1802 + "data_osquery_columns_pid": true,
1803 + "data_osquery_columns_port": true,
1804 + "data_osquery_columns_protocol": true,
1805 + "data_osquery_columns_remote_address": true,
1806 + "data_osquery_columns_remote_address_city_name": true,
1807 + "data_osquery_columns_remote_address_country_code": true,
1808 + "data_osquery_columns_remote_address_geolocation": true,
1809 + "data_osquery_columns_remote_port": true,
1810 + "data_osquery_columns_resident_size": true,
1811 + "data_osquery_columns_root": true,
1812 + "data_osquery_columns_sgid": true,
1813 + "data_osquery_columns_shell": true,
1814 + "data_osquery_columns_socket": true,
1815 + "data_osquery_columns_start_time": true,
1816 + "data_osquery_columns_state": true,
1817 + "data_osquery_columns_suid": true,
1818 + "data_osquery_columns_system_time": true,
1819 + "data_osquery_columns_threads": true,
1820 + "data_osquery_columns_time_utc": true,
1821 + "data_osquery_columns_total_size": true,
1822 + "data_osquery_columns_tty": true,
1823 + "data_osquery_columns_type": true,
1824 + "data_osquery_columns_uid": true,
1825 + "data_osquery_columns_uid_signed": true,
1826 + "data_osquery_columns_user": true,
1827 + "data_osquery_columns_user_time": true,
1828 + "data_osquery_columns_username": true,
1829 + "data_osquery_columns_wired_size": true,
1830 + "data_osquery_counter": true,
1831 + "data_osquery_decorations_host_uuid": true,
1832 + "data_osquery_decorations_hostname": true,
1833 + "data_osquery_epoch": true,
1834 + "data_osquery_hostIdentifier": true,
1835 + "data_osquery_name": true,
1836 + "data_osquery_numerics": true,
1837 + "data_osquery_unixTime": true,
1838 + "data_proto": true,
1839 + "data_sca_check_command": true,
1840 + "data_sca_check_compliance_cis": true,
1841 + "data_sca_check_compliance_cis_csc": true,
1842 + "data_sca_check_compliance_gdpr_IV": true,
1843 + "data_sca_check_compliance_gpg_13": true,
1844 + "data_sca_check_compliance_hipaa": true,
1845 + "data_sca_check_compliance_nist_800_53": true,
1846 + "data_sca_check_compliance_pci_dss": true,
1847 + "data_sca_check_compliance_tsc": true,
1848 + "data_sca_check_description": true,
1849 + "data_sca_check_id": true,
1850 + "data_sca_check_previous_result": true,
1851 + "data_sca_check_rationale": true,
1852 + "data_sca_check_remediation": true,
1853 + "data_sca_check_result": true,
1854 + "data_sca_check_title": true,
1855 + "data_sca_description": true,
1856 + "data_sca_failed": true,
1857 + "data_sca_file": true,
1858 + "data_sca_invalid": true,
1859 + "data_sca_passed": true,
1860 + "data_sca_policy": true,
1861 + "data_sca_policy_id": true,
1862 + "data_sca_scan_id": true,
1863 + "data_sca_score": true,
1864 + "data_sca_total_checks": true,
1865 + "data_sca_type": true,
1866 + "data_script": true,
1867 + "data_src_ip": true,
1868 + "data_src_ip_city_name": true,
1869 + "data_src_ip_country_code": true,
1870 + "data_src_ip_geolocation": true,
1871 + "data_src_port": true,
1872 + "data_srcip": true,
1873 + "data_srcip_city_name": true,
1874 + "data_srcip_country_code": true,
1875 + "data_srcip_geolocation": true,
1876 + "data_srcuser": true,
1877 + "data_timestamp": true,
1878 + "data_title": true,
1879 + "data_tls_session_resumed": true,
1880 + "data_tls_version": true,
1881 + "data_tx_id": true,
1882 + "data_type": true,
1883 + "data_win_eventXML_binaryData": true,
1884 + "data_win_eventXML_binaryDataSize": true,
1885 + "data_win_eventXML_param1": true,
1886 + "data_win_eventdata_authenticationPackageName": true,
1887 + "data_win_eventdata_callTrace": true,
1888 + "data_win_eventdata_commandLine": true,
1889 + "data_win_eventdata_company": true,
1890 + "data_win_eventdata_creationUtcTime": true,
1891 + "data_win_eventdata_currentDirectory": true,
1892 + "data_win_eventdata_description": true,
1893 + "data_win_eventdata_destinationHostname": true,
1894 + "data_win_eventdata_destinationIp": true,
1895 + "data_win_eventdata_destinationIp_city_name": true,
1896 + "data_win_eventdata_destinationIp_country_code": true,
1897 + "data_win_eventdata_destinationIp_geolocation": true,
1898 + "data_win_eventdata_destinationIsIpv6": true,
1899 + "data_win_eventdata_destinationPort": true,
1900 + "data_win_eventdata_destinationPortName": true,
1901 + "data_win_eventdata_details": true,
1902 + "data_win_eventdata_elevatedToken": true,
1903 + "data_win_eventdata_eventType": true,
1904 + "data_win_eventdata_fileVersion": true,
1905 + "data_win_eventdata_fileVersion_city_name": true,
1906 + "data_win_eventdata_fileVersion_country_code": true,
1907 + "data_win_eventdata_fileVersion_geolocation": true,
1908 + "data_win_eventdata_grantedAccess": true,
1909 + "data_win_eventdata_hashes": true,
1910 + "data_win_eventdata_image": true,
1911 + "data_win_eventdata_imageLoaded": true,
1912 + "data_win_eventdata_impersonationLevel": true,
1913 + "data_win_eventdata_initiated": true,
1914 + "data_win_eventdata_integrityLevel": true,
1915 + "data_win_eventdata_ipAddress": true,
1916 + "data_win_eventdata_ipPort": true,
1917 + "data_win_eventdata_keyLength": true,
1918 + "data_win_eventdata_logonGuid": true,
1919 + "data_win_eventdata_logonId": true,
1920 + "data_win_eventdata_logonProcessName": true,
1921 + "data_win_eventdata_logonType": true,
1922 + "data_win_eventdata_originalFileName": true,
1923 + "data_win_eventdata_param1": true,
1924 + "data_win_eventdata_param2": true,
1925 + "data_win_eventdata_param3": true,
1926 + "data_win_eventdata_param4": true,
1927 + "data_win_eventdata_parentCommandLine": true,
1928 + "data_win_eventdata_parentImage": true,
1929 + "data_win_eventdata_parentProcessGuid": true,
1930 + "data_win_eventdata_parentProcessId": true,
1931 + "data_win_eventdata_processGuid": true,
1932 + "data_win_eventdata_processId": true,
1933 + "data_win_eventdata_processName": true,
1934 + "data_win_eventdata_product": true,
1935 + "data_win_eventdata_protocol": true,
1936 + "data_win_eventdata_queryName": true,
1937 + "data_win_eventdata_queryResults": true,
1938 + "data_win_eventdata_queryStatus": true,
1939 + "data_win_eventdata_ruleName": true,
1940 + "data_win_eventdata_serviceName": true,
1941 + "data_win_eventdata_serviceSid": true,
1942 + "data_win_eventdata_signature": true,
1943 + "data_win_eventdata_signatureStatus": true,
1944 + "data_win_eventdata_signed": true,
1945 + "data_win_eventdata_sourceHostname": true,
1946 + "data_win_eventdata_sourceImage": true,
1947 + "data_win_eventdata_sourceIp": true,
1948 + "data_win_eventdata_sourceIp_city_name": true,
1949 + "data_win_eventdata_sourceIp_country_code": true,
1950 + "data_win_eventdata_sourceIp_geolocation": true,
1951 + "data_win_eventdata_sourceIsIpv6": true,
1952 + "data_win_eventdata_sourcePort": true,
1953 + "data_win_eventdata_sourceProcessGUID": true,
1954 + "data_win_eventdata_sourceProcessId": true,
1955 + "data_win_eventdata_sourceThreadId": true,
1956 + "data_win_eventdata_status": true,
1957 + "data_win_eventdata_subjectDomainName": true,
1958 + "data_win_eventdata_subjectLogonId": true,
1959 + "data_win_eventdata_subjectUserName": true,
1960 + "data_win_eventdata_subjectUserSid": true,
1961 + "data_win_eventdata_targetDomainName": true,
1962 + "data_win_eventdata_targetFilename": true,
1963 + "data_win_eventdata_targetImage": true,
1964 + "data_win_eventdata_targetLinkedLogonId": true,
1965 + "data_win_eventdata_targetLogonId": true,
1966 + "data_win_eventdata_targetObject": true,
1967 + "data_win_eventdata_targetProcessGUID": true,
1968 + "data_win_eventdata_targetProcessId": true,
1969 + "data_win_eventdata_targetUserName": true,
1970 + "data_win_eventdata_targetUserSid": true,
1971 + "data_win_eventdata_terminalSessionId": true,
1972 + "data_win_eventdata_ticketEncryptionType": true,
1973 + "data_win_eventdata_ticketOptions": true,
1974 + "data_win_eventdata_user": true,
1975 + "data_win_eventdata_utcTime": true,
1976 + "data_win_eventdata_virtualAccount": true,
1977 + "data_win_system_channel": true,
1978 + "data_win_system_computer": true,
1979 + "data_win_system_eventID": true,
1980 + "data_win_system_eventRecordID": true,
1981 + "data_win_system_eventSourceName": true,
1982 + "data_win_system_keywords": true,
1983 + "data_win_system_level": true,
1984 + "data_win_system_message": true,
1985 + "data_win_system_opcode": true,
1986 + "data_win_system_processID": true,
1987 + "data_win_system_providerGuid": true,
1988 + "data_win_system_providerName": true,
1989 + "data_win_system_severityValue": true,
1990 + "data_win_system_systemTime": true,
1991 + "data_win_system_task": true,
1992 + "data_win_system_threadID": true,
1993 + "data_win_system_version": true,
1994 + "decoder_name": true,
1995 + "decoder_parent": true,
1996 + "dns_query": true,
1997 + "dns_query_threat_indicated": true,
1998 + "dst_ip": true,
1999 + "dst_ip_city_name": true,
2000 + "dst_ip_country_code": true,
2001 + "dst_ip_geolocation": true,
2002 + "dst_ip_threat_indicated": true,
2003 + "dst_port": true,
2004 + "ecs_version": true,
2005 + "error": true,
2006 + "event_hash": true,
2007 + "file_path": true,
2008 + "firewall_rule_name": true,
2009 + "full_log": false,
2010 + "gl2_accounted_message_size": true,
2011 + "gl2_message_id": true,
2012 + "gl2_processing_error": true,
2013 + "gl2_remote_ip": true,
2014 + "gl2_remote_port": true,
2015 + "gl2_source_collector": true,
2016 + "gl2_source_input": true,
2017 + "gl2_source_node": true,
2018 + "hash_md5": true,
2019 + "hash_sha1": true,
2020 + "hash_sha256": true,
2021 + "highlight": true,
2022 + "host_architecture": true,
2023 + "host_containerized": true,
2024 + "host_hostname": true,
2025 + "host_id": true,
2026 + "host_ip": true,
2027 + "host_mac": true,
2028 + "host_name": true,
2029 + "host_os_codename": true,
2030 + "host_os_kernel": true,
2031 + "host_os_name": true,
2032 + "host_os_platform": true,
2033 + "host_os_version": true,
2034 + "hostname": true,
2035 + "id": true,
2036 + "input_type": true,
2037 + "level": true,
2038 + "location": true,
2039 + "log_file_path": true,
2040 + "log_offset": true,
2041 + "manager_name": true,
2042 + "message": true,
2043 + "module": true,
2044 + "msg_timestamp": true,
2045 + "parent_process_cmd_line": true,
2046 + "parent_process_id": true,
2047 + "parent_process_image": true,
2048 + "pid": true,
2049 + "predecoder_hostname": true,
2050 + "predecoder_program_name": true,
2051 + "predecoder_timestamp": true,
2052 + "previous_log": true,
2053 + "previous_output": true,
2054 + "process_cmd_line": true,
2055 + "process_id": true,
2056 + "process_image": true,
2057 + "process_name": true,
2058 + "protocol": true,
2059 + "rule_cis": true,
2060 + "rule_cis_csc": true,
2061 + "rule_description": true,
2062 + "rule_firedtimes": true,
2063 + "rule_gdpr": true,
2064 + "rule_gdpr_IV": true,
2065 + "rule_gpg13": true,
2066 + "rule_gpg_13": true,
2067 + "rule_group1": true,
2068 + "rule_group2": true,
2069 + "rule_group3": true,
2070 + "rule_groups": true,
2071 + "rule_hipaa": true,
2072 + "rule_id": true,
2073 + "rule_info": true,
2074 + "rule_mail": true,
2075 + "rule_mitre_id": true,
2076 + "rule_mitre_tactic": false,
2077 + "rule_nist_800_53": true,
2078 + "rule_pci_dss": true,
2079 + "rule_tsc": true,
2080 + "scanid": true,
2081 + "service": true,
2082 + "software_package": true,
2083 + "software_vendor": true,
2084 + "sort": true,
2085 + "source": true,
2086 + "source_reserved_ip": true,
2087 + "src_ip": true,
2088 + "src_ip_city_name": true,
2089 + "src_ip_country_code": true,
2090 + "src_ip_geolocation": true,
2091 + "src_port": true,
2092 + "streams": true,
2093 + "syscheck_attrs_after": true,
2094 + "syscheck_audit_effective_user_id": true,
2095 + "syscheck_audit_effective_user_name": true,
2096 + "syscheck_audit_group_id": true,
2097 + "syscheck_audit_group_name": true,
2098 + "syscheck_audit_login_user_id": true,
2099 + "syscheck_audit_login_user_name": true,
2100 + "syscheck_audit_process_cwd": true,
2101 + "syscheck_audit_process_id": true,
2102 + "syscheck_audit_process_name": true,
2103 + "syscheck_audit_process_parent_cwd": true,
2104 + "syscheck_audit_process_parent_name": true,
2105 + "syscheck_audit_process_ppid": true,
2106 + "syscheck_audit_user_id": true,
2107 + "syscheck_audit_user_name": true,
2108 + "syscheck_changed_attributes": true,
2109 + "syscheck_event": true,
2110 + "syscheck_gid_after": true,
2111 + "syscheck_gname_after": true,
2112 + "syscheck_hard_links": true,
2113 + "syscheck_inode_after": true,
2114 + "syscheck_inode_before": true,
2115 + "syscheck_md5_after": true,
2116 + "syscheck_md5_before": true,
2117 + "syscheck_mode": true,
2118 + "syscheck_mtime_after": true,
2119 + "syscheck_mtime_before": true,
2120 + "syscheck_path": true,
2121 + "syscheck_perm_after": true,
2122 + "syscheck_perm_before": true,
2123 + "syscheck_sha1_after": true,
2124 + "syscheck_sha1_before": true,
2125 + "syscheck_sha256_after": true,
2126 + "syscheck_sha256_before": true,
2127 + "syscheck_size_after": true,
2128 + "syscheck_size_before": true,
2129 + "syscheck_uid_after": true,
2130 + "syscheck_uname_after": true,
2131 + "syscheck_win_perm_after": true,
2132 + "syscheck_win_perm_after_0_allowed": true,
2133 + "syscheck_win_perm_after_0_name": true,
2134 + "syscheck_win_perm_after_1_allowed": true,
2135 + "syscheck_win_perm_after_1_name": true,
2136 + "syscheck_win_perm_after_2_allowed": true,
2137 + "syscheck_win_perm_after_2_name": true,
2138 + "syscheck_win_perm_after_3_allowed": true,
2139 + "syscheck_win_perm_after_3_name": true,
2140 + "syslog_customer": true,
2141 + "syslog_level": true,
2142 + "syslog_tag": true,
2143 + "syslog_type": true,
2144 + "sysmon_event_description": true,
2145 + "threat_ids": true,
2146 + "threat_indicated": true,
2147 + "threat_names": true,
2148 + "time": true,
2149 + "timestamp": true,
2150 + "true": true,
2151 + "user_name": true,
2152 + "win_registry_key": true,
2153 + "win_system_eventID": true,
2154 + "windows_auth_package": true,
2155 + "windows_domain": true,
2156 + "windows_event_id": true,
2157 + "windows_event_severity": true,
2158 + "windows_logon_type": true
2159 + },
2160 + "indexByName": {
2161 + "_id": 2,
2162 + "_index": 12,
2163 + "_type": 13,
2164 + "agent_id": 14,
2165 + "agent_name": 7,
2166 + "cluster_name": 15,
2167 + "cluster_node": 16,
2168 + "data_office365_Activity": 50,
2169 + "data_office365_ActivityId": 51,
2170 + "data_office365_ActivityParameters": 52,
2171 + "data_office365_ActorUserId": 53,
2172 + "data_office365_ActorYammerUserId": 54,
2173 + "data_office365_AdditionalInfo": 55,
2174 + "data_office365_AppAccessContext_AADSessionId": 56,
2175 + "data_office365_AppAccessContext_CorrelationId": 57,
2176 + "data_office365_AppAccessContext_UniqueTokenId": 58,
2177 + "data_office365_AppName": 59,
2178 + "data_office365_CapacityId": 60,
2179 + "data_office365_CapacityName": 61,
2180 + "data_office365_ClientIP": 4,
2181 + "data_office365_ClientIP_city_name": 17,
2182 + "data_office365_ClientIP_country_code": 18,
2183 + "data_office365_ClientIP_geolocation": 19,
2184 + "data_office365_ConsumptionMethod": 62,
2185 + "data_office365_CorrelationId": 63,
2186 + "data_office365_CreationTime": 0,
2187 + "data_office365_DashboardId": 64,
2188 + "data_office365_DashboardName": 65,
2189 + "data_office365_DatasetId": 66,
2190 + "data_office365_DatasetName": 67,
2191 + "data_office365_Datasets": 68,
2192 + "data_office365_DistributionMethod": 69,
2193 + "data_office365_Entity": 70,
2194 + "data_office365_EventSource": 71,
2195 + "data_office365_FileId": 72,
2196 + "data_office365_FileName": 73,
2197 + "data_office365_FormId": 74,
2198 + "data_office365_FormName": 75,
2199 + "data_office365_FormsUserType": 76,
2200 + "data_office365_Id": 20,
2201 + "data_office365_IsSuccess": 77,
2202 + "data_office365_ItemName": 78,
2203 + "data_office365_ItemType": 79,
2204 + "data_office365_ModelsSnapshots": 80,
2205 + "data_office365_ObjectId": 21,
2206 + "data_office365_Operation": 6,
2207 + "data_office365_OrganizationId": 22,
2208 + "data_office365_RecordType": 23,
2209 + "data_office365_ReportId": 81,
2210 + "data_office365_ReportName": 82,
2211 + "data_office365_ReportType": 83,
2212 + "data_office365_RequestId": 84,
2213 + "data_office365_ResultStatus": 8,
2214 + "data_office365_SourceApp": 85,
2215 + "data_office365_ThreadID": 86,
2216 + "data_office365_UserAgent": 87,
2217 + "data_office365_UserId": 3,
2218 + "data_office365_UserKey": 24,
2219 + "data_office365_UserType": 25,
2220 + "data_office365_Version": 26,
2221 + "data_office365_VersionId": 88,
2222 + "data_office365_WorkSpaceName": 89,
2223 + "data_office365_Workload": 5,
2224 + "data_office365_WorkspaceId": 90,
2225 + "data_office365_YammerNetworkId": 91,
2226 + "decoder_name": 27,
2227 + "gl2_accounted_message_size": 28,
2228 + "gl2_message_id": 29,
2229 + "gl2_processing_error": 30,
2230 + "gl2_remote_ip": 31,
2231 + "gl2_remote_port": 32,
2232 + "gl2_source_input": 33,
2233 + "gl2_source_node": 34,
2234 + "highlight": 35,
2235 + "id": 36,
2236 + "location": 37,
2237 + "manager_name": 38,
2238 + "message": 39,
2239 + "rule_description": 9,
2240 + "rule_firedtimes": 40,
2241 + "rule_group1": 41,
2242 + "rule_groups": 42,
2243 + "rule_id": 11,
2244 + "rule_level": 10,
2245 + "rule_mail": 43,
2246 + "sort": 44,
2247 + "source": 45,
2248 + "streams": 46,
2249 + "syslog_level": 47,
2250 + "syslog_type": 48,
2251 + "timestamp": 1,
2252 + "true": 49
2253 + },
2254 + "renameByName": {
2255 + "_id": "EVENT ID",
2256 + "agent_name": "",
2257 + "data_office365_ActorIpAddress": "SRC IP",
2258 + "data_office365_Application": "APP",
2259 + "data_office365_ClientIP": "SRC IP",
2260 + "data_office365_CreationTime": "EVENT TIME",
2261 + "data_office365_Operation": "OPERATION",
2262 + "data_office365_ResultStatus": "RESULT",
2263 + "data_office365_UserId": "ACCOUNT",
2264 + "data_office365_Workload": "WORKLOAD",
2265 + "decoder_name": "",
2266 + "rule_description": "DESCRIPTION",
2267 + "rule_id": "RULE ID",
2268 + "rule_level": "",
2269 + "rule_mitre_tactic": "MITRE TACTIC",
2270 + "rule_mitre_technique": "MITRE TECHNIQUE",
2271 + "timestamp": "Date/Time"
2272 + }
2273 + }
2274 + }
2275 + ],
2276 + "transparent": true,
2277 + "type": "table"
2278 + }
2279 + ],
2280 + "refresh": "",
2281 + "schemaVersion": 38,
2282 + "style": "dark",
2283 + "tags": ["O365"],
2284 + "templating": {
2285 + "list": [
2286 + {
2287 + "datasource": {
2288 + "type": "elasticsearch",
2289 + "uid": "replace_datasource_uid"
2290 + },
2291 + "filters": [],
2292 + "hide": 0,
2293 + "label": "",
2294 + "name": "Filters",
2295 + "skipUrlSync": false,
2296 + "type": "adhoc"
2297 + },
2298 + {
2299 + "current": {
2300 + "selected": false,
2301 + "text": "All",
2302 + "value": "$__all"
2303 + },
2304 + "datasource": {
2305 + "type": "elasticsearch",
2306 + "uid": "replace_datasource_uid"
2307 + },
2308 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2309 + "hide": 0,
2310 + "includeAll": true,
2311 + "label": "Workload",
2312 + "multi": false,
2313 + "name": "workload",
2314 + "options": [],
2315 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2316 + "refresh": 2,
2317 + "regex": "",
2318 + "skipUrlSync": false,
2319 + "sort": 1,
2320 + "tagValuesQuery": "",
2321 + "tagsQuery": "",
2322 + "type": "query",
2323 + "useTags": false
2324 + },
2325 + {
2326 + "current": {
2327 + "selected": false,
2328 + "text": "All",
2329 + "value": "$__all"
2330 + },
2331 + "datasource": {
2332 + "type": "elasticsearch",
2333 + "uid": "replace_datasource_uid"
2334 + },
2335 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2336 + "hide": 0,
2337 + "includeAll": true,
2338 + "label": "Rule Level",
2339 + "multi": false,
2340 + "name": "rule_level",
2341 + "options": [],
2342 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"!data_office365_Workload:AzureActiveDirectory\"}",
2343 + "refresh": 2,
2344 + "regex": "",
2345 + "skipUrlSync": false,
2346 + "sort": 0,
2347 + "type": "query"
2348 + }
2349 + ]
2350 + },
2351 + "time": {
2352 + "from": "now-6h",
2353 + "to": "now"
2354 + },
2355 + "timepicker": {
2356 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2357 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2358 + },
2359 + "timezone": "",
2360 + "title": "O365 - APPLICATIONS",
2361 + "weekStart": ""
2362 }
backend/app/connectors/grafana/dashboards/Office365/compliance_center.json
+1603 -1644
@@ -1,1646 +1,1605 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "9.2.0",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 3,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "displayMode": "auto",
261 - "inspect": false
262 - },
263 - "mappings": [],
264 - "thresholds": {
265 - "mode": "absolute",
266 - "steps": [
267 - {
268 - "color": "red",
269 - "value": null
270 - }
271 - ]
272 - }
273 - },
274 - "overrides": [
275 - {
276 - "matcher": {
277 - "id": "byName",
278 - "options": "Count"
279 - },
280 - "properties": [
281 - {
282 - "id": "displayName",
283 - "value": "EVENTS"
284 - },
285 - {
286 - "id": "unit",
287 - "value": "short"
288 - },
289 - {
290 - "id": "decimals",
291 - "value": -1
292 - },
293 - {
294 - "id": "custom.align"
295 - },
296 - {
297 - "id": "thresholds",
298 - "value": {
299 - "mode": "absolute",
300 - "steps": [
301 - {
302 - "color": "red",
303 - "value": null
304 - }
305 - ]
306 - }
307 - }
308 - ]
309 - },
310 - {
311 - "matcher": {
312 - "id": "byName",
313 - "options": "OPERATION"
314 - },
315 - "properties": [
316 - {
317 - "id": "custom.width",
318 - "value": 209
319 - }
320 - ]
321 - }
322 - ]
323 - },
324 - "gridPos": {
325 - "h": 7,
326 - "w": 5,
327 - "x": 7,
328 - "y": 0
329 - },
330 - "id": 54,
331 - "options": {
332 - "footer": {
333 - "fields": "",
334 - "reducer": [
335 - "sum"
336 - ],
337 - "show": false
338 - },
339 - "showHeader": true,
340 - "sortBy": []
341 - },
342 - "pluginVersion": "9.2.0",
343 - "targets": [
344 - {
345 - "bucketAggs": [
346 - {
347 - "fake": true,
348 - "field": "data_office365_Operation",
349 - "id": "4",
350 - "settings": {
351 - "min_doc_count": 1,
352 - "order": "desc",
353 - "orderBy": "_count",
354 - "size": "0"
355 - },
356 - "type": "terms"
357 - }
358 - ],
359 - "datasource": {
360 - "type": "elasticsearch",
361 - "uid": "replace_datasource_uid"
362 - },
363 - "metrics": [
364 - {
365 - "field": "select field",
366 - "id": "1",
367 - "type": "count"
368 - }
369 - ],
370 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
371 - "refId": "A",
372 - "timeField": "timestamp"
373 - }
374 - ],
375 - "title": "EVENTS BY OPERATION",
376 - "transformations": [
377 - {
378 - "id": "merge",
379 - "options": {
380 - "reducers": []
381 - }
382 - },
383 - {
384 - "id": "organize",
385 - "options": {
386 - "excludeByName": {},
387 - "indexByName": {},
388 - "renameByName": {
389 - "Count": "EVENTS",
390 - "data_office365_Operation": "OPERATION",
391 - "data_office365_Workload": "WORKLOAD"
392 - }
393 - }
394 - }
395 - ],
396 - "type": "table"
397 - },
398 - {
399 - "datasource": {
400 - "type": "elasticsearch",
401 - "uid": "replace_datasource_uid"
402 - },
403 - "fieldConfig": {
404 - "defaults": {
405 - "mappings": [
406 - {
407 - "options": {
408 - "match": "null",
409 - "result": {
410 - "text": "N/A"
411 - }
412 - },
413 - "type": "special"
414 - }
415 - ],
416 - "thresholds": {
417 - "mode": "absolute",
418 - "steps": [
419 - {
420 - "color": "orange",
421 - "value": null
422 - }
423 - ]
424 - },
425 - "unit": "locale"
426 - },
427 - "overrides": []
428 - },
429 - "gridPos": {
430 - "h": 7,
431 - "w": 4,
432 - "x": 12,
433 - "y": 0
434 - },
435 - "id": 55,
436 - "links": [],
437 - "options": {
438 - "colorMode": "value",
439 - "graphMode": "area",
440 - "justifyMode": "auto",
441 - "orientation": "horizontal",
442 - "reduceOptions": {
443 - "calcs": [
444 - "sum"
445 - ],
446 - "fields": "",
447 - "values": false
448 - },
449 - "text": {},
450 - "textMode": "auto"
451 - },
452 - "pluginVersion": "9.2.0",
453 - "targets": [
454 - {
455 - "bucketAggs": [
456 - {
457 - "field": "timestamp",
458 - "id": "2",
459 - "settings": {
460 - "interval": "auto",
461 - "min_doc_count": 0,
462 - "trimEdges": 0
463 - },
464 - "type": "date_histogram"
465 - }
466 - ],
467 - "datasource": {
468 - "type": "elasticsearch",
469 - "uid": "replace_datasource_uid"
470 - },
471 - "metrics": [
472 - {
473 - "field": "select field",
474 - "id": "1",
475 - "type": "count"
476 - }
477 - ],
478 - "query": "data_office365_Operation:UserSubmission",
479 - "refId": "A",
480 - "timeField": "timestamp"
481 - }
482 - ],
483 - "title": "PHISHING (USER SUBMISSIONS)",
484 - "type": "stat"
485 - },
486 - {
487 - "datasource": {
488 - "type": "elasticsearch",
489 - "uid": "replace_datasource_uid"
490 - },
491 - "fieldConfig": {
492 - "defaults": {
493 - "color": {
494 - "mode": "thresholds"
495 - },
496 - "custom": {
497 - "align": "auto",
498 - "displayMode": "auto",
499 - "inspect": false
500 - },
501 - "mappings": [],
502 - "thresholds": {
503 - "mode": "absolute",
504 - "steps": [
505 - {
506 - "color": "red",
507 - "value": null
508 - }
509 - ]
510 - }
511 - },
512 - "overrides": [
513 - {
514 - "matcher": {
515 - "id": "byName",
516 - "options": "Count"
517 - },
518 - "properties": [
519 - {
520 - "id": "displayName",
521 - "value": "EVENTS"
522 - },
523 - {
524 - "id": "unit",
525 - "value": "short"
526 - },
527 - {
528 - "id": "decimals",
529 - "value": -1
530 - },
531 - {
532 - "id": "custom.align"
533 - },
534 - {
535 - "id": "thresholds",
536 - "value": {
537 - "mode": "absolute",
538 - "steps": [
539 - {
540 - "color": "red",
541 - "value": null
542 - }
543 - ]
544 - }
545 - }
546 - ]
547 - },
548 - {
549 - "matcher": {
550 - "id": "byName",
551 - "options": "OPERATION"
552 - },
553 - "properties": [
554 - {
555 - "id": "custom.width",
556 - "value": 263
557 - }
558 - ]
559 - },
560 - {
561 - "matcher": {
562 - "id": "byName",
563 - "options": "ACCOUNT"
564 - },
565 - "properties": [
566 - {
567 - "id": "custom.width",
568 - "value": 439
569 - }
570 - ]
571 - }
572 - ]
573 - },
574 - "gridPos": {
575 - "h": 7,
576 - "w": 8,
577 - "x": 16,
578 - "y": 0
579 - },
580 - "id": 57,
581 - "options": {
582 - "footer": {
583 - "fields": "",
584 - "reducer": [
585 - "sum"
586 - ],
587 - "show": false
588 - },
589 - "showHeader": true,
590 - "sortBy": []
591 - },
592 - "pluginVersion": "9.2.0",
593 - "targets": [
594 - {
595 - "bucketAggs": [
596 - {
597 - "fake": true,
598 - "field": "data_office365_UserId",
599 - "id": "4",
600 - "settings": {
601 - "min_doc_count": 1,
602 - "order": "desc",
603 - "orderBy": "_count",
604 - "size": "0"
605 - },
606 - "type": "terms"
607 - }
608 - ],
609 - "datasource": {
610 - "type": "elasticsearch",
611 - "uid": "replace_datasource_uid"
612 - },
613 - "metrics": [
614 - {
615 - "field": "select field",
616 - "id": "1",
617 - "type": "count"
618 - }
619 - ],
620 - "query": "data_office365_Operation:UserSubmission",
621 - "refId": "A",
622 - "timeField": "timestamp"
623 - }
624 - ],
625 - "title": "PHISHING (REPORTERS)",
626 - "transformations": [
627 - {
628 - "id": "organize",
629 - "options": {
630 - "excludeByName": {},
631 - "indexByName": {},
632 - "renameByName": {
633 - "Count": "EVENTS",
634 - "data_office365_Operation": "OPERATION",
635 - "data_office365_UserId": "ACCOUNT",
636 - "data_office365_Workload": "WORKLOAD"
637 - }
638 - }
639 - }
640 - ],
641 - "type": "table"
642 - },
643 - {
644 - "datasource": {
645 - "type": "elasticsearch",
646 - "uid": "replace_datasource_uid"
647 - },
648 - "fieldConfig": {
649 - "defaults": {
650 - "color": {
651 - "mode": "thresholds"
652 - },
653 - "mappings": [
654 - {
655 - "options": {
656 - "match": "null",
657 - "result": {
658 - "text": "N/A"
659 - }
660 - },
661 - "type": "special"
662 - }
663 - ],
664 - "max": 15,
665 - "min": 0,
666 - "thresholds": {
667 - "mode": "absolute",
668 - "steps": [
669 - {
670 - "color": "#299c46",
671 - "value": null
672 - },
673 - {
674 - "color": "rgba(237, 129, 40, 0.89)",
675 - "value": 8
676 - },
677 - {
678 - "color": "#d44a3a",
679 - "value": 12
680 - }
681 - ]
682 - },
683 - "unit": "none"
684 - },
685 - "overrides": []
686 - },
687 - "gridPos": {
688 - "h": 7,
689 - "w": 4,
690 - "x": 0,
691 - "y": 7
692 - },
693 - "id": 16,
694 - "links": [],
695 - "options": {
696 - "orientation": "horizontal",
697 - "reduceOptions": {
698 - "calcs": [
699 - "max"
700 - ],
701 - "fields": "",
702 - "values": false
703 - },
704 - "showThresholdLabels": false,
705 - "showThresholdMarkers": true,
706 - "text": {}
707 - },
708 - "pluginVersion": "9.2.0",
709 - "targets": [
710 - {
711 - "bucketAggs": [
712 - {
713 - "field": "timestamp",
714 - "id": "2",
715 - "settings": {
716 - "interval": "auto",
717 - "min_doc_count": 0,
718 - "trimEdges": 0
719 - },
720 - "type": "date_histogram"
721 - }
722 - ],
723 - "datasource": {
724 - "type": "elasticsearch",
725 - "uid": "replace_datasource_uid"
726 - },
727 - "metrics": [
728 - {
729 - "field": "rule_level",
730 - "id": "1",
731 - "meta": {},
732 - "settings": {},
733 - "type": "max"
734 - }
735 - ],
736 - "query": "data_office365_Operation:$operation",
737 - "refId": "A",
738 - "timeField": "timestamp"
739 - }
740 - ],
741 - "title": "MAX SEVERITY (0 - 15)",
742 - "type": "gauge"
743 - },
744 - {
745 - "datasource": {
746 - "type": "elasticsearch",
747 - "uid": "replace_datasource_uid"
748 - },
749 - "fieldConfig": {
750 - "defaults": {
751 - "color": {
752 - "mode": "palette-classic"
753 - },
754 - "custom": {
755 - "axisCenteredZero": false,
756 - "axisColorMode": "text",
757 - "axisLabel": "",
758 - "axisPlacement": "auto",
759 - "barAlignment": 0,
760 - "drawStyle": "bars",
761 - "fillOpacity": 0,
762 - "gradientMode": "none",
763 - "hideFrom": {
764 - "legend": false,
765 - "tooltip": false,
766 - "viz": false
767 - },
768 - "lineInterpolation": "linear",
769 - "lineWidth": 1,
770 - "pointSize": 5,
771 - "scaleDistribution": {
772 - "type": "linear"
773 - },
774 - "showPoints": "auto",
775 - "spanNulls": false,
776 - "stacking": {
777 - "group": "A",
778 - "mode": "normal"
779 - },
780 - "thresholdsStyle": {
781 - "mode": "off"
782 - }
783 - },
784 - "mappings": [],
785 - "thresholds": {
786 - "mode": "absolute",
787 - "steps": [
788 - {
789 - "color": "green",
790 - "value": null
791 - },
792 - {
793 - "color": "red",
794 - "value": 80
795 - }
796 - ]
797 - }
798 - },
799 - "overrides": []
800 - },
801 - "gridPos": {
802 - "h": 13,
803 - "w": 20,
804 - "x": 4,
805 - "y": 7
806 - },
807 - "id": 59,
808 - "options": {
809 - "legend": {
810 - "calcs": [],
811 - "displayMode": "table",
812 - "placement": "right",
813 - "showLegend": true
814 - },
815 - "tooltip": {
816 - "mode": "single",
817 - "sort": "none"
818 - }
819 - },
820 - "targets": [
821 - {
822 - "alias": "",
823 - "bucketAggs": [
824 - {
825 - "field": "data_office365_Operation",
826 - "id": "3",
827 - "settings": {
828 - "min_doc_count": "1",
829 - "order": "desc",
830 - "orderBy": "_count",
831 - "size": "10"
832 - },
833 - "type": "terms"
834 - },
835 - {
836 - "field": "timestamp",
837 - "id": "2",
838 - "settings": {
839 - "interval": "auto"
840 - },
841 - "type": "date_histogram"
842 - }
843 - ],
844 - "datasource": {
845 - "type": "elasticsearch",
846 - "uid": "replace_datasource_uid"
847 - },
848 - "metrics": [
849 - {
850 - "id": "1",
851 - "type": "count"
852 - }
853 - ],
854 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
855 - "refId": "A",
856 - "timeField": "timestamp"
857 - }
858 - ],
859 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
860 - "transparent": true,
861 - "type": "timeseries"
862 - },
863 - {
864 - "datasource": {
865 - "type": "elasticsearch",
866 - "uid": "replace_datasource_uid"
867 - },
868 - "fieldConfig": {
869 - "defaults": {
870 - "mappings": [
871 - {
872 - "options": {
873 - "match": "null",
874 - "result": {
875 - "text": "N/A"
876 - }
877 - },
878 - "type": "special"
879 - }
880 - ],
881 - "thresholds": {
882 - "mode": "absolute",
883 - "steps": [
884 - {
885 - "color": "blue",
886 - "value": null
887 - }
888 - ]
889 - },
890 - "unit": "locale"
891 - },
892 - "overrides": []
893 - },
894 - "gridPos": {
895 - "h": 6,
896 - "w": 4,
897 - "x": 0,
898 - "y": 14
899 - },
900 - "id": 51,
901 - "links": [],
902 - "options": {
903 - "colorMode": "value",
904 - "graphMode": "area",
905 - "justifyMode": "auto",
906 - "orientation": "horizontal",
907 - "reduceOptions": {
908 - "calcs": [
909 - "sum"
910 - ],
911 - "fields": "",
912 - "values": false
913 - },
914 - "text": {},
915 - "textMode": "auto"
916 - },
917 - "pluginVersion": "9.2.0",
918 - "targets": [
919 - {
920 - "bucketAggs": [
921 - {
922 - "$$hashKey": "object:331",
923 - "field": "timestamp",
924 - "id": "2",
925 - "settings": {
926 - "interval": "auto",
927 - "min_doc_count": 0,
928 - "trimEdges": 0
929 - },
930 - "type": "date_histogram"
931 - }
932 - ],
933 - "datasource": {
934 - "type": "elasticsearch",
935 - "uid": "replace_datasource_uid"
936 - },
937 - "metrics": [
938 - {
939 - "$$hashKey": "object:329",
940 - "field": "select field",
941 - "id": "1",
942 - "type": "count"
943 - }
944 - ],
945 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
946 - "refId": "A",
947 - "timeField": "timestamp"
948 - }
949 - ],
950 - "title": "EVENTS (Total)",
951 - "type": "stat"
952 - },
953 - {
954 - "datasource": {
955 - "type": "elasticsearch",
956 - "uid": "replace_datasource_uid"
957 - },
958 - "fieldConfig": {
959 - "defaults": {
960 - "color": {
961 - "mode": "thresholds"
962 - },
963 - "custom": {
964 - "align": "auto",
965 - "displayMode": "auto",
966 - "filterable": true,
967 - "inspect": false
968 - },
969 - "mappings": [],
970 - "thresholds": {
971 - "mode": "absolute",
972 - "steps": [
973 - {
974 - "color": "green",
975 - "value": null
976 - },
977 - {
978 - "color": "red",
979 - "value": 80
980 - }
981 - ]
982 - }
983 - },
984 - "overrides": [
985 - {
986 - "matcher": {
987 - "id": "byName",
988 - "options": "rule_level"
989 - },
990 - "properties": [
991 - {
992 - "id": "displayName",
993 - "value": "RULE LEVEL"
994 - },
995 - {
996 - "id": "unit",
997 - "value": "short"
998 - },
999 - {
1000 - "id": "decimals",
1001 - "value": -1
1002 - },
1003 - {
1004 - "id": "custom.displayMode",
1005 - "value": "color-background"
1006 - },
1007 - {
1008 - "id": "custom.align"
1009 - },
1010 - {
1011 - "id": "thresholds",
1012 - "value": {
1013 - "mode": "absolute",
1014 - "steps": [
1015 - {
1016 - "color": "#37872D",
1017 - "value": null
1018 - },
1019 - {
1020 - "color": "rgba(237, 129, 40, 0.89)",
1021 - "value": 7
1022 - },
1023 - {
1024 - "color": "rgba(245, 54, 54, 0.9)",
1025 - "value": 12
1026 - }
1027 - ]
1028 - }
1029 - }
1030 - ]
1031 - },
1032 - {
1033 - "matcher": {
1034 - "id": "byName",
1035 - "options": "Date/Time"
1036 - },
1037 - "properties": [
1038 - {
1039 - "id": "custom.width",
1040 - "value": 242
1041 - }
1042 - ]
1043 - },
1044 - {
1045 - "matcher": {
1046 - "id": "byName",
1047 - "options": "MITRE TACTIC"
1048 - },
1049 - "properties": [
1050 - {
1051 - "id": "custom.width",
1052 - "value": 332
1053 - }
1054 - ]
1055 - },
1056 - {
1057 - "matcher": {
1058 - "id": "byName",
1059 - "options": "MITRE TECHNIQUE"
1060 - },
1061 - "properties": [
1062 - {
1063 - "id": "custom.width",
1064 - "value": 312
1065 - }
1066 - ]
1067 - },
1068 - {
1069 - "matcher": {
1070 - "id": "byName",
1071 - "options": "EVENT ID"
1072 - },
1073 - "properties": [
1074 - {
1075 - "id": "links",
1076 - "value": [
1077 - {
1078 - "targetBlank": true,
1079 - "title": "VIEW EVENT DETAILS",
1080 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1081 - }
1082 - ]
1083 - },
1084 - {
1085 - "id": "custom.width",
1086 - "value": 319
1087 - }
1088 - ]
1089 - },
1090 - {
1091 - "matcher": {
1092 - "id": "byName",
1093 - "options": "ACCOUNT"
1094 - },
1095 - "properties": [
1096 - {
1097 - "id": "custom.width",
1098 - "value": 343
1099 - }
1100 - ]
1101 - },
1102 - {
1103 - "matcher": {
1104 - "id": "byName",
1105 - "options": "EVENT TIME"
1106 - },
1107 - "properties": [
1108 - {
1109 - "id": "custom.width",
1110 - "value": 195
1111 - }
1112 - ]
1113 - },
1114 - {
1115 - "matcher": {
1116 - "id": "byName",
1117 - "options": "FILE SIZE"
1118 - },
1119 - "properties": [
1120 - {
1121 - "id": "unit",
1122 - "value": "bytes"
1123 - }
1124 - ]
1125 - },
1126 - {
1127 - "matcher": {
1128 - "id": "byName",
1129 - "options": "SENSITIVE INFO"
1130 - },
1131 - "properties": [
1132 - {
1133 - "id": "custom.width",
1134 - "value": 154
1135 - }
1136 - ]
1137 - },
1138 - {
1139 - "matcher": {
1140 - "id": "byName",
1141 - "options": "RULE LEVEL"
1142 - },
1143 - "properties": [
1144 - {
1145 - "id": "custom.width",
1146 - "value": 157
1147 - }
1148 - ]
1149 - }
1150 - ]
1151 - },
1152 - "gridPos": {
1153 - "h": 16,
1154 - "w": 24,
1155 - "x": 0,
1156 - "y": 20
1157 - },
1158 - "id": 27,
1159 - "options": {
1160 - "footer": {
1161 - "fields": "",
1162 - "reducer": [
1163 - "sum"
1164 - ],
1165 - "show": false
1166 - },
1167 - "showHeader": true,
1168 - "sortBy": []
1169 - },
1170 - "pluginVersion": "9.2.0",
1171 - "targets": [
1172 - {
1173 - "bucketAggs": [],
1174 - "datasource": {
1175 - "type": "elasticsearch",
1176 - "uid": "replace_datasource_uid"
1177 - },
1178 - "metrics": [
1179 - {
1180 - "id": "1",
1181 - "settings": {
1182 - "size": "250"
1183 - },
1184 - "type": "raw_data"
1185 - }
1186 - ],
1187 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1188 - "refId": "A",
1189 - "timeField": "timestamp"
1190 - }
1191 - ],
1192 - "title": "EVENTS",
1193 - "transformations": [
1194 - {
1195 - "id": "merge",
1196 - "options": {
1197 - "reducers": []
1198 - }
1199 - },
1200 - {
1201 - "id": "organize",
1202 - "options": {
1203 - "excludeByName": {
1204 - "@metadata_beat": true,
1205 - "@metadata_type": true,
1206 - "@metadata_version": true,
1207 - "IMPHASH": true,
1208 - "MD5": true,
1209 - "SHA1": true,
1210 - "SHA256": true,
1211 - "_id": false,
1212 - "_index": true,
1213 - "_type": true,
1214 - "agent_ephemeral_id": true,
1215 - "agent_hostname": true,
1216 - "agent_id": true,
1217 - "agent_ip_city_name": true,
1218 - "agent_ip_country_code": true,
1219 - "agent_ip_geolocation": true,
1220 - "agent_name": true,
1221 - "agent_type": true,
1222 - "agent_version": true,
1223 - "beats_type": true,
1224 - "cluster_name": true,
1225 - "cluster_node": true,
1226 - "collector_node_id": true,
1227 - "data_alert_action": true,
1228 - "data_alert_category": true,
1229 - "data_alert_gid": true,
1230 - "data_alert_rev": true,
1231 - "data_alert_severity": true,
1232 - "data_alert_signature": true,
1233 - "data_alert_signature_id": true,
1234 - "data_app_proto": true,
1235 - "data_audit_auid": true,
1236 - "data_audit_command": true,
1237 - "data_audit_euid": true,
1238 - "data_audit_exe": true,
1239 - "data_audit_gid": true,
1240 - "data_audit_id": true,
1241 - "data_audit_pid": true,
1242 - "data_audit_res": true,
1243 - "data_audit_session": true,
1244 - "data_audit_type": true,
1245 - "data_audit_uid": true,
1246 - "data_dest_ip": true,
1247 - "data_dest_port": true,
1248 - "data_dstuser": true,
1249 - "data_event_type": true,
1250 - "data_extra_data": true,
1251 - "data_file": true,
1252 - "data_flow_bytes_toclient": true,
1253 - "data_flow_bytes_toserver": true,
1254 - "data_flow_id": true,
1255 - "data_flow_pkts_toclient": true,
1256 - "data_flow_pkts_toserver": true,
1257 - "data_flow_start": true,
1258 - "data_http_http_content_type": true,
1259 - "data_http_http_port": true,
1260 - "data_http_length": true,
1261 - "data_http_status": true,
1262 - "data_http_url": true,
1263 - "data_id": true,
1264 - "data_in_iface": true,
1265 - "data_metadata_flowbits": true,
1266 - "data_metadata_flowints_http_anomaly_count": true,
1267 - "data_metadata_flowints_tcp_retransmission_count": true,
1268 - "data_office365_AadAppId": true,
1269 - "data_office365_Actor": true,
1270 - "data_office365_ActorContextId": true,
1271 - "data_office365_ActorIpAddress": false,
1272 - "data_office365_ActorIpAddress_city_name": true,
1273 - "data_office365_ActorIpAddress_country_code": true,
1274 - "data_office365_ActorIpAddress_geolocation": true,
1275 - "data_office365_AdditionalData": true,
1276 - "data_office365_AlertEntityId": true,
1277 - "data_office365_AlertId": true,
1278 - "data_office365_AlertLinks": true,
1279 - "data_office365_AlertType": true,
1280 - "data_office365_ApplicationId": true,
1281 - "data_office365_AzureActiveDirectoryEventType": true,
1282 - "data_office365_BCLValue": true,
1283 - "data_office365_Category": true,
1284 - "data_office365_ClientApplication": true,
1285 - "data_office365_ClientIP": true,
1286 - "data_office365_ClientIP_city_name": true,
1287 - "data_office365_ClientIP_country_code": true,
1288 - "data_office365_ClientIP_geolocation": true,
1289 - "data_office365_CmdletVersion": true,
1290 - "data_office365_Comments": true,
1291 - "data_office365_CreationTime": false,
1292 - "data_office365_Data": true,
1293 - "data_office365_DataType": true,
1294 - "data_office365_DatabaseType": true,
1295 - "data_office365_DeliveryMessageInfo_DIEnrichment": true,
1296 - "data_office365_DeliveryMessageInfo_DeliveryControlSource": true,
1297 - "data_office365_DeliveryMessageInfo_DeliveryControlType": true,
1298 - "data_office365_DeliveryMessageInfo_DeliveryReason": true,
1299 - "data_office365_DeliveryMessageInfo_Destination": true,
1300 - "data_office365_DeliveryMessageInfo_FinalFilterVerdict": true,
1301 - "data_office365_DeliveryMessageInfo_FinalFilterVerdictControlSource": true,
1302 - "data_office365_DeliveryMessageInfo_FinalVerdict": true,
1303 - "data_office365_DeliveryMessageInfo_FinalVerdictSource": true,
1304 - "data_office365_DeliveryMessageInfo_Id": true,
1305 - "data_office365_DeliveryMessageInfo_IsValid": true,
1306 - "data_office365_DeliveryMessageInfo_PolicyHit": true,
1307 - "data_office365_DeliveryMessageInfo_PolicyOverride": true,
1308 - "data_office365_DeliveryMessageInfo_TenantActionPolicyId": true,
1309 - "data_office365_DeliveryMessageInfo_TenantActionPolicyType": true,
1310 - "data_office365_DeliveryMessageInfo_Timestamp": true,
1311 - "data_office365_Description": true,
1312 - "data_office365_DeviceProperties": true,
1313 - "data_office365_EffectiveOrganization": true,
1314 - "data_office365_EntityType": true,
1315 - "data_office365_ErrorNumber": true,
1316 - "data_office365_ExchangeLocations": true,
1317 - "data_office365_ExchangeMetaData_CC": true,
1318 - "data_office365_ExchangeMetaData_FileSize": false,
1319 - "data_office365_ExchangeMetaData_From": true,
1320 - "data_office365_ExchangeMetaData_MessageID": true,
1321 - "data_office365_ExchangeMetaData_RecipientCount": false,
1322 - "data_office365_ExchangeMetaData_Sent": true,
1323 - "data_office365_ExchangeMetaData_Subject": false,
1324 - "data_office365_ExchangeMetaData_To": true,
1325 - "data_office365_ExchangeMetaData_UniqueID": true,
1326 - "data_office365_ExtendedProperties": true,
1327 - "data_office365_FilteringDate": true,
1328 - "data_office365_GradingResult_FirstTriagedBy": true,
1329 - "data_office365_GradingResult_Id": true,
1330 - "data_office365_GradingResult_LastUpdatedBy": true,
1331 - "data_office365_GradingResult_Timestamp": true,
1332 - "data_office365_GradingResult_TriageCategory": true,
1333 - "data_office365_GradingResult_TriageVerdict": true,
1334 - "data_office365_Id": true,
1335 - "data_office365_IncidentId": true,
1336 - "data_office365_InsightData": true,
1337 - "data_office365_InsightId": true,
1338 - "data_office365_InterSystemsId": true,
1339 - "data_office365_IntraSystemId": true,
1340 - "data_office365_KesMailId": true,
1341 - "data_office365_Language": true,
1342 - "data_office365_LogonError": true,
1343 - "data_office365_MessageDate": true,
1344 - "data_office365_ModifiedProperties": true,
1345 - "data_office365_Name": true,
1346 - "data_office365_NonPIIParameters": true,
1347 - "data_office365_ObjectId": true,
1348 - "data_office365_ObjectType": true,
1349 - "data_office365_Operation": true,
1350 - "data_office365_OrganizationId": true,
1351 - "data_office365_P1Sender": true,
1352 - "data_office365_P1SenderDomain": true,
1353 - "data_office365_P2Sender": true,
1354 - "data_office365_P2SenderDomain": true,
1355 - "data_office365_Parameters": true,
1356 - "data_office365_PolicyDetails": true,
1357 - "data_office365_PolicyId": true,
1358 - "data_office365_Query": true,
1359 - "data_office365_Recipients": true,
1360 - "data_office365_RecordType": true,
1361 - "data_office365_RelativeUrl": true,
1362 - "data_office365_RescanResult_Id": true,
1363 - "data_office365_RescanResult_RescanVerdict": true,
1364 - "data_office365_RescanResult_Timestamp": true,
1365 - "data_office365_ResultCount": true,
1366 - "data_office365_ResultStatus": true,
1367 - "data_office365_SecurityComplianceCenterEventType": true,
1368 - "data_office365_SenderIP": true,
1369 - "data_office365_SenderIP_city_name": true,
1370 - "data_office365_SenderIP_country_code": true,
1371 - "data_office365_SenderIP_geolocation": true,
1372 - "data_office365_Severity": true,
1373 - "data_office365_SharePointMetaData_FileID": true,
1374 - "data_office365_SharePointMetaData_FileName": false,
1375 - "data_office365_SharePointMetaData_FileOwner": true,
1376 - "data_office365_SharePointMetaData_FilePathUrl": true,
1377 - "data_office365_SharePointMetaData_FileSize": true,
1378 - "data_office365_SharePointMetaData_From": true,
1379 - "data_office365_SharePointMetaData_IsViewableByExternalUsers": true,
1380 - "data_office365_SharePointMetaData_IsVisibleOnlyToOdbOwner": true,
1381 - "data_office365_SharePointMetaData_ItemCreationTime": true,
1382 - "data_office365_SharePointMetaData_ItemLastModifiedTime": true,
1383 - "data_office365_SharePointMetaData_ItemLastSharedTime": true,
1384 - "data_office365_SharePointMetaData_SiteCollectionGuid": true,
1385 - "data_office365_SharePointMetaData_SiteCollectionUrl": true,
1386 - "data_office365_SharePointMetaData_UniqueID": true,
1387 - "data_office365_Source": true,
1388 - "data_office365_StartTime": true,
1389 - "data_office365_Status": true,
1390 - "data_office365_Subject": true,
1391 - "data_office365_SubmissionContent": true,
1392 - "data_office365_SubmissionContentSubType": true,
1393 - "data_office365_SubmissionContentType": true,
1394 - "data_office365_SubmissionId": true,
1395 - "data_office365_SubmissionState": true,
1396 - "data_office365_SubmissionType": true,
1397 - "data_office365_SubmitterDisplayName": true,
1398 - "data_office365_SubmitterId": true,
1399 - "data_office365_Target": true,
1400 - "data_office365_TargetContextId": true,
1401 - "data_office365_UserId": true,
1402 - "data_office365_UserKey": true,
1403 - "data_office365_UserType": true,
1404 - "data_office365_Version": true,
1405 - "data_office365_Workload": true,
1406 - "data_win_system_version": true,
1407 - "decoder_name": true,
1408 - "decoder_parent": true,
1409 - "error": true,
1410 - "full_log": false,
1411 - "gl2_accounted_message_size": true,
1412 - "gl2_message_id": true,
1413 - "gl2_processing_error": true,
1414 - "gl2_remote_ip": true,
1415 - "gl2_remote_port": true,
1416 - "gl2_source_collector": true,
1417 - "gl2_source_input": true,
1418 - "gl2_source_node": true,
1419 - "highlight": true,
1420 - "id": true,
1421 - "input_type": true,
1422 - "level": true,
1423 - "location": true,
1424 - "log_file_path": true,
1425 - "log_offset": true,
1426 - "manager_name": true,
1427 - "message": true,
1428 - "module": true,
1429 - "rule_firedtimes": true,
1430 - "rule_group1": true,
1431 - "rule_groups": true,
1432 - "rule_id": true,
1433 - "rule_mail": true,
1434 - "rule_mitre_technique": false,
1435 - "sort": true,
1436 - "source": true,
1437 - "src_ip": true,
1438 - "streams": true,
1439 - "syslog_level": true,
1440 - "syslog_tag": true,
1441 - "syslog_type": true,
1442 - "time": true,
1443 - "timestamp": true,
1444 - "true": true
1445 - },
1446 - "indexByName": {
1447 - "_id": 2,
1448 - "_index": 8,
1449 - "_type": 9,
1450 - "agent_id": 10,
1451 - "agent_name": 4,
1452 - "cluster_name": 11,
1453 - "cluster_node": 12,
1454 - "data_office365_CreationTime": 0,
1455 - "data_office365_ExchangeMetaData_CC": 45,
1456 - "data_office365_ExchangeMetaData_FileSize": 47,
1457 - "data_office365_ExchangeMetaData_From": 48,
1458 - "data_office365_ExchangeMetaData_MessageID": 49,
1459 - "data_office365_ExchangeMetaData_RecipientCount": 51,
1460 - "data_office365_ExchangeMetaData_Sent": 52,
1461 - "data_office365_ExchangeMetaData_Subject": 50,
1462 - "data_office365_ExchangeMetaData_To": 53,
1463 - "data_office365_ExchangeMetaData_UniqueID": 54,
1464 - "data_office365_Id": 13,
1465 - "data_office365_IncidentId": 55,
1466 - "data_office365_ObjectId": 14,
1467 - "data_office365_Operation": 20,
1468 - "data_office365_OrganizationId": 15,
1469 - "data_office365_RecordType": 16,
1470 - "data_office365_SensitiveInfoDetectionIsIncluded": 46,
1471 - "data_office365_UserId": 3,
1472 - "data_office365_UserKey": 17,
1473 - "data_office365_UserType": 18,
1474 - "data_office365_Version": 19,
1475 - "data_office365_Workload": 44,
1476 - "decoder_name": 21,
1477 - "gl2_accounted_message_size": 22,
1478 - "gl2_message_id": 23,
1479 - "gl2_processing_error": 24,
1480 - "gl2_remote_ip": 25,
1481 - "gl2_remote_port": 26,
1482 - "gl2_source_input": 27,
1483 - "gl2_source_node": 28,
1484 - "highlight": 29,
1485 - "id": 30,
1486 - "location": 31,
1487 - "manager_name": 32,
1488 - "message": 33,
1489 - "rule_description": 5,
1490 - "rule_firedtimes": 34,
1491 - "rule_group1": 35,
1492 - "rule_groups": 36,
1493 - "rule_id": 7,
1494 - "rule_level": 6,
1495 - "rule_mail": 37,
1496 - "sort": 38,
1497 - "source": 39,
1498 - "streams": 40,
1499 - "syslog_level": 41,
1500 - "syslog_type": 42,
1501 - "timestamp": 1,
1502 - "true": 43
1503 - },
1504 - "renameByName": {
1505 - "_id": "EVENT ID",
1506 - "agent_name": "",
1507 - "data_office365_ActorIpAddress": "SRC IP",
1508 - "data_office365_CreationTime": "EVENT TIME",
1509 - "data_office365_ExchangeMetaData_FileSize": "FILE SIZE",
1510 - "data_office365_ExchangeMetaData_RecipientCount": "RECIPIENTS",
1511 - "data_office365_ExchangeMetaData_Sent": "",
1512 - "data_office365_ExchangeMetaData_Subject": "MAIL SUBJECT",
1513 - "data_office365_GradingResult_TriageCategory": "",
1514 - "data_office365_GradingResult_TriageVerdict": "VEREDICT",
1515 - "data_office365_InsightData": "",
1516 - "data_office365_ResultStatus": "RESULT",
1517 - "data_office365_SensitiveInfoDetectionIsIncluded": "SENSITIVE INFO",
1518 - "data_office365_Severity": "SEVERITY",
1519 - "data_office365_SharePointMetaData_FileName": "FILE",
1520 - "data_office365_Subject": "MAIL SUBJECT",
1521 - "data_office365_SubmissionState": "STATE",
1522 - "data_office365_SubmissionType": "TYPE",
1523 - "data_office365_UserId": "ACCOUNT",
1524 - "rule_description": "DESCRIPTION",
1525 - "rule_id": "RULE ID",
1526 - "rule_level": "",
1527 - "rule_mitre_id": "MITRE ID",
1528 - "rule_mitre_tactic": "MITRE TACTIC",
1529 - "rule_mitre_technique": "MITRE TECHNIQUE",
1530 - "timestamp": "Date/Time"
1531 - }
1532 - }
1533 - }
1534 - ],
1535 - "transparent": true,
1536 - "type": "table"
1537 - }
1538 - ],
1539 - "refresh": false,
1540 - "schemaVersion": 37,
1541 - "style": "dark",
1542 - "tags": [
1543 - "O365"
1544 - ],
1545 - "templating": {
1546 - "list": [
1547 - {
1548 - "datasource": {
1549 - "type": "elasticsearch",
1550 - "uid": "replace_datasource_uid"
1551 - },
1552 - "filters": [],
1553 - "hide": 0,
1554 - "label": "",
1555 - "name": "Filters",
1556 - "skipUrlSync": false,
1557 - "type": "adhoc"
1558 - },
1559 - {
1560 - "current": {
1561 - "selected": false,
1562 - "text": "All",
1563 - "value": "$__all"
1564 - },
1565 - "datasource": {
1566 - "type": "elasticsearch",
1567 - "uid": "replace_datasource_uid"
1568 - },
1569 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SecurityComplianceCenter\"}",
1570 - "hide": 0,
1571 - "includeAll": true,
1572 - "label": "Operation",
1573 - "multi": false,
1574 - "name": "operation",
1575 - "options": [],
1576 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SecurityComplianceCenter\"}",
1577 - "refresh": 2,
1578 - "regex": "",
1579 - "skipUrlSync": false,
1580 - "sort": 1,
1581 - "tagValuesQuery": "",
1582 - "tagsQuery": "",
1583 - "type": "query",
1584 - "useTags": false
1585 - },
1586 - {
1587 - "current": {
1588 - "selected": false,
1589 - "text": "All",
1590 - "value": "$__all"
1591 - },
1592 - "datasource": {
1593 - "type": "elasticsearch",
1594 - "uid": "replace_datasource_uid"
1595 - },
1596 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1597 - "hide": 0,
1598 - "includeAll": true,
1599 - "label": "Rule Level",
1600 - "multi": false,
1601 - "name": "rule_level",
1602 - "options": [],
1603 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1604 - "refresh": 2,
1605 - "regex": "",
1606 - "skipUrlSync": false,
1607 - "sort": 0,
1608 - "type": "query"
1609 - }
1610 - ]
1611 - },
1612 - "time": {
1613 - "from": "now-12h",
1614 - "to": "now"
1615 - },
1616 - "timepicker": {
1617 - "refresh_intervals": [
1618 - "5s",
1619 - "10s",
1620 - "30s",
1621 - "1m",
1622 - "5m",
1623 - "15m",
1624 - "30m",
1625 - "1h",
1626 - "2h",
1627 - "1d"
1628 - ],
1629 - "time_options": [
1630 - "5m",
1631 - "15m",
1632 - "1h",
1633 - "6h",
1634 - "12h",
1635 - "24h",
1636 - "2d",
1637 - "7d",
1638 - "30d"
1639 - ]
1640 - },
1641 - "timezone": "",
1642 - "title": "O365 - SECURITY COMPLIANCE CENTER",
1643 - "uid": "itiq7wq7z",
1644 - "version": 1,
1645 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "9.2.0",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 3,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "displayMode": "auto",
255 + "inspect": false
256 + },
257 + "mappings": [],
258 + "thresholds": {
259 + "mode": "absolute",
260 + "steps": [
261 + {
262 + "color": "red",
263 + "value": null
264 + }
265 + ]
266 + }
267 + },
268 + "overrides": [
269 + {
270 + "matcher": {
271 + "id": "byName",
272 + "options": "Count"
273 + },
274 + "properties": [
275 + {
276 + "id": "displayName",
277 + "value": "EVENTS"
278 + },
279 + {
280 + "id": "unit",
281 + "value": "short"
282 + },
283 + {
284 + "id": "decimals",
285 + "value": -1
286 + },
287 + {
288 + "id": "custom.align"
289 + },
290 + {
291 + "id": "thresholds",
292 + "value": {
293 + "mode": "absolute",
294 + "steps": [
295 + {
296 + "color": "red",
297 + "value": null
298 + }
299 + ]
300 + }
301 + }
302 + ]
303 + },
304 + {
305 + "matcher": {
306 + "id": "byName",
307 + "options": "OPERATION"
308 + },
309 + "properties": [
310 + {
311 + "id": "custom.width",
312 + "value": 209
313 + }
314 + ]
315 + }
316 + ]
317 + },
318 + "gridPos": {
319 + "h": 7,
320 + "w": 5,
321 + "x": 7,
322 + "y": 0
323 + },
324 + "id": 54,
325 + "options": {
326 + "footer": {
327 + "fields": "",
328 + "reducer": ["sum"],
329 + "show": false
330 + },
331 + "showHeader": true,
332 + "sortBy": []
333 + },
334 + "pluginVersion": "9.2.0",
335 + "targets": [
336 + {
337 + "bucketAggs": [
338 + {
339 + "fake": true,
340 + "field": "data_office365_Operation",
341 + "id": "4",
342 + "settings": {
343 + "min_doc_count": 1,
344 + "order": "desc",
345 + "orderBy": "_count",
346 + "size": "0"
347 + },
348 + "type": "terms"
349 + }
350 + ],
351 + "datasource": {
352 + "type": "elasticsearch",
353 + "uid": "replace_datasource_uid"
354 + },
355 + "metrics": [
356 + {
357 + "field": "select field",
358 + "id": "1",
359 + "type": "count"
360 + }
361 + ],
362 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
363 + "refId": "A",
364 + "timeField": "timestamp"
365 + }
366 + ],
367 + "title": "EVENTS BY OPERATION",
368 + "transformations": [
369 + {
370 + "id": "merge",
371 + "options": {
372 + "reducers": []
373 + }
374 + },
375 + {
376 + "id": "organize",
377 + "options": {
378 + "excludeByName": {},
379 + "indexByName": {},
380 + "renameByName": {
381 + "Count": "EVENTS",
382 + "data_office365_Operation": "OPERATION",
383 + "data_office365_Workload": "WORKLOAD"
384 + }
385 + }
386 + }
387 + ],
388 + "type": "table"
389 + },
390 + {
391 + "datasource": {
392 + "type": "elasticsearch",
393 + "uid": "replace_datasource_uid"
394 + },
395 + "fieldConfig": {
396 + "defaults": {
397 + "mappings": [
398 + {
399 + "options": {
400 + "match": "null",
401 + "result": {
402 + "text": "N/A"
403 + }
404 + },
405 + "type": "special"
406 + }
407 + ],
408 + "thresholds": {
409 + "mode": "absolute",
410 + "steps": [
411 + {
412 + "color": "orange",
413 + "value": null
414 + }
415 + ]
416 + },
417 + "unit": "locale"
418 + },
419 + "overrides": []
420 + },
421 + "gridPos": {
422 + "h": 7,
423 + "w": 4,
424 + "x": 12,
425 + "y": 0
426 + },
427 + "id": 55,
428 + "links": [],
429 + "options": {
430 + "colorMode": "value",
431 + "graphMode": "area",
432 + "justifyMode": "auto",
433 + "orientation": "horizontal",
434 + "reduceOptions": {
435 + "calcs": ["sum"],
436 + "fields": "",
437 + "values": false
438 + },
439 + "text": {},
440 + "textMode": "auto"
441 + },
442 + "pluginVersion": "9.2.0",
443 + "targets": [
444 + {
445 + "bucketAggs": [
446 + {
447 + "field": "timestamp",
448 + "id": "2",
449 + "settings": {
450 + "interval": "auto",
451 + "min_doc_count": 0,
452 + "trimEdges": 0
453 + },
454 + "type": "date_histogram"
455 + }
456 + ],
457 + "datasource": {
458 + "type": "elasticsearch",
459 + "uid": "replace_datasource_uid"
460 + },
461 + "metrics": [
462 + {
463 + "field": "select field",
464 + "id": "1",
465 + "type": "count"
466 + }
467 + ],
468 + "query": "data_office365_Operation:UserSubmission",
469 + "refId": "A",
470 + "timeField": "timestamp"
471 + }
472 + ],
473 + "title": "PHISHING (USER SUBMISSIONS)",
474 + "type": "stat"
475 + },
476 + {
477 + "datasource": {
478 + "type": "elasticsearch",
479 + "uid": "replace_datasource_uid"
480 + },
481 + "fieldConfig": {
482 + "defaults": {
483 + "color": {
484 + "mode": "thresholds"
485 + },
486 + "custom": {
487 + "align": "auto",
488 + "displayMode": "auto",
489 + "inspect": false
490 + },
491 + "mappings": [],
492 + "thresholds": {
493 + "mode": "absolute",
494 + "steps": [
495 + {
496 + "color": "red",
497 + "value": null
498 + }
499 + ]
500 + }
501 + },
502 + "overrides": [
503 + {
504 + "matcher": {
505 + "id": "byName",
506 + "options": "Count"
507 + },
508 + "properties": [
509 + {
510 + "id": "displayName",
511 + "value": "EVENTS"
512 + },
513 + {
514 + "id": "unit",
515 + "value": "short"
516 + },
517 + {
518 + "id": "decimals",
519 + "value": -1
520 + },
521 + {
522 + "id": "custom.align"
523 + },
524 + {
525 + "id": "thresholds",
526 + "value": {
527 + "mode": "absolute",
528 + "steps": [
529 + {
530 + "color": "red",
531 + "value": null
532 + }
533 + ]
534 + }
535 + }
536 + ]
537 + },
538 + {
539 + "matcher": {
540 + "id": "byName",
541 + "options": "OPERATION"
542 + },
543 + "properties": [
544 + {
545 + "id": "custom.width",
546 + "value": 263
547 + }
548 + ]
549 + },
550 + {
551 + "matcher": {
552 + "id": "byName",
553 + "options": "ACCOUNT"
554 + },
555 + "properties": [
556 + {
557 + "id": "custom.width",
558 + "value": 439
559 + }
560 + ]
561 + }
562 + ]
563 + },
564 + "gridPos": {
565 + "h": 7,
566 + "w": 8,
567 + "x": 16,
568 + "y": 0
569 + },
570 + "id": 57,
571 + "options": {
572 + "footer": {
573 + "fields": "",
574 + "reducer": ["sum"],
575 + "show": false
576 + },
577 + "showHeader": true,
578 + "sortBy": []
579 + },
580 + "pluginVersion": "9.2.0",
581 + "targets": [
582 + {
583 + "bucketAggs": [
584 + {
585 + "fake": true,
586 + "field": "data_office365_UserId",
587 + "id": "4",
588 + "settings": {
589 + "min_doc_count": 1,
590 + "order": "desc",
591 + "orderBy": "_count",
592 + "size": "0"
593 + },
594 + "type": "terms"
595 + }
596 + ],
597 + "datasource": {
598 + "type": "elasticsearch",
599 + "uid": "replace_datasource_uid"
600 + },
601 + "metrics": [
602 + {
603 + "field": "select field",
604 + "id": "1",
605 + "type": "count"
606 + }
607 + ],
608 + "query": "data_office365_Operation:UserSubmission",
609 + "refId": "A",
610 + "timeField": "timestamp"
611 + }
612 + ],
613 + "title": "PHISHING (REPORTERS)",
614 + "transformations": [
615 + {
616 + "id": "organize",
617 + "options": {
618 + "excludeByName": {},
619 + "indexByName": {},
620 + "renameByName": {
621 + "Count": "EVENTS",
622 + "data_office365_Operation": "OPERATION",
623 + "data_office365_UserId": "ACCOUNT",
624 + "data_office365_Workload": "WORKLOAD"
625 + }
626 + }
627 + }
628 + ],
629 + "type": "table"
630 + },
631 + {
632 + "datasource": {
633 + "type": "elasticsearch",
634 + "uid": "replace_datasource_uid"
635 + },
636 + "fieldConfig": {
637 + "defaults": {
638 + "color": {
639 + "mode": "thresholds"
640 + },
641 + "mappings": [
642 + {
643 + "options": {
644 + "match": "null",
645 + "result": {
646 + "text": "N/A"
647 + }
648 + },
649 + "type": "special"
650 + }
651 + ],
652 + "max": 15,
653 + "min": 0,
654 + "thresholds": {
655 + "mode": "absolute",
656 + "steps": [
657 + {
658 + "color": "#299c46",
659 + "value": null
660 + },
661 + {
662 + "color": "rgba(237, 129, 40, 0.89)",
663 + "value": 8
664 + },
665 + {
666 + "color": "#d44a3a",
667 + "value": 12
668 + }
669 + ]
670 + },
671 + "unit": "none"
672 + },
673 + "overrides": []
674 + },
675 + "gridPos": {
676 + "h": 7,
677 + "w": 4,
678 + "x": 0,
679 + "y": 7
680 + },
681 + "id": 16,
682 + "links": [],
683 + "options": {
684 + "orientation": "horizontal",
685 + "reduceOptions": {
686 + "calcs": ["max"],
687 + "fields": "",
688 + "values": false
689 + },
690 + "showThresholdLabels": false,
691 + "showThresholdMarkers": true,
692 + "text": {}
693 + },
694 + "pluginVersion": "9.2.0",
695 + "targets": [
696 + {
697 + "bucketAggs": [
698 + {
699 + "field": "timestamp",
700 + "id": "2",
701 + "settings": {
702 + "interval": "auto",
703 + "min_doc_count": 0,
704 + "trimEdges": 0
705 + },
706 + "type": "date_histogram"
707 + }
708 + ],
709 + "datasource": {
710 + "type": "elasticsearch",
711 + "uid": "replace_datasource_uid"
712 + },
713 + "metrics": [
714 + {
715 + "field": "rule_level",
716 + "id": "1",
717 + "meta": {},
718 + "settings": {},
719 + "type": "max"
720 + }
721 + ],
722 + "query": "data_office365_Operation:$operation",
723 + "refId": "A",
724 + "timeField": "timestamp"
725 + }
726 + ],
727 + "title": "MAX SEVERITY (0 - 15)",
728 + "type": "gauge"
729 + },
730 + {
731 + "datasource": {
732 + "type": "elasticsearch",
733 + "uid": "replace_datasource_uid"
734 + },
735 + "fieldConfig": {
736 + "defaults": {
737 + "color": {
738 + "mode": "palette-classic"
739 + },
740 + "custom": {
741 + "axisCenteredZero": false,
742 + "axisColorMode": "text",
743 + "axisLabel": "",
744 + "axisPlacement": "auto",
745 + "barAlignment": 0,
746 + "drawStyle": "bars",
747 + "fillOpacity": 0,
748 + "gradientMode": "none",
749 + "hideFrom": {
750 + "legend": false,
751 + "tooltip": false,
752 + "viz": false
753 + },
754 + "lineInterpolation": "linear",
755 + "lineWidth": 1,
756 + "pointSize": 5,
757 + "scaleDistribution": {
758 + "type": "linear"
759 + },
760 + "showPoints": "auto",
761 + "spanNulls": false,
762 + "stacking": {
763 + "group": "A",
764 + "mode": "normal"
765 + },
766 + "thresholdsStyle": {
767 + "mode": "off"
768 + }
769 + },
770 + "mappings": [],
771 + "thresholds": {
772 + "mode": "absolute",
773 + "steps": [
774 + {
775 + "color": "green",
776 + "value": null
777 + },
778 + {
779 + "color": "red",
780 + "value": 80
781 + }
782 + ]
783 + }
784 + },
785 + "overrides": []
786 + },
787 + "gridPos": {
788 + "h": 13,
789 + "w": 20,
790 + "x": 4,
791 + "y": 7
792 + },
793 + "id": 59,
794 + "options": {
795 + "legend": {
796 + "calcs": [],
797 + "displayMode": "table",
798 + "placement": "right",
799 + "showLegend": true
800 + },
801 + "tooltip": {
802 + "mode": "single",
803 + "sort": "none"
804 + }
805 + },
806 + "targets": [
807 + {
808 + "alias": "",
809 + "bucketAggs": [
810 + {
811 + "field": "data_office365_Operation",
812 + "id": "3",
813 + "settings": {
814 + "min_doc_count": "1",
815 + "order": "desc",
816 + "orderBy": "_count",
817 + "size": "10"
818 + },
819 + "type": "terms"
820 + },
821 + {
822 + "field": "timestamp",
823 + "id": "2",
824 + "settings": {
825 + "interval": "auto"
826 + },
827 + "type": "date_histogram"
828 + }
829 + ],
830 + "datasource": {
831 + "type": "elasticsearch",
832 + "uid": "replace_datasource_uid"
833 + },
834 + "metrics": [
835 + {
836 + "id": "1",
837 + "type": "count"
838 + }
839 + ],
840 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
841 + "refId": "A",
842 + "timeField": "timestamp"
843 + }
844 + ],
845 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
846 + "transparent": true,
847 + "type": "timeseries"
848 + },
849 + {
850 + "datasource": {
851 + "type": "elasticsearch",
852 + "uid": "replace_datasource_uid"
853 + },
854 + "fieldConfig": {
855 + "defaults": {
856 + "mappings": [
857 + {
858 + "options": {
859 + "match": "null",
860 + "result": {
861 + "text": "N/A"
862 + }
863 + },
864 + "type": "special"
865 + }
866 + ],
867 + "thresholds": {
868 + "mode": "absolute",
869 + "steps": [
870 + {
871 + "color": "blue",
872 + "value": null
873 + }
874 + ]
875 + },
876 + "unit": "locale"
877 + },
878 + "overrides": []
879 + },
880 + "gridPos": {
881 + "h": 6,
882 + "w": 4,
883 + "x": 0,
884 + "y": 14
885 + },
886 + "id": 51,
887 + "links": [],
888 + "options": {
889 + "colorMode": "value",
890 + "graphMode": "area",
891 + "justifyMode": "auto",
892 + "orientation": "horizontal",
893 + "reduceOptions": {
894 + "calcs": ["sum"],
895 + "fields": "",
896 + "values": false
897 + },
898 + "text": {},
899 + "textMode": "auto"
900 + },
901 + "pluginVersion": "9.2.0",
902 + "targets": [
903 + {
904 + "bucketAggs": [
905 + {
906 + "$$hashKey": "object:331",
907 + "field": "timestamp",
908 + "id": "2",
909 + "settings": {
910 + "interval": "auto",
911 + "min_doc_count": 0,
912 + "trimEdges": 0
913 + },
914 + "type": "date_histogram"
915 + }
916 + ],
917 + "datasource": {
918 + "type": "elasticsearch",
919 + "uid": "replace_datasource_uid"
920 + },
921 + "metrics": [
922 + {
923 + "$$hashKey": "object:329",
924 + "field": "select field",
925 + "id": "1",
926 + "type": "count"
927 + }
928 + ],
929 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
930 + "refId": "A",
931 + "timeField": "timestamp"
932 + }
933 + ],
934 + "title": "EVENTS (Total)",
935 + "type": "stat"
936 + },
937 + {
938 + "datasource": {
939 + "type": "elasticsearch",
940 + "uid": "replace_datasource_uid"
941 + },
942 + "fieldConfig": {
943 + "defaults": {
944 + "color": {
945 + "mode": "thresholds"
946 + },
947 + "custom": {
948 + "align": "auto",
949 + "displayMode": "auto",
950 + "filterable": true,
951 + "inspect": false
952 + },
953 + "mappings": [],
954 + "thresholds": {
955 + "mode": "absolute",
956 + "steps": [
957 + {
958 + "color": "green",
959 + "value": null
960 + },
961 + {
962 + "color": "red",
963 + "value": 80
964 + }
965 + ]
966 + }
967 + },
968 + "overrides": [
969 + {
970 + "matcher": {
971 + "id": "byName",
972 + "options": "rule_level"
973 + },
974 + "properties": [
975 + {
976 + "id": "displayName",
977 + "value": "RULE LEVEL"
978 + },
979 + {
980 + "id": "unit",
981 + "value": "short"
982 + },
983 + {
984 + "id": "decimals",
985 + "value": -1
986 + },
987 + {
988 + "id": "custom.displayMode",
989 + "value": "color-background"
990 + },
991 + {
992 + "id": "custom.align"
993 + },
994 + {
995 + "id": "thresholds",
996 + "value": {
997 + "mode": "absolute",
998 + "steps": [
999 + {
1000 + "color": "#37872D",
1001 + "value": null
1002 + },
1003 + {
1004 + "color": "rgba(237, 129, 40, 0.89)",
1005 + "value": 7
1006 + },
1007 + {
1008 + "color": "rgba(245, 54, 54, 0.9)",
1009 + "value": 12
1010 + }
1011 + ]
1012 + }
1013 + }
1014 + ]
1015 + },
1016 + {
1017 + "matcher": {
1018 + "id": "byName",
1019 + "options": "Date/Time"
1020 + },
1021 + "properties": [
1022 + {
1023 + "id": "custom.width",
1024 + "value": 242
1025 + }
1026 + ]
1027 + },
1028 + {
1029 + "matcher": {
1030 + "id": "byName",
1031 + "options": "MITRE TACTIC"
1032 + },
1033 + "properties": [
1034 + {
1035 + "id": "custom.width",
1036 + "value": 332
1037 + }
1038 + ]
1039 + },
1040 + {
1041 + "matcher": {
1042 + "id": "byName",
1043 + "options": "MITRE TECHNIQUE"
1044 + },
1045 + "properties": [
1046 + {
1047 + "id": "custom.width",
1048 + "value": 312
1049 + }
1050 + ]
1051 + },
1052 + {
1053 + "matcher": {
1054 + "id": "byName",
1055 + "options": "EVENT ID"
1056 + },
1057 + "properties": [
1058 + {
1059 + "id": "links",
1060 + "value": [
1061 + {
1062 + "targetBlank": true,
1063 + "title": "VIEW EVENT DETAILS",
1064 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1065 + }
1066 + ]
1067 + },
1068 + {
1069 + "id": "custom.width",
1070 + "value": 319
1071 + }
1072 + ]
1073 + },
1074 + {
1075 + "matcher": {
1076 + "id": "byName",
1077 + "options": "ACCOUNT"
1078 + },
1079 + "properties": [
1080 + {
1081 + "id": "custom.width",
1082 + "value": 343
1083 + }
1084 + ]
1085 + },
1086 + {
1087 + "matcher": {
1088 + "id": "byName",
1089 + "options": "EVENT TIME"
1090 + },
1091 + "properties": [
1092 + {
1093 + "id": "custom.width",
1094 + "value": 195
1095 + }
1096 + ]
1097 + },
1098 + {
1099 + "matcher": {
1100 + "id": "byName",
1101 + "options": "FILE SIZE"
1102 + },
1103 + "properties": [
1104 + {
1105 + "id": "unit",
1106 + "value": "bytes"
1107 + }
1108 + ]
1109 + },
1110 + {
1111 + "matcher": {
1112 + "id": "byName",
1113 + "options": "SENSITIVE INFO"
1114 + },
1115 + "properties": [
1116 + {
1117 + "id": "custom.width",
1118 + "value": 154
1119 + }
1120 + ]
1121 + },
1122 + {
1123 + "matcher": {
1124 + "id": "byName",
1125 + "options": "RULE LEVEL"
1126 + },
1127 + "properties": [
1128 + {
1129 + "id": "custom.width",
1130 + "value": 157
1131 + }
1132 + ]
1133 + }
1134 + ]
1135 + },
1136 + "gridPos": {
1137 + "h": 16,
1138 + "w": 24,
1139 + "x": 0,
1140 + "y": 20
1141 + },
1142 + "id": 27,
1143 + "options": {
1144 + "footer": {
1145 + "fields": "",
1146 + "reducer": ["sum"],
1147 + "show": false
1148 + },
1149 + "showHeader": true,
1150 + "sortBy": []
1151 + },
1152 + "pluginVersion": "9.2.0",
1153 + "targets": [
1154 + {
1155 + "bucketAggs": [],
1156 + "datasource": {
1157 + "type": "elasticsearch",
1158 + "uid": "replace_datasource_uid"
1159 + },
1160 + "metrics": [
1161 + {
1162 + "id": "1",
1163 + "settings": {
1164 + "size": "250"
1165 + },
1166 + "type": "raw_data"
1167 + }
1168 + ],
1169 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1170 + "refId": "A",
1171 + "timeField": "timestamp"
1172 + }
1173 + ],
1174 + "title": "EVENTS",
1175 + "transformations": [
1176 + {
1177 + "id": "merge",
1178 + "options": {
1179 + "reducers": []
1180 + }
1181 + },
1182 + {
1183 + "id": "organize",
1184 + "options": {
1185 + "excludeByName": {
1186 + "@metadata_beat": true,
1187 + "@metadata_type": true,
1188 + "@metadata_version": true,
1189 + "IMPHASH": true,
1190 + "MD5": true,
1191 + "SHA1": true,
1192 + "SHA256": true,
1193 + "_id": false,
1194 + "_index": true,
1195 + "_type": true,
1196 + "agent_ephemeral_id": true,
1197 + "agent_hostname": true,
1198 + "agent_id": true,
1199 + "agent_ip_city_name": true,
1200 + "agent_ip_country_code": true,
1201 + "agent_ip_geolocation": true,
1202 + "agent_name": true,
1203 + "agent_type": true,
1204 + "agent_version": true,
1205 + "beats_type": true,
1206 + "cluster_name": true,
1207 + "cluster_node": true,
1208 + "collector_node_id": true,
1209 + "data_alert_action": true,
1210 + "data_alert_category": true,
1211 + "data_alert_gid": true,
1212 + "data_alert_rev": true,
1213 + "data_alert_severity": true,
1214 + "data_alert_signature": true,
1215 + "data_alert_signature_id": true,
1216 + "data_app_proto": true,
1217 + "data_audit_auid": true,
1218 + "data_audit_command": true,
1219 + "data_audit_euid": true,
1220 + "data_audit_exe": true,
1221 + "data_audit_gid": true,
1222 + "data_audit_id": true,
1223 + "data_audit_pid": true,
1224 + "data_audit_res": true,
1225 + "data_audit_session": true,
1226 + "data_audit_type": true,
1227 + "data_audit_uid": true,
1228 + "data_dest_ip": true,
1229 + "data_dest_port": true,
1230 + "data_dstuser": true,
1231 + "data_event_type": true,
1232 + "data_extra_data": true,
1233 + "data_file": true,
1234 + "data_flow_bytes_toclient": true,
1235 + "data_flow_bytes_toserver": true,
1236 + "data_flow_id": true,
1237 + "data_flow_pkts_toclient": true,
1238 + "data_flow_pkts_toserver": true,
1239 + "data_flow_start": true,
1240 + "data_http_http_content_type": true,
1241 + "data_http_http_port": true,
1242 + "data_http_length": true,
1243 + "data_http_status": true,
1244 + "data_http_url": true,
1245 + "data_id": true,
1246 + "data_in_iface": true,
1247 + "data_metadata_flowbits": true,
1248 + "data_metadata_flowints_http_anomaly_count": true,
1249 + "data_metadata_flowints_tcp_retransmission_count": true,
1250 + "data_office365_AadAppId": true,
1251 + "data_office365_Actor": true,
1252 + "data_office365_ActorContextId": true,
1253 + "data_office365_ActorIpAddress": false,
1254 + "data_office365_ActorIpAddress_city_name": true,
1255 + "data_office365_ActorIpAddress_country_code": true,
1256 + "data_office365_ActorIpAddress_geolocation": true,
1257 + "data_office365_AdditionalData": true,
1258 + "data_office365_AlertEntityId": true,
1259 + "data_office365_AlertId": true,
1260 + "data_office365_AlertLinks": true,
1261 + "data_office365_AlertType": true,
1262 + "data_office365_ApplicationId": true,
1263 + "data_office365_AzureActiveDirectoryEventType": true,
1264 + "data_office365_BCLValue": true,
1265 + "data_office365_Category": true,
1266 + "data_office365_ClientApplication": true,
1267 + "data_office365_ClientIP": true,
1268 + "data_office365_ClientIP_city_name": true,
1269 + "data_office365_ClientIP_country_code": true,
1270 + "data_office365_ClientIP_geolocation": true,
1271 + "data_office365_CmdletVersion": true,
1272 + "data_office365_Comments": true,
1273 + "data_office365_CreationTime": false,
1274 + "data_office365_Data": true,
1275 + "data_office365_DataType": true,
1276 + "data_office365_DatabaseType": true,
1277 + "data_office365_DeliveryMessageInfo_DIEnrichment": true,
1278 + "data_office365_DeliveryMessageInfo_DeliveryControlSource": true,
1279 + "data_office365_DeliveryMessageInfo_DeliveryControlType": true,
1280 + "data_office365_DeliveryMessageInfo_DeliveryReason": true,
1281 + "data_office365_DeliveryMessageInfo_Destination": true,
1282 + "data_office365_DeliveryMessageInfo_FinalFilterVerdict": true,
1283 + "data_office365_DeliveryMessageInfo_FinalFilterVerdictControlSource": true,
1284 + "data_office365_DeliveryMessageInfo_FinalVerdict": true,
1285 + "data_office365_DeliveryMessageInfo_FinalVerdictSource": true,
1286 + "data_office365_DeliveryMessageInfo_Id": true,
1287 + "data_office365_DeliveryMessageInfo_IsValid": true,
1288 + "data_office365_DeliveryMessageInfo_PolicyHit": true,
1289 + "data_office365_DeliveryMessageInfo_PolicyOverride": true,
1290 + "data_office365_DeliveryMessageInfo_TenantActionPolicyId": true,
1291 + "data_office365_DeliveryMessageInfo_TenantActionPolicyType": true,
1292 + "data_office365_DeliveryMessageInfo_Timestamp": true,
1293 + "data_office365_Description": true,
1294 + "data_office365_DeviceProperties": true,
1295 + "data_office365_EffectiveOrganization": true,
1296 + "data_office365_EntityType": true,
1297 + "data_office365_ErrorNumber": true,
1298 + "data_office365_ExchangeLocations": true,
1299 + "data_office365_ExchangeMetaData_CC": true,
1300 + "data_office365_ExchangeMetaData_FileSize": false,
1301 + "data_office365_ExchangeMetaData_From": true,
1302 + "data_office365_ExchangeMetaData_MessageID": true,
1303 + "data_office365_ExchangeMetaData_RecipientCount": false,
1304 + "data_office365_ExchangeMetaData_Sent": true,
1305 + "data_office365_ExchangeMetaData_Subject": false,
1306 + "data_office365_ExchangeMetaData_To": true,
1307 + "data_office365_ExchangeMetaData_UniqueID": true,
1308 + "data_office365_ExtendedProperties": true,
1309 + "data_office365_FilteringDate": true,
1310 + "data_office365_GradingResult_FirstTriagedBy": true,
1311 + "data_office365_GradingResult_Id": true,
1312 + "data_office365_GradingResult_LastUpdatedBy": true,
1313 + "data_office365_GradingResult_Timestamp": true,
1314 + "data_office365_GradingResult_TriageCategory": true,
1315 + "data_office365_GradingResult_TriageVerdict": true,
1316 + "data_office365_Id": true,
1317 + "data_office365_IncidentId": true,
1318 + "data_office365_InsightData": true,
1319 + "data_office365_InsightId": true,
1320 + "data_office365_InterSystemsId": true,
1321 + "data_office365_IntraSystemId": true,
1322 + "data_office365_KesMailId": true,
1323 + "data_office365_Language": true,
1324 + "data_office365_LogonError": true,
1325 + "data_office365_MessageDate": true,
1326 + "data_office365_ModifiedProperties": true,
1327 + "data_office365_Name": true,
1328 + "data_office365_NonPIIParameters": true,
1329 + "data_office365_ObjectId": true,
1330 + "data_office365_ObjectType": true,
1331 + "data_office365_Operation": true,
1332 + "data_office365_OrganizationId": true,
1333 + "data_office365_P1Sender": true,
1334 + "data_office365_P1SenderDomain": true,
1335 + "data_office365_P2Sender": true,
1336 + "data_office365_P2SenderDomain": true,
1337 + "data_office365_Parameters": true,
1338 + "data_office365_PolicyDetails": true,
1339 + "data_office365_PolicyId": true,
1340 + "data_office365_Query": true,
1341 + "data_office365_Recipients": true,
1342 + "data_office365_RecordType": true,
1343 + "data_office365_RelativeUrl": true,
1344 + "data_office365_RescanResult_Id": true,
1345 + "data_office365_RescanResult_RescanVerdict": true,
1346 + "data_office365_RescanResult_Timestamp": true,
1347 + "data_office365_ResultCount": true,
1348 + "data_office365_ResultStatus": true,
1349 + "data_office365_SecurityComplianceCenterEventType": true,
1350 + "data_office365_SenderIP": true,
1351 + "data_office365_SenderIP_city_name": true,
1352 + "data_office365_SenderIP_country_code": true,
1353 + "data_office365_SenderIP_geolocation": true,
1354 + "data_office365_Severity": true,
1355 + "data_office365_SharePointMetaData_FileID": true,
1356 + "data_office365_SharePointMetaData_FileName": false,
1357 + "data_office365_SharePointMetaData_FileOwner": true,
1358 + "data_office365_SharePointMetaData_FilePathUrl": true,
1359 + "data_office365_SharePointMetaData_FileSize": true,
1360 + "data_office365_SharePointMetaData_From": true,
1361 + "data_office365_SharePointMetaData_IsViewableByExternalUsers": true,
1362 + "data_office365_SharePointMetaData_IsVisibleOnlyToOdbOwner": true,
1363 + "data_office365_SharePointMetaData_ItemCreationTime": true,
1364 + "data_office365_SharePointMetaData_ItemLastModifiedTime": true,
1365 + "data_office365_SharePointMetaData_ItemLastSharedTime": true,
1366 + "data_office365_SharePointMetaData_SiteCollectionGuid": true,
1367 + "data_office365_SharePointMetaData_SiteCollectionUrl": true,
1368 + "data_office365_SharePointMetaData_UniqueID": true,
1369 + "data_office365_Source": true,
1370 + "data_office365_StartTime": true,
1371 + "data_office365_Status": true,
1372 + "data_office365_Subject": true,
1373 + "data_office365_SubmissionContent": true,
1374 + "data_office365_SubmissionContentSubType": true,
1375 + "data_office365_SubmissionContentType": true,
1376 + "data_office365_SubmissionId": true,
1377 + "data_office365_SubmissionState": true,
1378 + "data_office365_SubmissionType": true,
1379 + "data_office365_SubmitterDisplayName": true,
1380 + "data_office365_SubmitterId": true,
1381 + "data_office365_Target": true,
1382 + "data_office365_TargetContextId": true,
1383 + "data_office365_UserId": true,
1384 + "data_office365_UserKey": true,
1385 + "data_office365_UserType": true,
1386 + "data_office365_Version": true,
1387 + "data_office365_Workload": true,
1388 + "data_win_system_version": true,
1389 + "decoder_name": true,
1390 + "decoder_parent": true,
1391 + "error": true,
1392 + "full_log": false,
1393 + "gl2_accounted_message_size": true,
1394 + "gl2_message_id": true,
1395 + "gl2_processing_error": true,
1396 + "gl2_remote_ip": true,
1397 + "gl2_remote_port": true,
1398 + "gl2_source_collector": true,
1399 + "gl2_source_input": true,
1400 + "gl2_source_node": true,
1401 + "highlight": true,
1402 + "id": true,
1403 + "input_type": true,
1404 + "level": true,
1405 + "location": true,
1406 + "log_file_path": true,
1407 + "log_offset": true,
1408 + "manager_name": true,
1409 + "message": true,
1410 + "module": true,
1411 + "rule_firedtimes": true,
1412 + "rule_group1": true,
1413 + "rule_groups": true,
1414 + "rule_id": true,
1415 + "rule_mail": true,
1416 + "rule_mitre_technique": false,
1417 + "sort": true,
1418 + "source": true,
1419 + "src_ip": true,
1420 + "streams": true,
1421 + "syslog_level": true,
1422 + "syslog_tag": true,
1423 + "syslog_type": true,
1424 + "time": true,
1425 + "timestamp": true,
1426 + "true": true
1427 + },
1428 + "indexByName": {
1429 + "_id": 2,
1430 + "_index": 8,
1431 + "_type": 9,
1432 + "agent_id": 10,
1433 + "agent_name": 4,
1434 + "cluster_name": 11,
1435 + "cluster_node": 12,
1436 + "data_office365_CreationTime": 0,
1437 + "data_office365_ExchangeMetaData_CC": 45,
1438 + "data_office365_ExchangeMetaData_FileSize": 47,
1439 + "data_office365_ExchangeMetaData_From": 48,
1440 + "data_office365_ExchangeMetaData_MessageID": 49,
1441 + "data_office365_ExchangeMetaData_RecipientCount": 51,
1442 + "data_office365_ExchangeMetaData_Sent": 52,
1443 + "data_office365_ExchangeMetaData_Subject": 50,
1444 + "data_office365_ExchangeMetaData_To": 53,
1445 + "data_office365_ExchangeMetaData_UniqueID": 54,
1446 + "data_office365_Id": 13,
1447 + "data_office365_IncidentId": 55,
1448 + "data_office365_ObjectId": 14,
1449 + "data_office365_Operation": 20,
1450 + "data_office365_OrganizationId": 15,
1451 + "data_office365_RecordType": 16,
1452 + "data_office365_SensitiveInfoDetectionIsIncluded": 46,
1453 + "data_office365_UserId": 3,
1454 + "data_office365_UserKey": 17,
1455 + "data_office365_UserType": 18,
1456 + "data_office365_Version": 19,
1457 + "data_office365_Workload": 44,
1458 + "decoder_name": 21,
1459 + "gl2_accounted_message_size": 22,
1460 + "gl2_message_id": 23,
1461 + "gl2_processing_error": 24,
1462 + "gl2_remote_ip": 25,
1463 + "gl2_remote_port": 26,
1464 + "gl2_source_input": 27,
1465 + "gl2_source_node": 28,
1466 + "highlight": 29,
1467 + "id": 30,
1468 + "location": 31,
1469 + "manager_name": 32,
1470 + "message": 33,
1471 + "rule_description": 5,
1472 + "rule_firedtimes": 34,
1473 + "rule_group1": 35,
1474 + "rule_groups": 36,
1475 + "rule_id": 7,
1476 + "rule_level": 6,
1477 + "rule_mail": 37,
1478 + "sort": 38,
1479 + "source": 39,
1480 + "streams": 40,
1481 + "syslog_level": 41,
1482 + "syslog_type": 42,
1483 + "timestamp": 1,
1484 + "true": 43
1485 + },
1486 + "renameByName": {
1487 + "_id": "EVENT ID",
1488 + "agent_name": "",
1489 + "data_office365_ActorIpAddress": "SRC IP",
1490 + "data_office365_CreationTime": "EVENT TIME",
1491 + "data_office365_ExchangeMetaData_FileSize": "FILE SIZE",
1492 + "data_office365_ExchangeMetaData_RecipientCount": "RECIPIENTS",
1493 + "data_office365_ExchangeMetaData_Sent": "",
1494 + "data_office365_ExchangeMetaData_Subject": "MAIL SUBJECT",
1495 + "data_office365_GradingResult_TriageCategory": "",
1496 + "data_office365_GradingResult_TriageVerdict": "VEREDICT",
1497 + "data_office365_InsightData": "",
1498 + "data_office365_ResultStatus": "RESULT",
1499 + "data_office365_SensitiveInfoDetectionIsIncluded": "SENSITIVE INFO",
1500 + "data_office365_Severity": "SEVERITY",
1501 + "data_office365_SharePointMetaData_FileName": "FILE",
1502 + "data_office365_Subject": "MAIL SUBJECT",
1503 + "data_office365_SubmissionState": "STATE",
1504 + "data_office365_SubmissionType": "TYPE",
1505 + "data_office365_UserId": "ACCOUNT",
1506 + "rule_description": "DESCRIPTION",
1507 + "rule_id": "RULE ID",
1508 + "rule_level": "",
1509 + "rule_mitre_id": "MITRE ID",
1510 + "rule_mitre_tactic": "MITRE TACTIC",
1511 + "rule_mitre_technique": "MITRE TECHNIQUE",
1512 + "timestamp": "Date/Time"
1513 + }
1514 + }
1515 + }
1516 + ],
1517 + "transparent": true,
1518 + "type": "table"
1519 + }
1520 + ],
1521 + "refresh": false,
1522 + "schemaVersion": 37,
1523 + "style": "dark",
1524 + "tags": ["O365"],
1525 + "templating": {
1526 + "list": [
1527 + {
1528 + "datasource": {
1529 + "type": "elasticsearch",
1530 + "uid": "replace_datasource_uid"
1531 + },
1532 + "filters": [],
1533 + "hide": 0,
1534 + "label": "",
1535 + "name": "Filters",
1536 + "skipUrlSync": false,
1537 + "type": "adhoc"
1538 + },
1539 + {
1540 + "current": {
1541 + "selected": false,
1542 + "text": "All",
1543 + "value": "$__all"
1544 + },
1545 + "datasource": {
1546 + "type": "elasticsearch",
1547 + "uid": "replace_datasource_uid"
1548 + },
1549 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SecurityComplianceCenter\"}",
1550 + "hide": 0,
1551 + "includeAll": true,
1552 + "label": "Operation",
1553 + "multi": false,
1554 + "name": "operation",
1555 + "options": [],
1556 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SecurityComplianceCenter\"}",
1557 + "refresh": 2,
1558 + "regex": "",
1559 + "skipUrlSync": false,
1560 + "sort": 1,
1561 + "tagValuesQuery": "",
1562 + "tagsQuery": "",
1563 + "type": "query",
1564 + "useTags": false
1565 + },
1566 + {
1567 + "current": {
1568 + "selected": false,
1569 + "text": "All",
1570 + "value": "$__all"
1571 + },
1572 + "datasource": {
1573 + "type": "elasticsearch",
1574 + "uid": "replace_datasource_uid"
1575 + },
1576 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1577 + "hide": 0,
1578 + "includeAll": true,
1579 + "label": "Rule Level",
1580 + "multi": false,
1581 + "name": "rule_level",
1582 + "options": [],
1583 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1584 + "refresh": 2,
1585 + "regex": "",
1586 + "skipUrlSync": false,
1587 + "sort": 0,
1588 + "type": "query"
1589 + }
1590 + ]
1591 + },
1592 + "time": {
1593 + "from": "now-12h",
1594 + "to": "now"
1595 + },
1596 + "timepicker": {
1597 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
1598 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
1599 + },
1600 + "timezone": "",
1601 + "title": "O365 - SECURITY COMPLIANCE CENTER",
1602 + "uid": "itiq7wq7z",
1603 + "version": 1,
1604 + "weekStart": ""
1605 }
backend/app/connectors/grafana/dashboards/Office365/defender_for_identity.json
+2214 -2259
@@ -1,2261 +1,2216 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "10.0.3",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:MicrosoftDefenderForIdentity",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "cellOptions": {
261 - "type": "auto"
262 - },
263 - "inspect": false
264 - },
265 - "mappings": [],
266 - "thresholds": {
267 - "mode": "absolute",
268 - "steps": [
269 - {
270 - "color": "red",
271 - "value": null
272 - }
273 - ]
274 - }
275 - },
276 - "overrides": [
277 - {
278 - "matcher": {
279 - "id": "byName",
280 - "options": "Count"
281 - },
282 - "properties": [
283 - {
284 - "id": "displayName",
285 - "value": "EVENTS"
286 - },
287 - {
288 - "id": "unit",
289 - "value": "short"
290 - },
291 - {
292 - "id": "decimals",
293 - "value": -1
294 - },
295 - {
296 - "id": "custom.align"
297 - },
298 - {
299 - "id": "thresholds",
300 - "value": {
301 - "mode": "absolute",
302 - "steps": [
303 - {
304 - "color": "red",
305 - "value": null
306 - }
307 - ]
308 - }
309 - }
310 - ]
311 - }
312 - ]
313 - },
314 - "gridPos": {
315 - "h": 7,
316 - "w": 6,
317 - "x": 8,
318 - "y": 0
319 - },
320 - "id": 54,
321 - "options": {
322 - "cellHeight": "sm",
323 - "footer": {
324 - "countRows": false,
325 - "fields": "",
326 - "reducer": [
327 - "sum"
328 - ],
329 - "show": false
330 - },
331 - "showHeader": true
332 - },
333 - "pluginVersion": "10.0.3",
334 - "targets": [
335 - {
336 - "bucketAggs": [
337 - {
338 - "fake": true,
339 - "field": "data_office365_Operation",
340 - "id": "4",
341 - "settings": {
342 - "min_doc_count": 1,
343 - "order": "desc",
344 - "orderBy": "_count",
345 - "size": "0"
346 - },
347 - "type": "terms"
348 - }
349 - ],
350 - "datasource": {
351 - "type": "elasticsearch",
352 - "uid": "replace_datasource_uid"
353 - },
354 - "metrics": [
355 - {
356 - "field": "select field",
357 - "id": "1",
358 - "type": "count"
359 - }
360 - ],
361 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
362 - "refId": "A",
363 - "timeField": "timestamp"
364 - }
365 - ],
366 - "title": "EVENTS BY OPERATION",
367 - "transformations": [
368 - {
369 - "id": "merge",
370 - "options": {
371 - "reducers": []
372 - }
373 - },
374 - {
375 - "id": "organize",
376 - "options": {
377 - "excludeByName": {},
378 - "indexByName": {},
379 - "renameByName": {
380 - "Count": "EVENTS",
381 - "data_office365_Operation": "OPERATION"
382 - }
383 - }
384 - }
385 - ],
386 - "type": "table"
387 - },
388 - {
389 - "datasource": {
390 - "type": "elasticsearch",
391 - "uid": "replace_datasource_uid"
392 - },
393 - "fieldConfig": {
394 - "defaults": {
395 - "color": {
396 - "mode": "thresholds"
397 - },
398 - "mappings": [
399 - {
400 - "options": {
401 - "match": "null",
402 - "result": {
403 - "text": "N/A"
404 - }
405 - },
406 - "type": "special"
407 - }
408 - ],
409 - "max": 15,
410 - "min": 0,
411 - "thresholds": {
412 - "mode": "absolute",
413 - "steps": [
414 - {
415 - "color": "#299c46",
416 - "value": null
417 - },
418 - {
419 - "color": "rgba(237, 129, 40, 0.89)",
420 - "value": 8
421 - },
422 - {
423 - "color": "#d44a3a",
424 - "value": 12
425 - }
426 - ]
427 - },
428 - "unit": "none"
429 - },
430 - "overrides": []
431 - },
432 - "gridPos": {
433 - "h": 7,
434 - "w": 4,
435 - "x": 0,
436 - "y": 7
437 - },
438 - "id": 16,
439 - "links": [],
440 - "options": {
441 - "orientation": "horizontal",
442 - "reduceOptions": {
443 - "calcs": [
444 - "max"
445 - ],
446 - "fields": "",
447 - "values": false
448 - },
449 - "showThresholdLabels": false,
450 - "showThresholdMarkers": true,
451 - "text": {}
452 - },
453 - "pluginVersion": "10.0.3",
454 - "targets": [
455 - {
456 - "bucketAggs": [
457 - {
458 - "field": "timestamp",
459 - "id": "2",
460 - "settings": {
461 - "interval": "auto",
462 - "min_doc_count": 0,
463 - "trimEdges": 0
464 - },
465 - "type": "date_histogram"
466 - }
467 - ],
468 - "datasource": {
469 - "type": "elasticsearch",
470 - "uid": "replace_datasource_uid"
471 - },
472 - "metrics": [
473 - {
474 - "field": "rule_level",
475 - "id": "1",
476 - "meta": {},
477 - "settings": {},
478 - "type": "max"
479 - }
480 - ],
481 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
482 - "refId": "A",
483 - "timeField": "timestamp"
484 - }
485 - ],
486 - "title": "MAX SEVERITY (0 - 15)",
487 - "type": "gauge"
488 - },
489 - {
490 - "datasource": {
491 - "type": "elasticsearch",
492 - "uid": "replace_datasource_uid"
493 - },
494 - "fieldConfig": {
495 - "defaults": {
496 - "color": {
497 - "mode": "palette-classic"
498 - },
499 - "custom": {
500 - "axisCenteredZero": false,
501 - "axisColorMode": "text",
502 - "axisLabel": "",
503 - "axisPlacement": "auto",
504 - "barAlignment": 0,
505 - "drawStyle": "bars",
506 - "fillOpacity": 0,
507 - "gradientMode": "none",
508 - "hideFrom": {
509 - "legend": false,
510 - "tooltip": false,
511 - "viz": false
512 - },
513 - "lineInterpolation": "linear",
514 - "lineWidth": 1,
515 - "pointSize": 5,
516 - "scaleDistribution": {
517 - "type": "linear"
518 - },
519 - "showPoints": "auto",
520 - "spanNulls": false,
521 - "stacking": {
522 - "group": "A",
523 - "mode": "normal"
524 - },
525 - "thresholdsStyle": {
526 - "mode": "off"
527 - }
528 - },
529 - "mappings": [],
530 - "thresholds": {
531 - "mode": "absolute",
532 - "steps": [
533 - {
534 - "color": "green",
535 - "value": null
536 - },
537 - {
538 - "color": "red",
539 - "value": 80
540 - }
541 - ]
542 - }
543 - },
544 - "overrides": []
545 - },
546 - "gridPos": {
547 - "h": 13,
548 - "w": 20,
549 - "x": 4,
550 - "y": 7
551 - },
552 - "id": 60,
553 - "options": {
554 - "legend": {
555 - "calcs": [],
556 - "displayMode": "table",
557 - "placement": "right",
558 - "showLegend": true
559 - },
560 - "tooltip": {
561 - "mode": "single",
562 - "sort": "none"
563 - }
564 - },
565 - "targets": [
566 - {
567 - "alias": "",
568 - "bucketAggs": [
569 - {
570 - "field": "data_office365_Operation",
571 - "id": "3",
572 - "settings": {
573 - "min_doc_count": "1",
574 - "order": "desc",
575 - "orderBy": "_count",
576 - "size": "10"
577 - },
578 - "type": "terms"
579 - },
580 - {
581 - "field": "timestamp",
582 - "id": "2",
583 - "settings": {
584 - "interval": "auto"
585 - },
586 - "type": "date_histogram"
587 - }
588 - ],
589 - "datasource": {
590 - "type": "elasticsearch",
591 - "uid": "replace_datasource_uid"
592 - },
593 - "metrics": [
594 - {
595 - "id": "1",
596 - "type": "count"
597 - }
598 - ],
599 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
600 - "refId": "A",
601 - "timeField": "timestamp"
602 - }
603 - ],
604 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
605 - "transparent": true,
606 - "type": "timeseries"
607 - },
608 - {
609 - "datasource": {
610 - "type": "elasticsearch",
611 - "uid": "replace_datasource_uid"
612 - },
613 - "fieldConfig": {
614 - "defaults": {
615 - "mappings": [
616 - {
617 - "options": {
618 - "match": "null",
619 - "result": {
620 - "text": "N/A"
621 - }
622 - },
623 - "type": "special"
624 - }
625 - ],
626 - "thresholds": {
627 - "mode": "absolute",
628 - "steps": [
629 - {
630 - "color": "blue",
631 - "value": null
632 - }
633 - ]
634 - },
635 - "unit": "locale"
636 - },
637 - "overrides": []
638 - },
639 - "gridPos": {
640 - "h": 6,
641 - "w": 4,
642 - "x": 0,
643 - "y": 14
644 - },
645 - "id": 51,
646 - "links": [],
647 - "options": {
648 - "colorMode": "value",
649 - "graphMode": "area",
650 - "justifyMode": "auto",
651 - "orientation": "horizontal",
652 - "reduceOptions": {
653 - "calcs": [
654 - "sum"
655 - ],
656 - "fields": "",
657 - "values": false
658 - },
659 - "text": {},
660 - "textMode": "auto"
661 - },
662 - "pluginVersion": "10.0.3",
663 - "targets": [
664 - {
665 - "bucketAggs": [
666 - {
667 - "$$hashKey": "object:331",
668 - "field": "timestamp",
669 - "id": "2",
670 - "settings": {
671 - "interval": "auto",
672 - "min_doc_count": 0,
673 - "trimEdges": 0
674 - },
675 - "type": "date_histogram"
676 - }
677 - ],
678 - "datasource": {
679 - "type": "elasticsearch",
680 - "uid": "replace_datasource_uid"
681 - },
682 - "metrics": [
683 - {
684 - "$$hashKey": "object:329",
685 - "field": "select field",
686 - "id": "1",
687 - "type": "count"
688 - }
689 - ],
690 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
691 - "refId": "A",
692 - "timeField": "timestamp"
693 - }
694 - ],
695 - "title": "EVENTS (Total)",
696 - "type": "stat"
697 - },
698 - {
699 - "datasource": {
700 - "type": "elasticsearch",
701 - "uid": "replace_datasource_uid"
702 - },
703 - "fieldConfig": {
704 - "defaults": {
705 - "color": {
706 - "mode": "thresholds"
707 - },
708 - "custom": {
709 - "align": "auto",
710 - "cellOptions": {
711 - "type": "auto"
712 - },
713 - "inspect": false
714 - },
715 - "mappings": [],
716 - "thresholds": {
717 - "mode": "absolute",
718 - "steps": [
719 - {
720 - "color": "red",
721 - "value": null
722 - }
723 - ]
724 - }
725 - },
726 - "overrides": [
727 - {
728 - "matcher": {
729 - "id": "byName",
730 - "options": "Count"
731 - },
732 - "properties": [
733 - {
734 - "id": "displayName",
735 - "value": "EVENTS"
736 - },
737 - {
738 - "id": "unit",
739 - "value": "short"
740 - },
741 - {
742 - "id": "decimals",
743 - "value": -1
744 - },
745 - {
746 - "id": "custom.align"
747 - },
748 - {
749 - "id": "thresholds",
750 - "value": {
751 - "mode": "absolute",
752 - "steps": [
753 - {
754 - "color": "red",
755 - "value": null
756 - }
757 - ]
758 - }
759 - }
760 - ]
761 - },
762 - {
763 - "matcher": {
764 - "id": "byName",
765 - "options": "DEVICE"
766 - },
767 - "properties": [
768 - {
769 - "id": "custom.width",
770 - "value": 324
771 - }
772 - ]
773 - }
774 - ]
775 - },
776 - "gridPos": {
777 - "h": 12,
778 - "w": 7,
779 - "x": 0,
780 - "y": 20
781 - },
782 - "id": 62,
783 - "options": {
784 - "cellHeight": "sm",
785 - "footer": {
786 - "countRows": false,
787 - "fields": "",
788 - "reducer": [
789 - "sum"
790 - ],
791 - "show": false
792 - },
793 - "showHeader": true,
794 - "sortBy": []
795 - },
796 - "pluginVersion": "10.0.3",
797 - "targets": [
798 - {
799 - "bucketAggs": [
800 - {
801 - "fake": true,
802 - "field": "data_office365_ResultStatus",
803 - "id": "4",
804 - "settings": {
805 - "min_doc_count": 1,
806 - "order": "desc",
807 - "orderBy": "_count",
808 - "size": "0"
809 - },
810 - "type": "terms"
811 - }
812 - ],
813 - "datasource": {
814 - "type": "elasticsearch",
815 - "uid": "replace_datasource_uid"
816 - },
817 - "metrics": [
818 - {
819 - "field": "select field",
820 - "id": "1",
821 - "type": "count"
822 - }
823 - ],
824 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
825 - "refId": "A",
826 - "timeField": "timestamp"
827 - }
828 - ],
829 - "title": "EVENTS BY RESULT",
830 - "transformations": [
831 - {
832 - "id": "merge",
833 - "options": {
834 - "reducers": []
835 - }
836 - },
837 - {
838 - "id": "organize",
839 - "options": {
840 - "excludeByName": {},
841 - "indexByName": {},
842 - "renameByName": {
843 - "Count": "EVENTS",
844 - "data_office365_ClientIP_country_code": "COUNTRY",
845 - "data_office365_DeviceName": "DEVICE",
846 - "data_office365_Operation": "OPERATION",
847 - "data_office365_ResultStatus": "RESULT STATUS"
848 - }
849 - }
850 - }
851 - ],
852 - "type": "table"
853 - },
854 - {
855 - "circleMaxSize": 30,
856 - "circleMinSize": 2,
857 - "colors": [
858 - "rgba(245, 54, 54, 0.9)",
859 - "rgba(237, 129, 40, 0.89)",
860 - "rgba(50, 172, 45, 0.97)"
861 - ],
862 - "datasource": {
863 - "type": "elasticsearch",
864 - "uid": "replace_datasource_uid"
865 - },
866 - "decimals": 0,
867 - "esMetric": "Count",
868 - "gridPos": {
869 - "h": 12,
870 - "w": 8,
871 - "x": 7,
872 - "y": 20
873 - },
874 - "hideEmpty": false,
875 - "hideZero": false,
876 - "id": 50,
877 - "initialZoom": 1,
878 - "locationData": "countries",
879 - "mapCenter": "(0°, 0°)",
880 - "mapCenterLatitude": 0,
881 - "mapCenterLongitude": 0,
882 - "maxDataPoints": 1,
883 - "mouseWheelZoom": false,
884 - "showLegend": true,
885 - "stickyLabels": false,
886 - "tableQueryOptions": {
887 - "geohashField": "geohash",
888 - "latitudeField": "latitude",
889 - "longitudeField": "longitude",
890 - "metricField": "metric",
891 - "queryType": "geohash"
892 - },
893 - "targets": [
894 - {
895 - "bucketAggs": [
896 - {
897 - "fake": true,
898 - "field": "data_office365_ClientIP_country_code",
899 - "id": "3",
900 - "settings": {
901 - "min_doc_count": 1,
902 - "order": "desc",
903 - "orderBy": "_count",
904 - "size": "0"
905 - },
906 - "type": "terms"
907 - },
908 - {
909 - "field": "timestamp",
910 - "id": "2",
911 - "settings": {
912 - "interval": "auto",
913 - "min_doc_count": 0,
914 - "trimEdges": 0
915 - },
916 - "type": "date_histogram"
917 - }
918 - ],
919 - "datasource": {
920 - "type": "elasticsearch",
921 - "uid": "replace_datasource_uid"
922 - },
923 - "metrics": [
924 - {
925 - "field": "select field",
926 - "id": "1",
927 - "type": "count"
928 - }
929 - ],
930 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
931 - "refId": "A",
932 - "timeField": "timestamp"
933 - }
934 - ],
935 - "thresholds": "0,10",
936 - "title": "Endpoint - ALL EVENTS BY SRC COUNTRY",
937 - "type": "grafana-worldmap-panel",
938 - "unitPlural": "",
939 - "unitSingle": "",
940 - "valueName": "total"
941 - },
942 - {
943 - "datasource": {
944 - "type": "elasticsearch",
945 - "uid": "replace_datasource_uid"
946 - },
947 - "fieldConfig": {
948 - "defaults": {
949 - "color": {
950 - "mode": "thresholds"
951 - },
952 - "custom": {
953 - "align": "auto",
954 - "cellOptions": {
955 - "type": "auto"
956 - },
957 - "inspect": false
958 - },
959 - "mappings": [],
960 - "thresholds": {
961 - "mode": "absolute",
962 - "steps": [
963 - {
964 - "color": "orange",
965 - "value": null
966 - }
967 - ]
968 - }
969 - },
970 - "overrides": [
971 - {
972 - "matcher": {
973 - "id": "byName",
974 - "options": "Count"
975 - },
976 - "properties": [
977 - {
978 - "id": "displayName",
979 - "value": "EVENTS"
980 - },
981 - {
982 - "id": "unit",
983 - "value": "short"
984 - },
985 - {
986 - "id": "decimals",
987 - "value": -1
988 - },
989 - {
990 - "id": "custom.align"
991 - }
992 - ]
993 - },
994 - {
995 - "matcher": {
996 - "id": "byName",
997 - "options": "AD ACCOUNT"
998 - },
999 - "properties": [
1000 - {
1001 - "id": "custom.width",
1002 - "value": 377
1003 - }
1004 - ]
1005 - }
1006 - ]
1007 - },
1008 - "gridPos": {
1009 - "h": 12,
1010 - "w": 9,
1011 - "x": 15,
1012 - "y": 20
1013 - },
1014 - "id": 58,
1015 - "options": {
1016 - "cellHeight": "sm",
1017 - "footer": {
1018 - "countRows": false,
1019 - "fields": "",
1020 - "reducer": [
1021 - "sum"
1022 - ],
1023 - "show": false
1024 - },
1025 - "showHeader": true,
1026 - "sortBy": []
1027 - },
1028 - "pluginVersion": "10.0.3",
1029 - "targets": [
1030 - {
1031 - "bucketAggs": [
1032 - {
1033 - "fake": true,
1034 - "field": "data_office365_UserId",
1035 - "id": "4",
1036 - "settings": {
1037 - "min_doc_count": 1,
1038 - "order": "desc",
1039 - "orderBy": "_count",
1040 - "size": "0"
1041 - },
1042 - "type": "terms"
1043 - },
1044 - {
1045 - "field": "data_office365_ClientIP_country_code",
1046 - "id": "5",
1047 - "settings": {
1048 - "min_doc_count": "1",
1049 - "order": "desc",
1050 - "orderBy": "_term",
1051 - "size": "10"
1052 - },
1053 - "type": "terms"
1054 - }
1055 - ],
1056 - "datasource": {
1057 - "type": "elasticsearch",
1058 - "uid": "replace_datasource_uid"
1059 - },
1060 - "metrics": [
1061 - {
1062 - "field": "select field",
1063 - "id": "1",
1064 - "type": "count"
1065 - }
1066 - ],
1067 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
1068 - "refId": "A",
1069 - "timeField": "timestamp"
1070 - }
1071 - ],
1072 - "title": "Endpoint EVENTS BY ACCOUNT",
1073 - "transformations": [
1074 - {
1075 - "id": "merge",
1076 - "options": {
1077 - "reducers": []
1078 - }
1079 - },
1080 - {
1081 - "id": "organize",
1082 - "options": {
1083 - "excludeByName": {},
1084 - "indexByName": {},
1085 - "renameByName": {
1086 - "Count": "EVENTS",
1087 - "data_office365_ClientIP_country_code": "COUNTRY",
1088 - "data_office365_LogonError": "ERROR",
1089 - "data_office365_Operation": "WORKLOAD",
1090 - "data_office365_UserId": "AD ACCOUNT"
1091 - }
1092 - }
1093 - }
1094 - ],
1095 - "type": "table"
1096 - },
1097 - {
1098 - "datasource": {
1099 - "type": "elasticsearch",
1100 - "uid": "replace_datasource_uid"
1101 - },
1102 - "fieldConfig": {
1103 - "defaults": {
1104 - "color": {
1105 - "mode": "thresholds"
1106 - },
1107 - "custom": {
1108 - "align": "auto",
1109 - "cellOptions": {
1110 - "type": "auto"
1111 - },
1112 - "filterable": true,
1113 - "inspect": false
1114 - },
1115 - "mappings": [],
1116 - "thresholds": {
1117 - "mode": "absolute",
1118 - "steps": [
1119 - {
1120 - "color": "green",
1121 - "value": null
1122 - },
1123 - {
1124 - "color": "red",
1125 - "value": 80
1126 - }
1127 - ]
1128 - }
1129 - },
1130 - "overrides": [
1131 - {
1132 - "matcher": {
1133 - "id": "byName",
1134 - "options": "rule_level"
1135 - },
1136 - "properties": [
1137 - {
1138 - "id": "displayName",
1139 - "value": "RULE LEVEL"
1140 - },
1141 - {
1142 - "id": "unit",
1143 - "value": "short"
1144 - },
1145 - {
1146 - "id": "decimals",
1147 - "value": -1
1148 - },
1149 - {
1150 - "id": "custom.cellOptions",
1151 - "value": {
1152 - "mode": "gradient",
1153 - "type": "color-background"
1154 - }
1155 - },
1156 - {
1157 - "id": "custom.align"
1158 - },
1159 - {
1160 - "id": "thresholds",
1161 - "value": {
1162 - "mode": "absolute",
1163 - "steps": [
1164 - {
1165 - "color": "#37872D",
1166 - "value": null
1167 - },
1168 - {
1169 - "color": "rgba(237, 129, 40, 0.89)",
1170 - "value": 7
1171 - },
1172 - {
1173 - "color": "rgba(245, 54, 54, 0.9)",
1174 - "value": 12
1175 - }
1176 - ]
1177 - }
1178 - }
1179 - ]
1180 - },
1181 - {
1182 - "matcher": {
1183 - "id": "byName",
1184 - "options": "Date/Time"
1185 - },
1186 - "properties": [
1187 - {
1188 - "id": "custom.width",
1189 - "value": 242
1190 - }
1191 - ]
1192 - },
1193 - {
1194 - "matcher": {
1195 - "id": "byName",
1196 - "options": "MITRE TACTIC"
1197 - },
1198 - "properties": [
1199 - {
1200 - "id": "custom.width",
1201 - "value": 332
1202 - }
1203 - ]
1204 - },
1205 - {
1206 - "matcher": {
1207 - "id": "byName",
1208 - "options": "IP ADDRESS"
1209 - },
1210 - "properties": [
1211 - {
1212 - "id": "custom.width",
1213 - "value": 163
1214 - }
1215 - ]
1216 - },
1217 - {
1218 - "matcher": {
1219 - "id": "byName",
1220 - "options": "MITRE TECHNIQUE"
1221 - },
1222 - "properties": [
1223 - {
1224 - "id": "custom.width",
1225 - "value": 312
1226 - }
1227 - ]
1228 - },
1229 - {
1230 - "matcher": {
1231 - "id": "byName",
1232 - "options": "EVENT ID"
1233 - },
1234 - "properties": [
1235 - {
1236 - "id": "links",
1237 - "value": [
1238 - {
1239 - "targetBlank": true,
1240 - "title": "VIEW EVENT DETAILS",
1241 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1242 - }
1243 - ]
1244 - },
1245 - {
1246 - "id": "custom.width",
1247 - "value": 265
1248 - }
1249 - ]
1250 - },
1251 - {
1252 - "matcher": {
1253 - "id": "byName",
1254 - "options": "RESULT"
1255 - },
1256 - "properties": [
1257 - {
1258 - "id": "custom.width",
1259 - "value": 118
1260 - },
1261 - {
1262 - "id": "mappings",
1263 - "value": [
1264 - {
1265 - "options": {
1266 - "Failed": {
1267 - "color": "orange",
1268 - "index": 1
1269 - },
1270 - "Success": {
1271 - "color": "green",
1272 - "index": 0
1273 - }
1274 - },
1275 - "type": "value"
1276 - }
1277 - ]
1278 - },
1279 - {
1280 - "id": "custom.cellOptions",
1281 - "value": {
1282 - "type": "color-text"
1283 - }
1284 - }
1285 - ]
1286 - },
1287 - {
1288 - "matcher": {
1289 - "id": "byName",
1290 - "options": "SRC IP"
1291 - },
1292 - "properties": [
1293 - {
1294 - "id": "custom.width",
1295 - "value": 265
1296 - }
1297 - ]
1298 - },
1299 - {
1300 - "matcher": {
1301 - "id": "byName",
1302 - "options": "ACCOUNT"
1303 - },
1304 - "properties": [
1305 - {
1306 - "id": "custom.width",
1307 - "value": 193
1308 - }
1309 - ]
1310 - },
1311 - {
1312 - "matcher": {
1313 - "id": "byName",
1314 - "options": "EVENT TIME"
1315 - },
1316 - "properties": [
1317 - {
1318 - "id": "custom.width",
1319 - "value": 195
1320 - }
1321 - ]
1322 - },
1323 - {
1324 - "matcher": {
1325 - "id": "byName",
1326 - "options": "CLIENT IP"
1327 - },
1328 - "properties": [
1329 - {
1330 - "id": "custom.width",
1331 - "value": 143
1332 - }
1333 - ]
1334 - },
1335 - {
1336 - "matcher": {
1337 - "id": "byName",
1338 - "options": "DESCRIPTION"
1339 - },
1340 - "properties": [
1341 - {
1342 - "id": "custom.width",
1343 - "value": 296
1344 - }
1345 - ]
1346 - },
1347 - {
1348 - "matcher": {
1349 - "id": "byName",
1350 - "options": "DEVICE"
1351 - },
1352 - "properties": [
1353 - {
1354 - "id": "custom.width",
1355 - "value": 182
1356 - }
1357 - ]
1358 - },
1359 - {
1360 - "matcher": {
1361 - "id": "byName",
1362 - "options": "RULE LEVEL"
1363 - },
1364 - "properties": [
1365 - {
1366 - "id": "custom.width",
1367 - "value": 145
1368 - }
1369 - ]
1370 - },
1371 - {
1372 - "matcher": {
1373 - "id": "byName",
1374 - "options": "APP"
1375 - },
1376 - "properties": [
1377 - {
1378 - "id": "custom.width",
1379 - "value": 187
1380 - }
1381 - ]
1382 - },
1383 - {
1384 - "matcher": {
1385 - "id": "byName",
1386 - "options": "FILE TYPE"
1387 - },
1388 - "properties": [
1389 - {
1390 - "id": "custom.width",
1391 - "value": 157
1392 - }
1393 - ]
1394 - }
1395 - ]
1396 - },
1397 - "gridPos": {
1398 - "h": 16,
1399 - "w": 24,
1400 - "x": 0,
1401 - "y": 32
1402 - },
1403 - "id": 27,
1404 - "options": {
1405 - "cellHeight": "sm",
1406 - "footer": {
1407 - "countRows": false,
1408 - "enablePagination": true,
1409 - "fields": "",
1410 - "reducer": [
1411 - "sum"
1412 - ],
1413 - "show": false
1414 - },
1415 - "showHeader": true,
1416 - "sortBy": []
1417 - },
1418 - "pluginVersion": "10.0.3",
1419 - "targets": [
1420 - {
1421 - "bucketAggs": [],
1422 - "datasource": {
1423 - "type": "elasticsearch",
1424 - "uid": "replace_datasource_uid"
1425 - },
1426 - "metrics": [
1427 - {
1428 - "id": "1",
1429 - "settings": {
1430 - "size": "250"
1431 - },
1432 - "type": "raw_data"
1433 - }
1434 - ],
1435 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
1436 - "refId": "A",
1437 - "timeField": "timestamp"
1438 - }
1439 - ],
1440 - "title": "EVENTS",
1441 - "transformations": [
1442 - {
1443 - "id": "organize",
1444 - "options": {
1445 - "excludeByName": {
1446 - "@metadata_beat": true,
1447 - "@metadata_type": true,
1448 - "@metadata_version": true,
1449 - "IMPHASH": true,
1450 - "MD5": true,
1451 - "SHA1": true,
1452 - "SHA256": true,
1453 - "_id": false,
1454 - "_index": true,
1455 - "_type": true,
1456 - "agent_ephemeral_id": true,
1457 - "agent_hostname": true,
1458 - "agent_id": true,
1459 - "agent_ip_city_name": true,
1460 - "agent_ip_country_code": true,
1461 - "agent_ip_geolocation": true,
1462 - "agent_name": true,
1463 - "agent_type": true,
1464 - "agent_version": true,
1465 - "beats_type": true,
1466 - "cluster_name": true,
1467 - "cluster_node": true,
1468 - "collector_node_id": true,
1469 - "data_alert_action": true,
1470 - "data_alert_category": true,
1471 - "data_alert_gid": true,
1472 - "data_alert_rev": true,
1473 - "data_alert_severity": true,
1474 - "data_alert_signature": true,
1475 - "data_alert_signature_id": true,
1476 - "data_app_proto": true,
1477 - "data_audit_auid": true,
1478 - "data_audit_command": true,
1479 - "data_audit_euid": true,
1480 - "data_audit_exe": true,
1481 - "data_audit_gid": true,
1482 - "data_audit_id": true,
1483 - "data_audit_pid": true,
1484 - "data_audit_res": true,
1485 - "data_audit_session": true,
1486 - "data_audit_type": true,
1487 - "data_audit_uid": true,
1488 - "data_dest_ip": true,
1489 - "data_dest_port": true,
1490 - "data_dstuser": true,
1491 - "data_event_type": true,
1492 - "data_extra_data": true,
1493 - "data_file": true,
1494 - "data_flow_bytes_toclient": true,
1495 - "data_flow_bytes_toserver": true,
1496 - "data_flow_id": true,
1497 - "data_flow_pkts_toclient": true,
1498 - "data_flow_pkts_toserver": true,
1499 - "data_flow_start": true,
1500 - "data_http_http_content_type": true,
1501 - "data_http_http_port": true,
1502 - "data_http_length": true,
1503 - "data_http_status": true,
1504 - "data_http_url": true,
1505 - "data_id": true,
1506 - "data_in_iface": true,
1507 - "data_integration": true,
1508 - "data_metadata_flowbits": true,
1509 - "data_metadata_flowints_http_anomaly_count": true,
1510 - "data_metadata_flowints_tcp_retransmission_count": true,
1511 - "data_office365_AADGroupId": true,
1512 - "data_office365_Actor": true,
1513 - "data_office365_ActorContextId": true,
1514 - "data_office365_ActorIpAddress": false,
1515 - "data_office365_ActorIpAddress_city_name": true,
1516 - "data_office365_ActorIpAddress_country_code": true,
1517 - "data_office365_ActorIpAddress_geolocation": true,
1518 - "data_office365_AppAccessContext_AADSessionId": true,
1519 - "data_office365_AppAccessContext_APIId": true,
1520 - "data_office365_AppAccessContext_ClientAppId": true,
1521 - "data_office365_AppAccessContext_ClientAppName": true,
1522 - "data_office365_AppAccessContext_CorrelationId": true,
1523 - "data_office365_AppAccessContext_UniqueTokenId": true,
1524 - "data_office365_AppId": true,
1525 - "data_office365_Application": false,
1526 - "data_office365_ApplicationId": true,
1527 - "data_office365_ArtifactsShared": true,
1528 - "data_office365_Attendees": true,
1529 - "data_office365_AuthenticationType": true,
1530 - "data_office365_AzureActiveDirectoryEventType": true,
1531 - "data_office365_BrowserVersion": true,
1532 - "data_office365_ChannelGuid": true,
1533 - "data_office365_ChannelName": true,
1534 - "data_office365_ChatName": true,
1535 - "data_office365_ChatThreadId": true,
1536 - "data_office365_ClientAppId": true,
1537 - "data_office365_ClientIP": false,
1538 - "data_office365_ClientIPAddress": true,
1539 - "data_office365_ClientIPAddress_city_name": true,
1540 - "data_office365_ClientIPAddress_country_code": true,
1541 - "data_office365_ClientIPAddress_geolocation": true,
1542 - "data_office365_ClientIP_city_name": true,
1543 - "data_office365_ClientIP_country_code": true,
1544 - "data_office365_ClientIP_geolocation": true,
1545 - "data_office365_ClientIP_reserved_ip": true,
1546 - "data_office365_ClientInfoString": true,
1547 - "data_office365_ClientProcessName": true,
1548 - "data_office365_ClientRequestId": true,
1549 - "data_office365_ClientVersion": true,
1550 - "data_office365_CommunicationSubType": true,
1551 - "data_office365_CommunicationType": true,
1552 - "data_office365_CorrelationId": true,
1553 - "data_office365_CreationTime": false,
1554 - "data_office365_CrossMailboxOperation": true,
1555 - "data_office365_DestFolder_Id": true,
1556 - "data_office365_DestFolder_Path": true,
1557 - "data_office365_DestinationLocationType": true,
1558 - "data_office365_DeviceDisplayName": true,
1559 - "data_office365_DeviceDisplayName_city_name": true,
1560 - "data_office365_DeviceDisplayName_country_code": true,
1561 - "data_office365_DeviceDisplayName_geolocation": true,
1562 - "data_office365_DeviceId": true,
1563 - "data_office365_DeviceInformation": true,
1564 - "data_office365_DeviceName": false,
1565 - "data_office365_DeviceProperties": true,
1566 - "data_office365_DlpOriginalFilePath": true,
1567 - "data_office365_EndTime": true,
1568 - "data_office365_EnforcementMode": true,
1569 - "data_office365_ErrorNumber": true,
1570 - "data_office365_EventSource": true,
1571 - "data_office365_ExchangeId": true,
1572 - "data_office365_ExtendedProperties": true,
1573 - "data_office365_ExternalAccess": true,
1574 - "data_office365_ExtraProperties": true,
1575 - "data_office365_FileExtension": true,
1576 - "data_office365_FileSize": true,
1577 - "data_office365_FileSizeBytes": true,
1578 - "data_office365_Folder_Id": true,
1579 - "data_office365_Folder_Path": true,
1580 - "data_office365_Hidden": true,
1581 - "data_office365_HighPriorityMediaProcessing": true,
1582 - "data_office365_HostedContents": true,
1583 - "data_office365_ICalUid": true,
1584 - "data_office365_Id": true,
1585 - "data_office365_InterSystemsId": true,
1586 - "data_office365_InternalLogonType": true,
1587 - "data_office365_IntraSystemId": true,
1588 - "data_office365_IsManagedDevice": true,
1589 - "data_office365_ItemName": true,
1590 - "data_office365_ItemType": true,
1591 - "data_office365_Item_Id": true,
1592 - "data_office365_Item_InternetMessageId": true,
1593 - "data_office365_Item_IsRecord": true,
1594 - "data_office365_Item_ParentFolder_Id": true,
1595 - "data_office365_Item_SizeInBytes": true,
1596 - "data_office365_JitTriggered": true,
1597 - "data_office365_JoinTime": true,
1598 - "data_office365_LeaveTime": true,
1599 - "data_office365_ListBaseType": true,
1600 - "data_office365_ListId": true,
1601 - "data_office365_ListItemUniqueId": true,
1602 - "data_office365_ListServerTemplate": true,
1603 - "data_office365_LogonError": true,
1604 - "data_office365_LogonType": true,
1605 - "data_office365_LogonUserSid": true,
1606 - "data_office365_MDATPDeviceId": true,
1607 - "data_office365_MailboxGuid": true,
1608 - "data_office365_MailboxOwnerSid": true,
1609 - "data_office365_MailboxOwnerUPN": true,
1610 - "data_office365_MeetingDetailId": true,
1611 - "data_office365_MeetingURL": true,
1612 - "data_office365_Members": true,
1613 - "data_office365_MessageId": true,
1614 - "data_office365_MessageSizeInBytes": true,
1615 - "data_office365_MessageURLs": true,
1616 - "data_office365_MessageVersion": true,
1617 - "data_office365_Modalities": true,
1618 - "data_office365_ModifiedProperties": true,
1619 - "data_office365_Name": true,
1620 - "data_office365_NewValue": true,
1621 - "data_office365_ObjectId": false,
1622 - "data_office365_Operation": true,
1623 - "data_office365_OperationScope": true,
1624 - "data_office365_OrganizationId": true,
1625 - "data_office365_OrganizationName": true,
1626 - "data_office365_Organizer_OrganizationId": true,
1627 - "data_office365_Organizer_RecipientType": true,
1628 - "data_office365_Organizer_Role": true,
1629 - "data_office365_Organizer_UserObjectId": true,
1630 - "data_office365_OriginatingDomain": true,
1631 - "data_office365_OriginatingServer": true,
1632 - "data_office365_Parameters": true,
1633 - "data_office365_ParentMessageId": true,
1634 - "data_office365_Platform": true,
1635 - "data_office365_PreviousFileName": true,
1636 - "data_office365_ProviderTypes": true,
1637 - "data_office365_RMSEncrypted": true,
1638 - "data_office365_RecordType": true,
1639 - "data_office365_ResultStatus": false,
1640 - "data_office365_Scope": true,
1641 - "data_office365_SensitiveInfoTypeData": true,
1642 - "data_office365_SessionId": true,
1643 - "data_office365_Sha1": true,
1644 - "data_office365_Sha256": true,
1645 - "data_office365_Site": true,
1646 - "data_office365_SiteUrl": true,
1647 - "data_office365_SourceFileExtension": true,
1648 - "data_office365_SourceFileName": true,
1649 - "data_office365_SourceLocationType": true,
1650 - "data_office365_SourceRelativeUrl": true,
1651 - "data_office365_StartTime": true,
1652 - "data_office365_Subscription": true,
1653 - "data_office365_SubscriptionId": true,
1654 - "data_office365_Target": true,
1655 - "data_office365_TargetContextId": true,
1656 - "data_office365_TargetFilePath": true,
1657 - "data_office365_TargetPrinterName": true,
1658 - "data_office365_TeamGuid": true,
1659 - "data_office365_TeamName": true,
1660 - "data_office365_UserId": false,
1661 - "data_office365_UserKey": true,
1662 - "data_office365_UserType": true,
1663 - "data_office365_Version": true,
1664 - "data_office365_WebId": true,
1665 - "data_office365_Workload": true,
1666 - "data_osquery_action": true,
1667 - "data_osquery_calendarTime": true,
1668 - "data_osquery_columns_address": true,
1669 - "data_osquery_columns_address_city_name": true,
1670 - "data_osquery_columns_address_country_code": true,
1671 - "data_osquery_columns_address_geolocation": true,
1672 - "data_osquery_columns_cmdline": true,
1673 - "data_osquery_columns_cwd": true,
1674 - "data_osquery_columns_description": true,
1675 - "data_osquery_columns_directory": true,
1676 - "data_osquery_columns_disk_bytes_read": true,
1677 - "data_osquery_columns_disk_bytes_written": true,
1678 - "data_osquery_columns_egid": true,
1679 - "data_osquery_columns_euid": true,
1680 - "data_osquery_columns_family": true,
1681 - "data_osquery_columns_fd": true,
1682 - "data_osquery_columns_gid": true,
1683 - "data_osquery_columns_gid_signed": true,
1684 - "data_osquery_columns_host": true,
1685 - "data_osquery_columns_interface": true,
1686 - "data_osquery_columns_local_address": true,
1687 - "data_osquery_columns_local_address_city_name": true,
1688 - "data_osquery_columns_local_address_country_code": true,
1689 - "data_osquery_columns_local_address_geolocation": true,
1690 - "data_osquery_columns_local_port": true,
1691 - "data_osquery_columns_mac": true,
1692 - "data_osquery_columns_name": true,
1693 - "data_osquery_columns_net_namespace": true,
1694 - "data_osquery_columns_nice": true,
1695 - "data_osquery_columns_on_disk": true,
1696 - "data_osquery_columns_parent": true,
1697 - "data_osquery_columns_path": true,
1698 - "data_osquery_columns_pgroup": true,
1699 - "data_osquery_columns_pid": true,
1700 - "data_osquery_columns_port": true,
1701 - "data_osquery_columns_protocol": true,
1702 - "data_osquery_columns_remote_address": true,
1703 - "data_osquery_columns_remote_address_city_name": true,
1704 - "data_osquery_columns_remote_address_country_code": true,
1705 - "data_osquery_columns_remote_address_geolocation": true,
1706 - "data_osquery_columns_remote_port": true,
1707 - "data_osquery_columns_resident_size": true,
1708 - "data_osquery_columns_root": true,
1709 - "data_osquery_columns_sgid": true,
1710 - "data_osquery_columns_shell": true,
1711 - "data_osquery_columns_socket": true,
1712 - "data_osquery_columns_start_time": true,
1713 - "data_osquery_columns_state": true,
1714 - "data_osquery_columns_suid": true,
1715 - "data_osquery_columns_system_time": true,
1716 - "data_osquery_columns_threads": true,
1717 - "data_osquery_columns_time_utc": true,
1718 - "data_osquery_columns_total_size": true,
1719 - "data_osquery_columns_tty": true,
1720 - "data_osquery_columns_type": true,
1721 - "data_osquery_columns_uid": true,
1722 - "data_osquery_columns_uid_signed": true,
1723 - "data_osquery_columns_user": true,
1724 - "data_osquery_columns_user_time": true,
1725 - "data_osquery_columns_username": true,
1726 - "data_osquery_columns_wired_size": true,
1727 - "data_osquery_counter": true,
1728 - "data_osquery_decorations_host_uuid": true,
1729 - "data_osquery_decorations_hostname": true,
1730 - "data_osquery_epoch": true,
1731 - "data_osquery_hostIdentifier": true,
1732 - "data_osquery_name": true,
1733 - "data_osquery_numerics": true,
1734 - "data_osquery_unixTime": true,
1735 - "data_proto": true,
1736 - "data_sca_check_command": true,
1737 - "data_sca_check_compliance_cis": true,
1738 - "data_sca_check_compliance_cis_csc": true,
1739 - "data_sca_check_compliance_gdpr_IV": true,
1740 - "data_sca_check_compliance_gpg_13": true,
1741 - "data_sca_check_compliance_hipaa": true,
1742 - "data_sca_check_compliance_nist_800_53": true,
1743 - "data_sca_check_compliance_pci_dss": true,
1744 - "data_sca_check_compliance_tsc": true,
1745 - "data_sca_check_description": true,
1746 - "data_sca_check_id": true,
1747 - "data_sca_check_previous_result": true,
1748 - "data_sca_check_rationale": true,
1749 - "data_sca_check_remediation": true,
1750 - "data_sca_check_result": true,
1751 - "data_sca_check_title": true,
1752 - "data_sca_description": true,
1753 - "data_sca_failed": true,
1754 - "data_sca_file": true,
1755 - "data_sca_invalid": true,
1756 - "data_sca_passed": true,
1757 - "data_sca_policy": true,
1758 - "data_sca_policy_id": true,
1759 - "data_sca_scan_id": true,
1760 - "data_sca_score": true,
1761 - "data_sca_total_checks": true,
1762 - "data_sca_type": true,
1763 - "data_script": true,
1764 - "data_src_ip": true,
1765 - "data_src_ip_city_name": true,
1766 - "data_src_ip_country_code": true,
1767 - "data_src_ip_geolocation": true,
1768 - "data_src_port": true,
1769 - "data_srcip": true,
1770 - "data_srcip_city_name": true,
1771 - "data_srcip_country_code": true,
1772 - "data_srcip_geolocation": true,
1773 - "data_srcuser": true,
1774 - "data_timestamp": true,
1775 - "data_title": true,
1776 - "data_tls_session_resumed": true,
1777 - "data_tls_version": true,
1778 - "data_tx_id": true,
1779 - "data_type": true,
1780 - "data_win_eventXML_binaryData": true,
1781 - "data_win_eventXML_binaryDataSize": true,
1782 - "data_win_eventXML_param1": true,
1783 - "data_win_eventdata_authenticationPackageName": true,
1784 - "data_win_eventdata_callTrace": true,
1785 - "data_win_eventdata_commandLine": true,
1786 - "data_win_eventdata_company": true,
1787 - "data_win_eventdata_creationUtcTime": true,
1788 - "data_win_eventdata_currentDirectory": true,
1789 - "data_win_eventdata_description": true,
1790 - "data_win_eventdata_destinationHostname": true,
1791 - "data_win_eventdata_destinationIp": true,
1792 - "data_win_eventdata_destinationIp_city_name": true,
1793 - "data_win_eventdata_destinationIp_country_code": true,
1794 - "data_win_eventdata_destinationIp_geolocation": true,
1795 - "data_win_eventdata_destinationIsIpv6": true,
1796 - "data_win_eventdata_destinationPort": true,
1797 - "data_win_eventdata_destinationPortName": true,
1798 - "data_win_eventdata_details": true,
1799 - "data_win_eventdata_elevatedToken": true,
1800 - "data_win_eventdata_eventType": true,
1801 - "data_win_eventdata_fileVersion": true,
1802 - "data_win_eventdata_fileVersion_city_name": true,
1803 - "data_win_eventdata_fileVersion_country_code": true,
1804 - "data_win_eventdata_fileVersion_geolocation": true,
1805 - "data_win_eventdata_grantedAccess": true,
1806 - "data_win_eventdata_hashes": true,
1807 - "data_win_eventdata_image": true,
1808 - "data_win_eventdata_imageLoaded": true,
1809 - "data_win_eventdata_impersonationLevel": true,
1810 - "data_win_eventdata_initiated": true,
1811 - "data_win_eventdata_integrityLevel": true,
1812 - "data_win_eventdata_ipAddress": true,
1813 - "data_win_eventdata_ipPort": true,
1814 - "data_win_eventdata_keyLength": true,
1815 - "data_win_eventdata_logonGuid": true,
1816 - "data_win_eventdata_logonId": true,
1817 - "data_win_eventdata_logonProcessName": true,
1818 - "data_win_eventdata_logonType": true,
1819 - "data_win_eventdata_originalFileName": true,
1820 - "data_win_eventdata_param1": true,
1821 - "data_win_eventdata_param2": true,
1822 - "data_win_eventdata_param3": true,
1823 - "data_win_eventdata_param4": true,
1824 - "data_win_eventdata_parentCommandLine": true,
1825 - "data_win_eventdata_parentImage": true,
1826 - "data_win_eventdata_parentProcessGuid": true,
1827 - "data_win_eventdata_parentProcessId": true,
1828 - "data_win_eventdata_processGuid": true,
1829 - "data_win_eventdata_processId": true,
1830 - "data_win_eventdata_processName": true,
1831 - "data_win_eventdata_product": true,
1832 - "data_win_eventdata_protocol": true,
1833 - "data_win_eventdata_queryName": true,
1834 - "data_win_eventdata_queryResults": true,
1835 - "data_win_eventdata_queryStatus": true,
1836 - "data_win_eventdata_ruleName": true,
1837 - "data_win_eventdata_serviceName": true,
1838 - "data_win_eventdata_serviceSid": true,
1839 - "data_win_eventdata_signature": true,
1840 - "data_win_eventdata_signatureStatus": true,
1841 - "data_win_eventdata_signed": true,
1842 - "data_win_eventdata_sourceHostname": true,
1843 - "data_win_eventdata_sourceImage": true,
1844 - "data_win_eventdata_sourceIp": true,
1845 - "data_win_eventdata_sourceIp_city_name": true,
1846 - "data_win_eventdata_sourceIp_country_code": true,
1847 - "data_win_eventdata_sourceIp_geolocation": true,
1848 - "data_win_eventdata_sourceIsIpv6": true,
1849 - "data_win_eventdata_sourcePort": true,
1850 - "data_win_eventdata_sourceProcessGUID": true,
1851 - "data_win_eventdata_sourceProcessId": true,
1852 - "data_win_eventdata_sourceThreadId": true,
1853 - "data_win_eventdata_status": true,
1854 - "data_win_eventdata_subjectDomainName": true,
1855 - "data_win_eventdata_subjectLogonId": true,
1856 - "data_win_eventdata_subjectUserName": true,
1857 - "data_win_eventdata_subjectUserSid": true,
1858 - "data_win_eventdata_targetDomainName": true,
1859 - "data_win_eventdata_targetFilename": true,
1860 - "data_win_eventdata_targetImage": true,
1861 - "data_win_eventdata_targetLinkedLogonId": true,
1862 - "data_win_eventdata_targetLogonId": true,
1863 - "data_win_eventdata_targetObject": true,
1864 - "data_win_eventdata_targetProcessGUID": true,
1865 - "data_win_eventdata_targetProcessId": true,
1866 - "data_win_eventdata_targetUserName": true,
1867 - "data_win_eventdata_targetUserSid": true,
1868 - "data_win_eventdata_terminalSessionId": true,
1869 - "data_win_eventdata_ticketEncryptionType": true,
1870 - "data_win_eventdata_ticketOptions": true,
1871 - "data_win_eventdata_user": true,
1872 - "data_win_eventdata_utcTime": true,
1873 - "data_win_eventdata_virtualAccount": true,
1874 - "data_win_system_channel": true,
1875 - "data_win_system_computer": true,
1876 - "data_win_system_eventID": true,
1877 - "data_win_system_eventRecordID": true,
1878 - "data_win_system_eventSourceName": true,
1879 - "data_win_system_keywords": true,
1880 - "data_win_system_level": true,
1881 - "data_win_system_message": true,
1882 - "data_win_system_opcode": true,
1883 - "data_win_system_processID": true,
1884 - "data_win_system_providerGuid": true,
1885 - "data_win_system_providerName": true,
1886 - "data_win_system_severityValue": true,
1887 - "data_win_system_systemTime": true,
1888 - "data_win_system_task": true,
1889 - "data_win_system_threadID": true,
1890 - "data_win_system_version": true,
1891 - "decoder_name": true,
1892 - "decoder_parent": true,
1893 - "dns_query": true,
1894 - "dns_query_threat_indicated": true,
1895 - "dst_ip": true,
1896 - "dst_ip_city_name": true,
1897 - "dst_ip_country_code": true,
1898 - "dst_ip_geolocation": true,
1899 - "dst_ip_threat_indicated": true,
1900 - "dst_port": true,
1901 - "ecs_version": true,
1902 - "error": true,
1903 - "event_hash": true,
1904 - "file_path": true,
1905 - "firewall_rule_name": true,
1906 - "full_log": false,
1907 - "gl2_accounted_message_size": true,
1908 - "gl2_message_id": true,
1909 - "gl2_processing_error": true,
1910 - "gl2_remote_ip": true,
1911 - "gl2_remote_port": true,
1912 - "gl2_source_collector": true,
1913 - "gl2_source_input": true,
1914 - "gl2_source_node": true,
1915 - "hash_md5": true,
1916 - "hash_sha1": true,
1917 - "hash_sha256": true,
1918 - "highlight": true,
1919 - "host_architecture": true,
1920 - "host_containerized": true,
1921 - "host_hostname": true,
1922 - "host_id": true,
1923 - "host_ip": true,
1924 - "host_mac": true,
1925 - "host_name": true,
1926 - "host_os_codename": true,
1927 - "host_os_kernel": true,
1928 - "host_os_name": true,
1929 - "host_os_platform": true,
1930 - "host_os_version": true,
1931 - "hostname": true,
1932 - "id": true,
1933 - "input_type": true,
1934 - "level": true,
1935 - "location": true,
1936 - "log_file_path": true,
1937 - "log_offset": true,
1938 - "manager_name": true,
1939 - "message": true,
1940 - "module": true,
1941 - "msg_timestamp": true,
1942 - "parent_process_cmd_line": true,
1943 - "parent_process_id": true,
1944 - "parent_process_image": true,
1945 - "pid": true,
1946 - "predecoder_hostname": true,
1947 - "predecoder_program_name": true,
1948 - "predecoder_timestamp": true,
1949 - "previous_log": true,
1950 - "previous_output": true,
1951 - "process_cmd_line": true,
1952 - "process_id": true,
1953 - "process_image": true,
1954 - "process_name": true,
1955 - "protocol": true,
1956 - "rule_cis": true,
1957 - "rule_cis_csc": true,
1958 - "rule_firedtimes": true,
1959 - "rule_gdpr": true,
1960 - "rule_gdpr_IV": true,
1961 - "rule_gpg13": true,
1962 - "rule_gpg_13": true,
1963 - "rule_group1": true,
1964 - "rule_group2": true,
1965 - "rule_groups": true,
1966 - "rule_hipaa": true,
1967 - "rule_id": true,
1968 - "rule_info": true,
1969 - "rule_mail": true,
1970 - "rule_mitre_id": true,
1971 - "rule_mitre_tactic": false,
1972 - "rule_nist_800_53": true,
1973 - "rule_pci_dss": true,
1974 - "rule_tsc": true,
1975 - "scanid": true,
1976 - "service": true,
1977 - "software_package": true,
1978 - "software_vendor": true,
1979 - "sort": true,
1980 - "source": true,
1981 - "source_reserved_ip": true,
1982 - "src_ip": true,
1983 - "src_ip_city_name": true,
1984 - "src_ip_country_code": true,
1985 - "src_ip_geolocation": true,
1986 - "src_port": true,
1987 - "streams": true,
1988 - "syscheck_attrs_after": true,
1989 - "syscheck_audit_effective_user_id": true,
1990 - "syscheck_audit_effective_user_name": true,
1991 - "syscheck_audit_group_id": true,
1992 - "syscheck_audit_group_name": true,
1993 - "syscheck_audit_login_user_id": true,
1994 - "syscheck_audit_login_user_name": true,
1995 - "syscheck_audit_process_cwd": true,
1996 - "syscheck_audit_process_id": true,
1997 - "syscheck_audit_process_name": true,
1998 - "syscheck_audit_process_parent_cwd": true,
1999 - "syscheck_audit_process_parent_name": true,
2000 - "syscheck_audit_process_ppid": true,
2001 - "syscheck_audit_user_id": true,
2002 - "syscheck_audit_user_name": true,
2003 - "syscheck_changed_attributes": true,
2004 - "syscheck_event": true,
2005 - "syscheck_gid_after": true,
2006 - "syscheck_gname_after": true,
2007 - "syscheck_hard_links": true,
2008 - "syscheck_inode_after": true,
2009 - "syscheck_inode_before": true,
2010 - "syscheck_md5_after": true,
2011 - "syscheck_md5_before": true,
2012 - "syscheck_mode": true,
2013 - "syscheck_mtime_after": true,
2014 - "syscheck_mtime_before": true,
2015 - "syscheck_path": true,
2016 - "syscheck_perm_after": true,
2017 - "syscheck_perm_before": true,
2018 - "syscheck_sha1_after": true,
2019 - "syscheck_sha1_before": true,
2020 - "syscheck_sha256_after": true,
2021 - "syscheck_sha256_before": true,
2022 - "syscheck_size_after": true,
2023 - "syscheck_size_before": true,
2024 - "syscheck_uid_after": true,
2025 - "syscheck_uname_after": true,
2026 - "syscheck_win_perm_after": true,
2027 - "syscheck_win_perm_after_0_allowed": true,
2028 - "syscheck_win_perm_after_0_name": true,
2029 - "syscheck_win_perm_after_1_allowed": true,
2030 - "syscheck_win_perm_after_1_name": true,
2031 - "syscheck_win_perm_after_2_allowed": true,
2032 - "syscheck_win_perm_after_2_name": true,
2033 - "syscheck_win_perm_after_3_allowed": true,
2034 - "syscheck_win_perm_after_3_name": true,
2035 - "syslog_customer": true,
2036 - "syslog_level": true,
2037 - "syslog_tag": true,
2038 - "syslog_type": true,
2039 - "sysmon_event_description": true,
2040 - "threat_ids": true,
2041 - "threat_indicated": true,
2042 - "threat_names": true,
2043 - "time": true,
2044 - "timestamp": true,
2045 - "true": true,
2046 - "user_name": true,
2047 - "win_registry_key": true,
2048 - "win_system_eventID": true,
2049 - "windows_auth_package": true,
2050 - "windows_domain": true,
2051 - "windows_event_id": true,
2052 - "windows_event_severity": true,
2053 - "windows_logon_type": true
2054 - },
2055 - "indexByName": {
2056 - "_id": 2,
2057 - "_index": 10,
2058 - "_type": 11,
2059 - "agent_id": 12,
2060 - "agent_name": 6,
2061 - "cluster_name": 13,
2062 - "cluster_node": 14,
2063 - "data_integration": 48,
2064 - "data_office365_Application": 49,
2065 - "data_office365_ClientIP": 4,
2066 - "data_office365_ClientIP_city_name": 15,
2067 - "data_office365_ClientIP_country_code": 16,
2068 - "data_office365_ClientIP_geolocation": 17,
2069 - "data_office365_CreationTime": 0,
2070 - "data_office365_DeviceName": 5,
2071 - "data_office365_FileSize": 50,
2072 - "data_office365_FileType": 51,
2073 - "data_office365_Hidden": 53,
2074 - "data_office365_Id": 18,
2075 - "data_office365_MDATPDeviceId": 54,
2076 - "data_office365_ObjectId": 52,
2077 - "data_office365_Operation": 24,
2078 - "data_office365_OrganizationId": 19,
2079 - "data_office365_Platform": 55,
2080 - "data_office365_RecordType": 20,
2081 - "data_office365_Scope": 56,
2082 - "data_office365_SourceLocationType": 57,
2083 - "data_office365_Subscription": 58,
2084 - "data_office365_UserId": 3,
2085 - "data_office365_UserKey": 21,
2086 - "data_office365_UserType": 22,
2087 - "data_office365_Version": 23,
2088 - "data_office365_Workload": 47,
2089 - "decoder_name": 25,
2090 - "gl2_accounted_message_size": 26,
2091 - "gl2_message_id": 27,
2092 - "gl2_processing_error": 28,
2093 - "gl2_remote_ip": 29,
2094 - "gl2_remote_port": 30,
2095 - "gl2_source_input": 31,
2096 - "gl2_source_node": 32,
2097 - "highlight": 33,
2098 - "id": 34,
2099 - "location": 35,
2100 - "manager_name": 36,
2101 - "message": 37,
2102 - "msg_timestamp": 59,
2103 - "rule_description": 7,
2104 - "rule_firedtimes": 38,
2105 - "rule_group1": 39,
2106 - "rule_group2": 60,
2107 - "rule_groups": 40,
2108 - "rule_hipaa": 61,
2109 - "rule_id": 9,
2110 - "rule_level": 8,
2111 - "rule_mail": 41,
2112 - "rule_pci_dss": 62,
2113 - "sort": 42,
2114 - "source": 43,
2115 - "source_reserved_ip": 63,
2116 - "streams": 44,
2117 - "syslog_type": 45,
2118 - "timestamp": 1,
2119 - "true": 46
2120 - },
2121 - "renameByName": {
2122 - "_id": "EVENT ID",
2123 - "agent_name": "",
2124 - "data_office365_ActorIpAddress": "SRC IP",
2125 - "data_office365_AffectedItems": "ITEMS",
2126 - "data_office365_Application": "APP",
2127 - "data_office365_BrowserName": "BROWSER",
2128 - "data_office365_ClientIP": "CLIENT IP",
2129 - "data_office365_ClientIP_city_name": "",
2130 - "data_office365_CreationTime": "EVENT TIME",
2131 - "data_office365_DeviceDisplayName": "",
2132 - "data_office365_DeviceName": "DEVICE",
2133 - "data_office365_FileType": "FILE TYPE",
2134 - "data_office365_Item_Attachments": "ATTACHMENT",
2135 - "data_office365_Item_ParentFolder_Path": "FOLDER",
2136 - "data_office365_Item_Subject": "SUBJECT",
2137 - "data_office365_ObjectId": "OBJECT",
2138 - "data_office365_ResultDescription": "RESULT DESCRIPTION",
2139 - "data_office365_ResultStatus": "RESULT STATUS",
2140 - "data_office365_UserAgent": "USER AGENT",
2141 - "data_office365_UserId": "ACCOUNT",
2142 - "rule_description": "DESCRIPTION",
2143 - "rule_id": "RULE ID",
2144 - "rule_level": "",
2145 - "rule_mitre_tactic": "MITRE TACTIC",
2146 - "rule_mitre_technique": "MITRE TECHNIQUE",
2147 - "timestamp": "Date/Time"
2148 - }
2149 - }
2150 - }
2151 - ],
2152 - "transparent": true,
2153 - "type": "table"
2154 - }
2155 - ],
2156 - "refresh": "",
2157 - "schemaVersion": 38,
2158 - "style": "dark",
2159 - "tags": [
2160 - "O365"
2161 - ],
2162 - "templating": {
2163 - "list": [
2164 - {
2165 - "datasource": {
2166 - "type": "elasticsearch",
2167 - "uid": "replace_datasource_uid"
2168 - },
2169 - "filters": [],
2170 - "hide": 0,
2171 - "label": "",
2172 - "name": "Filters",
2173 - "skipUrlSync": false,
2174 - "type": "adhoc"
2175 - },
2176 - {
2177 - "current": {
2178 - "selected": false,
2179 - "text": "All",
2180 - "value": "$__all"
2181 - },
2182 - "datasource": {
2183 - "type": "elasticsearch",
2184 - "uid": "replace_datasource_uid"
2185 - },
2186 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2187 - "hide": 0,
2188 - "includeAll": true,
2189 - "label": "Operation",
2190 - "multi": false,
2191 - "name": "operation",
2192 - "options": [],
2193 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2194 - "refresh": 2,
2195 - "regex": "",
2196 - "skipUrlSync": false,
2197 - "sort": 1,
2198 - "tagValuesQuery": "",
2199 - "tagsQuery": "",
2200 - "type": "query",
2201 - "useTags": false
2202 - },
2203 - {
2204 - "current": {
2205 - "selected": false,
2206 - "text": "All",
2207 - "value": "$__all"
2208 - },
2209 - "datasource": {
2210 - "type": "elasticsearch",
2211 - "uid": "replace_datasource_uid"
2212 - },
2213 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2214 - "hide": 0,
2215 - "includeAll": true,
2216 - "label": "Rule Level",
2217 - "multi": false,
2218 - "name": "rule_level",
2219 - "options": [],
2220 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2221 - "refresh": 2,
2222 - "regex": "",
2223 - "skipUrlSync": false,
2224 - "sort": 0,
2225 - "type": "query"
2226 - }
2227 - ]
2228 - },
2229 - "time": {
2230 - "from": "now-6h",
2231 - "to": "now"
2232 - },
2233 - "timepicker": {
2234 - "refresh_intervals": [
2235 - "5s",
2236 - "10s",
2237 - "30s",
2238 - "1m",
2239 - "5m",
2240 - "15m",
2241 - "30m",
2242 - "1h",
2243 - "2h",
2244 - "1d"
2245 - ],
2246 - "time_options": [
2247 - "5m",
2248 - "15m",
2249 - "1h",
2250 - "6h",
2251 - "12h",
2252 - "24h",
2253 - "2d",
2254 - "7d",
2255 - "30d"
2256 - ]
2257 - },
2258 - "timezone": "",
2259 - "title": "O365 - DEFENDER FOR IDENTITY",
2260 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "10.0.3",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:MicrosoftDefenderForIdentity",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "cellOptions": {
255 + "type": "auto"
256 + },
257 + "inspect": false
258 + },
259 + "mappings": [],
260 + "thresholds": {
261 + "mode": "absolute",
262 + "steps": [
263 + {
264 + "color": "red",
265 + "value": null
266 + }
267 + ]
268 + }
269 + },
270 + "overrides": [
271 + {
272 + "matcher": {
273 + "id": "byName",
274 + "options": "Count"
275 + },
276 + "properties": [
277 + {
278 + "id": "displayName",
279 + "value": "EVENTS"
280 + },
281 + {
282 + "id": "unit",
283 + "value": "short"
284 + },
285 + {
286 + "id": "decimals",
287 + "value": -1
288 + },
289 + {
290 + "id": "custom.align"
291 + },
292 + {
293 + "id": "thresholds",
294 + "value": {
295 + "mode": "absolute",
296 + "steps": [
297 + {
298 + "color": "red",
299 + "value": null
300 + }
301 + ]
302 + }
303 + }
304 + ]
305 + }
306 + ]
307 + },
308 + "gridPos": {
309 + "h": 7,
310 + "w": 6,
311 + "x": 8,
312 + "y": 0
313 + },
314 + "id": 54,
315 + "options": {
316 + "cellHeight": "sm",
317 + "footer": {
318 + "countRows": false,
319 + "fields": "",
320 + "reducer": ["sum"],
321 + "show": false
322 + },
323 + "showHeader": true
324 + },
325 + "pluginVersion": "10.0.3",
326 + "targets": [
327 + {
328 + "bucketAggs": [
329 + {
330 + "fake": true,
331 + "field": "data_office365_Operation",
332 + "id": "4",
333 + "settings": {
334 + "min_doc_count": 1,
335 + "order": "desc",
336 + "orderBy": "_count",
337 + "size": "0"
338 + },
339 + "type": "terms"
340 + }
341 + ],
342 + "datasource": {
343 + "type": "elasticsearch",
344 + "uid": "replace_datasource_uid"
345 + },
346 + "metrics": [
347 + {
348 + "field": "select field",
349 + "id": "1",
350 + "type": "count"
351 + }
352 + ],
353 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
354 + "refId": "A",
355 + "timeField": "timestamp"
356 + }
357 + ],
358 + "title": "EVENTS BY OPERATION",
359 + "transformations": [
360 + {
361 + "id": "merge",
362 + "options": {
363 + "reducers": []
364 + }
365 + },
366 + {
367 + "id": "organize",
368 + "options": {
369 + "excludeByName": {},
370 + "indexByName": {},
371 + "renameByName": {
372 + "Count": "EVENTS",
373 + "data_office365_Operation": "OPERATION"
374 + }
375 + }
376 + }
377 + ],
378 + "type": "table"
379 + },
380 + {
381 + "datasource": {
382 + "type": "elasticsearch",
383 + "uid": "replace_datasource_uid"
384 + },
385 + "fieldConfig": {
386 + "defaults": {
387 + "color": {
388 + "mode": "thresholds"
389 + },
390 + "mappings": [
391 + {
392 + "options": {
393 + "match": "null",
394 + "result": {
395 + "text": "N/A"
396 + }
397 + },
398 + "type": "special"
399 + }
400 + ],
401 + "max": 15,
402 + "min": 0,
403 + "thresholds": {
404 + "mode": "absolute",
405 + "steps": [
406 + {
407 + "color": "#299c46",
408 + "value": null
409 + },
410 + {
411 + "color": "rgba(237, 129, 40, 0.89)",
412 + "value": 8
413 + },
414 + {
415 + "color": "#d44a3a",
416 + "value": 12
417 + }
418 + ]
419 + },
420 + "unit": "none"
421 + },
422 + "overrides": []
423 + },
424 + "gridPos": {
425 + "h": 7,
426 + "w": 4,
427 + "x": 0,
428 + "y": 7
429 + },
430 + "id": 16,
431 + "links": [],
432 + "options": {
433 + "orientation": "horizontal",
434 + "reduceOptions": {
435 + "calcs": ["max"],
436 + "fields": "",
437 + "values": false
438 + },
439 + "showThresholdLabels": false,
440 + "showThresholdMarkers": true,
441 + "text": {}
442 + },
443 + "pluginVersion": "10.0.3",
444 + "targets": [
445 + {
446 + "bucketAggs": [
447 + {
448 + "field": "timestamp",
449 + "id": "2",
450 + "settings": {
451 + "interval": "auto",
452 + "min_doc_count": 0,
453 + "trimEdges": 0
454 + },
455 + "type": "date_histogram"
456 + }
457 + ],
458 + "datasource": {
459 + "type": "elasticsearch",
460 + "uid": "replace_datasource_uid"
461 + },
462 + "metrics": [
463 + {
464 + "field": "rule_level",
465 + "id": "1",
466 + "meta": {},
467 + "settings": {},
468 + "type": "max"
469 + }
470 + ],
471 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
472 + "refId": "A",
473 + "timeField": "timestamp"
474 + }
475 + ],
476 + "title": "MAX SEVERITY (0 - 15)",
477 + "type": "gauge"
478 + },
479 + {
480 + "datasource": {
481 + "type": "elasticsearch",
482 + "uid": "replace_datasource_uid"
483 + },
484 + "fieldConfig": {
485 + "defaults": {
486 + "color": {
487 + "mode": "palette-classic"
488 + },
489 + "custom": {
490 + "axisCenteredZero": false,
491 + "axisColorMode": "text",
492 + "axisLabel": "",
493 + "axisPlacement": "auto",
494 + "barAlignment": 0,
495 + "drawStyle": "bars",
496 + "fillOpacity": 0,
497 + "gradientMode": "none",
498 + "hideFrom": {
499 + "legend": false,
500 + "tooltip": false,
501 + "viz": false
502 + },
503 + "lineInterpolation": "linear",
504 + "lineWidth": 1,
505 + "pointSize": 5,
506 + "scaleDistribution": {
507 + "type": "linear"
508 + },
509 + "showPoints": "auto",
510 + "spanNulls": false,
511 + "stacking": {
512 + "group": "A",
513 + "mode": "normal"
514 + },
515 + "thresholdsStyle": {
516 + "mode": "off"
517 + }
518 + },
519 + "mappings": [],
520 + "thresholds": {
521 + "mode": "absolute",
522 + "steps": [
523 + {
524 + "color": "green",
525 + "value": null
526 + },
527 + {
528 + "color": "red",
529 + "value": 80
530 + }
531 + ]
532 + }
533 + },
534 + "overrides": []
535 + },
536 + "gridPos": {
537 + "h": 13,
538 + "w": 20,
539 + "x": 4,
540 + "y": 7
541 + },
542 + "id": 60,
543 + "options": {
544 + "legend": {
545 + "calcs": [],
546 + "displayMode": "table",
547 + "placement": "right",
548 + "showLegend": true
549 + },
550 + "tooltip": {
551 + "mode": "single",
552 + "sort": "none"
553 + }
554 + },
555 + "targets": [
556 + {
557 + "alias": "",
558 + "bucketAggs": [
559 + {
560 + "field": "data_office365_Operation",
561 + "id": "3",
562 + "settings": {
563 + "min_doc_count": "1",
564 + "order": "desc",
565 + "orderBy": "_count",
566 + "size": "10"
567 + },
568 + "type": "terms"
569 + },
570 + {
571 + "field": "timestamp",
572 + "id": "2",
573 + "settings": {
574 + "interval": "auto"
575 + },
576 + "type": "date_histogram"
577 + }
578 + ],
579 + "datasource": {
580 + "type": "elasticsearch",
581 + "uid": "replace_datasource_uid"
582 + },
583 + "metrics": [
584 + {
585 + "id": "1",
586 + "type": "count"
587 + }
588 + ],
589 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
590 + "refId": "A",
591 + "timeField": "timestamp"
592 + }
593 + ],
594 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
595 + "transparent": true,
596 + "type": "timeseries"
597 + },
598 + {
599 + "datasource": {
600 + "type": "elasticsearch",
601 + "uid": "replace_datasource_uid"
602 + },
603 + "fieldConfig": {
604 + "defaults": {
605 + "mappings": [
606 + {
607 + "options": {
608 + "match": "null",
609 + "result": {
610 + "text": "N/A"
611 + }
612 + },
613 + "type": "special"
614 + }
615 + ],
616 + "thresholds": {
617 + "mode": "absolute",
618 + "steps": [
619 + {
620 + "color": "blue",
621 + "value": null
622 + }
623 + ]
624 + },
625 + "unit": "locale"
626 + },
627 + "overrides": []
628 + },
629 + "gridPos": {
630 + "h": 6,
631 + "w": 4,
632 + "x": 0,
633 + "y": 14
634 + },
635 + "id": 51,
636 + "links": [],
637 + "options": {
638 + "colorMode": "value",
639 + "graphMode": "area",
640 + "justifyMode": "auto",
641 + "orientation": "horizontal",
642 + "reduceOptions": {
643 + "calcs": ["sum"],
644 + "fields": "",
645 + "values": false
646 + },
647 + "text": {},
648 + "textMode": "auto"
649 + },
650 + "pluginVersion": "10.0.3",
651 + "targets": [
652 + {
653 + "bucketAggs": [
654 + {
655 + "$$hashKey": "object:331",
656 + "field": "timestamp",
657 + "id": "2",
658 + "settings": {
659 + "interval": "auto",
660 + "min_doc_count": 0,
661 + "trimEdges": 0
662 + },
663 + "type": "date_histogram"
664 + }
665 + ],
666 + "datasource": {
667 + "type": "elasticsearch",
668 + "uid": "replace_datasource_uid"
669 + },
670 + "metrics": [
671 + {
672 + "$$hashKey": "object:329",
673 + "field": "select field",
674 + "id": "1",
675 + "type": "count"
676 + }
677 + ],
678 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
679 + "refId": "A",
680 + "timeField": "timestamp"
681 + }
682 + ],
683 + "title": "EVENTS (Total)",
684 + "type": "stat"
685 + },
686 + {
687 + "datasource": {
688 + "type": "elasticsearch",
689 + "uid": "replace_datasource_uid"
690 + },
691 + "fieldConfig": {
692 + "defaults": {
693 + "color": {
694 + "mode": "thresholds"
695 + },
696 + "custom": {
697 + "align": "auto",
698 + "cellOptions": {
699 + "type": "auto"
700 + },
701 + "inspect": false
702 + },
703 + "mappings": [],
704 + "thresholds": {
705 + "mode": "absolute",
706 + "steps": [
707 + {
708 + "color": "red",
709 + "value": null
710 + }
711 + ]
712 + }
713 + },
714 + "overrides": [
715 + {
716 + "matcher": {
717 + "id": "byName",
718 + "options": "Count"
719 + },
720 + "properties": [
721 + {
722 + "id": "displayName",
723 + "value": "EVENTS"
724 + },
725 + {
726 + "id": "unit",
727 + "value": "short"
728 + },
729 + {
730 + "id": "decimals",
731 + "value": -1
732 + },
733 + {
734 + "id": "custom.align"
735 + },
736 + {
737 + "id": "thresholds",
738 + "value": {
739 + "mode": "absolute",
740 + "steps": [
741 + {
742 + "color": "red",
743 + "value": null
744 + }
745 + ]
746 + }
747 + }
748 + ]
749 + },
750 + {
751 + "matcher": {
752 + "id": "byName",
753 + "options": "DEVICE"
754 + },
755 + "properties": [
756 + {
757 + "id": "custom.width",
758 + "value": 324
759 + }
760 + ]
761 + }
762 + ]
763 + },
764 + "gridPos": {
765 + "h": 12,
766 + "w": 7,
767 + "x": 0,
768 + "y": 20
769 + },
770 + "id": 62,
771 + "options": {
772 + "cellHeight": "sm",
773 + "footer": {
774 + "countRows": false,
775 + "fields": "",
776 + "reducer": ["sum"],
777 + "show": false
778 + },
779 + "showHeader": true,
780 + "sortBy": []
781 + },
782 + "pluginVersion": "10.0.3",
783 + "targets": [
784 + {
785 + "bucketAggs": [
786 + {
787 + "fake": true,
788 + "field": "data_office365_ResultStatus",
789 + "id": "4",
790 + "settings": {
791 + "min_doc_count": 1,
792 + "order": "desc",
793 + "orderBy": "_count",
794 + "size": "0"
795 + },
796 + "type": "terms"
797 + }
798 + ],
799 + "datasource": {
800 + "type": "elasticsearch",
801 + "uid": "replace_datasource_uid"
802 + },
803 + "metrics": [
804 + {
805 + "field": "select field",
806 + "id": "1",
807 + "type": "count"
808 + }
809 + ],
810 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
811 + "refId": "A",
812 + "timeField": "timestamp"
813 + }
814 + ],
815 + "title": "EVENTS BY RESULT",
816 + "transformations": [
817 + {
818 + "id": "merge",
819 + "options": {
820 + "reducers": []
821 + }
822 + },
823 + {
824 + "id": "organize",
825 + "options": {
826 + "excludeByName": {},
827 + "indexByName": {},
828 + "renameByName": {
829 + "Count": "EVENTS",
830 + "data_office365_ClientIP_country_code": "COUNTRY",
831 + "data_office365_DeviceName": "DEVICE",
832 + "data_office365_Operation": "OPERATION",
833 + "data_office365_ResultStatus": "RESULT STATUS"
834 + }
835 + }
836 + }
837 + ],
838 + "type": "table"
839 + },
840 + {
841 + "circleMaxSize": 30,
842 + "circleMinSize": 2,
843 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
844 + "datasource": {
845 + "type": "elasticsearch",
846 + "uid": "replace_datasource_uid"
847 + },
848 + "decimals": 0,
849 + "esMetric": "Count",
850 + "gridPos": {
851 + "h": 12,
852 + "w": 8,
853 + "x": 7,
854 + "y": 20
855 + },
856 + "hideEmpty": false,
857 + "hideZero": false,
858 + "id": 50,
859 + "initialZoom": 1,
860 + "locationData": "countries",
861 + "mapCenter": "(0°, 0°)",
862 + "mapCenterLatitude": 0,
863 + "mapCenterLongitude": 0,
864 + "maxDataPoints": 1,
865 + "mouseWheelZoom": false,
866 + "showLegend": true,
867 + "stickyLabels": false,
868 + "tableQueryOptions": {
869 + "geohashField": "geohash",
870 + "latitudeField": "latitude",
871 + "longitudeField": "longitude",
872 + "metricField": "metric",
873 + "queryType": "geohash"
874 + },
875 + "targets": [
876 + {
877 + "bucketAggs": [
878 + {
879 + "fake": true,
880 + "field": "data_office365_ClientIP_country_code",
881 + "id": "3",
882 + "settings": {
883 + "min_doc_count": 1,
884 + "order": "desc",
885 + "orderBy": "_count",
886 + "size": "0"
887 + },
888 + "type": "terms"
889 + },
890 + {
891 + "field": "timestamp",
892 + "id": "2",
893 + "settings": {
894 + "interval": "auto",
895 + "min_doc_count": 0,
896 + "trimEdges": 0
897 + },
898 + "type": "date_histogram"
899 + }
900 + ],
901 + "datasource": {
902 + "type": "elasticsearch",
903 + "uid": "replace_datasource_uid"
904 + },
905 + "metrics": [
906 + {
907 + "field": "select field",
908 + "id": "1",
909 + "type": "count"
910 + }
911 + ],
912 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
913 + "refId": "A",
914 + "timeField": "timestamp"
915 + }
916 + ],
917 + "thresholds": "0,10",
918 + "title": "Endpoint - ALL EVENTS BY SRC COUNTRY",
919 + "type": "grafana-worldmap-panel",
920 + "unitPlural": "",
921 + "unitSingle": "",
922 + "valueName": "total"
923 + },
924 + {
925 + "datasource": {
926 + "type": "elasticsearch",
927 + "uid": "replace_datasource_uid"
928 + },
929 + "fieldConfig": {
930 + "defaults": {
931 + "color": {
932 + "mode": "thresholds"
933 + },
934 + "custom": {
935 + "align": "auto",
936 + "cellOptions": {
937 + "type": "auto"
938 + },
939 + "inspect": false
940 + },
941 + "mappings": [],
942 + "thresholds": {
943 + "mode": "absolute",
944 + "steps": [
945 + {
946 + "color": "orange",
947 + "value": null
948 + }
949 + ]
950 + }
951 + },
952 + "overrides": [
953 + {
954 + "matcher": {
955 + "id": "byName",
956 + "options": "Count"
957 + },
958 + "properties": [
959 + {
960 + "id": "displayName",
961 + "value": "EVENTS"
962 + },
963 + {
964 + "id": "unit",
965 + "value": "short"
966 + },
967 + {
968 + "id": "decimals",
969 + "value": -1
970 + },
971 + {
972 + "id": "custom.align"
973 + }
974 + ]
975 + },
976 + {
977 + "matcher": {
978 + "id": "byName",
979 + "options": "AD ACCOUNT"
980 + },
981 + "properties": [
982 + {
983 + "id": "custom.width",
984 + "value": 377
985 + }
986 + ]
987 + }
988 + ]
989 + },
990 + "gridPos": {
991 + "h": 12,
992 + "w": 9,
993 + "x": 15,
994 + "y": 20
995 + },
996 + "id": 58,
997 + "options": {
998 + "cellHeight": "sm",
999 + "footer": {
1000 + "countRows": false,
1001 + "fields": "",
1002 + "reducer": ["sum"],
1003 + "show": false
1004 + },
1005 + "showHeader": true,
1006 + "sortBy": []
1007 + },
1008 + "pluginVersion": "10.0.3",
1009 + "targets": [
1010 + {
1011 + "bucketAggs": [
1012 + {
1013 + "fake": true,
1014 + "field": "data_office365_UserId",
1015 + "id": "4",
1016 + "settings": {
1017 + "min_doc_count": 1,
1018 + "order": "desc",
1019 + "orderBy": "_count",
1020 + "size": "0"
1021 + },
1022 + "type": "terms"
1023 + },
1024 + {
1025 + "field": "data_office365_ClientIP_country_code",
1026 + "id": "5",
1027 + "settings": {
1028 + "min_doc_count": "1",
1029 + "order": "desc",
1030 + "orderBy": "_term",
1031 + "size": "10"
1032 + },
1033 + "type": "terms"
1034 + }
1035 + ],
1036 + "datasource": {
1037 + "type": "elasticsearch",
1038 + "uid": "replace_datasource_uid"
1039 + },
1040 + "metrics": [
1041 + {
1042 + "field": "select field",
1043 + "id": "1",
1044 + "type": "count"
1045 + }
1046 + ],
1047 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
1048 + "refId": "A",
1049 + "timeField": "timestamp"
1050 + }
1051 + ],
1052 + "title": "Endpoint EVENTS BY ACCOUNT",
1053 + "transformations": [
1054 + {
1055 + "id": "merge",
1056 + "options": {
1057 + "reducers": []
1058 + }
1059 + },
1060 + {
1061 + "id": "organize",
1062 + "options": {
1063 + "excludeByName": {},
1064 + "indexByName": {},
1065 + "renameByName": {
1066 + "Count": "EVENTS",
1067 + "data_office365_ClientIP_country_code": "COUNTRY",
1068 + "data_office365_LogonError": "ERROR",
1069 + "data_office365_Operation": "WORKLOAD",
1070 + "data_office365_UserId": "AD ACCOUNT"
1071 + }
1072 + }
1073 + }
1074 + ],
1075 + "type": "table"
1076 + },
1077 + {
1078 + "datasource": {
1079 + "type": "elasticsearch",
1080 + "uid": "replace_datasource_uid"
1081 + },
1082 + "fieldConfig": {
1083 + "defaults": {
1084 + "color": {
1085 + "mode": "thresholds"
1086 + },
1087 + "custom": {
1088 + "align": "auto",
1089 + "cellOptions": {
1090 + "type": "auto"
1091 + },
1092 + "filterable": true,
1093 + "inspect": false
1094 + },
1095 + "mappings": [],
1096 + "thresholds": {
1097 + "mode": "absolute",
1098 + "steps": [
1099 + {
1100 + "color": "green",
1101 + "value": null
1102 + },
1103 + {
1104 + "color": "red",
1105 + "value": 80
1106 + }
1107 + ]
1108 + }
1109 + },
1110 + "overrides": [
1111 + {
1112 + "matcher": {
1113 + "id": "byName",
1114 + "options": "rule_level"
1115 + },
1116 + "properties": [
1117 + {
1118 + "id": "displayName",
1119 + "value": "RULE LEVEL"
1120 + },
1121 + {
1122 + "id": "unit",
1123 + "value": "short"
1124 + },
1125 + {
1126 + "id": "decimals",
1127 + "value": -1
1128 + },
1129 + {
1130 + "id": "custom.cellOptions",
1131 + "value": {
1132 + "mode": "gradient",
1133 + "type": "color-background"
1134 + }
1135 + },
1136 + {
1137 + "id": "custom.align"
1138 + },
1139 + {
1140 + "id": "thresholds",
1141 + "value": {
1142 + "mode": "absolute",
1143 + "steps": [
1144 + {
1145 + "color": "#37872D",
1146 + "value": null
1147 + },
1148 + {
1149 + "color": "rgba(237, 129, 40, 0.89)",
1150 + "value": 7
1151 + },
1152 + {
1153 + "color": "rgba(245, 54, 54, 0.9)",
1154 + "value": 12
1155 + }
1156 + ]
1157 + }
1158 + }
1159 + ]
1160 + },
1161 + {
1162 + "matcher": {
1163 + "id": "byName",
1164 + "options": "Date/Time"
1165 + },
1166 + "properties": [
1167 + {
1168 + "id": "custom.width",
1169 + "value": 242
1170 + }
1171 + ]
1172 + },
1173 + {
1174 + "matcher": {
1175 + "id": "byName",
1176 + "options": "MITRE TACTIC"
1177 + },
1178 + "properties": [
1179 + {
1180 + "id": "custom.width",
1181 + "value": 332
1182 + }
1183 + ]
1184 + },
1185 + {
1186 + "matcher": {
1187 + "id": "byName",
1188 + "options": "IP ADDRESS"
1189 + },
1190 + "properties": [
1191 + {
1192 + "id": "custom.width",
1193 + "value": 163
1194 + }
1195 + ]
1196 + },
1197 + {
1198 + "matcher": {
1199 + "id": "byName",
1200 + "options": "MITRE TECHNIQUE"
1201 + },
1202 + "properties": [
1203 + {
1204 + "id": "custom.width",
1205 + "value": 312
1206 + }
1207 + ]
1208 + },
1209 + {
1210 + "matcher": {
1211 + "id": "byName",
1212 + "options": "EVENT ID"
1213 + },
1214 + "properties": [
1215 + {
1216 + "id": "links",
1217 + "value": [
1218 + {
1219 + "targetBlank": true,
1220 + "title": "VIEW EVENT DETAILS",
1221 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1222 + }
1223 + ]
1224 + },
1225 + {
1226 + "id": "custom.width",
1227 + "value": 265
1228 + }
1229 + ]
1230 + },
1231 + {
1232 + "matcher": {
1233 + "id": "byName",
1234 + "options": "RESULT"
1235 + },
1236 + "properties": [
1237 + {
1238 + "id": "custom.width",
1239 + "value": 118
1240 + },
1241 + {
1242 + "id": "mappings",
1243 + "value": [
1244 + {
1245 + "options": {
1246 + "Failed": {
1247 + "color": "orange",
1248 + "index": 1
1249 + },
1250 + "Success": {
1251 + "color": "green",
1252 + "index": 0
1253 + }
1254 + },
1255 + "type": "value"
1256 + }
1257 + ]
1258 + },
1259 + {
1260 + "id": "custom.cellOptions",
1261 + "value": {
1262 + "type": "color-text"
1263 + }
1264 + }
1265 + ]
1266 + },
1267 + {
1268 + "matcher": {
1269 + "id": "byName",
1270 + "options": "SRC IP"
1271 + },
1272 + "properties": [
1273 + {
1274 + "id": "custom.width",
1275 + "value": 265
1276 + }
1277 + ]
1278 + },
1279 + {
1280 + "matcher": {
1281 + "id": "byName",
1282 + "options": "ACCOUNT"
1283 + },
1284 + "properties": [
1285 + {
1286 + "id": "custom.width",
1287 + "value": 193
1288 + }
1289 + ]
1290 + },
1291 + {
1292 + "matcher": {
1293 + "id": "byName",
1294 + "options": "EVENT TIME"
1295 + },
1296 + "properties": [
1297 + {
1298 + "id": "custom.width",
1299 + "value": 195
1300 + }
1301 + ]
1302 + },
1303 + {
1304 + "matcher": {
1305 + "id": "byName",
1306 + "options": "CLIENT IP"
1307 + },
1308 + "properties": [
1309 + {
1310 + "id": "custom.width",
1311 + "value": 143
1312 + }
1313 + ]
1314 + },
1315 + {
1316 + "matcher": {
1317 + "id": "byName",
1318 + "options": "DESCRIPTION"
1319 + },
1320 + "properties": [
1321 + {
1322 + "id": "custom.width",
1323 + "value": 296
1324 + }
1325 + ]
1326 + },
1327 + {
1328 + "matcher": {
1329 + "id": "byName",
1330 + "options": "DEVICE"
1331 + },
1332 + "properties": [
1333 + {
1334 + "id": "custom.width",
1335 + "value": 182
1336 + }
1337 + ]
1338 + },
1339 + {
1340 + "matcher": {
1341 + "id": "byName",
1342 + "options": "RULE LEVEL"
1343 + },
1344 + "properties": [
1345 + {
1346 + "id": "custom.width",
1347 + "value": 145
1348 + }
1349 + ]
1350 + },
1351 + {
1352 + "matcher": {
1353 + "id": "byName",
1354 + "options": "APP"
1355 + },
1356 + "properties": [
1357 + {
1358 + "id": "custom.width",
1359 + "value": 187
1360 + }
1361 + ]
1362 + },
1363 + {
1364 + "matcher": {
1365 + "id": "byName",
1366 + "options": "FILE TYPE"
1367 + },
1368 + "properties": [
1369 + {
1370 + "id": "custom.width",
1371 + "value": 157
1372 + }
1373 + ]
1374 + }
1375 + ]
1376 + },
1377 + "gridPos": {
1378 + "h": 16,
1379 + "w": 24,
1380 + "x": 0,
1381 + "y": 32
1382 + },
1383 + "id": 27,
1384 + "options": {
1385 + "cellHeight": "sm",
1386 + "footer": {
1387 + "countRows": false,
1388 + "enablePagination": true,
1389 + "fields": "",
1390 + "reducer": ["sum"],
1391 + "show": false
1392 + },
1393 + "showHeader": true,
1394 + "sortBy": []
1395 + },
1396 + "pluginVersion": "10.0.3",
1397 + "targets": [
1398 + {
1399 + "bucketAggs": [],
1400 + "datasource": {
1401 + "type": "elasticsearch",
1402 + "uid": "replace_datasource_uid"
1403 + },
1404 + "metrics": [
1405 + {
1406 + "id": "1",
1407 + "settings": {
1408 + "size": "250"
1409 + },
1410 + "type": "raw_data"
1411 + }
1412 + ],
1413 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftDefenderForIdentity",
1414 + "refId": "A",
1415 + "timeField": "timestamp"
1416 + }
1417 + ],
1418 + "title": "EVENTS",
1419 + "transformations": [
1420 + {
1421 + "id": "organize",
1422 + "options": {
1423 + "excludeByName": {
1424 + "@metadata_beat": true,
1425 + "@metadata_type": true,
1426 + "@metadata_version": true,
1427 + "IMPHASH": true,
1428 + "MD5": true,
1429 + "SHA1": true,
1430 + "SHA256": true,
1431 + "_id": false,
1432 + "_index": true,
1433 + "_type": true,
1434 + "agent_ephemeral_id": true,
1435 + "agent_hostname": true,
1436 + "agent_id": true,
1437 + "agent_ip_city_name": true,
1438 + "agent_ip_country_code": true,
1439 + "agent_ip_geolocation": true,
1440 + "agent_name": true,
1441 + "agent_type": true,
1442 + "agent_version": true,
1443 + "beats_type": true,
1444 + "cluster_name": true,
1445 + "cluster_node": true,
1446 + "collector_node_id": true,
1447 + "data_alert_action": true,
1448 + "data_alert_category": true,
1449 + "data_alert_gid": true,
1450 + "data_alert_rev": true,
1451 + "data_alert_severity": true,
1452 + "data_alert_signature": true,
1453 + "data_alert_signature_id": true,
1454 + "data_app_proto": true,
1455 + "data_audit_auid": true,
1456 + "data_audit_command": true,
1457 + "data_audit_euid": true,
1458 + "data_audit_exe": true,
1459 + "data_audit_gid": true,
1460 + "data_audit_id": true,
1461 + "data_audit_pid": true,
1462 + "data_audit_res": true,
1463 + "data_audit_session": true,
1464 + "data_audit_type": true,
1465 + "data_audit_uid": true,
1466 + "data_dest_ip": true,
1467 + "data_dest_port": true,
1468 + "data_dstuser": true,
1469 + "data_event_type": true,
1470 + "data_extra_data": true,
1471 + "data_file": true,
1472 + "data_flow_bytes_toclient": true,
1473 + "data_flow_bytes_toserver": true,
1474 + "data_flow_id": true,
1475 + "data_flow_pkts_toclient": true,
1476 + "data_flow_pkts_toserver": true,
1477 + "data_flow_start": true,
1478 + "data_http_http_content_type": true,
1479 + "data_http_http_port": true,
1480 + "data_http_length": true,
1481 + "data_http_status": true,
1482 + "data_http_url": true,
1483 + "data_id": true,
1484 + "data_in_iface": true,
1485 + "data_integration": true,
1486 + "data_metadata_flowbits": true,
1487 + "data_metadata_flowints_http_anomaly_count": true,
1488 + "data_metadata_flowints_tcp_retransmission_count": true,
1489 + "data_office365_AADGroupId": true,
1490 + "data_office365_Actor": true,
1491 + "data_office365_ActorContextId": true,
1492 + "data_office365_ActorIpAddress": false,
1493 + "data_office365_ActorIpAddress_city_name": true,
1494 + "data_office365_ActorIpAddress_country_code": true,
1495 + "data_office365_ActorIpAddress_geolocation": true,
1496 + "data_office365_AppAccessContext_AADSessionId": true,
1497 + "data_office365_AppAccessContext_APIId": true,
1498 + "data_office365_AppAccessContext_ClientAppId": true,
1499 + "data_office365_AppAccessContext_ClientAppName": true,
1500 + "data_office365_AppAccessContext_CorrelationId": true,
1501 + "data_office365_AppAccessContext_UniqueTokenId": true,
1502 + "data_office365_AppId": true,
1503 + "data_office365_Application": false,
1504 + "data_office365_ApplicationId": true,
1505 + "data_office365_ArtifactsShared": true,
1506 + "data_office365_Attendees": true,
1507 + "data_office365_AuthenticationType": true,
1508 + "data_office365_AzureActiveDirectoryEventType": true,
1509 + "data_office365_BrowserVersion": true,
1510 + "data_office365_ChannelGuid": true,
1511 + "data_office365_ChannelName": true,
1512 + "data_office365_ChatName": true,
1513 + "data_office365_ChatThreadId": true,
1514 + "data_office365_ClientAppId": true,
1515 + "data_office365_ClientIP": false,
1516 + "data_office365_ClientIPAddress": true,
1517 + "data_office365_ClientIPAddress_city_name": true,
1518 + "data_office365_ClientIPAddress_country_code": true,
1519 + "data_office365_ClientIPAddress_geolocation": true,
1520 + "data_office365_ClientIP_city_name": true,
1521 + "data_office365_ClientIP_country_code": true,
1522 + "data_office365_ClientIP_geolocation": true,
1523 + "data_office365_ClientIP_reserved_ip": true,
1524 + "data_office365_ClientInfoString": true,
1525 + "data_office365_ClientProcessName": true,
1526 + "data_office365_ClientRequestId": true,
1527 + "data_office365_ClientVersion": true,
1528 + "data_office365_CommunicationSubType": true,
1529 + "data_office365_CommunicationType": true,
1530 + "data_office365_CorrelationId": true,
1531 + "data_office365_CreationTime": false,
1532 + "data_office365_CrossMailboxOperation": true,
1533 + "data_office365_DestFolder_Id": true,
1534 + "data_office365_DestFolder_Path": true,
1535 + "data_office365_DestinationLocationType": true,
1536 + "data_office365_DeviceDisplayName": true,
1537 + "data_office365_DeviceDisplayName_city_name": true,
1538 + "data_office365_DeviceDisplayName_country_code": true,
1539 + "data_office365_DeviceDisplayName_geolocation": true,
1540 + "data_office365_DeviceId": true,
1541 + "data_office365_DeviceInformation": true,
1542 + "data_office365_DeviceName": false,
1543 + "data_office365_DeviceProperties": true,
1544 + "data_office365_DlpOriginalFilePath": true,
1545 + "data_office365_EndTime": true,
1546 + "data_office365_EnforcementMode": true,
1547 + "data_office365_ErrorNumber": true,
1548 + "data_office365_EventSource": true,
1549 + "data_office365_ExchangeId": true,
1550 + "data_office365_ExtendedProperties": true,
1551 + "data_office365_ExternalAccess": true,
1552 + "data_office365_ExtraProperties": true,
1553 + "data_office365_FileExtension": true,
1554 + "data_office365_FileSize": true,
1555 + "data_office365_FileSizeBytes": true,
1556 + "data_office365_Folder_Id": true,
1557 + "data_office365_Folder_Path": true,
1558 + "data_office365_Hidden": true,
1559 + "data_office365_HighPriorityMediaProcessing": true,
1560 + "data_office365_HostedContents": true,
1561 + "data_office365_ICalUid": true,
1562 + "data_office365_Id": true,
1563 + "data_office365_InterSystemsId": true,
1564 + "data_office365_InternalLogonType": true,
1565 + "data_office365_IntraSystemId": true,
1566 + "data_office365_IsManagedDevice": true,
1567 + "data_office365_ItemName": true,
1568 + "data_office365_ItemType": true,
1569 + "data_office365_Item_Id": true,
1570 + "data_office365_Item_InternetMessageId": true,
1571 + "data_office365_Item_IsRecord": true,
1572 + "data_office365_Item_ParentFolder_Id": true,
1573 + "data_office365_Item_SizeInBytes": true,
1574 + "data_office365_JitTriggered": true,
1575 + "data_office365_JoinTime": true,
1576 + "data_office365_LeaveTime": true,
1577 + "data_office365_ListBaseType": true,
1578 + "data_office365_ListId": true,
1579 + "data_office365_ListItemUniqueId": true,
1580 + "data_office365_ListServerTemplate": true,
1581 + "data_office365_LogonError": true,
1582 + "data_office365_LogonType": true,
1583 + "data_office365_LogonUserSid": true,
1584 + "data_office365_MDATPDeviceId": true,
1585 + "data_office365_MailboxGuid": true,
1586 + "data_office365_MailboxOwnerSid": true,
1587 + "data_office365_MailboxOwnerUPN": true,
1588 + "data_office365_MeetingDetailId": true,
1589 + "data_office365_MeetingURL": true,
1590 + "data_office365_Members": true,
1591 + "data_office365_MessageId": true,
1592 + "data_office365_MessageSizeInBytes": true,
1593 + "data_office365_MessageURLs": true,
1594 + "data_office365_MessageVersion": true,
1595 + "data_office365_Modalities": true,
1596 + "data_office365_ModifiedProperties": true,
1597 + "data_office365_Name": true,
1598 + "data_office365_NewValue": true,
1599 + "data_office365_ObjectId": false,
1600 + "data_office365_Operation": true,
1601 + "data_office365_OperationScope": true,
1602 + "data_office365_OrganizationId": true,
1603 + "data_office365_OrganizationName": true,
1604 + "data_office365_Organizer_OrganizationId": true,
1605 + "data_office365_Organizer_RecipientType": true,
1606 + "data_office365_Organizer_Role": true,
1607 + "data_office365_Organizer_UserObjectId": true,
1608 + "data_office365_OriginatingDomain": true,
1609 + "data_office365_OriginatingServer": true,
1610 + "data_office365_Parameters": true,
1611 + "data_office365_ParentMessageId": true,
1612 + "data_office365_Platform": true,
1613 + "data_office365_PreviousFileName": true,
1614 + "data_office365_ProviderTypes": true,
1615 + "data_office365_RMSEncrypted": true,
1616 + "data_office365_RecordType": true,
1617 + "data_office365_ResultStatus": false,
1618 + "data_office365_Scope": true,
1619 + "data_office365_SensitiveInfoTypeData": true,
1620 + "data_office365_SessionId": true,
1621 + "data_office365_Sha1": true,
1622 + "data_office365_Sha256": true,
1623 + "data_office365_Site": true,
1624 + "data_office365_SiteUrl": true,
1625 + "data_office365_SourceFileExtension": true,
1626 + "data_office365_SourceFileName": true,
1627 + "data_office365_SourceLocationType": true,
1628 + "data_office365_SourceRelativeUrl": true,
1629 + "data_office365_StartTime": true,
1630 + "data_office365_Subscription": true,
1631 + "data_office365_SubscriptionId": true,
1632 + "data_office365_Target": true,
1633 + "data_office365_TargetContextId": true,
1634 + "data_office365_TargetFilePath": true,
1635 + "data_office365_TargetPrinterName": true,
1636 + "data_office365_TeamGuid": true,
1637 + "data_office365_TeamName": true,
1638 + "data_office365_UserId": false,
1639 + "data_office365_UserKey": true,
1640 + "data_office365_UserType": true,
1641 + "data_office365_Version": true,
1642 + "data_office365_WebId": true,
1643 + "data_office365_Workload": true,
1644 + "data_osquery_action": true,
1645 + "data_osquery_calendarTime": true,
1646 + "data_osquery_columns_address": true,
1647 + "data_osquery_columns_address_city_name": true,
1648 + "data_osquery_columns_address_country_code": true,
1649 + "data_osquery_columns_address_geolocation": true,
1650 + "data_osquery_columns_cmdline": true,
1651 + "data_osquery_columns_cwd": true,
1652 + "data_osquery_columns_description": true,
1653 + "data_osquery_columns_directory": true,
1654 + "data_osquery_columns_disk_bytes_read": true,
1655 + "data_osquery_columns_disk_bytes_written": true,
1656 + "data_osquery_columns_egid": true,
1657 + "data_osquery_columns_euid": true,
1658 + "data_osquery_columns_family": true,
1659 + "data_osquery_columns_fd": true,
1660 + "data_osquery_columns_gid": true,
1661 + "data_osquery_columns_gid_signed": true,
1662 + "data_osquery_columns_host": true,
1663 + "data_osquery_columns_interface": true,
1664 + "data_osquery_columns_local_address": true,
1665 + "data_osquery_columns_local_address_city_name": true,
1666 + "data_osquery_columns_local_address_country_code": true,
1667 + "data_osquery_columns_local_address_geolocation": true,
1668 + "data_osquery_columns_local_port": true,
1669 + "data_osquery_columns_mac": true,
1670 + "data_osquery_columns_name": true,
1671 + "data_osquery_columns_net_namespace": true,
1672 + "data_osquery_columns_nice": true,
1673 + "data_osquery_columns_on_disk": true,
1674 + "data_osquery_columns_parent": true,
1675 + "data_osquery_columns_path": true,
1676 + "data_osquery_columns_pgroup": true,
1677 + "data_osquery_columns_pid": true,
1678 + "data_osquery_columns_port": true,
1679 + "data_osquery_columns_protocol": true,
1680 + "data_osquery_columns_remote_address": true,
1681 + "data_osquery_columns_remote_address_city_name": true,
1682 + "data_osquery_columns_remote_address_country_code": true,
1683 + "data_osquery_columns_remote_address_geolocation": true,
1684 + "data_osquery_columns_remote_port": true,
1685 + "data_osquery_columns_resident_size": true,
1686 + "data_osquery_columns_root": true,
1687 + "data_osquery_columns_sgid": true,
1688 + "data_osquery_columns_shell": true,
1689 + "data_osquery_columns_socket": true,
1690 + "data_osquery_columns_start_time": true,
1691 + "data_osquery_columns_state": true,
1692 + "data_osquery_columns_suid": true,
1693 + "data_osquery_columns_system_time": true,
1694 + "data_osquery_columns_threads": true,
1695 + "data_osquery_columns_time_utc": true,
1696 + "data_osquery_columns_total_size": true,
1697 + "data_osquery_columns_tty": true,
1698 + "data_osquery_columns_type": true,
1699 + "data_osquery_columns_uid": true,
1700 + "data_osquery_columns_uid_signed": true,
1701 + "data_osquery_columns_user": true,
1702 + "data_osquery_columns_user_time": true,
1703 + "data_osquery_columns_username": true,
1704 + "data_osquery_columns_wired_size": true,
1705 + "data_osquery_counter": true,
1706 + "data_osquery_decorations_host_uuid": true,
1707 + "data_osquery_decorations_hostname": true,
1708 + "data_osquery_epoch": true,
1709 + "data_osquery_hostIdentifier": true,
1710 + "data_osquery_name": true,
1711 + "data_osquery_numerics": true,
1712 + "data_osquery_unixTime": true,
1713 + "data_proto": true,
1714 + "data_sca_check_command": true,
1715 + "data_sca_check_compliance_cis": true,
1716 + "data_sca_check_compliance_cis_csc": true,
1717 + "data_sca_check_compliance_gdpr_IV": true,
1718 + "data_sca_check_compliance_gpg_13": true,
1719 + "data_sca_check_compliance_hipaa": true,
1720 + "data_sca_check_compliance_nist_800_53": true,
1721 + "data_sca_check_compliance_pci_dss": true,
1722 + "data_sca_check_compliance_tsc": true,
1723 + "data_sca_check_description": true,
1724 + "data_sca_check_id": true,
1725 + "data_sca_check_previous_result": true,
1726 + "data_sca_check_rationale": true,
1727 + "data_sca_check_remediation": true,
1728 + "data_sca_check_result": true,
1729 + "data_sca_check_title": true,
1730 + "data_sca_description": true,
1731 + "data_sca_failed": true,
1732 + "data_sca_file": true,
1733 + "data_sca_invalid": true,
1734 + "data_sca_passed": true,
1735 + "data_sca_policy": true,
1736 + "data_sca_policy_id": true,
1737 + "data_sca_scan_id": true,
1738 + "data_sca_score": true,
1739 + "data_sca_total_checks": true,
1740 + "data_sca_type": true,
1741 + "data_script": true,
1742 + "data_src_ip": true,
1743 + "data_src_ip_city_name": true,
1744 + "data_src_ip_country_code": true,
1745 + "data_src_ip_geolocation": true,
1746 + "data_src_port": true,
1747 + "data_srcip": true,
1748 + "data_srcip_city_name": true,
1749 + "data_srcip_country_code": true,
1750 + "data_srcip_geolocation": true,
1751 + "data_srcuser": true,
1752 + "data_timestamp": true,
1753 + "data_title": true,
1754 + "data_tls_session_resumed": true,
1755 + "data_tls_version": true,
1756 + "data_tx_id": true,
1757 + "data_type": true,
1758 + "data_win_eventXML_binaryData": true,
1759 + "data_win_eventXML_binaryDataSize": true,
1760 + "data_win_eventXML_param1": true,
1761 + "data_win_eventdata_authenticationPackageName": true,
1762 + "data_win_eventdata_callTrace": true,
1763 + "data_win_eventdata_commandLine": true,
1764 + "data_win_eventdata_company": true,
1765 + "data_win_eventdata_creationUtcTime": true,
1766 + "data_win_eventdata_currentDirectory": true,
1767 + "data_win_eventdata_description": true,
1768 + "data_win_eventdata_destinationHostname": true,
1769 + "data_win_eventdata_destinationIp": true,
1770 + "data_win_eventdata_destinationIp_city_name": true,
1771 + "data_win_eventdata_destinationIp_country_code": true,
1772 + "data_win_eventdata_destinationIp_geolocation": true,
1773 + "data_win_eventdata_destinationIsIpv6": true,
1774 + "data_win_eventdata_destinationPort": true,
1775 + "data_win_eventdata_destinationPortName": true,
1776 + "data_win_eventdata_details": true,
1777 + "data_win_eventdata_elevatedToken": true,
1778 + "data_win_eventdata_eventType": true,
1779 + "data_win_eventdata_fileVersion": true,
1780 + "data_win_eventdata_fileVersion_city_name": true,
1781 + "data_win_eventdata_fileVersion_country_code": true,
1782 + "data_win_eventdata_fileVersion_geolocation": true,
1783 + "data_win_eventdata_grantedAccess": true,
1784 + "data_win_eventdata_hashes": true,
1785 + "data_win_eventdata_image": true,
1786 + "data_win_eventdata_imageLoaded": true,
1787 + "data_win_eventdata_impersonationLevel": true,
1788 + "data_win_eventdata_initiated": true,
1789 + "data_win_eventdata_integrityLevel": true,
1790 + "data_win_eventdata_ipAddress": true,
1791 + "data_win_eventdata_ipPort": true,
1792 + "data_win_eventdata_keyLength": true,
1793 + "data_win_eventdata_logonGuid": true,
1794 + "data_win_eventdata_logonId": true,
1795 + "data_win_eventdata_logonProcessName": true,
1796 + "data_win_eventdata_logonType": true,
1797 + "data_win_eventdata_originalFileName": true,
1798 + "data_win_eventdata_param1": true,
1799 + "data_win_eventdata_param2": true,
1800 + "data_win_eventdata_param3": true,
1801 + "data_win_eventdata_param4": true,
1802 + "data_win_eventdata_parentCommandLine": true,
1803 + "data_win_eventdata_parentImage": true,
1804 + "data_win_eventdata_parentProcessGuid": true,
1805 + "data_win_eventdata_parentProcessId": true,
1806 + "data_win_eventdata_processGuid": true,
1807 + "data_win_eventdata_processId": true,
1808 + "data_win_eventdata_processName": true,
1809 + "data_win_eventdata_product": true,
1810 + "data_win_eventdata_protocol": true,
1811 + "data_win_eventdata_queryName": true,
1812 + "data_win_eventdata_queryResults": true,
1813 + "data_win_eventdata_queryStatus": true,
1814 + "data_win_eventdata_ruleName": true,
1815 + "data_win_eventdata_serviceName": true,
1816 + "data_win_eventdata_serviceSid": true,
1817 + "data_win_eventdata_signature": true,
1818 + "data_win_eventdata_signatureStatus": true,
1819 + "data_win_eventdata_signed": true,
1820 + "data_win_eventdata_sourceHostname": true,
1821 + "data_win_eventdata_sourceImage": true,
1822 + "data_win_eventdata_sourceIp": true,
1823 + "data_win_eventdata_sourceIp_city_name": true,
1824 + "data_win_eventdata_sourceIp_country_code": true,
1825 + "data_win_eventdata_sourceIp_geolocation": true,
1826 + "data_win_eventdata_sourceIsIpv6": true,
1827 + "data_win_eventdata_sourcePort": true,
1828 + "data_win_eventdata_sourceProcessGUID": true,
1829 + "data_win_eventdata_sourceProcessId": true,
1830 + "data_win_eventdata_sourceThreadId": true,
1831 + "data_win_eventdata_status": true,
1832 + "data_win_eventdata_subjectDomainName": true,
1833 + "data_win_eventdata_subjectLogonId": true,
1834 + "data_win_eventdata_subjectUserName": true,
1835 + "data_win_eventdata_subjectUserSid": true,
1836 + "data_win_eventdata_targetDomainName": true,
1837 + "data_win_eventdata_targetFilename": true,
1838 + "data_win_eventdata_targetImage": true,
1839 + "data_win_eventdata_targetLinkedLogonId": true,
1840 + "data_win_eventdata_targetLogonId": true,
1841 + "data_win_eventdata_targetObject": true,
1842 + "data_win_eventdata_targetProcessGUID": true,
1843 + "data_win_eventdata_targetProcessId": true,
1844 + "data_win_eventdata_targetUserName": true,
1845 + "data_win_eventdata_targetUserSid": true,
1846 + "data_win_eventdata_terminalSessionId": true,
1847 + "data_win_eventdata_ticketEncryptionType": true,
1848 + "data_win_eventdata_ticketOptions": true,
1849 + "data_win_eventdata_user": true,
1850 + "data_win_eventdata_utcTime": true,
1851 + "data_win_eventdata_virtualAccount": true,
1852 + "data_win_system_channel": true,
1853 + "data_win_system_computer": true,
1854 + "data_win_system_eventID": true,
1855 + "data_win_system_eventRecordID": true,
1856 + "data_win_system_eventSourceName": true,
1857 + "data_win_system_keywords": true,
1858 + "data_win_system_level": true,
1859 + "data_win_system_message": true,
1860 + "data_win_system_opcode": true,
1861 + "data_win_system_processID": true,
1862 + "data_win_system_providerGuid": true,
1863 + "data_win_system_providerName": true,
1864 + "data_win_system_severityValue": true,
1865 + "data_win_system_systemTime": true,
1866 + "data_win_system_task": true,
1867 + "data_win_system_threadID": true,
1868 + "data_win_system_version": true,
1869 + "decoder_name": true,
1870 + "decoder_parent": true,
1871 + "dns_query": true,
1872 + "dns_query_threat_indicated": true,
1873 + "dst_ip": true,
1874 + "dst_ip_city_name": true,
1875 + "dst_ip_country_code": true,
1876 + "dst_ip_geolocation": true,
1877 + "dst_ip_threat_indicated": true,
1878 + "dst_port": true,
1879 + "ecs_version": true,
1880 + "error": true,
1881 + "event_hash": true,
1882 + "file_path": true,
1883 + "firewall_rule_name": true,
1884 + "full_log": false,
1885 + "gl2_accounted_message_size": true,
1886 + "gl2_message_id": true,
1887 + "gl2_processing_error": true,
1888 + "gl2_remote_ip": true,
1889 + "gl2_remote_port": true,
1890 + "gl2_source_collector": true,
1891 + "gl2_source_input": true,
1892 + "gl2_source_node": true,
1893 + "hash_md5": true,
1894 + "hash_sha1": true,
1895 + "hash_sha256": true,
1896 + "highlight": true,
1897 + "host_architecture": true,
1898 + "host_containerized": true,
1899 + "host_hostname": true,
1900 + "host_id": true,
1901 + "host_ip": true,
1902 + "host_mac": true,
1903 + "host_name": true,
1904 + "host_os_codename": true,
1905 + "host_os_kernel": true,
1906 + "host_os_name": true,
1907 + "host_os_platform": true,
1908 + "host_os_version": true,
1909 + "hostname": true,
1910 + "id": true,
1911 + "input_type": true,
1912 + "level": true,
1913 + "location": true,
1914 + "log_file_path": true,
1915 + "log_offset": true,
1916 + "manager_name": true,
1917 + "message": true,
1918 + "module": true,
1919 + "msg_timestamp": true,
1920 + "parent_process_cmd_line": true,
1921 + "parent_process_id": true,
1922 + "parent_process_image": true,
1923 + "pid": true,
1924 + "predecoder_hostname": true,
1925 + "predecoder_program_name": true,
1926 + "predecoder_timestamp": true,
1927 + "previous_log": true,
1928 + "previous_output": true,
1929 + "process_cmd_line": true,
1930 + "process_id": true,
1931 + "process_image": true,
1932 + "process_name": true,
1933 + "protocol": true,
1934 + "rule_cis": true,
1935 + "rule_cis_csc": true,
1936 + "rule_firedtimes": true,
1937 + "rule_gdpr": true,
1938 + "rule_gdpr_IV": true,
1939 + "rule_gpg13": true,
1940 + "rule_gpg_13": true,
1941 + "rule_group1": true,
1942 + "rule_group2": true,
1943 + "rule_groups": true,
1944 + "rule_hipaa": true,
1945 + "rule_id": true,
1946 + "rule_info": true,
1947 + "rule_mail": true,
1948 + "rule_mitre_id": true,
1949 + "rule_mitre_tactic": false,
1950 + "rule_nist_800_53": true,
1951 + "rule_pci_dss": true,
1952 + "rule_tsc": true,
1953 + "scanid": true,
1954 + "service": true,
1955 + "software_package": true,
1956 + "software_vendor": true,
1957 + "sort": true,
1958 + "source": true,
1959 + "source_reserved_ip": true,
1960 + "src_ip": true,
1961 + "src_ip_city_name": true,
1962 + "src_ip_country_code": true,
1963 + "src_ip_geolocation": true,
1964 + "src_port": true,
1965 + "streams": true,
1966 + "syscheck_attrs_after": true,
1967 + "syscheck_audit_effective_user_id": true,
1968 + "syscheck_audit_effective_user_name": true,
1969 + "syscheck_audit_group_id": true,
1970 + "syscheck_audit_group_name": true,
1971 + "syscheck_audit_login_user_id": true,
1972 + "syscheck_audit_login_user_name": true,
1973 + "syscheck_audit_process_cwd": true,
1974 + "syscheck_audit_process_id": true,
1975 + "syscheck_audit_process_name": true,
1976 + "syscheck_audit_process_parent_cwd": true,
1977 + "syscheck_audit_process_parent_name": true,
1978 + "syscheck_audit_process_ppid": true,
1979 + "syscheck_audit_user_id": true,
1980 + "syscheck_audit_user_name": true,
1981 + "syscheck_changed_attributes": true,
1982 + "syscheck_event": true,
1983 + "syscheck_gid_after": true,
1984 + "syscheck_gname_after": true,
1985 + "syscheck_hard_links": true,
1986 + "syscheck_inode_after": true,
1987 + "syscheck_inode_before": true,
1988 + "syscheck_md5_after": true,
1989 + "syscheck_md5_before": true,
1990 + "syscheck_mode": true,
1991 + "syscheck_mtime_after": true,
1992 + "syscheck_mtime_before": true,
1993 + "syscheck_path": true,
1994 + "syscheck_perm_after": true,
1995 + "syscheck_perm_before": true,
1996 + "syscheck_sha1_after": true,
1997 + "syscheck_sha1_before": true,
1998 + "syscheck_sha256_after": true,
1999 + "syscheck_sha256_before": true,
2000 + "syscheck_size_after": true,
2001 + "syscheck_size_before": true,
2002 + "syscheck_uid_after": true,
2003 + "syscheck_uname_after": true,
2004 + "syscheck_win_perm_after": true,
2005 + "syscheck_win_perm_after_0_allowed": true,
2006 + "syscheck_win_perm_after_0_name": true,
2007 + "syscheck_win_perm_after_1_allowed": true,
2008 + "syscheck_win_perm_after_1_name": true,
2009 + "syscheck_win_perm_after_2_allowed": true,
2010 + "syscheck_win_perm_after_2_name": true,
2011 + "syscheck_win_perm_after_3_allowed": true,
2012 + "syscheck_win_perm_after_3_name": true,
2013 + "syslog_customer": true,
2014 + "syslog_level": true,
2015 + "syslog_tag": true,
2016 + "syslog_type": true,
2017 + "sysmon_event_description": true,
2018 + "threat_ids": true,
2019 + "threat_indicated": true,
2020 + "threat_names": true,
2021 + "time": true,
2022 + "timestamp": true,
2023 + "true": true,
2024 + "user_name": true,
2025 + "win_registry_key": true,
2026 + "win_system_eventID": true,
2027 + "windows_auth_package": true,
2028 + "windows_domain": true,
2029 + "windows_event_id": true,
2030 + "windows_event_severity": true,
2031 + "windows_logon_type": true
2032 + },
2033 + "indexByName": {
2034 + "_id": 2,
2035 + "_index": 10,
2036 + "_type": 11,
2037 + "agent_id": 12,
2038 + "agent_name": 6,
2039 + "cluster_name": 13,
2040 + "cluster_node": 14,
2041 + "data_integration": 48,
2042 + "data_office365_Application": 49,
2043 + "data_office365_ClientIP": 4,
2044 + "data_office365_ClientIP_city_name": 15,
2045 + "data_office365_ClientIP_country_code": 16,
2046 + "data_office365_ClientIP_geolocation": 17,
2047 + "data_office365_CreationTime": 0,
2048 + "data_office365_DeviceName": 5,
2049 + "data_office365_FileSize": 50,
2050 + "data_office365_FileType": 51,
2051 + "data_office365_Hidden": 53,
2052 + "data_office365_Id": 18,
2053 + "data_office365_MDATPDeviceId": 54,
2054 + "data_office365_ObjectId": 52,
2055 + "data_office365_Operation": 24,
2056 + "data_office365_OrganizationId": 19,
2057 + "data_office365_Platform": 55,
2058 + "data_office365_RecordType": 20,
2059 + "data_office365_Scope": 56,
2060 + "data_office365_SourceLocationType": 57,
2061 + "data_office365_Subscription": 58,
2062 + "data_office365_UserId": 3,
2063 + "data_office365_UserKey": 21,
2064 + "data_office365_UserType": 22,
2065 + "data_office365_Version": 23,
2066 + "data_office365_Workload": 47,
2067 + "decoder_name": 25,
2068 + "gl2_accounted_message_size": 26,
2069 + "gl2_message_id": 27,
2070 + "gl2_processing_error": 28,
2071 + "gl2_remote_ip": 29,
2072 + "gl2_remote_port": 30,
2073 + "gl2_source_input": 31,
2074 + "gl2_source_node": 32,
2075 + "highlight": 33,
2076 + "id": 34,
2077 + "location": 35,
2078 + "manager_name": 36,
2079 + "message": 37,
2080 + "msg_timestamp": 59,
2081 + "rule_description": 7,
2082 + "rule_firedtimes": 38,
2083 + "rule_group1": 39,
2084 + "rule_group2": 60,
2085 + "rule_groups": 40,
2086 + "rule_hipaa": 61,
2087 + "rule_id": 9,
2088 + "rule_level": 8,
2089 + "rule_mail": 41,
2090 + "rule_pci_dss": 62,
2091 + "sort": 42,
2092 + "source": 43,
2093 + "source_reserved_ip": 63,
2094 + "streams": 44,
2095 + "syslog_type": 45,
2096 + "timestamp": 1,
2097 + "true": 46
2098 + },
2099 + "renameByName": {
2100 + "_id": "EVENT ID",
2101 + "agent_name": "",
2102 + "data_office365_ActorIpAddress": "SRC IP",
2103 + "data_office365_AffectedItems": "ITEMS",
2104 + "data_office365_Application": "APP",
2105 + "data_office365_BrowserName": "BROWSER",
2106 + "data_office365_ClientIP": "CLIENT IP",
2107 + "data_office365_ClientIP_city_name": "",
2108 + "data_office365_CreationTime": "EVENT TIME",
2109 + "data_office365_DeviceDisplayName": "",
2110 + "data_office365_DeviceName": "DEVICE",
2111 + "data_office365_FileType": "FILE TYPE",
2112 + "data_office365_Item_Attachments": "ATTACHMENT",
2113 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2114 + "data_office365_Item_Subject": "SUBJECT",
2115 + "data_office365_ObjectId": "OBJECT",
2116 + "data_office365_ResultDescription": "RESULT DESCRIPTION",
2117 + "data_office365_ResultStatus": "RESULT STATUS",
2118 + "data_office365_UserAgent": "USER AGENT",
2119 + "data_office365_UserId": "ACCOUNT",
2120 + "rule_description": "DESCRIPTION",
2121 + "rule_id": "RULE ID",
2122 + "rule_level": "",
2123 + "rule_mitre_tactic": "MITRE TACTIC",
2124 + "rule_mitre_technique": "MITRE TECHNIQUE",
2125 + "timestamp": "Date/Time"
2126 + }
2127 + }
2128 + }
2129 + ],
2130 + "transparent": true,
2131 + "type": "table"
2132 + }
2133 + ],
2134 + "refresh": "",
2135 + "schemaVersion": 38,
2136 + "style": "dark",
2137 + "tags": ["O365"],
2138 + "templating": {
2139 + "list": [
2140 + {
2141 + "datasource": {
2142 + "type": "elasticsearch",
2143 + "uid": "replace_datasource_uid"
2144 + },
2145 + "filters": [],
2146 + "hide": 0,
2147 + "label": "",
2148 + "name": "Filters",
2149 + "skipUrlSync": false,
2150 + "type": "adhoc"
2151 + },
2152 + {
2153 + "current": {
2154 + "selected": false,
2155 + "text": "All",
2156 + "value": "$__all"
2157 + },
2158 + "datasource": {
2159 + "type": "elasticsearch",
2160 + "uid": "replace_datasource_uid"
2161 + },
2162 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2163 + "hide": 0,
2164 + "includeAll": true,
2165 + "label": "Operation",
2166 + "multi": false,
2167 + "name": "operation",
2168 + "options": [],
2169 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2170 + "refresh": 2,
2171 + "regex": "",
2172 + "skipUrlSync": false,
2173 + "sort": 1,
2174 + "tagValuesQuery": "",
2175 + "tagsQuery": "",
2176 + "type": "query",
2177 + "useTags": false
2178 + },
2179 + {
2180 + "current": {
2181 + "selected": false,
2182 + "text": "All",
2183 + "value": "$__all"
2184 + },
2185 + "datasource": {
2186 + "type": "elasticsearch",
2187 + "uid": "replace_datasource_uid"
2188 + },
2189 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2190 + "hide": 0,
2191 + "includeAll": true,
2192 + "label": "Rule Level",
2193 + "multi": false,
2194 + "name": "rule_level",
2195 + "options": [],
2196 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftDefenderForIdentity\"}",
2197 + "refresh": 2,
2198 + "regex": "",
2199 + "skipUrlSync": false,
2200 + "sort": 0,
2201 + "type": "query"
2202 + }
2203 + ]
2204 + },
2205 + "time": {
2206 + "from": "now-6h",
2207 + "to": "now"
2208 + },
2209 + "timepicker": {
2210 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2211 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2212 + },
2213 + "timezone": "",
2214 + "title": "O365 - DEFENDER FOR IDENTITY",
2215 + "weekStart": ""
2216 }
backend/app/connectors/grafana/dashboards/Office365/dlp.json
+1953 -1996
@@ -1,1998 +1,1955 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "9.2.0",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Workload:$workload",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Workload",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY WORKLOAD (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "displayMode": "auto",
261 - "inspect": false
262 - },
263 - "mappings": [],
264 - "thresholds": {
265 - "mode": "absolute",
266 - "steps": [
267 - {
268 - "color": "red",
269 - "value": null
270 - }
271 - ]
272 - }
273 - },
274 - "overrides": [
275 - {
276 - "matcher": {
277 - "id": "byName",
278 - "options": "Count"
279 - },
280 - "properties": [
281 - {
282 - "id": "displayName",
283 - "value": "EVENTS"
284 - },
285 - {
286 - "id": "unit",
287 - "value": "short"
288 - },
289 - {
290 - "id": "decimals",
291 - "value": -1
292 - },
293 - {
294 - "id": "custom.align"
295 - },
296 - {
297 - "id": "thresholds",
298 - "value": {
299 - "mode": "absolute",
300 - "steps": [
301 - {
302 - "color": "red",
303 - "value": null
304 - }
305 - ]
306 - }
307 - }
308 - ]
309 - }
310 - ]
311 - },
312 - "gridPos": {
313 - "h": 7,
314 - "w": 6,
315 - "x": 8,
316 - "y": 0
317 - },
318 - "id": 54,
319 - "options": {
320 - "footer": {
321 - "fields": "",
322 - "reducer": [
323 - "sum"
324 - ],
325 - "show": false
326 - },
327 - "showHeader": true
328 - },
329 - "pluginVersion": "9.2.0",
330 - "targets": [
331 - {
332 - "bucketAggs": [
333 - {
334 - "fake": true,
335 - "field": "data_office365_Workload",
336 - "id": "4",
337 - "settings": {
338 - "min_doc_count": 1,
339 - "order": "desc",
340 - "orderBy": "_count",
341 - "size": "0"
342 - },
343 - "type": "terms"
344 - }
345 - ],
346 - "datasource": {
347 - "type": "elasticsearch",
348 - "uid": "replace_datasource_uid"
349 - },
350 - "metrics": [
351 - {
352 - "field": "select field",
353 - "id": "1",
354 - "type": "count"
355 - }
356 - ],
357 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
358 - "refId": "A",
359 - "timeField": "timestamp"
360 - }
361 - ],
362 - "title": "EVENTS BY WORKLOAD",
363 - "transformations": [
364 - {
365 - "id": "merge",
366 - "options": {
367 - "reducers": []
368 - }
369 - },
370 - {
371 - "id": "organize",
372 - "options": {
373 - "excludeByName": {},
374 - "indexByName": {},
375 - "renameByName": {
376 - "Count": "EVENTS",
377 - "data_office365_Operation": "OPERATION",
378 - "data_office365_Workload": "WORKLOAD"
379 - }
380 - }
381 - }
382 - ],
383 - "type": "table"
384 - },
385 - {
386 - "datasource": {
387 - "type": "elasticsearch",
388 - "uid": "replace_datasource_uid"
389 - },
390 - "fieldConfig": {
391 - "defaults": {
392 - "color": {
393 - "mode": "thresholds"
394 - },
395 - "mappings": [
396 - {
397 - "options": {
398 - "match": "null",
399 - "result": {
400 - "text": "N/A"
401 - }
402 - },
403 - "type": "special"
404 - }
405 - ],
406 - "max": 15,
407 - "min": 0,
408 - "thresholds": {
409 - "mode": "absolute",
410 - "steps": [
411 - {
412 - "color": "#299c46",
413 - "value": null
414 - },
415 - {
416 - "color": "rgba(237, 129, 40, 0.89)",
417 - "value": 8
418 - },
419 - {
420 - "color": "#d44a3a",
421 - "value": 12
422 - }
423 - ]
424 - },
425 - "unit": "none"
426 - },
427 - "overrides": []
428 - },
429 - "gridPos": {
430 - "h": 7,
431 - "w": 4,
432 - "x": 0,
433 - "y": 7
434 - },
435 - "id": 16,
436 - "links": [],
437 - "options": {
438 - "orientation": "horizontal",
439 - "reduceOptions": {
440 - "calcs": [
441 - "max"
442 - ],
443 - "fields": "",
444 - "values": false
445 - },
446 - "showThresholdLabels": false,
447 - "showThresholdMarkers": true,
448 - "text": {}
449 - },
450 - "pluginVersion": "9.2.0",
451 - "targets": [
452 - {
453 - "bucketAggs": [
454 - {
455 - "field": "timestamp",
456 - "id": "2",
457 - "settings": {
458 - "interval": "auto",
459 - "min_doc_count": 0,
460 - "trimEdges": 0
461 - },
462 - "type": "date_histogram"
463 - }
464 - ],
465 - "datasource": {
466 - "type": "elasticsearch",
467 - "uid": "replace_datasource_uid"
468 - },
469 - "metrics": [
470 - {
471 - "field": "rule_level",
472 - "id": "1",
473 - "meta": {},
474 - "settings": {},
475 - "type": "max"
476 - }
477 - ],
478 - "query": "data_office365_Workload:$workload",
479 - "refId": "A",
480 - "timeField": "timestamp"
481 - }
482 - ],
483 - "title": "MAX SEVERITY (0 - 15)",
484 - "type": "gauge"
485 - },
486 - {
487 - "datasource": {
488 - "type": "elasticsearch",
489 - "uid": "replace_datasource_uid"
490 - },
491 - "fieldConfig": {
492 - "defaults": {
493 - "color": {
494 - "mode": "palette-classic"
495 - },
496 - "custom": {
497 - "axisCenteredZero": false,
498 - "axisColorMode": "text",
499 - "axisLabel": "",
500 - "axisPlacement": "auto",
501 - "barAlignment": 0,
502 - "drawStyle": "bars",
503 - "fillOpacity": 0,
504 - "gradientMode": "none",
505 - "hideFrom": {
506 - "legend": false,
507 - "tooltip": false,
508 - "viz": false
509 - },
510 - "lineInterpolation": "linear",
511 - "lineWidth": 1,
512 - "pointSize": 5,
513 - "scaleDistribution": {
514 - "type": "linear"
515 - },
516 - "showPoints": "auto",
517 - "spanNulls": false,
518 - "stacking": {
519 - "group": "A",
520 - "mode": "normal"
521 - },
522 - "thresholdsStyle": {
523 - "mode": "off"
524 - }
525 - },
526 - "mappings": [],
527 - "thresholds": {
528 - "mode": "absolute",
529 - "steps": [
530 - {
531 - "color": "green",
532 - "value": null
533 - },
534 - {
535 - "color": "red",
536 - "value": 80
537 - }
538 - ]
539 - }
540 - },
541 - "overrides": []
542 - },
543 - "gridPos": {
544 - "h": 13,
545 - "w": 20,
546 - "x": 4,
547 - "y": 7
548 - },
549 - "id": 61,
550 - "options": {
551 - "legend": {
552 - "calcs": [],
553 - "displayMode": "table",
554 - "placement": "right",
555 - "showLegend": true
556 - },
557 - "tooltip": {
558 - "mode": "single",
559 - "sort": "none"
560 - }
561 - },
562 - "targets": [
563 - {
564 - "alias": "",
565 - "bucketAggs": [
566 - {
567 - "field": "data_office365_Workload",
568 - "id": "3",
569 - "settings": {
570 - "min_doc_count": "1",
571 - "order": "desc",
572 - "orderBy": "_count",
573 - "size": "10"
574 - },
575 - "type": "terms"
576 - },
577 - {
578 - "field": "timestamp",
579 - "id": "2",
580 - "settings": {
581 - "interval": "auto"
582 - },
583 - "type": "date_histogram"
584 - }
585 - ],
586 - "datasource": {
587 - "type": "elasticsearch",
588 - "uid": "replace_datasource_uid"
589 - },
590 - "metrics": [
591 - {
592 - "id": "1",
593 - "type": "count"
594 - }
595 - ],
596 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
597 - "refId": "A",
598 - "timeField": "timestamp"
599 - }
600 - ],
601 - "title": "TOP 10 WORKLOADS - HISTOGRAM",
602 - "transparent": true,
603 - "type": "timeseries"
604 - },
605 - {
606 - "datasource": {
607 - "type": "elasticsearch",
608 - "uid": "replace_datasource_uid"
609 - },
610 - "fieldConfig": {
611 - "defaults": {
612 - "mappings": [
613 - {
614 - "options": {
615 - "match": "null",
616 - "result": {
617 - "text": "N/A"
618 - }
619 - },
620 - "type": "special"
621 - }
622 - ],
623 - "thresholds": {
624 - "mode": "absolute",
625 - "steps": [
626 - {
627 - "color": "blue",
628 - "value": null
629 - }
630 - ]
631 - },
632 - "unit": "locale"
633 - },
634 - "overrides": []
635 - },
636 - "gridPos": {
637 - "h": 6,
638 - "w": 4,
639 - "x": 0,
640 - "y": 14
641 - },
642 - "id": 51,
643 - "links": [],
644 - "options": {
645 - "colorMode": "value",
646 - "graphMode": "area",
647 - "justifyMode": "auto",
648 - "orientation": "horizontal",
649 - "reduceOptions": {
650 - "calcs": [
651 - "sum"
652 - ],
653 - "fields": "",
654 - "values": false
655 - },
656 - "text": {},
657 - "textMode": "auto"
658 - },
659 - "pluginVersion": "9.2.0",
660 - "targets": [
661 - {
662 - "bucketAggs": [
663 - {
664 - "$$hashKey": "object:331",
665 - "field": "timestamp",
666 - "id": "2",
667 - "settings": {
668 - "interval": "auto",
669 - "min_doc_count": 0,
670 - "trimEdges": 0
671 - },
672 - "type": "date_histogram"
673 - }
674 - ],
675 - "datasource": {
676 - "type": "elasticsearch",
677 - "uid": "replace_datasource_uid"
678 - },
679 - "metrics": [
680 - {
681 - "$$hashKey": "object:329",
682 - "field": "select field",
683 - "id": "1",
684 - "type": "count"
685 - }
686 - ],
687 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
688 - "refId": "A",
689 - "timeField": "timestamp"
690 - }
691 - ],
692 - "title": "EVENTS (Total)",
693 - "type": "stat"
694 - },
695 - {
696 - "datasource": {
697 - "type": "elasticsearch",
698 - "uid": "replace_datasource_uid"
699 - },
700 - "fieldConfig": {
701 - "defaults": {
702 - "color": {
703 - "mode": "thresholds"
704 - },
705 - "custom": {
706 - "align": "auto",
707 - "displayMode": "auto",
708 - "inspect": false
709 - },
710 - "mappings": [],
711 - "thresholds": {
712 - "mode": "absolute",
713 - "steps": [
714 - {
715 - "color": "orange",
716 - "value": null
717 - }
718 - ]
719 - }
720 - },
721 - "overrides": [
722 - {
723 - "matcher": {
724 - "id": "byName",
725 - "options": "Count"
726 - },
727 - "properties": [
728 - {
729 - "id": "displayName",
730 - "value": "EVENTS"
731 - },
732 - {
733 - "id": "unit",
734 - "value": "short"
735 - },
736 - {
737 - "id": "decimals",
738 - "value": -1
739 - },
740 - {
741 - "id": "custom.align"
742 - },
743 - {
744 - "id": "custom.displayMode",
745 - "value": "color-text"
746 - }
747 - ]
748 - },
749 - {
750 - "matcher": {
751 - "id": "byName",
752 - "options": "AD ACCOUNT"
753 - },
754 - "properties": [
755 - {
756 - "id": "custom.width",
757 - "value": 377
758 - },
759 - {
760 - "id": "custom.displayMode",
761 - "value": "color-text"
762 - }
763 - ]
764 - },
765 - {
766 - "matcher": {
767 - "id": "byName",
768 - "options": "data_office365_LogonError"
769 - },
770 - "properties": [
771 - {
772 - "id": "custom.width",
773 - "value": 326
774 - },
775 - {
776 - "id": "custom.displayMode",
777 - "value": "color-text"
778 - }
779 - ]
780 - }
781 - ]
782 - },
783 - "gridPos": {
784 - "h": 12,
785 - "w": 10,
786 - "x": 0,
787 - "y": 20
788 - },
789 - "id": 58,
790 - "options": {
791 - "footer": {
792 - "fields": "",
793 - "reducer": [
794 - "sum"
795 - ],
796 - "show": false
797 - },
798 - "showHeader": true,
799 - "sortBy": []
800 - },
801 - "pluginVersion": "9.2.0",
802 - "targets": [
803 - {
804 - "bucketAggs": [
805 - {
806 - "fake": true,
807 - "field": "data_office365_UserId",
808 - "id": "4",
809 - "settings": {
810 - "min_doc_count": 1,
811 - "order": "desc",
812 - "orderBy": "_count",
813 - "size": "0"
814 - },
815 - "type": "terms"
816 - }
817 - ],
818 - "datasource": {
819 - "type": "elasticsearch",
820 - "uid": "replace_datasource_uid"
821 - },
822 - "metrics": [
823 - {
824 - "field": "select field",
825 - "id": "1",
826 - "type": "count"
827 - }
828 - ],
829 - "query": "(data_office365_Operation:DLPRuleMatch OR data_office365_Operation:DlpRuleMatch) AND data_office365_Workload:$workload",
830 - "refId": "A",
831 - "timeField": "timestamp"
832 - }
833 - ],
834 - "title": "DLP DETECTIONS BY USER ACCOUNT",
835 - "transformations": [
836 - {
837 - "id": "merge",
838 - "options": {
839 - "reducers": []
840 - }
841 - },
842 - {
843 - "id": "organize",
844 - "options": {
845 - "excludeByName": {},
846 - "indexByName": {},
847 - "renameByName": {
848 - "Count": "EVENTS",
849 - "data_office365_LogonError": "ERROR",
850 - "data_office365_Operation": "WORKLOAD",
851 - "data_office365_UserId": "AD ACCOUNT"
852 - }
853 - }
854 - }
855 - ],
856 - "type": "table"
857 - },
858 - {
859 - "datasource": {
860 - "type": "elasticsearch",
861 - "uid": "replace_datasource_uid"
862 - },
863 - "fieldConfig": {
864 - "defaults": {
865 - "color": {
866 - "mode": "thresholds"
867 - },
868 - "mappings": [],
869 - "thresholds": {
870 - "mode": "absolute",
871 - "steps": [
872 - {
873 - "color": "green",
874 - "value": null
875 - },
876 - {
877 - "color": "red",
878 - "value": 80
879 - }
880 - ]
881 - }
882 - },
883 - "overrides": []
884 - },
885 - "gridPos": {
886 - "h": 12,
887 - "w": 14,
888 - "x": 10,
889 - "y": 20
890 - },
891 - "id": 57,
892 - "options": {
893 - "displayMode": "gradient",
894 - "minVizHeight": 10,
895 - "minVizWidth": 0,
896 - "orientation": "horizontal",
897 - "reduceOptions": {
898 - "calcs": [
899 - "sum"
900 - ],
901 - "fields": "",
902 - "values": false
903 - },
904 - "showUnfilled": true
905 - },
906 - "pluginVersion": "9.2.0",
907 - "targets": [
908 - {
909 - "alias": "",
910 - "bucketAggs": [
911 - {
912 - "field": "data_office365_SharePointMetaData_FileName",
913 - "id": "2",
914 - "settings": {
915 - "min_doc_count": "1",
916 - "order": "desc",
917 - "orderBy": "_count",
918 - "size": "15"
919 - },
920 - "type": "terms"
921 - },
922 - {
923 - "field": "timestamp",
924 - "id": "3",
925 - "settings": {
926 - "interval": "auto",
927 - "min_doc_count": "1",
928 - "timeZone": "utc",
929 - "trimEdges": "0"
930 - },
931 - "type": "date_histogram"
932 - }
933 - ],
934 - "datasource": {
935 - "type": "elasticsearch",
936 - "uid": "replace_datasource_uid"
937 - },
938 - "metrics": [
939 - {
940 - "id": "1",
941 - "type": "count"
942 - }
943 - ],
944 - "query": "data_office365_Workload:$workload",
945 - "refId": "A",
946 - "timeField": "timestamp"
947 - }
948 - ],
949 - "title": "DLP - FILENAMES (Sharepoint/OneDrive)",
950 - "type": "bargauge"
951 - },
952 - {
953 - "datasource": {
954 - "type": "elasticsearch",
955 - "uid": "replace_datasource_uid"
956 - },
957 - "fieldConfig": {
958 - "defaults": {
959 - "color": {
960 - "mode": "thresholds"
961 - },
962 - "mappings": [],
963 - "thresholds": {
964 - "mode": "absolute",
965 - "steps": [
966 - {
967 - "color": "green",
968 - "value": null
969 - },
970 - {
971 - "color": "red",
972 - "value": 80
973 - }
974 - ]
975 - }
976 - },
977 - "overrides": []
978 - },
979 - "gridPos": {
980 - "h": 12,
981 - "w": 14,
982 - "x": 0,
983 - "y": 32
984 - },
985 - "id": 59,
986 - "options": {
987 - "displayMode": "gradient",
988 - "minVizHeight": 10,
989 - "minVizWidth": 0,
990 - "orientation": "horizontal",
991 - "reduceOptions": {
992 - "calcs": [
993 - "sum"
994 - ],
995 - "fields": "",
996 - "values": false
997 - },
998 - "showUnfilled": true
999 - },
1000 - "pluginVersion": "9.2.0",
1001 - "targets": [
1002 - {
1003 - "alias": "",
1004 - "bucketAggs": [
1005 - {
1006 - "field": "data_office365_ExchangeMetaData_Subject",
1007 - "id": "2",
1008 - "settings": {
1009 - "min_doc_count": "1",
1010 - "order": "desc",
1011 - "orderBy": "_count",
1012 - "size": "15"
1013 - },
1014 - "type": "terms"
1015 - },
1016 - {
1017 - "field": "timestamp",
1018 - "id": "3",
1019 - "settings": {
1020 - "interval": "auto",
1021 - "min_doc_count": "1",
1022 - "timeZone": "utc",
1023 - "trimEdges": "0"
1024 - },
1025 - "type": "date_histogram"
1026 - }
1027 - ],
1028 - "datasource": {
1029 - "type": "elasticsearch",
1030 - "uid": "replace_datasource_uid"
1031 - },
1032 - "metrics": [
1033 - {
1034 - "id": "1",
1035 - "type": "count"
1036 - }
1037 - ],
1038 - "query": "data_office365_Workload:$workload",
1039 - "refId": "A",
1040 - "timeField": "timestamp"
1041 - }
1042 - ],
1043 - "title": "DLP - MAIL SUBJECTS (Exchange)",
1044 - "type": "bargauge"
1045 - },
1046 - {
1047 - "datasource": {
1048 - "type": "elasticsearch",
1049 - "uid": "replace_datasource_uid"
1050 - },
1051 - "fieldConfig": {
1052 - "defaults": {
1053 - "color": {
1054 - "mode": "thresholds"
1055 - },
1056 - "custom": {
1057 - "align": "auto",
1058 - "displayMode": "auto",
1059 - "filterable": true,
1060 - "inspect": false
1061 - },
1062 - "mappings": [],
1063 - "thresholds": {
1064 - "mode": "absolute",
1065 - "steps": [
1066 - {
1067 - "color": "green"
1068 - },
1069 - {
1070 - "color": "red",
1071 - "value": 80
1072 - }
1073 - ]
1074 - }
1075 - },
1076 - "overrides": [
1077 - {
1078 - "matcher": {
1079 - "id": "byName",
1080 - "options": "rule_level"
1081 - },
1082 - "properties": [
1083 - {
1084 - "id": "displayName",
1085 - "value": "RULE LEVEL"
1086 - },
1087 - {
1088 - "id": "unit",
1089 - "value": "short"
1090 - },
1091 - {
1092 - "id": "decimals",
1093 - "value": -1
1094 - },
1095 - {
1096 - "id": "custom.displayMode",
1097 - "value": "color-background"
1098 - },
1099 - {
1100 - "id": "custom.align"
1101 - },
1102 - {
1103 - "id": "thresholds",
1104 - "value": {
1105 - "mode": "absolute",
1106 - "steps": [
1107 - {
1108 - "color": "#37872D"
1109 - },
1110 - {
1111 - "color": "rgba(237, 129, 40, 0.89)",
1112 - "value": 7
1113 - },
1114 - {
1115 - "color": "rgba(245, 54, 54, 0.9)",
1116 - "value": 12
1117 - }
1118 - ]
1119 - }
1120 - }
1121 - ]
1122 - },
1123 - {
1124 - "matcher": {
1125 - "id": "byName",
1126 - "options": "Date/Time"
1127 - },
1128 - "properties": [
1129 - {
1130 - "id": "custom.width",
1131 - "value": 242
1132 - }
1133 - ]
1134 - },
1135 - {
1136 - "matcher": {
1137 - "id": "byName",
1138 - "options": "MITRE TACTIC"
1139 - },
1140 - "properties": [
1141 - {
1142 - "id": "custom.width",
1143 - "value": 332
1144 - }
1145 - ]
1146 - },
1147 - {
1148 - "matcher": {
1149 - "id": "byName",
1150 - "options": "MITRE TECHNIQUE"
1151 - },
1152 - "properties": [
1153 - {
1154 - "id": "custom.width",
1155 - "value": 312
1156 - }
1157 - ]
1158 - },
1159 - {
1160 - "matcher": {
1161 - "id": "byName",
1162 - "options": "EVENT ID"
1163 - },
1164 - "properties": [
1165 - {
1166 - "id": "links",
1167 - "value": [
1168 - {
1169 - "targetBlank": true,
1170 - "title": "VIEW EVENT DETAILS",
1171 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1172 - }
1173 - ]
1174 - },
1175 - {
1176 - "id": "custom.width",
1177 - "value": 319
1178 - }
1179 - ]
1180 - },
1181 - {
1182 - "matcher": {
1183 - "id": "byName",
1184 - "options": "ACCOUNT"
1185 - },
1186 - "properties": [
1187 - {
1188 - "id": "custom.width",
1189 - "value": 343
1190 - }
1191 - ]
1192 - },
1193 - {
1194 - "matcher": {
1195 - "id": "byName",
1196 - "options": "EVENT TIME"
1197 - },
1198 - "properties": [
1199 - {
1200 - "id": "custom.width",
1201 - "value": 195
1202 - }
1203 - ]
1204 - },
1205 - {
1206 - "matcher": {
1207 - "id": "byName",
1208 - "options": "FILE SIZE"
1209 - },
1210 - "properties": [
1211 - {
1212 - "id": "unit",
1213 - "value": "bytes"
1214 - }
1215 - ]
1216 - },
1217 - {
1218 - "matcher": {
1219 - "id": "byName",
1220 - "options": "SENSITIVE INFO"
1221 - },
1222 - "properties": [
1223 - {
1224 - "id": "custom.width",
1225 - "value": 154
1226 - }
1227 - ]
1228 - },
1229 - {
1230 - "matcher": {
1231 - "id": "byName",
1232 - "options": "RULE LEVEL"
1233 - },
1234 - "properties": [
1235 - {
1236 - "id": "custom.width",
1237 - "value": 157
1238 - }
1239 - ]
1240 - }
1241 - ]
1242 - },
1243 - "gridPos": {
1244 - "h": 16,
1245 - "w": 24,
1246 - "x": 0,
1247 - "y": 44
1248 - },
1249 - "id": 27,
1250 - "options": {
1251 - "footer": {
1252 - "fields": "",
1253 - "reducer": [
1254 - "sum"
1255 - ],
1256 - "show": false
1257 - },
1258 - "showHeader": true,
1259 - "sortBy": []
1260 - },
1261 - "pluginVersion": "9.0.0",
1262 - "targets": [
1263 - {
1264 - "bucketAggs": [],
1265 - "datasource": {
1266 - "type": "elasticsearch",
1267 - "uid": "replace_datasource_uid"
1268 - },
1269 - "metrics": [
1270 - {
1271 - "id": "1",
1272 - "settings": {
1273 - "size": "250"
1274 - },
1275 - "type": "raw_data"
1276 - }
1277 - ],
1278 - "query": "(data_office365_Workload:$workload AND rule_level:$rule_level) AND data_office365_Workload:$workload",
1279 - "refId": "A",
1280 - "timeField": "timestamp"
1281 - }
1282 - ],
1283 - "title": "EVENTS",
1284 - "transformations": [
1285 - {
1286 - "id": "merge",
1287 - "options": {
1288 - "reducers": []
1289 - }
1290 - },
1291 - {
1292 - "id": "organize",
1293 - "options": {
1294 - "excludeByName": {
1295 - "@metadata_beat": true,
1296 - "@metadata_type": true,
1297 - "@metadata_version": true,
1298 - "IMPHASH": true,
1299 - "MD5": true,
1300 - "SHA1": true,
1301 - "SHA256": true,
1302 - "_id": false,
1303 - "_index": true,
1304 - "_type": true,
1305 - "agent_ephemeral_id": true,
1306 - "agent_hostname": true,
1307 - "agent_id": true,
1308 - "agent_ip_city_name": true,
1309 - "agent_ip_country_code": true,
1310 - "agent_ip_geolocation": true,
1311 - "agent_name": true,
1312 - "agent_type": true,
1313 - "agent_version": true,
1314 - "beats_type": true,
1315 - "cluster_name": true,
1316 - "cluster_node": true,
1317 - "collector_node_id": true,
1318 - "data_alert_action": true,
1319 - "data_alert_category": true,
1320 - "data_alert_gid": true,
1321 - "data_alert_rev": true,
1322 - "data_alert_severity": true,
1323 - "data_alert_signature": true,
1324 - "data_alert_signature_id": true,
1325 - "data_app_proto": true,
1326 - "data_audit_auid": true,
1327 - "data_audit_command": true,
1328 - "data_audit_euid": true,
1329 - "data_audit_exe": true,
1330 - "data_audit_gid": true,
1331 - "data_audit_id": true,
1332 - "data_audit_pid": true,
1333 - "data_audit_res": true,
1334 - "data_audit_session": true,
1335 - "data_audit_type": true,
1336 - "data_audit_uid": true,
1337 - "data_dest_ip": true,
1338 - "data_dest_port": true,
1339 - "data_dstuser": true,
1340 - "data_event_type": true,
1341 - "data_extra_data": true,
1342 - "data_file": true,
1343 - "data_flow_bytes_toclient": true,
1344 - "data_flow_bytes_toserver": true,
1345 - "data_flow_id": true,
1346 - "data_flow_pkts_toclient": true,
1347 - "data_flow_pkts_toserver": true,
1348 - "data_flow_start": true,
1349 - "data_http_http_content_type": true,
1350 - "data_http_http_port": true,
1351 - "data_http_length": true,
1352 - "data_http_status": true,
1353 - "data_http_url": true,
1354 - "data_id": true,
1355 - "data_in_iface": true,
1356 - "data_metadata_flowbits": true,
1357 - "data_metadata_flowints_http_anomaly_count": true,
1358 - "data_metadata_flowints_tcp_retransmission_count": true,
1359 - "data_office365_Actor": true,
1360 - "data_office365_ActorContextId": true,
1361 - "data_office365_ActorIpAddress": false,
1362 - "data_office365_ActorIpAddress_city_name": true,
1363 - "data_office365_ActorIpAddress_country_code": true,
1364 - "data_office365_ActorIpAddress_geolocation": true,
1365 - "data_office365_ApplicationId": true,
1366 - "data_office365_AzureActiveDirectoryEventType": true,
1367 - "data_office365_ClientIP": true,
1368 - "data_office365_ClientIP_city_name": true,
1369 - "data_office365_ClientIP_country_code": true,
1370 - "data_office365_ClientIP_geolocation": true,
1371 - "data_office365_CreationTime": false,
1372 - "data_office365_DeviceProperties": true,
1373 - "data_office365_ErrorNumber": true,
1374 - "data_office365_ExceptionInfo_Reason": true,
1375 - "data_office365_ExchangeMetaData_BCC": true,
1376 - "data_office365_ExchangeMetaData_CC": true,
1377 - "data_office365_ExchangeMetaData_FileSize": true,
1378 - "data_office365_ExchangeMetaData_From": true,
1379 - "data_office365_ExchangeMetaData_MessageID": true,
1380 - "data_office365_ExchangeMetaData_RecipientCount": true,
1381 - "data_office365_ExchangeMetaData_Sent": true,
1382 - "data_office365_ExchangeMetaData_Subject": true,
1383 - "data_office365_ExchangeMetaData_To": true,
1384 - "data_office365_ExchangeMetaData_UniqueID": true,
1385 - "data_office365_ExtendedProperties": true,
1386 - "data_office365_Id": true,
1387 - "data_office365_IncidentId": true,
1388 - "data_office365_InterSystemsId": true,
1389 - "data_office365_IntraSystemId": true,
1390 - "data_office365_LogonError": true,
1391 - "data_office365_ModifiedProperties": true,
1392 - "data_office365_ObjectId": true,
1393 - "data_office365_Operation": true,
1394 - "data_office365_OrganizationId": true,
1395 - "data_office365_PolicyDetails": true,
1396 - "data_office365_RecordType": true,
1397 - "data_office365_ResultStatus": false,
1398 - "data_office365_SensitiveInfoDetectionIsIncluded": true,
1399 - "data_office365_SharePointMetaData_FileID": true,
1400 - "data_office365_SharePointMetaData_FileName": false,
1401 - "data_office365_SharePointMetaData_FileOwner": true,
1402 - "data_office365_SharePointMetaData_FilePathUrl": true,
1403 - "data_office365_SharePointMetaData_FileSize": true,
1404 - "data_office365_SharePointMetaData_From": true,
1405 - "data_office365_SharePointMetaData_IsViewableByExternalUsers": true,
1406 - "data_office365_SharePointMetaData_IsVisibleOnlyToOdbOwner": true,
1407 - "data_office365_SharePointMetaData_ItemCreationTime": true,
1408 - "data_office365_SharePointMetaData_ItemLastModifiedTime": true,
1409 - "data_office365_SharePointMetaData_ItemLastSharedTime": true,
1410 - "data_office365_SharePointMetaData_SiteCollectionGuid": true,
1411 - "data_office365_SharePointMetaData_SiteCollectionUrl": true,
1412 - "data_office365_SharePointMetaData_UniqueID": true,
1413 - "data_office365_Target": true,
1414 - "data_office365_TargetContextId": true,
1415 - "data_office365_UserId": false,
1416 - "data_office365_UserKey": true,
1417 - "data_office365_UserType": true,
1418 - "data_office365_Version": true,
1419 - "data_office365_Workload": true,
1420 - "data_osquery_action": true,
1421 - "data_osquery_calendarTime": true,
1422 - "data_osquery_columns_address": true,
1423 - "data_osquery_columns_address_city_name": true,
1424 - "data_osquery_columns_address_country_code": true,
1425 - "data_osquery_columns_address_geolocation": true,
1426 - "data_osquery_columns_cmdline": true,
1427 - "data_osquery_columns_cwd": true,
1428 - "data_osquery_columns_description": true,
1429 - "data_osquery_columns_directory": true,
1430 - "data_osquery_columns_disk_bytes_read": true,
1431 - "data_osquery_columns_disk_bytes_written": true,
1432 - "data_osquery_columns_egid": true,
1433 - "data_osquery_columns_euid": true,
1434 - "data_osquery_columns_family": true,
1435 - "data_osquery_columns_fd": true,
1436 - "data_osquery_columns_gid": true,
1437 - "data_osquery_columns_gid_signed": true,
1438 - "data_osquery_columns_host": true,
1439 - "data_osquery_columns_interface": true,
1440 - "data_osquery_columns_local_address": true,
1441 - "data_osquery_columns_local_address_city_name": true,
1442 - "data_osquery_columns_local_address_country_code": true,
1443 - "data_osquery_columns_local_address_geolocation": true,
1444 - "data_osquery_columns_local_port": true,
1445 - "data_osquery_columns_mac": true,
1446 - "data_osquery_columns_name": true,
1447 - "data_osquery_columns_net_namespace": true,
1448 - "data_osquery_columns_nice": true,
1449 - "data_osquery_columns_on_disk": true,
1450 - "data_osquery_columns_parent": true,
1451 - "data_osquery_columns_path": true,
1452 - "data_osquery_columns_pgroup": true,
1453 - "data_osquery_columns_pid": true,
1454 - "data_osquery_columns_port": true,
1455 - "data_osquery_columns_protocol": true,
1456 - "data_osquery_columns_remote_address": true,
1457 - "data_osquery_columns_remote_address_city_name": true,
1458 - "data_osquery_columns_remote_address_country_code": true,
1459 - "data_osquery_columns_remote_address_geolocation": true,
1460 - "data_osquery_columns_remote_port": true,
1461 - "data_osquery_columns_resident_size": true,
1462 - "data_osquery_columns_root": true,
1463 - "data_osquery_columns_sgid": true,
1464 - "data_osquery_columns_shell": true,
1465 - "data_osquery_columns_socket": true,
1466 - "data_osquery_columns_start_time": true,
1467 - "data_osquery_columns_state": true,
1468 - "data_osquery_columns_suid": true,
1469 - "data_osquery_columns_system_time": true,
1470 - "data_osquery_columns_threads": true,
1471 - "data_osquery_columns_time_utc": true,
1472 - "data_osquery_columns_total_size": true,
1473 - "data_osquery_columns_tty": true,
1474 - "data_osquery_columns_type": true,
1475 - "data_osquery_columns_uid": true,
1476 - "data_osquery_columns_uid_signed": true,
1477 - "data_osquery_columns_user": true,
1478 - "data_osquery_columns_user_time": true,
1479 - "data_osquery_columns_username": true,
1480 - "data_osquery_columns_wired_size": true,
1481 - "data_osquery_counter": true,
1482 - "data_osquery_decorations_host_uuid": true,
1483 - "data_osquery_decorations_hostname": true,
1484 - "data_osquery_epoch": true,
1485 - "data_osquery_hostIdentifier": true,
1486 - "data_osquery_name": true,
1487 - "data_osquery_numerics": true,
1488 - "data_osquery_unixTime": true,
1489 - "data_proto": true,
1490 - "data_sca_check_command": true,
1491 - "data_sca_check_compliance_cis": true,
1492 - "data_sca_check_compliance_cis_csc": true,
1493 - "data_sca_check_compliance_gdpr_IV": true,
1494 - "data_sca_check_compliance_gpg_13": true,
1495 - "data_sca_check_compliance_hipaa": true,
1496 - "data_sca_check_compliance_nist_800_53": true,
1497 - "data_sca_check_compliance_pci_dss": true,
1498 - "data_sca_check_compliance_tsc": true,
1499 - "data_sca_check_description": true,
1500 - "data_sca_check_id": true,
1501 - "data_sca_check_previous_result": true,
1502 - "data_sca_check_rationale": true,
1503 - "data_sca_check_remediation": true,
1504 - "data_sca_check_result": true,
1505 - "data_sca_check_title": true,
1506 - "data_sca_description": true,
1507 - "data_sca_failed": true,
1508 - "data_sca_file": true,
1509 - "data_sca_invalid": true,
1510 - "data_sca_passed": true,
1511 - "data_sca_policy": true,
1512 - "data_sca_policy_id": true,
1513 - "data_sca_scan_id": true,
1514 - "data_sca_score": true,
1515 - "data_sca_total_checks": true,
1516 - "data_sca_type": true,
1517 - "data_script": true,
1518 - "data_src_ip": true,
1519 - "data_src_ip_city_name": true,
1520 - "data_src_ip_country_code": true,
1521 - "data_src_ip_geolocation": true,
1522 - "data_src_port": true,
1523 - "data_srcip": true,
1524 - "data_srcip_city_name": true,
1525 - "data_srcip_country_code": true,
1526 - "data_srcip_geolocation": true,
1527 - "data_srcuser": true,
1528 - "data_timestamp": true,
1529 - "data_title": true,
1530 - "data_tls_session_resumed": true,
1531 - "data_tls_version": true,
1532 - "data_tx_id": true,
1533 - "data_type": true,
1534 - "data_win_eventXML_binaryData": true,
1535 - "data_win_eventXML_binaryDataSize": true,
1536 - "data_win_eventXML_param1": true,
1537 - "data_win_eventdata_authenticationPackageName": true,
1538 - "data_win_eventdata_callTrace": true,
1539 - "data_win_eventdata_commandLine": true,
1540 - "data_win_eventdata_company": true,
1541 - "data_win_eventdata_creationUtcTime": true,
1542 - "data_win_eventdata_currentDirectory": true,
1543 - "data_win_eventdata_description": true,
1544 - "data_win_eventdata_destinationHostname": true,
1545 - "data_win_eventdata_destinationIp": true,
1546 - "data_win_eventdata_destinationIp_city_name": true,
1547 - "data_win_eventdata_destinationIp_country_code": true,
1548 - "data_win_eventdata_destinationIp_geolocation": true,
1549 - "data_win_eventdata_destinationIsIpv6": true,
1550 - "data_win_eventdata_destinationPort": true,
1551 - "data_win_eventdata_destinationPortName": true,
1552 - "data_win_eventdata_details": true,
1553 - "data_win_eventdata_elevatedToken": true,
1554 - "data_win_eventdata_eventType": true,
1555 - "data_win_eventdata_fileVersion": true,
1556 - "data_win_eventdata_fileVersion_city_name": true,
1557 - "data_win_eventdata_fileVersion_country_code": true,
1558 - "data_win_eventdata_fileVersion_geolocation": true,
1559 - "data_win_eventdata_grantedAccess": true,
1560 - "data_win_eventdata_hashes": true,
1561 - "data_win_eventdata_image": true,
1562 - "data_win_eventdata_imageLoaded": true,
1563 - "data_win_eventdata_impersonationLevel": true,
1564 - "data_win_eventdata_initiated": true,
1565 - "data_win_eventdata_integrityLevel": true,
1566 - "data_win_eventdata_ipAddress": true,
1567 - "data_win_eventdata_ipPort": true,
1568 - "data_win_eventdata_keyLength": true,
1569 - "data_win_eventdata_logonGuid": true,
1570 - "data_win_eventdata_logonId": true,
1571 - "data_win_eventdata_logonProcessName": true,
1572 - "data_win_eventdata_logonType": true,
1573 - "data_win_eventdata_originalFileName": true,
1574 - "data_win_eventdata_param1": true,
1575 - "data_win_eventdata_param2": true,
1576 - "data_win_eventdata_param3": true,
1577 - "data_win_eventdata_param4": true,
1578 - "data_win_eventdata_parentCommandLine": true,
1579 - "data_win_eventdata_parentImage": true,
1580 - "data_win_eventdata_parentProcessGuid": true,
1581 - "data_win_eventdata_parentProcessId": true,
1582 - "data_win_eventdata_processGuid": true,
1583 - "data_win_eventdata_processId": true,
1584 - "data_win_eventdata_processName": true,
1585 - "data_win_eventdata_product": true,
1586 - "data_win_eventdata_protocol": true,
1587 - "data_win_eventdata_queryName": true,
1588 - "data_win_eventdata_queryResults": true,
1589 - "data_win_eventdata_queryStatus": true,
1590 - "data_win_eventdata_ruleName": true,
1591 - "data_win_eventdata_serviceName": true,
1592 - "data_win_eventdata_serviceSid": true,
1593 - "data_win_eventdata_signature": true,
1594 - "data_win_eventdata_signatureStatus": true,
1595 - "data_win_eventdata_signed": true,
1596 - "data_win_eventdata_sourceHostname": true,
1597 - "data_win_eventdata_sourceImage": true,
1598 - "data_win_eventdata_sourceIp": true,
1599 - "data_win_eventdata_sourceIp_city_name": true,
1600 - "data_win_eventdata_sourceIp_country_code": true,
1601 - "data_win_eventdata_sourceIp_geolocation": true,
1602 - "data_win_eventdata_sourceIsIpv6": true,
1603 - "data_win_eventdata_sourcePort": true,
1604 - "data_win_eventdata_sourceProcessGUID": true,
1605 - "data_win_eventdata_sourceProcessId": true,
1606 - "data_win_eventdata_sourceThreadId": true,
1607 - "data_win_eventdata_status": true,
1608 - "data_win_eventdata_subjectDomainName": true,
1609 - "data_win_eventdata_subjectLogonId": true,
1610 - "data_win_eventdata_subjectUserName": true,
1611 - "data_win_eventdata_subjectUserSid": true,
1612 - "data_win_eventdata_targetDomainName": true,
1613 - "data_win_eventdata_targetFilename": true,
1614 - "data_win_eventdata_targetImage": true,
1615 - "data_win_eventdata_targetLinkedLogonId": true,
1616 - "data_win_eventdata_targetLogonId": true,
1617 - "data_win_eventdata_targetObject": true,
1618 - "data_win_eventdata_targetProcessGUID": true,
1619 - "data_win_eventdata_targetProcessId": true,
1620 - "data_win_eventdata_targetUserName": true,
1621 - "data_win_eventdata_targetUserSid": true,
1622 - "data_win_eventdata_terminalSessionId": true,
1623 - "data_win_eventdata_ticketEncryptionType": true,
1624 - "data_win_eventdata_ticketOptions": true,
1625 - "data_win_eventdata_user": true,
1626 - "data_win_eventdata_utcTime": true,
1627 - "data_win_eventdata_virtualAccount": true,
1628 - "data_win_system_channel": true,
1629 - "data_win_system_computer": true,
1630 - "data_win_system_eventID": true,
1631 - "data_win_system_eventRecordID": true,
1632 - "data_win_system_eventSourceName": true,
1633 - "data_win_system_keywords": true,
1634 - "data_win_system_level": true,
1635 - "data_win_system_message": true,
1636 - "data_win_system_opcode": true,
1637 - "data_win_system_processID": true,
1638 - "data_win_system_providerGuid": true,
1639 - "data_win_system_providerName": true,
1640 - "data_win_system_severityValue": true,
1641 - "data_win_system_systemTime": true,
1642 - "data_win_system_task": true,
1643 - "data_win_system_threadID": true,
1644 - "data_win_system_version": true,
1645 - "decoder_name": true,
1646 - "decoder_parent": true,
1647 - "dns_query": true,
1648 - "dns_query_threat_indicated": true,
1649 - "dst_ip": true,
1650 - "dst_ip_city_name": true,
1651 - "dst_ip_country_code": true,
1652 - "dst_ip_geolocation": true,
1653 - "dst_ip_threat_indicated": true,
1654 - "dst_port": true,
1655 - "ecs_version": true,
1656 - "error": true,
1657 - "event_hash": true,
1658 - "file_path": true,
1659 - "firewall_rule_name": true,
1660 - "full_log": false,
1661 - "gl2_accounted_message_size": true,
1662 - "gl2_message_id": true,
1663 - "gl2_processing_error": true,
1664 - "gl2_remote_ip": true,
1665 - "gl2_remote_port": true,
1666 - "gl2_source_collector": true,
1667 - "gl2_source_input": true,
1668 - "gl2_source_node": true,
1669 - "hash_md5": true,
1670 - "hash_sha1": true,
1671 - "hash_sha256": true,
1672 - "highlight": true,
1673 - "host_architecture": true,
1674 - "host_containerized": true,
1675 - "host_hostname": true,
1676 - "host_id": true,
1677 - "host_ip": true,
1678 - "host_mac": true,
1679 - "host_name": true,
1680 - "host_os_codename": true,
1681 - "host_os_kernel": true,
1682 - "host_os_name": true,
1683 - "host_os_platform": true,
1684 - "host_os_version": true,
1685 - "hostname": true,
1686 - "id": true,
1687 - "input_type": true,
1688 - "level": true,
1689 - "location": true,
1690 - "log_file_path": true,
1691 - "log_offset": true,
1692 - "manager_name": true,
1693 - "message": true,
1694 - "module": true,
1695 - "parent_process_cmd_line": true,
1696 - "parent_process_id": true,
1697 - "parent_process_image": true,
1698 - "pid": true,
1699 - "predecoder_hostname": true,
1700 - "predecoder_program_name": true,
1701 - "predecoder_timestamp": true,
1702 - "previous_log": true,
1703 - "previous_output": true,
1704 - "process_cmd_line": true,
1705 - "process_id": true,
1706 - "process_image": true,
1707 - "process_name": true,
1708 - "protocol": true,
1709 - "rule_cis": true,
1710 - "rule_cis_csc": true,
1711 - "rule_firedtimes": true,
1712 - "rule_gdpr": true,
1713 - "rule_gdpr_IV": true,
1714 - "rule_gpg13": true,
1715 - "rule_gpg_13": true,
1716 - "rule_group1": true,
1717 - "rule_groups": true,
1718 - "rule_hipaa": true,
1719 - "rule_id": true,
1720 - "rule_info": true,
1721 - "rule_mail": true,
1722 - "rule_mitre_id": true,
1723 - "rule_mitre_tactic": false,
1724 - "rule_nist_800_53": true,
1725 - "rule_pci_dss": true,
1726 - "rule_tsc": true,
1727 - "scanid": true,
1728 - "service": true,
1729 - "software_package": true,
1730 - "software_vendor": true,
1731 - "sort": true,
1732 - "source": true,
1733 - "src_ip": true,
1734 - "src_ip_city_name": true,
1735 - "src_ip_country_code": true,
1736 - "src_ip_geolocation": true,
1737 - "src_port": true,
1738 - "streams": true,
1739 - "syscheck_attrs_after": true,
1740 - "syscheck_audit_effective_user_id": true,
1741 - "syscheck_audit_effective_user_name": true,
1742 - "syscheck_audit_group_id": true,
1743 - "syscheck_audit_group_name": true,
1744 - "syscheck_audit_login_user_id": true,
1745 - "syscheck_audit_login_user_name": true,
1746 - "syscheck_audit_process_cwd": true,
1747 - "syscheck_audit_process_id": true,
1748 - "syscheck_audit_process_name": true,
1749 - "syscheck_audit_process_parent_cwd": true,
1750 - "syscheck_audit_process_parent_name": true,
1751 - "syscheck_audit_process_ppid": true,
1752 - "syscheck_audit_user_id": true,
1753 - "syscheck_audit_user_name": true,
1754 - "syscheck_changed_attributes": true,
1755 - "syscheck_event": true,
1756 - "syscheck_gid_after": true,
1757 - "syscheck_gname_after": true,
1758 - "syscheck_hard_links": true,
1759 - "syscheck_inode_after": true,
1760 - "syscheck_inode_before": true,
1761 - "syscheck_md5_after": true,
1762 - "syscheck_md5_before": true,
1763 - "syscheck_mode": true,
1764 - "syscheck_mtime_after": true,
1765 - "syscheck_mtime_before": true,
1766 - "syscheck_path": true,
1767 - "syscheck_perm_after": true,
1768 - "syscheck_perm_before": true,
1769 - "syscheck_sha1_after": true,
1770 - "syscheck_sha1_before": true,
1771 - "syscheck_sha256_after": true,
1772 - "syscheck_sha256_before": true,
1773 - "syscheck_size_after": true,
1774 - "syscheck_size_before": true,
1775 - "syscheck_uid_after": true,
1776 - "syscheck_uname_after": true,
1777 - "syscheck_win_perm_after": true,
1778 - "syscheck_win_perm_after_0_allowed": true,
1779 - "syscheck_win_perm_after_0_name": true,
1780 - "syscheck_win_perm_after_1_allowed": true,
1781 - "syscheck_win_perm_after_1_name": true,
1782 - "syscheck_win_perm_after_2_allowed": true,
1783 - "syscheck_win_perm_after_2_name": true,
1784 - "syscheck_win_perm_after_3_allowed": true,
1785 - "syscheck_win_perm_after_3_name": true,
1786 - "syslog_customer": true,
1787 - "syslog_level": true,
1788 - "syslog_tag": true,
1789 - "syslog_type": true,
1790 - "sysmon_event_description": true,
1791 - "threat_ids": true,
1792 - "threat_indicated": true,
1793 - "threat_names": true,
1794 - "time": true,
1795 - "timestamp": true,
1796 - "true": true,
1797 - "user_name": true,
1798 - "win_registry_key": true,
1799 - "win_system_eventID": true,
1800 - "windows_auth_package": true,
1801 - "windows_domain": true,
1802 - "windows_event_id": true,
1803 - "windows_event_severity": true,
1804 - "windows_logon_type": true
1805 - },
1806 - "indexByName": {
1807 - "_id": 2,
1808 - "_index": 8,
1809 - "_type": 9,
1810 - "agent_id": 10,
1811 - "agent_name": 4,
1812 - "cluster_name": 11,
1813 - "cluster_node": 12,
1814 - "data_office365_CreationTime": 0,
1815 - "data_office365_ExchangeMetaData_CC": 45,
1816 - "data_office365_ExchangeMetaData_FileSize": 47,
1817 - "data_office365_ExchangeMetaData_From": 48,
1818 - "data_office365_ExchangeMetaData_MessageID": 49,
1819 - "data_office365_ExchangeMetaData_RecipientCount": 51,
1820 - "data_office365_ExchangeMetaData_Sent": 52,
1821 - "data_office365_ExchangeMetaData_Subject": 50,
1822 - "data_office365_ExchangeMetaData_To": 53,
1823 - "data_office365_ExchangeMetaData_UniqueID": 54,
1824 - "data_office365_Id": 13,
1825 - "data_office365_IncidentId": 55,
1826 - "data_office365_ObjectId": 14,
1827 - "data_office365_Operation": 20,
1828 - "data_office365_OrganizationId": 15,
1829 - "data_office365_RecordType": 16,
1830 - "data_office365_SensitiveInfoDetectionIsIncluded": 46,
1831 - "data_office365_UserId": 3,
1832 - "data_office365_UserKey": 17,
1833 - "data_office365_UserType": 18,
1834 - "data_office365_Version": 19,
1835 - "data_office365_Workload": 44,
1836 - "decoder_name": 21,
1837 - "gl2_accounted_message_size": 22,
1838 - "gl2_message_id": 23,
1839 - "gl2_processing_error": 24,
1840 - "gl2_remote_ip": 25,
1841 - "gl2_remote_port": 26,
1842 - "gl2_source_input": 27,
1843 - "gl2_source_node": 28,
1844 - "highlight": 29,
1845 - "id": 30,
1846 - "location": 31,
1847 - "manager_name": 32,
1848 - "message": 33,
1849 - "rule_description": 5,
1850 - "rule_firedtimes": 34,
1851 - "rule_group1": 35,
1852 - "rule_groups": 36,
1853 - "rule_id": 7,
1854 - "rule_level": 6,
1855 - "rule_mail": 37,
1856 - "sort": 38,
1857 - "source": 39,
1858 - "streams": 40,
1859 - "syslog_level": 41,
1860 - "syslog_type": 42,
1861 - "timestamp": 1,
1862 - "true": 43
1863 - },
1864 - "renameByName": {
1865 - "_id": "EVENT ID",
1866 - "agent_name": "",
1867 - "data_office365_ActorIpAddress": "SRC IP",
1868 - "data_office365_CreationTime": "EVENT TIME",
1869 - "data_office365_ExchangeMetaData_FileSize": "FILE SIZE",
1870 - "data_office365_ExchangeMetaData_RecipientCount": "RECIPIENTS",
1871 - "data_office365_ExchangeMetaData_Sent": "",
1872 - "data_office365_ExchangeMetaData_Subject": "MAIL SUBJECT",
1873 - "data_office365_ResultStatus": "RESULT",
1874 - "data_office365_SensitiveInfoDetectionIsIncluded": "SENSITIVE INFO",
1875 - "data_office365_SharePointMetaData_FileName": "FILE",
1876 - "data_office365_UserId": "ACCOUNT",
1877 - "rule_description": "DESCRIPTION",
1878 - "rule_id": "RULE ID",
1879 - "rule_level": "",
1880 - "rule_mitre_tactic": "MITRE TACTIC",
1881 - "rule_mitre_technique": "MITRE TECHNIQUE",
1882 - "timestamp": "Date/Time"
1883 - }
1884 - }
1885 - }
1886 - ],
1887 - "transparent": true,
1888 - "type": "table"
1889 - }
1890 - ],
1891 - "refresh": false,
1892 - "schemaVersion": 37,
1893 - "style": "dark",
1894 - "tags": [
1895 - "O365"
1896 - ],
1897 - "templating": {
1898 - "list": [
1899 - {
1900 - "datasource": {
1901 - "type": "elasticsearch",
1902 - "uid": "replace_datasource_uid"
1903 - },
1904 - "filters": [],
1905 - "hide": 0,
1906 - "label": "",
1907 - "name": "Filters",
1908 - "skipUrlSync": false,
1909 - "type": "adhoc"
1910 - },
1911 - {
1912 - "current": {
1913 - "selected": false,
1914 - "text": "All",
1915 - "value": "$__all"
1916 - },
1917 - "datasource": {
1918 - "type": "elasticsearch",
1919 - "uid": "replace_datasource_uid"
1920 - },
1921 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"data_office365_Operation:DLPRuleMatch OR data_office365_Operation:DlpRuleMatch\"}",
1922 - "hide": 0,
1923 - "includeAll": true,
1924 - "label": "Workload",
1925 - "multi": false,
1926 - "name": "workload",
1927 - "options": [],
1928 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"data_office365_Operation:DLPRuleMatch OR data_office365_Operation:DlpRuleMatch\"}",
1929 - "refresh": 2,
1930 - "regex": "",
1931 - "skipUrlSync": false,
1932 - "sort": 1,
1933 - "tagValuesQuery": "",
1934 - "tagsQuery": "",
1935 - "type": "query",
1936 - "useTags": false
1937 - },
1938 - {
1939 - "current": {
1940 - "selected": false,
1941 - "text": "All",
1942 - "value": "$__all"
1943 - },
1944 - "datasource": {
1945 - "type": "elasticsearch",
1946 - "uid": "replace_datasource_uid"
1947 - },
1948 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1949 - "hide": 0,
1950 - "includeAll": true,
1951 - "label": "Rule Level",
1952 - "multi": false,
1953 - "name": "rule_level",
1954 - "options": [],
1955 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1956 - "refresh": 2,
1957 - "regex": "",
1958 - "skipUrlSync": false,
1959 - "sort": 0,
1960 - "type": "query"
1961 - }
1962 - ]
1963 - },
1964 - "time": {
1965 - "from": "now-6h",
1966 - "to": "now"
1967 - },
1968 - "timepicker": {
1969 - "refresh_intervals": [
1970 - "5s",
1971 - "10s",
1972 - "30s",
1973 - "1m",
1974 - "5m",
1975 - "15m",
1976 - "30m",
1977 - "1h",
1978 - "2h",
1979 - "1d"
1980 - ],
1981 - "time_options": [
1982 - "5m",
1983 - "15m",
1984 - "1h",
1985 - "6h",
1986 - "12h",
1987 - "24h",
1988 - "2d",
1989 - "7d",
1990 - "30d"
1991 - ]
1992 - },
1993 - "timezone": "",
1994 - "title": "O365 - DLP DETECTIONS",
1995 - "uid": "fpSr7wq7z",
1996 - "version": 1,
1997 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "9.2.0",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Workload:$workload",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Workload",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY WORKLOAD (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "displayMode": "auto",
255 + "inspect": false
256 + },
257 + "mappings": [],
258 + "thresholds": {
259 + "mode": "absolute",
260 + "steps": [
261 + {
262 + "color": "red",
263 + "value": null
264 + }
265 + ]
266 + }
267 + },
268 + "overrides": [
269 + {
270 + "matcher": {
271 + "id": "byName",
272 + "options": "Count"
273 + },
274 + "properties": [
275 + {
276 + "id": "displayName",
277 + "value": "EVENTS"
278 + },
279 + {
280 + "id": "unit",
281 + "value": "short"
282 + },
283 + {
284 + "id": "decimals",
285 + "value": -1
286 + },
287 + {
288 + "id": "custom.align"
289 + },
290 + {
291 + "id": "thresholds",
292 + "value": {
293 + "mode": "absolute",
294 + "steps": [
295 + {
296 + "color": "red",
297 + "value": null
298 + }
299 + ]
300 + }
301 + }
302 + ]
303 + }
304 + ]
305 + },
306 + "gridPos": {
307 + "h": 7,
308 + "w": 6,
309 + "x": 8,
310 + "y": 0
311 + },
312 + "id": 54,
313 + "options": {
314 + "footer": {
315 + "fields": "",
316 + "reducer": ["sum"],
317 + "show": false
318 + },
319 + "showHeader": true
320 + },
321 + "pluginVersion": "9.2.0",
322 + "targets": [
323 + {
324 + "bucketAggs": [
325 + {
326 + "fake": true,
327 + "field": "data_office365_Workload",
328 + "id": "4",
329 + "settings": {
330 + "min_doc_count": 1,
331 + "order": "desc",
332 + "orderBy": "_count",
333 + "size": "0"
334 + },
335 + "type": "terms"
336 + }
337 + ],
338 + "datasource": {
339 + "type": "elasticsearch",
340 + "uid": "replace_datasource_uid"
341 + },
342 + "metrics": [
343 + {
344 + "field": "select field",
345 + "id": "1",
346 + "type": "count"
347 + }
348 + ],
349 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
350 + "refId": "A",
351 + "timeField": "timestamp"
352 + }
353 + ],
354 + "title": "EVENTS BY WORKLOAD",
355 + "transformations": [
356 + {
357 + "id": "merge",
358 + "options": {
359 + "reducers": []
360 + }
361 + },
362 + {
363 + "id": "organize",
364 + "options": {
365 + "excludeByName": {},
366 + "indexByName": {},
367 + "renameByName": {
368 + "Count": "EVENTS",
369 + "data_office365_Operation": "OPERATION",
370 + "data_office365_Workload": "WORKLOAD"
371 + }
372 + }
373 + }
374 + ],
375 + "type": "table"
376 + },
377 + {
378 + "datasource": {
379 + "type": "elasticsearch",
380 + "uid": "replace_datasource_uid"
381 + },
382 + "fieldConfig": {
383 + "defaults": {
384 + "color": {
385 + "mode": "thresholds"
386 + },
387 + "mappings": [
388 + {
389 + "options": {
390 + "match": "null",
391 + "result": {
392 + "text": "N/A"
393 + }
394 + },
395 + "type": "special"
396 + }
397 + ],
398 + "max": 15,
399 + "min": 0,
400 + "thresholds": {
401 + "mode": "absolute",
402 + "steps": [
403 + {
404 + "color": "#299c46",
405 + "value": null
406 + },
407 + {
408 + "color": "rgba(237, 129, 40, 0.89)",
409 + "value": 8
410 + },
411 + {
412 + "color": "#d44a3a",
413 + "value": 12
414 + }
415 + ]
416 + },
417 + "unit": "none"
418 + },
419 + "overrides": []
420 + },
421 + "gridPos": {
422 + "h": 7,
423 + "w": 4,
424 + "x": 0,
425 + "y": 7
426 + },
427 + "id": 16,
428 + "links": [],
429 + "options": {
430 + "orientation": "horizontal",
431 + "reduceOptions": {
432 + "calcs": ["max"],
433 + "fields": "",
434 + "values": false
435 + },
436 + "showThresholdLabels": false,
437 + "showThresholdMarkers": true,
438 + "text": {}
439 + },
440 + "pluginVersion": "9.2.0",
441 + "targets": [
442 + {
443 + "bucketAggs": [
444 + {
445 + "field": "timestamp",
446 + "id": "2",
447 + "settings": {
448 + "interval": "auto",
449 + "min_doc_count": 0,
450 + "trimEdges": 0
451 + },
452 + "type": "date_histogram"
453 + }
454 + ],
455 + "datasource": {
456 + "type": "elasticsearch",
457 + "uid": "replace_datasource_uid"
458 + },
459 + "metrics": [
460 + {
461 + "field": "rule_level",
462 + "id": "1",
463 + "meta": {},
464 + "settings": {},
465 + "type": "max"
466 + }
467 + ],
468 + "query": "data_office365_Workload:$workload",
469 + "refId": "A",
470 + "timeField": "timestamp"
471 + }
472 + ],
473 + "title": "MAX SEVERITY (0 - 15)",
474 + "type": "gauge"
475 + },
476 + {
477 + "datasource": {
478 + "type": "elasticsearch",
479 + "uid": "replace_datasource_uid"
480 + },
481 + "fieldConfig": {
482 + "defaults": {
483 + "color": {
484 + "mode": "palette-classic"
485 + },
486 + "custom": {
487 + "axisCenteredZero": false,
488 + "axisColorMode": "text",
489 + "axisLabel": "",
490 + "axisPlacement": "auto",
491 + "barAlignment": 0,
492 + "drawStyle": "bars",
493 + "fillOpacity": 0,
494 + "gradientMode": "none",
495 + "hideFrom": {
496 + "legend": false,
497 + "tooltip": false,
498 + "viz": false
499 + },
500 + "lineInterpolation": "linear",
501 + "lineWidth": 1,
502 + "pointSize": 5,
503 + "scaleDistribution": {
504 + "type": "linear"
505 + },
506 + "showPoints": "auto",
507 + "spanNulls": false,
508 + "stacking": {
509 + "group": "A",
510 + "mode": "normal"
511 + },
512 + "thresholdsStyle": {
513 + "mode": "off"
514 + }
515 + },
516 + "mappings": [],
517 + "thresholds": {
518 + "mode": "absolute",
519 + "steps": [
520 + {
521 + "color": "green",
522 + "value": null
523 + },
524 + {
525 + "color": "red",
526 + "value": 80
527 + }
528 + ]
529 + }
530 + },
531 + "overrides": []
532 + },
533 + "gridPos": {
534 + "h": 13,
535 + "w": 20,
536 + "x": 4,
537 + "y": 7
538 + },
539 + "id": 61,
540 + "options": {
541 + "legend": {
542 + "calcs": [],
543 + "displayMode": "table",
544 + "placement": "right",
545 + "showLegend": true
546 + },
547 + "tooltip": {
548 + "mode": "single",
549 + "sort": "none"
550 + }
551 + },
552 + "targets": [
553 + {
554 + "alias": "",
555 + "bucketAggs": [
556 + {
557 + "field": "data_office365_Workload",
558 + "id": "3",
559 + "settings": {
560 + "min_doc_count": "1",
561 + "order": "desc",
562 + "orderBy": "_count",
563 + "size": "10"
564 + },
565 + "type": "terms"
566 + },
567 + {
568 + "field": "timestamp",
569 + "id": "2",
570 + "settings": {
571 + "interval": "auto"
572 + },
573 + "type": "date_histogram"
574 + }
575 + ],
576 + "datasource": {
577 + "type": "elasticsearch",
578 + "uid": "replace_datasource_uid"
579 + },
580 + "metrics": [
581 + {
582 + "id": "1",
583 + "type": "count"
584 + }
585 + ],
586 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
587 + "refId": "A",
588 + "timeField": "timestamp"
589 + }
590 + ],
591 + "title": "TOP 10 WORKLOADS - HISTOGRAM",
592 + "transparent": true,
593 + "type": "timeseries"
594 + },
595 + {
596 + "datasource": {
597 + "type": "elasticsearch",
598 + "uid": "replace_datasource_uid"
599 + },
600 + "fieldConfig": {
601 + "defaults": {
602 + "mappings": [
603 + {
604 + "options": {
605 + "match": "null",
606 + "result": {
607 + "text": "N/A"
608 + }
609 + },
610 + "type": "special"
611 + }
612 + ],
613 + "thresholds": {
614 + "mode": "absolute",
615 + "steps": [
616 + {
617 + "color": "blue",
618 + "value": null
619 + }
620 + ]
621 + },
622 + "unit": "locale"
623 + },
624 + "overrides": []
625 + },
626 + "gridPos": {
627 + "h": 6,
628 + "w": 4,
629 + "x": 0,
630 + "y": 14
631 + },
632 + "id": 51,
633 + "links": [],
634 + "options": {
635 + "colorMode": "value",
636 + "graphMode": "area",
637 + "justifyMode": "auto",
638 + "orientation": "horizontal",
639 + "reduceOptions": {
640 + "calcs": ["sum"],
641 + "fields": "",
642 + "values": false
643 + },
644 + "text": {},
645 + "textMode": "auto"
646 + },
647 + "pluginVersion": "9.2.0",
648 + "targets": [
649 + {
650 + "bucketAggs": [
651 + {
652 + "$$hashKey": "object:331",
653 + "field": "timestamp",
654 + "id": "2",
655 + "settings": {
656 + "interval": "auto",
657 + "min_doc_count": 0,
658 + "trimEdges": 0
659 + },
660 + "type": "date_histogram"
661 + }
662 + ],
663 + "datasource": {
664 + "type": "elasticsearch",
665 + "uid": "replace_datasource_uid"
666 + },
667 + "metrics": [
668 + {
669 + "$$hashKey": "object:329",
670 + "field": "select field",
671 + "id": "1",
672 + "type": "count"
673 + }
674 + ],
675 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
676 + "refId": "A",
677 + "timeField": "timestamp"
678 + }
679 + ],
680 + "title": "EVENTS (Total)",
681 + "type": "stat"
682 + },
683 + {
684 + "datasource": {
685 + "type": "elasticsearch",
686 + "uid": "replace_datasource_uid"
687 + },
688 + "fieldConfig": {
689 + "defaults": {
690 + "color": {
691 + "mode": "thresholds"
692 + },
693 + "custom": {
694 + "align": "auto",
695 + "displayMode": "auto",
696 + "inspect": false
697 + },
698 + "mappings": [],
699 + "thresholds": {
700 + "mode": "absolute",
701 + "steps": [
702 + {
703 + "color": "orange",
704 + "value": null
705 + }
706 + ]
707 + }
708 + },
709 + "overrides": [
710 + {
711 + "matcher": {
712 + "id": "byName",
713 + "options": "Count"
714 + },
715 + "properties": [
716 + {
717 + "id": "displayName",
718 + "value": "EVENTS"
719 + },
720 + {
721 + "id": "unit",
722 + "value": "short"
723 + },
724 + {
725 + "id": "decimals",
726 + "value": -1
727 + },
728 + {
729 + "id": "custom.align"
730 + },
731 + {
732 + "id": "custom.displayMode",
733 + "value": "color-text"
734 + }
735 + ]
736 + },
737 + {
738 + "matcher": {
739 + "id": "byName",
740 + "options": "AD ACCOUNT"
741 + },
742 + "properties": [
743 + {
744 + "id": "custom.width",
745 + "value": 377
746 + },
747 + {
748 + "id": "custom.displayMode",
749 + "value": "color-text"
750 + }
751 + ]
752 + },
753 + {
754 + "matcher": {
755 + "id": "byName",
756 + "options": "data_office365_LogonError"
757 + },
758 + "properties": [
759 + {
760 + "id": "custom.width",
761 + "value": 326
762 + },
763 + {
764 + "id": "custom.displayMode",
765 + "value": "color-text"
766 + }
767 + ]
768 + }
769 + ]
770 + },
771 + "gridPos": {
772 + "h": 12,
773 + "w": 10,
774 + "x": 0,
775 + "y": 20
776 + },
777 + "id": 58,
778 + "options": {
779 + "footer": {
780 + "fields": "",
781 + "reducer": ["sum"],
782 + "show": false
783 + },
784 + "showHeader": true,
785 + "sortBy": []
786 + },
787 + "pluginVersion": "9.2.0",
788 + "targets": [
789 + {
790 + "bucketAggs": [
791 + {
792 + "fake": true,
793 + "field": "data_office365_UserId",
794 + "id": "4",
795 + "settings": {
796 + "min_doc_count": 1,
797 + "order": "desc",
798 + "orderBy": "_count",
799 + "size": "0"
800 + },
801 + "type": "terms"
802 + }
803 + ],
804 + "datasource": {
805 + "type": "elasticsearch",
806 + "uid": "replace_datasource_uid"
807 + },
808 + "metrics": [
809 + {
810 + "field": "select field",
811 + "id": "1",
812 + "type": "count"
813 + }
814 + ],
815 + "query": "(data_office365_Operation:DLPRuleMatch OR data_office365_Operation:DlpRuleMatch) AND data_office365_Workload:$workload",
816 + "refId": "A",
817 + "timeField": "timestamp"
818 + }
819 + ],
820 + "title": "DLP DETECTIONS BY USER ACCOUNT",
821 + "transformations": [
822 + {
823 + "id": "merge",
824 + "options": {
825 + "reducers": []
826 + }
827 + },
828 + {
829 + "id": "organize",
830 + "options": {
831 + "excludeByName": {},
832 + "indexByName": {},
833 + "renameByName": {
834 + "Count": "EVENTS",
835 + "data_office365_LogonError": "ERROR",
836 + "data_office365_Operation": "WORKLOAD",
837 + "data_office365_UserId": "AD ACCOUNT"
838 + }
839 + }
840 + }
841 + ],
842 + "type": "table"
843 + },
844 + {
845 + "datasource": {
846 + "type": "elasticsearch",
847 + "uid": "replace_datasource_uid"
848 + },
849 + "fieldConfig": {
850 + "defaults": {
851 + "color": {
852 + "mode": "thresholds"
853 + },
854 + "mappings": [],
855 + "thresholds": {
856 + "mode": "absolute",
857 + "steps": [
858 + {
859 + "color": "green",
860 + "value": null
861 + },
862 + {
863 + "color": "red",
864 + "value": 80
865 + }
866 + ]
867 + }
868 + },
869 + "overrides": []
870 + },
871 + "gridPos": {
872 + "h": 12,
873 + "w": 14,
874 + "x": 10,
875 + "y": 20
876 + },
877 + "id": 57,
878 + "options": {
879 + "displayMode": "gradient",
880 + "minVizHeight": 10,
881 + "minVizWidth": 0,
882 + "orientation": "horizontal",
883 + "reduceOptions": {
884 + "calcs": ["sum"],
885 + "fields": "",
886 + "values": false
887 + },
888 + "showUnfilled": true
889 + },
890 + "pluginVersion": "9.2.0",
891 + "targets": [
892 + {
893 + "alias": "",
894 + "bucketAggs": [
895 + {
896 + "field": "data_office365_SharePointMetaData_FileName",
897 + "id": "2",
898 + "settings": {
899 + "min_doc_count": "1",
900 + "order": "desc",
901 + "orderBy": "_count",
902 + "size": "15"
903 + },
904 + "type": "terms"
905 + },
906 + {
907 + "field": "timestamp",
908 + "id": "3",
909 + "settings": {
910 + "interval": "auto",
911 + "min_doc_count": "1",
912 + "timeZone": "utc",
913 + "trimEdges": "0"
914 + },
915 + "type": "date_histogram"
916 + }
917 + ],
918 + "datasource": {
919 + "type": "elasticsearch",
920 + "uid": "replace_datasource_uid"
921 + },
922 + "metrics": [
923 + {
924 + "id": "1",
925 + "type": "count"
926 + }
927 + ],
928 + "query": "data_office365_Workload:$workload",
929 + "refId": "A",
930 + "timeField": "timestamp"
931 + }
932 + ],
933 + "title": "DLP - FILENAMES (Sharepoint/OneDrive)",
934 + "type": "bargauge"
935 + },
936 + {
937 + "datasource": {
938 + "type": "elasticsearch",
939 + "uid": "replace_datasource_uid"
940 + },
941 + "fieldConfig": {
942 + "defaults": {
943 + "color": {
944 + "mode": "thresholds"
945 + },
946 + "mappings": [],
947 + "thresholds": {
948 + "mode": "absolute",
949 + "steps": [
950 + {
951 + "color": "green",
952 + "value": null
953 + },
954 + {
955 + "color": "red",
956 + "value": 80
957 + }
958 + ]
959 + }
960 + },
961 + "overrides": []
962 + },
963 + "gridPos": {
964 + "h": 12,
965 + "w": 14,
966 + "x": 0,
967 + "y": 32
968 + },
969 + "id": 59,
970 + "options": {
971 + "displayMode": "gradient",
972 + "minVizHeight": 10,
973 + "minVizWidth": 0,
974 + "orientation": "horizontal",
975 + "reduceOptions": {
976 + "calcs": ["sum"],
977 + "fields": "",
978 + "values": false
979 + },
980 + "showUnfilled": true
981 + },
982 + "pluginVersion": "9.2.0",
983 + "targets": [
984 + {
985 + "alias": "",
986 + "bucketAggs": [
987 + {
988 + "field": "data_office365_ExchangeMetaData_Subject",
989 + "id": "2",
990 + "settings": {
991 + "min_doc_count": "1",
992 + "order": "desc",
993 + "orderBy": "_count",
994 + "size": "15"
995 + },
996 + "type": "terms"
997 + },
998 + {
999 + "field": "timestamp",
1000 + "id": "3",
1001 + "settings": {
1002 + "interval": "auto",
1003 + "min_doc_count": "1",
1004 + "timeZone": "utc",
1005 + "trimEdges": "0"
1006 + },
1007 + "type": "date_histogram"
1008 + }
1009 + ],
1010 + "datasource": {
1011 + "type": "elasticsearch",
1012 + "uid": "replace_datasource_uid"
1013 + },
1014 + "metrics": [
1015 + {
1016 + "id": "1",
1017 + "type": "count"
1018 + }
1019 + ],
1020 + "query": "data_office365_Workload:$workload",
1021 + "refId": "A",
1022 + "timeField": "timestamp"
1023 + }
1024 + ],
1025 + "title": "DLP - MAIL SUBJECTS (Exchange)",
1026 + "type": "bargauge"
1027 + },
1028 + {
1029 + "datasource": {
1030 + "type": "elasticsearch",
1031 + "uid": "replace_datasource_uid"
1032 + },
1033 + "fieldConfig": {
1034 + "defaults": {
1035 + "color": {
1036 + "mode": "thresholds"
1037 + },
1038 + "custom": {
1039 + "align": "auto",
1040 + "displayMode": "auto",
1041 + "filterable": true,
1042 + "inspect": false
1043 + },
1044 + "mappings": [],
1045 + "thresholds": {
1046 + "mode": "absolute",
1047 + "steps": [
1048 + {
1049 + "color": "green"
1050 + },
1051 + {
1052 + "color": "red",
1053 + "value": 80
1054 + }
1055 + ]
1056 + }
1057 + },
1058 + "overrides": [
1059 + {
1060 + "matcher": {
1061 + "id": "byName",
1062 + "options": "rule_level"
1063 + },
1064 + "properties": [
1065 + {
1066 + "id": "displayName",
1067 + "value": "RULE LEVEL"
1068 + },
1069 + {
1070 + "id": "unit",
1071 + "value": "short"
1072 + },
1073 + {
1074 + "id": "decimals",
1075 + "value": -1
1076 + },
1077 + {
1078 + "id": "custom.displayMode",
1079 + "value": "color-background"
1080 + },
1081 + {
1082 + "id": "custom.align"
1083 + },
1084 + {
1085 + "id": "thresholds",
1086 + "value": {
1087 + "mode": "absolute",
1088 + "steps": [
1089 + {
1090 + "color": "#37872D"
1091 + },
1092 + {
1093 + "color": "rgba(237, 129, 40, 0.89)",
1094 + "value": 7
1095 + },
1096 + {
1097 + "color": "rgba(245, 54, 54, 0.9)",
1098 + "value": 12
1099 + }
1100 + ]
1101 + }
1102 + }
1103 + ]
1104 + },
1105 + {
1106 + "matcher": {
1107 + "id": "byName",
1108 + "options": "Date/Time"
1109 + },
1110 + "properties": [
1111 + {
1112 + "id": "custom.width",
1113 + "value": 242
1114 + }
1115 + ]
1116 + },
1117 + {
1118 + "matcher": {
1119 + "id": "byName",
1120 + "options": "MITRE TACTIC"
1121 + },
1122 + "properties": [
1123 + {
1124 + "id": "custom.width",
1125 + "value": 332
1126 + }
1127 + ]
1128 + },
1129 + {
1130 + "matcher": {
1131 + "id": "byName",
1132 + "options": "MITRE TECHNIQUE"
1133 + },
1134 + "properties": [
1135 + {
1136 + "id": "custom.width",
1137 + "value": 312
1138 + }
1139 + ]
1140 + },
1141 + {
1142 + "matcher": {
1143 + "id": "byName",
1144 + "options": "EVENT ID"
1145 + },
1146 + "properties": [
1147 + {
1148 + "id": "links",
1149 + "value": [
1150 + {
1151 + "targetBlank": true,
1152 + "title": "VIEW EVENT DETAILS",
1153 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1154 + }
1155 + ]
1156 + },
1157 + {
1158 + "id": "custom.width",
1159 + "value": 319
1160 + }
1161 + ]
1162 + },
1163 + {
1164 + "matcher": {
1165 + "id": "byName",
1166 + "options": "ACCOUNT"
1167 + },
1168 + "properties": [
1169 + {
1170 + "id": "custom.width",
1171 + "value": 343
1172 + }
1173 + ]
1174 + },
1175 + {
1176 + "matcher": {
1177 + "id": "byName",
1178 + "options": "EVENT TIME"
1179 + },
1180 + "properties": [
1181 + {
1182 + "id": "custom.width",
1183 + "value": 195
1184 + }
1185 + ]
1186 + },
1187 + {
1188 + "matcher": {
1189 + "id": "byName",
1190 + "options": "FILE SIZE"
1191 + },
1192 + "properties": [
1193 + {
1194 + "id": "unit",
1195 + "value": "bytes"
1196 + }
1197 + ]
1198 + },
1199 + {
1200 + "matcher": {
1201 + "id": "byName",
1202 + "options": "SENSITIVE INFO"
1203 + },
1204 + "properties": [
1205 + {
1206 + "id": "custom.width",
1207 + "value": 154
1208 + }
1209 + ]
1210 + },
1211 + {
1212 + "matcher": {
1213 + "id": "byName",
1214 + "options": "RULE LEVEL"
1215 + },
1216 + "properties": [
1217 + {
1218 + "id": "custom.width",
1219 + "value": 157
1220 + }
1221 + ]
1222 + }
1223 + ]
1224 + },
1225 + "gridPos": {
1226 + "h": 16,
1227 + "w": 24,
1228 + "x": 0,
1229 + "y": 44
1230 + },
1231 + "id": 27,
1232 + "options": {
1233 + "footer": {
1234 + "fields": "",
1235 + "reducer": ["sum"],
1236 + "show": false
1237 + },
1238 + "showHeader": true,
1239 + "sortBy": []
1240 + },
1241 + "pluginVersion": "9.0.0",
1242 + "targets": [
1243 + {
1244 + "bucketAggs": [],
1245 + "datasource": {
1246 + "type": "elasticsearch",
1247 + "uid": "replace_datasource_uid"
1248 + },
1249 + "metrics": [
1250 + {
1251 + "id": "1",
1252 + "settings": {
1253 + "size": "250"
1254 + },
1255 + "type": "raw_data"
1256 + }
1257 + ],
1258 + "query": "(data_office365_Workload:$workload AND rule_level:$rule_level) AND data_office365_Workload:$workload",
1259 + "refId": "A",
1260 + "timeField": "timestamp"
1261 + }
1262 + ],
1263 + "title": "EVENTS",
1264 + "transformations": [
1265 + {
1266 + "id": "merge",
1267 + "options": {
1268 + "reducers": []
1269 + }
1270 + },
1271 + {
1272 + "id": "organize",
1273 + "options": {
1274 + "excludeByName": {
1275 + "@metadata_beat": true,
1276 + "@metadata_type": true,
1277 + "@metadata_version": true,
1278 + "IMPHASH": true,
1279 + "MD5": true,
1280 + "SHA1": true,
1281 + "SHA256": true,
1282 + "_id": false,
1283 + "_index": true,
1284 + "_type": true,
1285 + "agent_ephemeral_id": true,
1286 + "agent_hostname": true,
1287 + "agent_id": true,
1288 + "agent_ip_city_name": true,
1289 + "agent_ip_country_code": true,
1290 + "agent_ip_geolocation": true,
1291 + "agent_name": true,
1292 + "agent_type": true,
1293 + "agent_version": true,
1294 + "beats_type": true,
1295 + "cluster_name": true,
1296 + "cluster_node": true,
1297 + "collector_node_id": true,
1298 + "data_alert_action": true,
1299 + "data_alert_category": true,
1300 + "data_alert_gid": true,
1301 + "data_alert_rev": true,
1302 + "data_alert_severity": true,
1303 + "data_alert_signature": true,
1304 + "data_alert_signature_id": true,
1305 + "data_app_proto": true,
1306 + "data_audit_auid": true,
1307 + "data_audit_command": true,
1308 + "data_audit_euid": true,
1309 + "data_audit_exe": true,
1310 + "data_audit_gid": true,
1311 + "data_audit_id": true,
1312 + "data_audit_pid": true,
1313 + "data_audit_res": true,
1314 + "data_audit_session": true,
1315 + "data_audit_type": true,
1316 + "data_audit_uid": true,
1317 + "data_dest_ip": true,
1318 + "data_dest_port": true,
1319 + "data_dstuser": true,
1320 + "data_event_type": true,
1321 + "data_extra_data": true,
1322 + "data_file": true,
1323 + "data_flow_bytes_toclient": true,
1324 + "data_flow_bytes_toserver": true,
1325 + "data_flow_id": true,
1326 + "data_flow_pkts_toclient": true,
1327 + "data_flow_pkts_toserver": true,
1328 + "data_flow_start": true,
1329 + "data_http_http_content_type": true,
1330 + "data_http_http_port": true,
1331 + "data_http_length": true,
1332 + "data_http_status": true,
1333 + "data_http_url": true,
1334 + "data_id": true,
1335 + "data_in_iface": true,
1336 + "data_metadata_flowbits": true,
1337 + "data_metadata_flowints_http_anomaly_count": true,
1338 + "data_metadata_flowints_tcp_retransmission_count": true,
1339 + "data_office365_Actor": true,
1340 + "data_office365_ActorContextId": true,
1341 + "data_office365_ActorIpAddress": false,
1342 + "data_office365_ActorIpAddress_city_name": true,
1343 + "data_office365_ActorIpAddress_country_code": true,
1344 + "data_office365_ActorIpAddress_geolocation": true,
1345 + "data_office365_ApplicationId": true,
1346 + "data_office365_AzureActiveDirectoryEventType": true,
1347 + "data_office365_ClientIP": true,
1348 + "data_office365_ClientIP_city_name": true,
1349 + "data_office365_ClientIP_country_code": true,
1350 + "data_office365_ClientIP_geolocation": true,
1351 + "data_office365_CreationTime": false,
1352 + "data_office365_DeviceProperties": true,
1353 + "data_office365_ErrorNumber": true,
1354 + "data_office365_ExceptionInfo_Reason": true,
1355 + "data_office365_ExchangeMetaData_BCC": true,
1356 + "data_office365_ExchangeMetaData_CC": true,
1357 + "data_office365_ExchangeMetaData_FileSize": true,
1358 + "data_office365_ExchangeMetaData_From": true,
1359 + "data_office365_ExchangeMetaData_MessageID": true,
1360 + "data_office365_ExchangeMetaData_RecipientCount": true,
1361 + "data_office365_ExchangeMetaData_Sent": true,
1362 + "data_office365_ExchangeMetaData_Subject": true,
1363 + "data_office365_ExchangeMetaData_To": true,
1364 + "data_office365_ExchangeMetaData_UniqueID": true,
1365 + "data_office365_ExtendedProperties": true,
1366 + "data_office365_Id": true,
1367 + "data_office365_IncidentId": true,
1368 + "data_office365_InterSystemsId": true,
1369 + "data_office365_IntraSystemId": true,
1370 + "data_office365_LogonError": true,
1371 + "data_office365_ModifiedProperties": true,
1372 + "data_office365_ObjectId": true,
1373 + "data_office365_Operation": true,
1374 + "data_office365_OrganizationId": true,
1375 + "data_office365_PolicyDetails": true,
1376 + "data_office365_RecordType": true,
1377 + "data_office365_ResultStatus": false,
1378 + "data_office365_SensitiveInfoDetectionIsIncluded": true,
1379 + "data_office365_SharePointMetaData_FileID": true,
1380 + "data_office365_SharePointMetaData_FileName": false,
1381 + "data_office365_SharePointMetaData_FileOwner": true,
1382 + "data_office365_SharePointMetaData_FilePathUrl": true,
1383 + "data_office365_SharePointMetaData_FileSize": true,
1384 + "data_office365_SharePointMetaData_From": true,
1385 + "data_office365_SharePointMetaData_IsViewableByExternalUsers": true,
1386 + "data_office365_SharePointMetaData_IsVisibleOnlyToOdbOwner": true,
1387 + "data_office365_SharePointMetaData_ItemCreationTime": true,
1388 + "data_office365_SharePointMetaData_ItemLastModifiedTime": true,
1389 + "data_office365_SharePointMetaData_ItemLastSharedTime": true,
1390 + "data_office365_SharePointMetaData_SiteCollectionGuid": true,
1391 + "data_office365_SharePointMetaData_SiteCollectionUrl": true,
1392 + "data_office365_SharePointMetaData_UniqueID": true,
1393 + "data_office365_Target": true,
1394 + "data_office365_TargetContextId": true,
1395 + "data_office365_UserId": false,
1396 + "data_office365_UserKey": true,
1397 + "data_office365_UserType": true,
1398 + "data_office365_Version": true,
1399 + "data_office365_Workload": true,
1400 + "data_osquery_action": true,
1401 + "data_osquery_calendarTime": true,
1402 + "data_osquery_columns_address": true,
1403 + "data_osquery_columns_address_city_name": true,
1404 + "data_osquery_columns_address_country_code": true,
1405 + "data_osquery_columns_address_geolocation": true,
1406 + "data_osquery_columns_cmdline": true,
1407 + "data_osquery_columns_cwd": true,
1408 + "data_osquery_columns_description": true,
1409 + "data_osquery_columns_directory": true,
1410 + "data_osquery_columns_disk_bytes_read": true,
1411 + "data_osquery_columns_disk_bytes_written": true,
1412 + "data_osquery_columns_egid": true,
1413 + "data_osquery_columns_euid": true,
1414 + "data_osquery_columns_family": true,
1415 + "data_osquery_columns_fd": true,
1416 + "data_osquery_columns_gid": true,
1417 + "data_osquery_columns_gid_signed": true,
1418 + "data_osquery_columns_host": true,
1419 + "data_osquery_columns_interface": true,
1420 + "data_osquery_columns_local_address": true,
1421 + "data_osquery_columns_local_address_city_name": true,
1422 + "data_osquery_columns_local_address_country_code": true,
1423 + "data_osquery_columns_local_address_geolocation": true,
1424 + "data_osquery_columns_local_port": true,
1425 + "data_osquery_columns_mac": true,
1426 + "data_osquery_columns_name": true,
1427 + "data_osquery_columns_net_namespace": true,
1428 + "data_osquery_columns_nice": true,
1429 + "data_osquery_columns_on_disk": true,
1430 + "data_osquery_columns_parent": true,
1431 + "data_osquery_columns_path": true,
1432 + "data_osquery_columns_pgroup": true,
1433 + "data_osquery_columns_pid": true,
1434 + "data_osquery_columns_port": true,
1435 + "data_osquery_columns_protocol": true,
1436 + "data_osquery_columns_remote_address": true,
1437 + "data_osquery_columns_remote_address_city_name": true,
1438 + "data_osquery_columns_remote_address_country_code": true,
1439 + "data_osquery_columns_remote_address_geolocation": true,
1440 + "data_osquery_columns_remote_port": true,
1441 + "data_osquery_columns_resident_size": true,
1442 + "data_osquery_columns_root": true,
1443 + "data_osquery_columns_sgid": true,
1444 + "data_osquery_columns_shell": true,
1445 + "data_osquery_columns_socket": true,
1446 + "data_osquery_columns_start_time": true,
1447 + "data_osquery_columns_state": true,
1448 + "data_osquery_columns_suid": true,
1449 + "data_osquery_columns_system_time": true,
1450 + "data_osquery_columns_threads": true,
1451 + "data_osquery_columns_time_utc": true,
1452 + "data_osquery_columns_total_size": true,
1453 + "data_osquery_columns_tty": true,
1454 + "data_osquery_columns_type": true,
1455 + "data_osquery_columns_uid": true,
1456 + "data_osquery_columns_uid_signed": true,
1457 + "data_osquery_columns_user": true,
1458 + "data_osquery_columns_user_time": true,
1459 + "data_osquery_columns_username": true,
1460 + "data_osquery_columns_wired_size": true,
1461 + "data_osquery_counter": true,
1462 + "data_osquery_decorations_host_uuid": true,
1463 + "data_osquery_decorations_hostname": true,
1464 + "data_osquery_epoch": true,
1465 + "data_osquery_hostIdentifier": true,
1466 + "data_osquery_name": true,
1467 + "data_osquery_numerics": true,
1468 + "data_osquery_unixTime": true,
1469 + "data_proto": true,
1470 + "data_sca_check_command": true,
1471 + "data_sca_check_compliance_cis": true,
1472 + "data_sca_check_compliance_cis_csc": true,
1473 + "data_sca_check_compliance_gdpr_IV": true,
1474 + "data_sca_check_compliance_gpg_13": true,
1475 + "data_sca_check_compliance_hipaa": true,
1476 + "data_sca_check_compliance_nist_800_53": true,
1477 + "data_sca_check_compliance_pci_dss": true,
1478 + "data_sca_check_compliance_tsc": true,
1479 + "data_sca_check_description": true,
1480 + "data_sca_check_id": true,
1481 + "data_sca_check_previous_result": true,
1482 + "data_sca_check_rationale": true,
1483 + "data_sca_check_remediation": true,
1484 + "data_sca_check_result": true,
1485 + "data_sca_check_title": true,
1486 + "data_sca_description": true,
1487 + "data_sca_failed": true,
1488 + "data_sca_file": true,
1489 + "data_sca_invalid": true,
1490 + "data_sca_passed": true,
1491 + "data_sca_policy": true,
1492 + "data_sca_policy_id": true,
1493 + "data_sca_scan_id": true,
1494 + "data_sca_score": true,
1495 + "data_sca_total_checks": true,
1496 + "data_sca_type": true,
1497 + "data_script": true,
1498 + "data_src_ip": true,
1499 + "data_src_ip_city_name": true,
1500 + "data_src_ip_country_code": true,
1501 + "data_src_ip_geolocation": true,
1502 + "data_src_port": true,
1503 + "data_srcip": true,
1504 + "data_srcip_city_name": true,
1505 + "data_srcip_country_code": true,
1506 + "data_srcip_geolocation": true,
1507 + "data_srcuser": true,
1508 + "data_timestamp": true,
1509 + "data_title": true,
1510 + "data_tls_session_resumed": true,
1511 + "data_tls_version": true,
1512 + "data_tx_id": true,
1513 + "data_type": true,
1514 + "data_win_eventXML_binaryData": true,
1515 + "data_win_eventXML_binaryDataSize": true,
1516 + "data_win_eventXML_param1": true,
1517 + "data_win_eventdata_authenticationPackageName": true,
1518 + "data_win_eventdata_callTrace": true,
1519 + "data_win_eventdata_commandLine": true,
1520 + "data_win_eventdata_company": true,
1521 + "data_win_eventdata_creationUtcTime": true,
1522 + "data_win_eventdata_currentDirectory": true,
1523 + "data_win_eventdata_description": true,
1524 + "data_win_eventdata_destinationHostname": true,
1525 + "data_win_eventdata_destinationIp": true,
1526 + "data_win_eventdata_destinationIp_city_name": true,
1527 + "data_win_eventdata_destinationIp_country_code": true,
1528 + "data_win_eventdata_destinationIp_geolocation": true,
1529 + "data_win_eventdata_destinationIsIpv6": true,
1530 + "data_win_eventdata_destinationPort": true,
1531 + "data_win_eventdata_destinationPortName": true,
1532 + "data_win_eventdata_details": true,
1533 + "data_win_eventdata_elevatedToken": true,
1534 + "data_win_eventdata_eventType": true,
1535 + "data_win_eventdata_fileVersion": true,
1536 + "data_win_eventdata_fileVersion_city_name": true,
1537 + "data_win_eventdata_fileVersion_country_code": true,
1538 + "data_win_eventdata_fileVersion_geolocation": true,
1539 + "data_win_eventdata_grantedAccess": true,
1540 + "data_win_eventdata_hashes": true,
1541 + "data_win_eventdata_image": true,
1542 + "data_win_eventdata_imageLoaded": true,
1543 + "data_win_eventdata_impersonationLevel": true,
1544 + "data_win_eventdata_initiated": true,
1545 + "data_win_eventdata_integrityLevel": true,
1546 + "data_win_eventdata_ipAddress": true,
1547 + "data_win_eventdata_ipPort": true,
1548 + "data_win_eventdata_keyLength": true,
1549 + "data_win_eventdata_logonGuid": true,
1550 + "data_win_eventdata_logonId": true,
1551 + "data_win_eventdata_logonProcessName": true,
1552 + "data_win_eventdata_logonType": true,
1553 + "data_win_eventdata_originalFileName": true,
1554 + "data_win_eventdata_param1": true,
1555 + "data_win_eventdata_param2": true,
1556 + "data_win_eventdata_param3": true,
1557 + "data_win_eventdata_param4": true,
1558 + "data_win_eventdata_parentCommandLine": true,
1559 + "data_win_eventdata_parentImage": true,
1560 + "data_win_eventdata_parentProcessGuid": true,
1561 + "data_win_eventdata_parentProcessId": true,
1562 + "data_win_eventdata_processGuid": true,
1563 + "data_win_eventdata_processId": true,
1564 + "data_win_eventdata_processName": true,
1565 + "data_win_eventdata_product": true,
1566 + "data_win_eventdata_protocol": true,
1567 + "data_win_eventdata_queryName": true,
1568 + "data_win_eventdata_queryResults": true,
1569 + "data_win_eventdata_queryStatus": true,
1570 + "data_win_eventdata_ruleName": true,
1571 + "data_win_eventdata_serviceName": true,
1572 + "data_win_eventdata_serviceSid": true,
1573 + "data_win_eventdata_signature": true,
1574 + "data_win_eventdata_signatureStatus": true,
1575 + "data_win_eventdata_signed": true,
1576 + "data_win_eventdata_sourceHostname": true,
1577 + "data_win_eventdata_sourceImage": true,
1578 + "data_win_eventdata_sourceIp": true,
1579 + "data_win_eventdata_sourceIp_city_name": true,
1580 + "data_win_eventdata_sourceIp_country_code": true,
1581 + "data_win_eventdata_sourceIp_geolocation": true,
1582 + "data_win_eventdata_sourceIsIpv6": true,
1583 + "data_win_eventdata_sourcePort": true,
1584 + "data_win_eventdata_sourceProcessGUID": true,
1585 + "data_win_eventdata_sourceProcessId": true,
1586 + "data_win_eventdata_sourceThreadId": true,
1587 + "data_win_eventdata_status": true,
1588 + "data_win_eventdata_subjectDomainName": true,
1589 + "data_win_eventdata_subjectLogonId": true,
1590 + "data_win_eventdata_subjectUserName": true,
1591 + "data_win_eventdata_subjectUserSid": true,
1592 + "data_win_eventdata_targetDomainName": true,
1593 + "data_win_eventdata_targetFilename": true,
1594 + "data_win_eventdata_targetImage": true,
1595 + "data_win_eventdata_targetLinkedLogonId": true,
1596 + "data_win_eventdata_targetLogonId": true,
1597 + "data_win_eventdata_targetObject": true,
1598 + "data_win_eventdata_targetProcessGUID": true,
1599 + "data_win_eventdata_targetProcessId": true,
1600 + "data_win_eventdata_targetUserName": true,
1601 + "data_win_eventdata_targetUserSid": true,
1602 + "data_win_eventdata_terminalSessionId": true,
1603 + "data_win_eventdata_ticketEncryptionType": true,
1604 + "data_win_eventdata_ticketOptions": true,
1605 + "data_win_eventdata_user": true,
1606 + "data_win_eventdata_utcTime": true,
1607 + "data_win_eventdata_virtualAccount": true,
1608 + "data_win_system_channel": true,
1609 + "data_win_system_computer": true,
1610 + "data_win_system_eventID": true,
1611 + "data_win_system_eventRecordID": true,
1612 + "data_win_system_eventSourceName": true,
1613 + "data_win_system_keywords": true,
1614 + "data_win_system_level": true,
1615 + "data_win_system_message": true,
1616 + "data_win_system_opcode": true,
1617 + "data_win_system_processID": true,
1618 + "data_win_system_providerGuid": true,
1619 + "data_win_system_providerName": true,
1620 + "data_win_system_severityValue": true,
1621 + "data_win_system_systemTime": true,
1622 + "data_win_system_task": true,
1623 + "data_win_system_threadID": true,
1624 + "data_win_system_version": true,
1625 + "decoder_name": true,
1626 + "decoder_parent": true,
1627 + "dns_query": true,
1628 + "dns_query_threat_indicated": true,
1629 + "dst_ip": true,
1630 + "dst_ip_city_name": true,
1631 + "dst_ip_country_code": true,
1632 + "dst_ip_geolocation": true,
1633 + "dst_ip_threat_indicated": true,
1634 + "dst_port": true,
1635 + "ecs_version": true,
1636 + "error": true,
1637 + "event_hash": true,
1638 + "file_path": true,
1639 + "firewall_rule_name": true,
1640 + "full_log": false,
1641 + "gl2_accounted_message_size": true,
1642 + "gl2_message_id": true,
1643 + "gl2_processing_error": true,
1644 + "gl2_remote_ip": true,
1645 + "gl2_remote_port": true,
1646 + "gl2_source_collector": true,
1647 + "gl2_source_input": true,
1648 + "gl2_source_node": true,
1649 + "hash_md5": true,
1650 + "hash_sha1": true,
1651 + "hash_sha256": true,
1652 + "highlight": true,
1653 + "host_architecture": true,
1654 + "host_containerized": true,
1655 + "host_hostname": true,
1656 + "host_id": true,
1657 + "host_ip": true,
1658 + "host_mac": true,
1659 + "host_name": true,
1660 + "host_os_codename": true,
1661 + "host_os_kernel": true,
1662 + "host_os_name": true,
1663 + "host_os_platform": true,
1664 + "host_os_version": true,
1665 + "hostname": true,
1666 + "id": true,
1667 + "input_type": true,
1668 + "level": true,
1669 + "location": true,
1670 + "log_file_path": true,
1671 + "log_offset": true,
1672 + "manager_name": true,
1673 + "message": true,
1674 + "module": true,
1675 + "parent_process_cmd_line": true,
1676 + "parent_process_id": true,
1677 + "parent_process_image": true,
1678 + "pid": true,
1679 + "predecoder_hostname": true,
1680 + "predecoder_program_name": true,
1681 + "predecoder_timestamp": true,
1682 + "previous_log": true,
1683 + "previous_output": true,
1684 + "process_cmd_line": true,
1685 + "process_id": true,
1686 + "process_image": true,
1687 + "process_name": true,
1688 + "protocol": true,
1689 + "rule_cis": true,
1690 + "rule_cis_csc": true,
1691 + "rule_firedtimes": true,
1692 + "rule_gdpr": true,
1693 + "rule_gdpr_IV": true,
1694 + "rule_gpg13": true,
1695 + "rule_gpg_13": true,
1696 + "rule_group1": true,
1697 + "rule_groups": true,
1698 + "rule_hipaa": true,
1699 + "rule_id": true,
1700 + "rule_info": true,
1701 + "rule_mail": true,
1702 + "rule_mitre_id": true,
1703 + "rule_mitre_tactic": false,
1704 + "rule_nist_800_53": true,
1705 + "rule_pci_dss": true,
1706 + "rule_tsc": true,
1707 + "scanid": true,
1708 + "service": true,
1709 + "software_package": true,
1710 + "software_vendor": true,
1711 + "sort": true,
1712 + "source": true,
1713 + "src_ip": true,
1714 + "src_ip_city_name": true,
1715 + "src_ip_country_code": true,
1716 + "src_ip_geolocation": true,
1717 + "src_port": true,
1718 + "streams": true,
1719 + "syscheck_attrs_after": true,
1720 + "syscheck_audit_effective_user_id": true,
1721 + "syscheck_audit_effective_user_name": true,
1722 + "syscheck_audit_group_id": true,
1723 + "syscheck_audit_group_name": true,
1724 + "syscheck_audit_login_user_id": true,
1725 + "syscheck_audit_login_user_name": true,
1726 + "syscheck_audit_process_cwd": true,
1727 + "syscheck_audit_process_id": true,
1728 + "syscheck_audit_process_name": true,
1729 + "syscheck_audit_process_parent_cwd": true,
1730 + "syscheck_audit_process_parent_name": true,
1731 + "syscheck_audit_process_ppid": true,
1732 + "syscheck_audit_user_id": true,
1733 + "syscheck_audit_user_name": true,
1734 + "syscheck_changed_attributes": true,
1735 + "syscheck_event": true,
1736 + "syscheck_gid_after": true,
1737 + "syscheck_gname_after": true,
1738 + "syscheck_hard_links": true,
1739 + "syscheck_inode_after": true,
1740 + "syscheck_inode_before": true,
1741 + "syscheck_md5_after": true,
1742 + "syscheck_md5_before": true,
1743 + "syscheck_mode": true,
1744 + "syscheck_mtime_after": true,
1745 + "syscheck_mtime_before": true,
1746 + "syscheck_path": true,
1747 + "syscheck_perm_after": true,
1748 + "syscheck_perm_before": true,
1749 + "syscheck_sha1_after": true,
1750 + "syscheck_sha1_before": true,
1751 + "syscheck_sha256_after": true,
1752 + "syscheck_sha256_before": true,
1753 + "syscheck_size_after": true,
1754 + "syscheck_size_before": true,
1755 + "syscheck_uid_after": true,
1756 + "syscheck_uname_after": true,
1757 + "syscheck_win_perm_after": true,
1758 + "syscheck_win_perm_after_0_allowed": true,
1759 + "syscheck_win_perm_after_0_name": true,
1760 + "syscheck_win_perm_after_1_allowed": true,
1761 + "syscheck_win_perm_after_1_name": true,
1762 + "syscheck_win_perm_after_2_allowed": true,
1763 + "syscheck_win_perm_after_2_name": true,
1764 + "syscheck_win_perm_after_3_allowed": true,
1765 + "syscheck_win_perm_after_3_name": true,
1766 + "syslog_customer": true,
1767 + "syslog_level": true,
1768 + "syslog_tag": true,
1769 + "syslog_type": true,
1770 + "sysmon_event_description": true,
1771 + "threat_ids": true,
1772 + "threat_indicated": true,
1773 + "threat_names": true,
1774 + "time": true,
1775 + "timestamp": true,
1776 + "true": true,
1777 + "user_name": true,
1778 + "win_registry_key": true,
1779 + "win_system_eventID": true,
1780 + "windows_auth_package": true,
1781 + "windows_domain": true,
1782 + "windows_event_id": true,
1783 + "windows_event_severity": true,
1784 + "windows_logon_type": true
1785 + },
1786 + "indexByName": {
1787 + "_id": 2,
1788 + "_index": 8,
1789 + "_type": 9,
1790 + "agent_id": 10,
1791 + "agent_name": 4,
1792 + "cluster_name": 11,
1793 + "cluster_node": 12,
1794 + "data_office365_CreationTime": 0,
1795 + "data_office365_ExchangeMetaData_CC": 45,
1796 + "data_office365_ExchangeMetaData_FileSize": 47,
1797 + "data_office365_ExchangeMetaData_From": 48,
1798 + "data_office365_ExchangeMetaData_MessageID": 49,
1799 + "data_office365_ExchangeMetaData_RecipientCount": 51,
1800 + "data_office365_ExchangeMetaData_Sent": 52,
1801 + "data_office365_ExchangeMetaData_Subject": 50,
1802 + "data_office365_ExchangeMetaData_To": 53,
1803 + "data_office365_ExchangeMetaData_UniqueID": 54,
1804 + "data_office365_Id": 13,
1805 + "data_office365_IncidentId": 55,
1806 + "data_office365_ObjectId": 14,
1807 + "data_office365_Operation": 20,
1808 + "data_office365_OrganizationId": 15,
1809 + "data_office365_RecordType": 16,
1810 + "data_office365_SensitiveInfoDetectionIsIncluded": 46,
1811 + "data_office365_UserId": 3,
1812 + "data_office365_UserKey": 17,
1813 + "data_office365_UserType": 18,
1814 + "data_office365_Version": 19,
1815 + "data_office365_Workload": 44,
1816 + "decoder_name": 21,
1817 + "gl2_accounted_message_size": 22,
1818 + "gl2_message_id": 23,
1819 + "gl2_processing_error": 24,
1820 + "gl2_remote_ip": 25,
1821 + "gl2_remote_port": 26,
1822 + "gl2_source_input": 27,
1823 + "gl2_source_node": 28,
1824 + "highlight": 29,
1825 + "id": 30,
1826 + "location": 31,
1827 + "manager_name": 32,
1828 + "message": 33,
1829 + "rule_description": 5,
1830 + "rule_firedtimes": 34,
1831 + "rule_group1": 35,
1832 + "rule_groups": 36,
1833 + "rule_id": 7,
1834 + "rule_level": 6,
1835 + "rule_mail": 37,
1836 + "sort": 38,
1837 + "source": 39,
1838 + "streams": 40,
1839 + "syslog_level": 41,
1840 + "syslog_type": 42,
1841 + "timestamp": 1,
1842 + "true": 43
1843 + },
1844 + "renameByName": {
1845 + "_id": "EVENT ID",
1846 + "agent_name": "",
1847 + "data_office365_ActorIpAddress": "SRC IP",
1848 + "data_office365_CreationTime": "EVENT TIME",
1849 + "data_office365_ExchangeMetaData_FileSize": "FILE SIZE",
1850 + "data_office365_ExchangeMetaData_RecipientCount": "RECIPIENTS",
1851 + "data_office365_ExchangeMetaData_Sent": "",
1852 + "data_office365_ExchangeMetaData_Subject": "MAIL SUBJECT",
1853 + "data_office365_ResultStatus": "RESULT",
1854 + "data_office365_SensitiveInfoDetectionIsIncluded": "SENSITIVE INFO",
1855 + "data_office365_SharePointMetaData_FileName": "FILE",
1856 + "data_office365_UserId": "ACCOUNT",
1857 + "rule_description": "DESCRIPTION",
1858 + "rule_id": "RULE ID",
1859 + "rule_level": "",
1860 + "rule_mitre_tactic": "MITRE TACTIC",
1861 + "rule_mitre_technique": "MITRE TECHNIQUE",
1862 + "timestamp": "Date/Time"
1863 + }
1864 + }
1865 + }
1866 + ],
1867 + "transparent": true,
1868 + "type": "table"
1869 + }
1870 + ],
1871 + "refresh": false,
1872 + "schemaVersion": 37,
1873 + "style": "dark",
1874 + "tags": ["O365"],
1875 + "templating": {
1876 + "list": [
1877 + {
1878 + "datasource": {
1879 + "type": "elasticsearch",
1880 + "uid": "replace_datasource_uid"
1881 + },
1882 + "filters": [],
1883 + "hide": 0,
1884 + "label": "",
1885 + "name": "Filters",
1886 + "skipUrlSync": false,
1887 + "type": "adhoc"
1888 + },
1889 + {
1890 + "current": {
1891 + "selected": false,
1892 + "text": "All",
1893 + "value": "$__all"
1894 + },
1895 + "datasource": {
1896 + "type": "elasticsearch",
1897 + "uid": "replace_datasource_uid"
1898 + },
1899 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"data_office365_Operation:DLPRuleMatch OR data_office365_Operation:DlpRuleMatch\"}",
1900 + "hide": 0,
1901 + "includeAll": true,
1902 + "label": "Workload",
1903 + "multi": false,
1904 + "name": "workload",
1905 + "options": [],
1906 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"data_office365_Operation:DLPRuleMatch OR data_office365_Operation:DlpRuleMatch\"}",
1907 + "refresh": 2,
1908 + "regex": "",
1909 + "skipUrlSync": false,
1910 + "sort": 1,
1911 + "tagValuesQuery": "",
1912 + "tagsQuery": "",
1913 + "type": "query",
1914 + "useTags": false
1915 + },
1916 + {
1917 + "current": {
1918 + "selected": false,
1919 + "text": "All",
1920 + "value": "$__all"
1921 + },
1922 + "datasource": {
1923 + "type": "elasticsearch",
1924 + "uid": "replace_datasource_uid"
1925 + },
1926 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1927 + "hide": 0,
1928 + "includeAll": true,
1929 + "label": "Rule Level",
1930 + "multi": false,
1931 + "name": "rule_level",
1932 + "options": [],
1933 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1934 + "refresh": 2,
1935 + "regex": "",
1936 + "skipUrlSync": false,
1937 + "sort": 0,
1938 + "type": "query"
1939 + }
1940 + ]
1941 + },
1942 + "time": {
1943 + "from": "now-6h",
1944 + "to": "now"
1945 + },
1946 + "timepicker": {
1947 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
1948 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
1949 + },
1950 + "timezone": "",
1951 + "title": "O365 - DLP DETECTIONS",
1952 + "uid": "fpSr7wq7z",
1953 + "version": 1,
1954 + "weekStart": ""
1955 }
backend/app/connectors/grafana/dashboards/Office365/endpoint.json
+2362 -2409
@@ -1,2411 +1,2364 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "10.0.3",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:Endpoint",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "cellOptions": {
261 - "type": "auto"
262 - },
263 - "inspect": false
264 - },
265 - "mappings": [],
266 - "thresholds": {
267 - "mode": "absolute",
268 - "steps": [
269 - {
270 - "color": "red",
271 - "value": null
272 - }
273 - ]
274 - }
275 - },
276 - "overrides": [
277 - {
278 - "matcher": {
279 - "id": "byName",
280 - "options": "Count"
281 - },
282 - "properties": [
283 - {
284 - "id": "displayName",
285 - "value": "EVENTS"
286 - },
287 - {
288 - "id": "unit",
289 - "value": "short"
290 - },
291 - {
292 - "id": "decimals",
293 - "value": -1
294 - },
295 - {
296 - "id": "custom.align"
297 - },
298 - {
299 - "id": "thresholds",
300 - "value": {
301 - "mode": "absolute",
302 - "steps": [
303 - {
304 - "color": "red",
305 - "value": null
306 - }
307 - ]
308 - }
309 - }
310 - ]
311 - }
312 - ]
313 - },
314 - "gridPos": {
315 - "h": 7,
316 - "w": 6,
317 - "x": 8,
318 - "y": 0
319 - },
320 - "id": 54,
321 - "options": {
322 - "cellHeight": "sm",
323 - "footer": {
324 - "countRows": false,
325 - "fields": "",
326 - "reducer": [
327 - "sum"
328 - ],
329 - "show": false
330 - },
331 - "showHeader": true
332 - },
333 - "pluginVersion": "10.0.3",
334 - "targets": [
335 - {
336 - "bucketAggs": [
337 - {
338 - "fake": true,
339 - "field": "data_office365_Operation",
340 - "id": "4",
341 - "settings": {
342 - "min_doc_count": 1,
343 - "order": "desc",
344 - "orderBy": "_count",
345 - "size": "0"
346 - },
347 - "type": "terms"
348 - }
349 - ],
350 - "datasource": {
351 - "type": "elasticsearch",
352 - "uid": "replace_datasource_uid"
353 - },
354 - "metrics": [
355 - {
356 - "field": "select field",
357 - "id": "1",
358 - "type": "count"
359 - }
360 - ],
361 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
362 - "refId": "A",
363 - "timeField": "timestamp"
364 - }
365 - ],
366 - "title": "EVENTS BY OPERATION",
367 - "transformations": [
368 - {
369 - "id": "merge",
370 - "options": {
371 - "reducers": []
372 - }
373 - },
374 - {
375 - "id": "organize",
376 - "options": {
377 - "excludeByName": {},
378 - "indexByName": {},
379 - "renameByName": {
380 - "Count": "EVENTS",
381 - "data_office365_Operation": "OPERATION"
382 - }
383 - }
384 - }
385 - ],
386 - "type": "table"
387 - },
388 - {
389 - "datasource": {
390 - "type": "elasticsearch",
391 - "uid": "replace_datasource_uid"
392 - },
393 - "fieldConfig": {
394 - "defaults": {
395 - "color": {
396 - "mode": "thresholds"
397 - },
398 - "custom": {
399 - "align": "auto",
400 - "cellOptions": {
401 - "type": "auto"
402 - },
403 - "inspect": false
404 - },
405 - "mappings": [],
406 - "thresholds": {
407 - "mode": "absolute",
408 - "steps": [
409 - {
410 - "color": "red",
411 - "value": null
412 - }
413 - ]
414 - }
415 - },
416 - "overrides": [
417 - {
418 - "matcher": {
419 - "id": "byName",
420 - "options": "Count"
421 - },
422 - "properties": [
423 - {
424 - "id": "displayName",
425 - "value": "EVENTS"
426 - },
427 - {
428 - "id": "unit",
429 - "value": "short"
430 - },
431 - {
432 - "id": "decimals",
433 - "value": -1
434 - },
435 - {
436 - "id": "custom.align"
437 - },
438 - {
439 - "id": "thresholds",
440 - "value": {
441 - "mode": "absolute",
442 - "steps": [
443 - {
444 - "color": "red",
445 - "value": null
446 - }
447 - ]
448 - }
449 - }
450 - ]
451 - }
452 - ]
453 - },
454 - "gridPos": {
455 - "h": 7,
456 - "w": 6,
457 - "x": 14,
458 - "y": 0
459 - },
460 - "id": 61,
461 - "options": {
462 - "cellHeight": "sm",
463 - "footer": {
464 - "countRows": false,
465 - "fields": "",
466 - "reducer": [
467 - "sum"
468 - ],
469 - "show": false
470 - },
471 - "showHeader": true
472 - },
473 - "pluginVersion": "10.0.3",
474 - "targets": [
475 - {
476 - "bucketAggs": [
477 - {
478 - "fake": true,
479 - "field": "data_office365_Application",
480 - "id": "4",
481 - "settings": {
482 - "min_doc_count": 1,
483 - "order": "desc",
484 - "orderBy": "_count",
485 - "size": "0"
486 - },
487 - "type": "terms"
488 - }
489 - ],
490 - "datasource": {
491 - "type": "elasticsearch",
492 - "uid": "replace_datasource_uid"
493 - },
494 - "metrics": [
495 - {
496 - "field": "select field",
497 - "id": "1",
498 - "type": "count"
499 - }
500 - ],
501 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
502 - "refId": "A",
503 - "timeField": "timestamp"
504 - }
505 - ],
506 - "title": "EVENTS BY APPLICATION",
507 - "transformations": [
508 - {
509 - "id": "merge",
510 - "options": {
511 - "reducers": []
512 - }
513 - },
514 - {
515 - "id": "organize",
516 - "options": {
517 - "excludeByName": {},
518 - "indexByName": {},
519 - "renameByName": {
520 - "Count": "EVENTS",
521 - "data_office365_Application": "APP",
522 - "data_office365_DeviceName": "DEVICE",
523 - "data_office365_Operation": "OPERATION"
524 - }
525 - }
526 - }
527 - ],
528 - "type": "table"
529 - },
530 - {
531 - "datasource": {
532 - "type": "elasticsearch",
533 - "uid": "replace_datasource_uid"
534 - },
535 - "fieldConfig": {
536 - "defaults": {
537 - "color": {
538 - "mode": "thresholds"
539 - },
540 - "mappings": [
541 - {
542 - "options": {
543 - "match": "null",
544 - "result": {
545 - "text": "N/A"
546 - }
547 - },
548 - "type": "special"
549 - }
550 - ],
551 - "max": 15,
552 - "min": 0,
553 - "thresholds": {
554 - "mode": "absolute",
555 - "steps": [
556 - {
557 - "color": "#299c46",
558 - "value": null
559 - },
560 - {
561 - "color": "rgba(237, 129, 40, 0.89)",
562 - "value": 8
563 - },
564 - {
565 - "color": "#d44a3a",
566 - "value": 12
567 - }
568 - ]
569 - },
570 - "unit": "none"
571 - },
572 - "overrides": []
573 - },
574 - "gridPos": {
575 - "h": 7,
576 - "w": 4,
577 - "x": 0,
578 - "y": 7
579 - },
580 - "id": 16,
581 - "links": [],
582 - "options": {
583 - "orientation": "horizontal",
584 - "reduceOptions": {
585 - "calcs": [
586 - "max"
587 - ],
588 - "fields": "",
589 - "values": false
590 - },
591 - "showThresholdLabels": false,
592 - "showThresholdMarkers": true,
593 - "text": {}
594 - },
595 - "pluginVersion": "10.0.3",
596 - "targets": [
597 - {
598 - "bucketAggs": [
599 - {
600 - "field": "timestamp",
601 - "id": "2",
602 - "settings": {
603 - "interval": "auto",
604 - "min_doc_count": 0,
605 - "trimEdges": 0
606 - },
607 - "type": "date_histogram"
608 - }
609 - ],
610 - "datasource": {
611 - "type": "elasticsearch",
612 - "uid": "replace_datasource_uid"
613 - },
614 - "metrics": [
615 - {
616 - "field": "rule_level",
617 - "id": "1",
618 - "meta": {},
619 - "settings": {},
620 - "type": "max"
621 - }
622 - ],
623 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
624 - "refId": "A",
625 - "timeField": "timestamp"
626 - }
627 - ],
628 - "title": "MAX SEVERITY (0 - 15)",
629 - "type": "gauge"
630 - },
631 - {
632 - "datasource": {
633 - "type": "elasticsearch",
634 - "uid": "replace_datasource_uid"
635 - },
636 - "fieldConfig": {
637 - "defaults": {
638 - "color": {
639 - "mode": "palette-classic"
640 - },
641 - "custom": {
642 - "axisCenteredZero": false,
643 - "axisColorMode": "text",
644 - "axisLabel": "",
645 - "axisPlacement": "auto",
646 - "barAlignment": 0,
647 - "drawStyle": "bars",
648 - "fillOpacity": 0,
649 - "gradientMode": "none",
650 - "hideFrom": {
651 - "legend": false,
652 - "tooltip": false,
653 - "viz": false
654 - },
655 - "lineInterpolation": "linear",
656 - "lineWidth": 1,
657 - "pointSize": 5,
658 - "scaleDistribution": {
659 - "type": "linear"
660 - },
661 - "showPoints": "auto",
662 - "spanNulls": false,
663 - "stacking": {
664 - "group": "A",
665 - "mode": "normal"
666 - },
667 - "thresholdsStyle": {
668 - "mode": "off"
669 - }
670 - },
671 - "mappings": [],
672 - "thresholds": {
673 - "mode": "absolute",
674 - "steps": [
675 - {
676 - "color": "green",
677 - "value": null
678 - },
679 - {
680 - "color": "red",
681 - "value": 80
682 - }
683 - ]
684 - }
685 - },
686 - "overrides": []
687 - },
688 - "gridPos": {
689 - "h": 13,
690 - "w": 20,
691 - "x": 4,
692 - "y": 7
693 - },
694 - "id": 60,
695 - "options": {
696 - "legend": {
697 - "calcs": [],
698 - "displayMode": "table",
699 - "placement": "right",
700 - "showLegend": true
701 - },
702 - "tooltip": {
703 - "mode": "single",
704 - "sort": "none"
705 - }
706 - },
707 - "targets": [
708 - {
709 - "alias": "",
710 - "bucketAggs": [
711 - {
712 - "field": "data_office365_Operation",
713 - "id": "3",
714 - "settings": {
715 - "min_doc_count": "1",
716 - "order": "desc",
717 - "orderBy": "_count",
718 - "size": "10"
719 - },
720 - "type": "terms"
721 - },
722 - {
723 - "field": "timestamp",
724 - "id": "2",
725 - "settings": {
726 - "interval": "auto"
727 - },
728 - "type": "date_histogram"
729 - }
730 - ],
731 - "datasource": {
732 - "type": "elasticsearch",
733 - "uid": "replace_datasource_uid"
734 - },
735 - "metrics": [
736 - {
737 - "id": "1",
738 - "type": "count"
739 - }
740 - ],
741 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
742 - "refId": "A",
743 - "timeField": "timestamp"
744 - }
745 - ],
746 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
747 - "transparent": true,
748 - "type": "timeseries"
749 - },
750 - {
751 - "datasource": {
752 - "type": "elasticsearch",
753 - "uid": "replace_datasource_uid"
754 - },
755 - "fieldConfig": {
756 - "defaults": {
757 - "mappings": [
758 - {
759 - "options": {
760 - "match": "null",
761 - "result": {
762 - "text": "N/A"
763 - }
764 - },
765 - "type": "special"
766 - }
767 - ],
768 - "thresholds": {
769 - "mode": "absolute",
770 - "steps": [
771 - {
772 - "color": "blue",
773 - "value": null
774 - }
775 - ]
776 - },
777 - "unit": "locale"
778 - },
779 - "overrides": []
780 - },
781 - "gridPos": {
782 - "h": 6,
783 - "w": 4,
784 - "x": 0,
785 - "y": 14
786 - },
787 - "id": 51,
788 - "links": [],
789 - "options": {
790 - "colorMode": "value",
791 - "graphMode": "area",
792 - "justifyMode": "auto",
793 - "orientation": "horizontal",
794 - "reduceOptions": {
795 - "calcs": [
796 - "sum"
797 - ],
798 - "fields": "",
799 - "values": false
800 - },
801 - "text": {},
802 - "textMode": "auto"
803 - },
804 - "pluginVersion": "10.0.3",
805 - "targets": [
806 - {
807 - "bucketAggs": [
808 - {
809 - "$$hashKey": "object:331",
810 - "field": "timestamp",
811 - "id": "2",
812 - "settings": {
813 - "interval": "auto",
814 - "min_doc_count": 0,
815 - "trimEdges": 0
816 - },
817 - "type": "date_histogram"
818 - }
819 - ],
820 - "datasource": {
821 - "type": "elasticsearch",
822 - "uid": "replace_datasource_uid"
823 - },
824 - "metrics": [
825 - {
826 - "$$hashKey": "object:329",
827 - "field": "select field",
828 - "id": "1",
829 - "type": "count"
830 - }
831 - ],
832 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
833 - "refId": "A",
834 - "timeField": "timestamp"
835 - }
836 - ],
837 - "title": "EVENTS (Total)",
838 - "type": "stat"
839 - },
840 - {
841 - "datasource": {
842 - "type": "elasticsearch",
843 - "uid": "replace_datasource_uid"
844 - },
845 - "fieldConfig": {
846 - "defaults": {
847 - "color": {
848 - "mode": "thresholds"
849 - },
850 - "custom": {
851 - "align": "auto",
852 - "cellOptions": {
853 - "type": "auto"
854 - },
855 - "inspect": false
856 - },
857 - "mappings": [],
858 - "thresholds": {
859 - "mode": "absolute",
860 - "steps": [
861 - {
862 - "color": "red",
863 - "value": null
864 - }
865 - ]
866 - }
867 - },
868 - "overrides": [
869 - {
870 - "matcher": {
871 - "id": "byName",
872 - "options": "Count"
873 - },
874 - "properties": [
875 - {
876 - "id": "displayName",
877 - "value": "EVENTS"
878 - },
879 - {
880 - "id": "unit",
881 - "value": "short"
882 - },
883 - {
884 - "id": "decimals",
885 - "value": -1
886 - },
887 - {
888 - "id": "custom.align"
889 - },
890 - {
891 - "id": "thresholds",
892 - "value": {
893 - "mode": "absolute",
894 - "steps": [
895 - {
896 - "color": "red",
897 - "value": null
898 - }
899 - ]
900 - }
901 - }
902 - ]
903 - },
904 - {
905 - "matcher": {
906 - "id": "byName",
907 - "options": "DEVICE"
908 - },
909 - "properties": [
910 - {
911 - "id": "custom.width",
912 - "value": 324
913 - }
914 - ]
915 - }
916 - ]
917 - },
918 - "gridPos": {
919 - "h": 12,
920 - "w": 7,
921 - "x": 0,
922 - "y": 20
923 - },
924 - "id": 62,
925 - "options": {
926 - "cellHeight": "sm",
927 - "footer": {
928 - "countRows": false,
929 - "fields": "",
930 - "reducer": [
931 - "sum"
932 - ],
933 - "show": false
934 - },
935 - "showHeader": true,
936 - "sortBy": []
937 - },
938 - "pluginVersion": "10.0.3",
939 - "targets": [
940 - {
941 - "bucketAggs": [
942 - {
943 - "fake": true,
944 - "field": "data_office365_DeviceName",
945 - "id": "4",
946 - "settings": {
947 - "min_doc_count": 1,
948 - "order": "desc",
949 - "orderBy": "_count",
950 - "size": "0"
951 - },
952 - "type": "terms"
953 - },
954 - {
955 - "field": "data_office365_ClientIP_country_code",
956 - "id": "5",
957 - "settings": {
958 - "min_doc_count": "1",
959 - "order": "desc",
960 - "orderBy": "_term",
961 - "size": "10"
962 - },
963 - "type": "terms"
964 - }
965 - ],
966 - "datasource": {
967 - "type": "elasticsearch",
968 - "uid": "replace_datasource_uid"
969 - },
970 - "metrics": [
971 - {
972 - "field": "select field",
973 - "id": "1",
974 - "type": "count"
975 - }
976 - ],
977 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
978 - "refId": "A",
979 - "timeField": "timestamp"
980 - }
981 - ],
982 - "title": "EVENTS BY DEVICE",
983 - "transformations": [
984 - {
985 - "id": "merge",
986 - "options": {
987 - "reducers": []
988 - }
989 - },
990 - {
991 - "id": "organize",
992 - "options": {
993 - "excludeByName": {},
994 - "indexByName": {},
995 - "renameByName": {
996 - "Count": "EVENTS",
997 - "data_office365_ClientIP_country_code": "COUNTRY",
998 - "data_office365_DeviceName": "DEVICE",
999 - "data_office365_Operation": "OPERATION"
1000 - }
1001 - }
1002 - }
1003 - ],
1004 - "type": "table"
1005 - },
1006 - {
1007 - "circleMaxSize": 30,
1008 - "circleMinSize": 2,
1009 - "colors": [
1010 - "rgba(245, 54, 54, 0.9)",
1011 - "rgba(237, 129, 40, 0.89)",
1012 - "rgba(50, 172, 45, 0.97)"
1013 - ],
1014 - "datasource": {
1015 - "type": "elasticsearch",
1016 - "uid": "replace_datasource_uid"
1017 - },
1018 - "decimals": 0,
1019 - "esMetric": "Count",
1020 - "gridPos": {
1021 - "h": 12,
1022 - "w": 8,
1023 - "x": 7,
1024 - "y": 20
1025 - },
1026 - "hideEmpty": false,
1027 - "hideZero": false,
1028 - "id": 50,
1029 - "initialZoom": 1,
1030 - "locationData": "countries",
1031 - "mapCenter": "(0°, 0°)",
1032 - "mapCenterLatitude": 0,
1033 - "mapCenterLongitude": 0,
1034 - "maxDataPoints": 1,
1035 - "mouseWheelZoom": false,
1036 - "showLegend": true,
1037 - "stickyLabels": false,
1038 - "tableQueryOptions": {
1039 - "geohashField": "geohash",
1040 - "latitudeField": "latitude",
1041 - "longitudeField": "longitude",
1042 - "metricField": "metric",
1043 - "queryType": "geohash"
1044 - },
1045 - "targets": [
1046 - {
1047 - "bucketAggs": [
1048 - {
1049 - "fake": true,
1050 - "field": "data_office365_ClientIP_country_code",
1051 - "id": "3",
1052 - "settings": {
1053 - "min_doc_count": 1,
1054 - "order": "desc",
1055 - "orderBy": "_count",
1056 - "size": "0"
1057 - },
1058 - "type": "terms"
1059 - },
1060 - {
1061 - "field": "timestamp",
1062 - "id": "2",
1063 - "settings": {
1064 - "interval": "auto",
1065 - "min_doc_count": 0,
1066 - "trimEdges": 0
1067 - },
1068 - "type": "date_histogram"
1069 - }
1070 - ],
1071 - "datasource": {
1072 - "type": "elasticsearch",
1073 - "uid": "replace_datasource_uid"
1074 - },
1075 - "metrics": [
1076 - {
1077 - "field": "select field",
1078 - "id": "1",
1079 - "type": "count"
1080 - }
1081 - ],
1082 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
1083 - "refId": "A",
1084 - "timeField": "timestamp"
1085 - }
1086 - ],
1087 - "thresholds": "0,10",
1088 - "title": "Endpoint - ALL EVENTS BY SRC COUNTRY",
1089 - "type": "grafana-worldmap-panel",
1090 - "unitPlural": "",
1091 - "unitSingle": "",
1092 - "valueName": "total"
1093 - },
1094 - {
1095 - "datasource": {
1096 - "type": "elasticsearch",
1097 - "uid": "replace_datasource_uid"
1098 - },
1099 - "fieldConfig": {
1100 - "defaults": {
1101 - "color": {
1102 - "mode": "thresholds"
1103 - },
1104 - "custom": {
1105 - "align": "auto",
1106 - "cellOptions": {
1107 - "type": "auto"
1108 - },
1109 - "inspect": false
1110 - },
1111 - "mappings": [],
1112 - "thresholds": {
1113 - "mode": "absolute",
1114 - "steps": [
1115 - {
1116 - "color": "orange",
1117 - "value": null
1118 - }
1119 - ]
1120 - }
1121 - },
1122 - "overrides": [
1123 - {
1124 - "matcher": {
1125 - "id": "byName",
1126 - "options": "Count"
1127 - },
1128 - "properties": [
1129 - {
1130 - "id": "displayName",
1131 - "value": "EVENTS"
1132 - },
1133 - {
1134 - "id": "unit",
1135 - "value": "short"
1136 - },
1137 - {
1138 - "id": "decimals",
1139 - "value": -1
1140 - },
1141 - {
1142 - "id": "custom.align"
1143 - }
1144 - ]
1145 - },
1146 - {
1147 - "matcher": {
1148 - "id": "byName",
1149 - "options": "AD ACCOUNT"
1150 - },
1151 - "properties": [
1152 - {
1153 - "id": "custom.width",
1154 - "value": 377
1155 - }
1156 - ]
1157 - }
1158 - ]
1159 - },
1160 - "gridPos": {
1161 - "h": 12,
1162 - "w": 9,
1163 - "x": 15,
1164 - "y": 20
1165 - },
1166 - "id": 58,
1167 - "options": {
1168 - "cellHeight": "sm",
1169 - "footer": {
1170 - "countRows": false,
1171 - "fields": "",
1172 - "reducer": [
1173 - "sum"
1174 - ],
1175 - "show": false
1176 - },
1177 - "showHeader": true,
1178 - "sortBy": []
1179 - },
1180 - "pluginVersion": "10.0.3",
1181 - "targets": [
1182 - {
1183 - "bucketAggs": [
1184 - {
1185 - "fake": true,
1186 - "field": "data_office365_UserId",
1187 - "id": "4",
1188 - "settings": {
1189 - "min_doc_count": 1,
1190 - "order": "desc",
1191 - "orderBy": "_count",
1192 - "size": "0"
1193 - },
1194 - "type": "terms"
1195 - },
1196 - {
1197 - "field": "data_office365_ClientIP_country_code",
1198 - "id": "5",
1199 - "settings": {
1200 - "min_doc_count": "1",
1201 - "order": "desc",
1202 - "orderBy": "_term",
1203 - "size": "10"
1204 - },
1205 - "type": "terms"
1206 - }
1207 - ],
1208 - "datasource": {
1209 - "type": "elasticsearch",
1210 - "uid": "replace_datasource_uid"
1211 - },
1212 - "metrics": [
1213 - {
1214 - "field": "select field",
1215 - "id": "1",
1216 - "type": "count"
1217 - }
1218 - ],
1219 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
1220 - "refId": "A",
1221 - "timeField": "timestamp"
1222 - }
1223 - ],
1224 - "title": "Endpoint EVENTS BY ACCOUNT",
1225 - "transformations": [
1226 - {
1227 - "id": "merge",
1228 - "options": {
1229 - "reducers": []
1230 - }
1231 - },
1232 - {
1233 - "id": "organize",
1234 - "options": {
1235 - "excludeByName": {},
1236 - "indexByName": {},
1237 - "renameByName": {
1238 - "Count": "EVENTS",
1239 - "data_office365_ClientIP_country_code": "COUNTRY",
1240 - "data_office365_LogonError": "ERROR",
1241 - "data_office365_Operation": "WORKLOAD",
1242 - "data_office365_UserId": "AD ACCOUNT"
1243 - }
1244 - }
1245 - }
1246 - ],
1247 - "type": "table"
1248 - },
1249 - {
1250 - "datasource": {
1251 - "type": "elasticsearch",
1252 - "uid": "replace_datasource_uid"
1253 - },
1254 - "fieldConfig": {
1255 - "defaults": {
1256 - "color": {
1257 - "mode": "thresholds"
1258 - },
1259 - "custom": {
1260 - "align": "auto",
1261 - "cellOptions": {
1262 - "type": "auto"
1263 - },
1264 - "filterable": true,
1265 - "inspect": false
1266 - },
1267 - "mappings": [],
1268 - "thresholds": {
1269 - "mode": "absolute",
1270 - "steps": [
1271 - {
1272 - "color": "green",
1273 - "value": null
1274 - },
1275 - {
1276 - "color": "red",
1277 - "value": 80
1278 - }
1279 - ]
1280 - }
1281 - },
1282 - "overrides": [
1283 - {
1284 - "matcher": {
1285 - "id": "byName",
1286 - "options": "rule_level"
1287 - },
1288 - "properties": [
1289 - {
1290 - "id": "displayName",
1291 - "value": "RULE LEVEL"
1292 - },
1293 - {
1294 - "id": "unit",
1295 - "value": "short"
1296 - },
1297 - {
1298 - "id": "decimals",
1299 - "value": -1
1300 - },
1301 - {
1302 - "id": "custom.cellOptions",
1303 - "value": {
1304 - "mode": "gradient",
1305 - "type": "color-background"
1306 - }
1307 - },
1308 - {
1309 - "id": "custom.align"
1310 - },
1311 - {
1312 - "id": "thresholds",
1313 - "value": {
1314 - "mode": "absolute",
1315 - "steps": [
1316 - {
1317 - "color": "#37872D",
1318 - "value": null
1319 - },
1320 - {
1321 - "color": "rgba(237, 129, 40, 0.89)",
1322 - "value": 7
1323 - },
1324 - {
1325 - "color": "rgba(245, 54, 54, 0.9)",
1326 - "value": 12
1327 - }
1328 - ]
1329 - }
1330 - }
1331 - ]
1332 - },
1333 - {
1334 - "matcher": {
1335 - "id": "byName",
1336 - "options": "Date/Time"
1337 - },
1338 - "properties": [
1339 - {
1340 - "id": "custom.width",
1341 - "value": 242
1342 - }
1343 - ]
1344 - },
1345 - {
1346 - "matcher": {
1347 - "id": "byName",
1348 - "options": "MITRE TACTIC"
1349 - },
1350 - "properties": [
1351 - {
1352 - "id": "custom.width",
1353 - "value": 332
1354 - }
1355 - ]
1356 - },
1357 - {
1358 - "matcher": {
1359 - "id": "byName",
1360 - "options": "IP ADDRESS"
1361 - },
1362 - "properties": [
1363 - {
1364 - "id": "custom.width",
1365 - "value": 163
1366 - }
1367 - ]
1368 - },
1369 - {
1370 - "matcher": {
1371 - "id": "byName",
1372 - "options": "MITRE TECHNIQUE"
1373 - },
1374 - "properties": [
1375 - {
1376 - "id": "custom.width",
1377 - "value": 312
1378 - }
1379 - ]
1380 - },
1381 - {
1382 - "matcher": {
1383 - "id": "byName",
1384 - "options": "EVENT ID"
1385 - },
1386 - "properties": [
1387 - {
1388 - "id": "links",
1389 - "value": [
1390 - {
1391 - "targetBlank": true,
1392 - "title": "VIEW EVENT DETAILS",
1393 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1394 - }
1395 - ]
1396 - },
1397 - {
1398 - "id": "custom.width",
1399 - "value": 265
1400 - }
1401 - ]
1402 - },
1403 - {
1404 - "matcher": {
1405 - "id": "byName",
1406 - "options": "RESULT"
1407 - },
1408 - "properties": [
1409 - {
1410 - "id": "custom.width",
1411 - "value": 118
1412 - },
1413 - {
1414 - "id": "mappings",
1415 - "value": [
1416 - {
1417 - "options": {
1418 - "Failed": {
1419 - "color": "orange",
1420 - "index": 1
1421 - },
1422 - "Success": {
1423 - "color": "green",
1424 - "index": 0
1425 - }
1426 - },
1427 - "type": "value"
1428 - }
1429 - ]
1430 - },
1431 - {
1432 - "id": "custom.cellOptions",
1433 - "value": {
1434 - "type": "color-text"
1435 - }
1436 - }
1437 - ]
1438 - },
1439 - {
1440 - "matcher": {
1441 - "id": "byName",
1442 - "options": "SRC IP"
1443 - },
1444 - "properties": [
1445 - {
1446 - "id": "custom.width",
1447 - "value": 265
1448 - }
1449 - ]
1450 - },
1451 - {
1452 - "matcher": {
1453 - "id": "byName",
1454 - "options": "ACCOUNT"
1455 - },
1456 - "properties": [
1457 - {
1458 - "id": "custom.width",
1459 - "value": 193
1460 - }
1461 - ]
1462 - },
1463 - {
1464 - "matcher": {
1465 - "id": "byName",
1466 - "options": "EVENT TIME"
1467 - },
1468 - "properties": [
1469 - {
1470 - "id": "custom.width",
1471 - "value": 195
1472 - }
1473 - ]
1474 - },
1475 - {
1476 - "matcher": {
1477 - "id": "byName",
1478 - "options": "CLIENT IP"
1479 - },
1480 - "properties": [
1481 - {
1482 - "id": "custom.width",
1483 - "value": 143
1484 - }
1485 - ]
1486 - },
1487 - {
1488 - "matcher": {
1489 - "id": "byName",
1490 - "options": "DESCRIPTION"
1491 - },
1492 - "properties": [
1493 - {
1494 - "id": "custom.width",
1495 - "value": 296
1496 - }
1497 - ]
1498 - },
1499 - {
1500 - "matcher": {
1501 - "id": "byName",
1502 - "options": "DEVICE"
1503 - },
1504 - "properties": [
1505 - {
1506 - "id": "custom.width",
1507 - "value": 182
1508 - }
1509 - ]
1510 - },
1511 - {
1512 - "matcher": {
1513 - "id": "byName",
1514 - "options": "RULE LEVEL"
1515 - },
1516 - "properties": [
1517 - {
1518 - "id": "custom.width",
1519 - "value": 145
1520 - }
1521 - ]
1522 - },
1523 - {
1524 - "matcher": {
1525 - "id": "byName",
1526 - "options": "APP"
1527 - },
1528 - "properties": [
1529 - {
1530 - "id": "custom.width",
1531 - "value": 187
1532 - }
1533 - ]
1534 - },
1535 - {
1536 - "matcher": {
1537 - "id": "byName",
1538 - "options": "FILE TYPE"
1539 - },
1540 - "properties": [
1541 - {
1542 - "id": "custom.width",
1543 - "value": 157
1544 - }
1545 - ]
1546 - }
1547 - ]
1548 - },
1549 - "gridPos": {
1550 - "h": 16,
1551 - "w": 24,
1552 - "x": 0,
1553 - "y": 32
1554 - },
1555 - "id": 27,
1556 - "options": {
1557 - "cellHeight": "sm",
1558 - "footer": {
1559 - "countRows": false,
1560 - "enablePagination": true,
1561 - "fields": "",
1562 - "reducer": [
1563 - "sum"
1564 - ],
1565 - "show": false
1566 - },
1567 - "showHeader": true,
1568 - "sortBy": []
1569 - },
1570 - "pluginVersion": "10.0.3",
1571 - "targets": [
1572 - {
1573 - "bucketAggs": [],
1574 - "datasource": {
1575 - "type": "elasticsearch",
1576 - "uid": "replace_datasource_uid"
1577 - },
1578 - "metrics": [
1579 - {
1580 - "id": "1",
1581 - "settings": {
1582 - "size": "250"
1583 - },
1584 - "type": "raw_data"
1585 - }
1586 - ],
1587 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
1588 - "refId": "A",
1589 - "timeField": "timestamp"
1590 - }
1591 - ],
1592 - "title": "EVENTS",
1593 - "transformations": [
1594 - {
1595 - "id": "organize",
1596 - "options": {
1597 - "excludeByName": {
1598 - "@metadata_beat": true,
1599 - "@metadata_type": true,
1600 - "@metadata_version": true,
1601 - "IMPHASH": true,
1602 - "MD5": true,
1603 - "SHA1": true,
1604 - "SHA256": true,
1605 - "_id": false,
1606 - "_index": true,
1607 - "_type": true,
1608 - "agent_ephemeral_id": true,
1609 - "agent_hostname": true,
1610 - "agent_id": true,
1611 - "agent_ip_city_name": true,
1612 - "agent_ip_country_code": true,
1613 - "agent_ip_geolocation": true,
1614 - "agent_name": true,
1615 - "agent_type": true,
1616 - "agent_version": true,
1617 - "beats_type": true,
1618 - "cluster_name": true,
1619 - "cluster_node": true,
1620 - "collector_node_id": true,
1621 - "data_alert_action": true,
1622 - "data_alert_category": true,
1623 - "data_alert_gid": true,
1624 - "data_alert_rev": true,
1625 - "data_alert_severity": true,
1626 - "data_alert_signature": true,
1627 - "data_alert_signature_id": true,
1628 - "data_app_proto": true,
1629 - "data_audit_auid": true,
1630 - "data_audit_command": true,
1631 - "data_audit_euid": true,
1632 - "data_audit_exe": true,
1633 - "data_audit_gid": true,
1634 - "data_audit_id": true,
1635 - "data_audit_pid": true,
1636 - "data_audit_res": true,
1637 - "data_audit_session": true,
1638 - "data_audit_type": true,
1639 - "data_audit_uid": true,
1640 - "data_dest_ip": true,
1641 - "data_dest_port": true,
1642 - "data_dstuser": true,
1643 - "data_event_type": true,
1644 - "data_extra_data": true,
1645 - "data_file": true,
1646 - "data_flow_bytes_toclient": true,
1647 - "data_flow_bytes_toserver": true,
1648 - "data_flow_id": true,
1649 - "data_flow_pkts_toclient": true,
1650 - "data_flow_pkts_toserver": true,
1651 - "data_flow_start": true,
1652 - "data_http_http_content_type": true,
1653 - "data_http_http_port": true,
1654 - "data_http_length": true,
1655 - "data_http_status": true,
1656 - "data_http_url": true,
1657 - "data_id": true,
1658 - "data_in_iface": true,
1659 - "data_integration": true,
1660 - "data_metadata_flowbits": true,
1661 - "data_metadata_flowints_http_anomaly_count": true,
1662 - "data_metadata_flowints_tcp_retransmission_count": true,
1663 - "data_office365_AADGroupId": true,
1664 - "data_office365_Actor": true,
1665 - "data_office365_ActorContextId": true,
1666 - "data_office365_ActorIpAddress": false,
1667 - "data_office365_ActorIpAddress_city_name": true,
1668 - "data_office365_ActorIpAddress_country_code": true,
1669 - "data_office365_ActorIpAddress_geolocation": true,
1670 - "data_office365_AppAccessContext_AADSessionId": true,
1671 - "data_office365_AppAccessContext_APIId": true,
1672 - "data_office365_AppAccessContext_ClientAppId": true,
1673 - "data_office365_AppAccessContext_ClientAppName": true,
1674 - "data_office365_AppAccessContext_CorrelationId": true,
1675 - "data_office365_AppAccessContext_UniqueTokenId": true,
1676 - "data_office365_AppId": true,
1677 - "data_office365_Application": false,
1678 - "data_office365_ApplicationId": true,
1679 - "data_office365_ArtifactsShared": true,
1680 - "data_office365_Attendees": true,
1681 - "data_office365_AuthenticationType": true,
1682 - "data_office365_AzureActiveDirectoryEventType": true,
1683 - "data_office365_BrowserVersion": true,
1684 - "data_office365_ChannelGuid": true,
1685 - "data_office365_ChannelName": true,
1686 - "data_office365_ChatName": true,
1687 - "data_office365_ChatThreadId": true,
1688 - "data_office365_ClientAppId": true,
1689 - "data_office365_ClientIP": false,
1690 - "data_office365_ClientIPAddress": true,
1691 - "data_office365_ClientIPAddress_city_name": true,
1692 - "data_office365_ClientIPAddress_country_code": true,
1693 - "data_office365_ClientIPAddress_geolocation": true,
1694 - "data_office365_ClientIP_city_name": true,
1695 - "data_office365_ClientIP_country_code": true,
1696 - "data_office365_ClientIP_geolocation": true,
1697 - "data_office365_ClientInfoString": true,
1698 - "data_office365_ClientProcessName": true,
1699 - "data_office365_ClientRequestId": true,
1700 - "data_office365_ClientVersion": true,
1701 - "data_office365_CommunicationSubType": true,
1702 - "data_office365_CommunicationType": true,
1703 - "data_office365_CorrelationId": true,
1704 - "data_office365_CreationTime": false,
1705 - "data_office365_CrossMailboxOperation": true,
1706 - "data_office365_DestFolder_Id": true,
1707 - "data_office365_DestFolder_Path": true,
1708 - "data_office365_DestinationLocationType": true,
1709 - "data_office365_DeviceDisplayName": true,
1710 - "data_office365_DeviceDisplayName_city_name": true,
1711 - "data_office365_DeviceDisplayName_country_code": true,
1712 - "data_office365_DeviceDisplayName_geolocation": true,
1713 - "data_office365_DeviceId": true,
1714 - "data_office365_DeviceInformation": true,
1715 - "data_office365_DeviceName": false,
1716 - "data_office365_DeviceProperties": true,
1717 - "data_office365_DlpOriginalFilePath": true,
1718 - "data_office365_EndTime": true,
1719 - "data_office365_EnforcementMode": true,
1720 - "data_office365_ErrorNumber": true,
1721 - "data_office365_EventSource": true,
1722 - "data_office365_ExchangeId": true,
1723 - "data_office365_ExtendedProperties": true,
1724 - "data_office365_ExternalAccess": true,
1725 - "data_office365_ExtraProperties": true,
1726 - "data_office365_FileExtension": true,
1727 - "data_office365_FileSize": true,
1728 - "data_office365_FileSizeBytes": true,
1729 - "data_office365_Folder_Id": true,
1730 - "data_office365_Folder_Path": true,
1731 - "data_office365_Hidden": true,
1732 - "data_office365_HighPriorityMediaProcessing": true,
1733 - "data_office365_HostedContents": true,
1734 - "data_office365_ICalUid": true,
1735 - "data_office365_Id": true,
1736 - "data_office365_InterSystemsId": true,
1737 - "data_office365_InternalLogonType": true,
1738 - "data_office365_IntraSystemId": true,
1739 - "data_office365_IsManagedDevice": true,
1740 - "data_office365_ItemName": true,
1741 - "data_office365_ItemType": true,
1742 - "data_office365_Item_Id": true,
1743 - "data_office365_Item_InternetMessageId": true,
1744 - "data_office365_Item_IsRecord": true,
1745 - "data_office365_Item_ParentFolder_Id": true,
1746 - "data_office365_Item_SizeInBytes": true,
1747 - "data_office365_JitTriggered": true,
1748 - "data_office365_JoinTime": true,
1749 - "data_office365_LeaveTime": true,
1750 - "data_office365_ListBaseType": true,
1751 - "data_office365_ListId": true,
1752 - "data_office365_ListItemUniqueId": true,
1753 - "data_office365_ListServerTemplate": true,
1754 - "data_office365_LogonError": true,
1755 - "data_office365_LogonType": true,
1756 - "data_office365_LogonUserSid": true,
1757 - "data_office365_MDATPDeviceId": true,
1758 - "data_office365_MailboxGuid": true,
1759 - "data_office365_MailboxOwnerSid": true,
1760 - "data_office365_MailboxOwnerUPN": true,
1761 - "data_office365_MeetingDetailId": true,
1762 - "data_office365_MeetingURL": true,
1763 - "data_office365_Members": true,
1764 - "data_office365_MessageId": true,
1765 - "data_office365_MessageSizeInBytes": true,
1766 - "data_office365_MessageURLs": true,
1767 - "data_office365_MessageVersion": true,
1768 - "data_office365_Modalities": true,
1769 - "data_office365_ModifiedProperties": true,
1770 - "data_office365_Name": true,
1771 - "data_office365_NewValue": true,
1772 - "data_office365_ObjectId": false,
1773 - "data_office365_Operation": true,
1774 - "data_office365_OperationScope": true,
1775 - "data_office365_OrganizationId": true,
1776 - "data_office365_OrganizationName": true,
1777 - "data_office365_Organizer_OrganizationId": true,
1778 - "data_office365_Organizer_RecipientType": true,
1779 - "data_office365_Organizer_Role": true,
1780 - "data_office365_Organizer_UserObjectId": true,
1781 - "data_office365_OriginatingDomain": true,
1782 - "data_office365_OriginatingServer": true,
1783 - "data_office365_Parameters": true,
1784 - "data_office365_ParentMessageId": true,
1785 - "data_office365_Platform": true,
1786 - "data_office365_PreviousFileName": true,
1787 - "data_office365_ProviderTypes": true,
1788 - "data_office365_RMSEncrypted": true,
1789 - "data_office365_RecordType": true,
1790 - "data_office365_ResultStatus": true,
1791 - "data_office365_Scope": true,
1792 - "data_office365_SensitiveInfoTypeData": true,
1793 - "data_office365_SessionId": true,
1794 - "data_office365_Sha1": true,
1795 - "data_office365_Sha256": true,
1796 - "data_office365_Site": true,
1797 - "data_office365_SiteUrl": true,
1798 - "data_office365_SourceFileExtension": true,
1799 - "data_office365_SourceFileName": true,
1800 - "data_office365_SourceLocationType": true,
1801 - "data_office365_SourceRelativeUrl": true,
1802 - "data_office365_StartTime": true,
1803 - "data_office365_Subscription": true,
1804 - "data_office365_SubscriptionId": true,
1805 - "data_office365_Target": true,
1806 - "data_office365_TargetContextId": true,
1807 - "data_office365_TargetFilePath": true,
1808 - "data_office365_TargetPrinterName": true,
1809 - "data_office365_TeamGuid": true,
1810 - "data_office365_TeamName": true,
1811 - "data_office365_UserId": false,
1812 - "data_office365_UserKey": true,
1813 - "data_office365_UserType": true,
1814 - "data_office365_Version": true,
1815 - "data_office365_WebId": true,
1816 - "data_office365_Workload": true,
1817 - "data_osquery_action": true,
1818 - "data_osquery_calendarTime": true,
1819 - "data_osquery_columns_address": true,
1820 - "data_osquery_columns_address_city_name": true,
1821 - "data_osquery_columns_address_country_code": true,
1822 - "data_osquery_columns_address_geolocation": true,
1823 - "data_osquery_columns_cmdline": true,
1824 - "data_osquery_columns_cwd": true,
1825 - "data_osquery_columns_description": true,
1826 - "data_osquery_columns_directory": true,
1827 - "data_osquery_columns_disk_bytes_read": true,
1828 - "data_osquery_columns_disk_bytes_written": true,
1829 - "data_osquery_columns_egid": true,
1830 - "data_osquery_columns_euid": true,
1831 - "data_osquery_columns_family": true,
1832 - "data_osquery_columns_fd": true,
1833 - "data_osquery_columns_gid": true,
1834 - "data_osquery_columns_gid_signed": true,
1835 - "data_osquery_columns_host": true,
1836 - "data_osquery_columns_interface": true,
1837 - "data_osquery_columns_local_address": true,
1838 - "data_osquery_columns_local_address_city_name": true,
1839 - "data_osquery_columns_local_address_country_code": true,
1840 - "data_osquery_columns_local_address_geolocation": true,
1841 - "data_osquery_columns_local_port": true,
1842 - "data_osquery_columns_mac": true,
1843 - "data_osquery_columns_name": true,
1844 - "data_osquery_columns_net_namespace": true,
1845 - "data_osquery_columns_nice": true,
1846 - "data_osquery_columns_on_disk": true,
1847 - "data_osquery_columns_parent": true,
1848 - "data_osquery_columns_path": true,
1849 - "data_osquery_columns_pgroup": true,
1850 - "data_osquery_columns_pid": true,
1851 - "data_osquery_columns_port": true,
1852 - "data_osquery_columns_protocol": true,
1853 - "data_osquery_columns_remote_address": true,
1854 - "data_osquery_columns_remote_address_city_name": true,
1855 - "data_osquery_columns_remote_address_country_code": true,
1856 - "data_osquery_columns_remote_address_geolocation": true,
1857 - "data_osquery_columns_remote_port": true,
1858 - "data_osquery_columns_resident_size": true,
1859 - "data_osquery_columns_root": true,
1860 - "data_osquery_columns_sgid": true,
1861 - "data_osquery_columns_shell": true,
1862 - "data_osquery_columns_socket": true,
1863 - "data_osquery_columns_start_time": true,
1864 - "data_osquery_columns_state": true,
1865 - "data_osquery_columns_suid": true,
1866 - "data_osquery_columns_system_time": true,
1867 - "data_osquery_columns_threads": true,
1868 - "data_osquery_columns_time_utc": true,
1869 - "data_osquery_columns_total_size": true,
1870 - "data_osquery_columns_tty": true,
1871 - "data_osquery_columns_type": true,
1872 - "data_osquery_columns_uid": true,
1873 - "data_osquery_columns_uid_signed": true,
1874 - "data_osquery_columns_user": true,
1875 - "data_osquery_columns_user_time": true,
1876 - "data_osquery_columns_username": true,
1877 - "data_osquery_columns_wired_size": true,
1878 - "data_osquery_counter": true,
1879 - "data_osquery_decorations_host_uuid": true,
1880 - "data_osquery_decorations_hostname": true,
1881 - "data_osquery_epoch": true,
1882 - "data_osquery_hostIdentifier": true,
1883 - "data_osquery_name": true,
1884 - "data_osquery_numerics": true,
1885 - "data_osquery_unixTime": true,
1886 - "data_proto": true,
1887 - "data_sca_check_command": true,
1888 - "data_sca_check_compliance_cis": true,
1889 - "data_sca_check_compliance_cis_csc": true,
1890 - "data_sca_check_compliance_gdpr_IV": true,
1891 - "data_sca_check_compliance_gpg_13": true,
1892 - "data_sca_check_compliance_hipaa": true,
1893 - "data_sca_check_compliance_nist_800_53": true,
1894 - "data_sca_check_compliance_pci_dss": true,
1895 - "data_sca_check_compliance_tsc": true,
1896 - "data_sca_check_description": true,
1897 - "data_sca_check_id": true,
1898 - "data_sca_check_previous_result": true,
1899 - "data_sca_check_rationale": true,
1900 - "data_sca_check_remediation": true,
1901 - "data_sca_check_result": true,
1902 - "data_sca_check_title": true,
1903 - "data_sca_description": true,
1904 - "data_sca_failed": true,
1905 - "data_sca_file": true,
1906 - "data_sca_invalid": true,
1907 - "data_sca_passed": true,
1908 - "data_sca_policy": true,
1909 - "data_sca_policy_id": true,
1910 - "data_sca_scan_id": true,
1911 - "data_sca_score": true,
1912 - "data_sca_total_checks": true,
1913 - "data_sca_type": true,
1914 - "data_script": true,
1915 - "data_src_ip": true,
1916 - "data_src_ip_city_name": true,
1917 - "data_src_ip_country_code": true,
1918 - "data_src_ip_geolocation": true,
1919 - "data_src_port": true,
1920 - "data_srcip": true,
1921 - "data_srcip_city_name": true,
1922 - "data_srcip_country_code": true,
1923 - "data_srcip_geolocation": true,
1924 - "data_srcuser": true,
1925 - "data_timestamp": true,
1926 - "data_title": true,
1927 - "data_tls_session_resumed": true,
1928 - "data_tls_version": true,
1929 - "data_tx_id": true,
1930 - "data_type": true,
1931 - "data_win_eventXML_binaryData": true,
1932 - "data_win_eventXML_binaryDataSize": true,
1933 - "data_win_eventXML_param1": true,
1934 - "data_win_eventdata_authenticationPackageName": true,
1935 - "data_win_eventdata_callTrace": true,
1936 - "data_win_eventdata_commandLine": true,
1937 - "data_win_eventdata_company": true,
1938 - "data_win_eventdata_creationUtcTime": true,
1939 - "data_win_eventdata_currentDirectory": true,
1940 - "data_win_eventdata_description": true,
1941 - "data_win_eventdata_destinationHostname": true,
1942 - "data_win_eventdata_destinationIp": true,
1943 - "data_win_eventdata_destinationIp_city_name": true,
1944 - "data_win_eventdata_destinationIp_country_code": true,
1945 - "data_win_eventdata_destinationIp_geolocation": true,
1946 - "data_win_eventdata_destinationIsIpv6": true,
1947 - "data_win_eventdata_destinationPort": true,
1948 - "data_win_eventdata_destinationPortName": true,
1949 - "data_win_eventdata_details": true,
1950 - "data_win_eventdata_elevatedToken": true,
1951 - "data_win_eventdata_eventType": true,
1952 - "data_win_eventdata_fileVersion": true,
1953 - "data_win_eventdata_fileVersion_city_name": true,
1954 - "data_win_eventdata_fileVersion_country_code": true,
1955 - "data_win_eventdata_fileVersion_geolocation": true,
1956 - "data_win_eventdata_grantedAccess": true,
1957 - "data_win_eventdata_hashes": true,
1958 - "data_win_eventdata_image": true,
1959 - "data_win_eventdata_imageLoaded": true,
1960 - "data_win_eventdata_impersonationLevel": true,
1961 - "data_win_eventdata_initiated": true,
1962 - "data_win_eventdata_integrityLevel": true,
1963 - "data_win_eventdata_ipAddress": true,
1964 - "data_win_eventdata_ipPort": true,
1965 - "data_win_eventdata_keyLength": true,
1966 - "data_win_eventdata_logonGuid": true,
1967 - "data_win_eventdata_logonId": true,
1968 - "data_win_eventdata_logonProcessName": true,
1969 - "data_win_eventdata_logonType": true,
1970 - "data_win_eventdata_originalFileName": true,
1971 - "data_win_eventdata_param1": true,
1972 - "data_win_eventdata_param2": true,
1973 - "data_win_eventdata_param3": true,
1974 - "data_win_eventdata_param4": true,
1975 - "data_win_eventdata_parentCommandLine": true,
1976 - "data_win_eventdata_parentImage": true,
1977 - "data_win_eventdata_parentProcessGuid": true,
1978 - "data_win_eventdata_parentProcessId": true,
1979 - "data_win_eventdata_processGuid": true,
1980 - "data_win_eventdata_processId": true,
1981 - "data_win_eventdata_processName": true,
1982 - "data_win_eventdata_product": true,
1983 - "data_win_eventdata_protocol": true,
1984 - "data_win_eventdata_queryName": true,
1985 - "data_win_eventdata_queryResults": true,
1986 - "data_win_eventdata_queryStatus": true,
1987 - "data_win_eventdata_ruleName": true,
1988 - "data_win_eventdata_serviceName": true,
1989 - "data_win_eventdata_serviceSid": true,
1990 - "data_win_eventdata_signature": true,
1991 - "data_win_eventdata_signatureStatus": true,
1992 - "data_win_eventdata_signed": true,
1993 - "data_win_eventdata_sourceHostname": true,
1994 - "data_win_eventdata_sourceImage": true,
1995 - "data_win_eventdata_sourceIp": true,
1996 - "data_win_eventdata_sourceIp_city_name": true,
1997 - "data_win_eventdata_sourceIp_country_code": true,
1998 - "data_win_eventdata_sourceIp_geolocation": true,
1999 - "data_win_eventdata_sourceIsIpv6": true,
2000 - "data_win_eventdata_sourcePort": true,
2001 - "data_win_eventdata_sourceProcessGUID": true,
2002 - "data_win_eventdata_sourceProcessId": true,
2003 - "data_win_eventdata_sourceThreadId": true,
2004 - "data_win_eventdata_status": true,
2005 - "data_win_eventdata_subjectDomainName": true,
2006 - "data_win_eventdata_subjectLogonId": true,
2007 - "data_win_eventdata_subjectUserName": true,
2008 - "data_win_eventdata_subjectUserSid": true,
2009 - "data_win_eventdata_targetDomainName": true,
2010 - "data_win_eventdata_targetFilename": true,
2011 - "data_win_eventdata_targetImage": true,
2012 - "data_win_eventdata_targetLinkedLogonId": true,
2013 - "data_win_eventdata_targetLogonId": true,
2014 - "data_win_eventdata_targetObject": true,
2015 - "data_win_eventdata_targetProcessGUID": true,
2016 - "data_win_eventdata_targetProcessId": true,
2017 - "data_win_eventdata_targetUserName": true,
2018 - "data_win_eventdata_targetUserSid": true,
2019 - "data_win_eventdata_terminalSessionId": true,
2020 - "data_win_eventdata_ticketEncryptionType": true,
2021 - "data_win_eventdata_ticketOptions": true,
2022 - "data_win_eventdata_user": true,
2023 - "data_win_eventdata_utcTime": true,
2024 - "data_win_eventdata_virtualAccount": true,
2025 - "data_win_system_channel": true,
2026 - "data_win_system_computer": true,
2027 - "data_win_system_eventID": true,
2028 - "data_win_system_eventRecordID": true,
2029 - "data_win_system_eventSourceName": true,
2030 - "data_win_system_keywords": true,
2031 - "data_win_system_level": true,
2032 - "data_win_system_message": true,
2033 - "data_win_system_opcode": true,
2034 - "data_win_system_processID": true,
2035 - "data_win_system_providerGuid": true,
2036 - "data_win_system_providerName": true,
2037 - "data_win_system_severityValue": true,
2038 - "data_win_system_systemTime": true,
2039 - "data_win_system_task": true,
2040 - "data_win_system_threadID": true,
2041 - "data_win_system_version": true,
2042 - "decoder_name": true,
2043 - "decoder_parent": true,
2044 - "dns_query": true,
2045 - "dns_query_threat_indicated": true,
2046 - "dst_ip": true,
2047 - "dst_ip_city_name": true,
2048 - "dst_ip_country_code": true,
2049 - "dst_ip_geolocation": true,
2050 - "dst_ip_threat_indicated": true,
2051 - "dst_port": true,
2052 - "ecs_version": true,
2053 - "error": true,
2054 - "event_hash": true,
2055 - "file_path": true,
2056 - "firewall_rule_name": true,
2057 - "full_log": false,
2058 - "gl2_accounted_message_size": true,
2059 - "gl2_message_id": true,
2060 - "gl2_processing_error": true,
2061 - "gl2_remote_ip": true,
2062 - "gl2_remote_port": true,
2063 - "gl2_source_collector": true,
2064 - "gl2_source_input": true,
2065 - "gl2_source_node": true,
2066 - "hash_md5": true,
2067 - "hash_sha1": true,
2068 - "hash_sha256": true,
2069 - "highlight": true,
2070 - "host_architecture": true,
2071 - "host_containerized": true,
2072 - "host_hostname": true,
2073 - "host_id": true,
2074 - "host_ip": true,
2075 - "host_mac": true,
2076 - "host_name": true,
2077 - "host_os_codename": true,
2078 - "host_os_kernel": true,
2079 - "host_os_name": true,
2080 - "host_os_platform": true,
2081 - "host_os_version": true,
2082 - "hostname": true,
2083 - "id": true,
2084 - "input_type": true,
2085 - "level": true,
2086 - "location": true,
2087 - "log_file_path": true,
2088 - "log_offset": true,
2089 - "manager_name": true,
2090 - "message": true,
2091 - "module": true,
2092 - "msg_timestamp": true,
2093 - "parent_process_cmd_line": true,
2094 - "parent_process_id": true,
2095 - "parent_process_image": true,
2096 - "pid": true,
2097 - "predecoder_hostname": true,
2098 - "predecoder_program_name": true,
2099 - "predecoder_timestamp": true,
2100 - "previous_log": true,
2101 - "previous_output": true,
2102 - "process_cmd_line": true,
2103 - "process_id": true,
2104 - "process_image": true,
2105 - "process_name": true,
2106 - "protocol": true,
2107 - "rule_cis": true,
2108 - "rule_cis_csc": true,
2109 - "rule_firedtimes": true,
2110 - "rule_gdpr": true,
2111 - "rule_gdpr_IV": true,
2112 - "rule_gpg13": true,
2113 - "rule_gpg_13": true,
2114 - "rule_group1": true,
2115 - "rule_group2": true,
2116 - "rule_groups": true,
2117 - "rule_hipaa": true,
2118 - "rule_id": true,
2119 - "rule_info": true,
2120 - "rule_mail": true,
2121 - "rule_mitre_id": true,
2122 - "rule_mitre_tactic": false,
2123 - "rule_nist_800_53": true,
2124 - "rule_pci_dss": true,
2125 - "rule_tsc": true,
2126 - "scanid": true,
2127 - "service": true,
2128 - "software_package": true,
2129 - "software_vendor": true,
2130 - "sort": true,
2131 - "source": true,
2132 - "source_reserved_ip": true,
2133 - "src_ip": true,
2134 - "src_ip_city_name": true,
2135 - "src_ip_country_code": true,
2136 - "src_ip_geolocation": true,
2137 - "src_port": true,
2138 - "streams": true,
2139 - "syscheck_attrs_after": true,
2140 - "syscheck_audit_effective_user_id": true,
2141 - "syscheck_audit_effective_user_name": true,
2142 - "syscheck_audit_group_id": true,
2143 - "syscheck_audit_group_name": true,
2144 - "syscheck_audit_login_user_id": true,
2145 - "syscheck_audit_login_user_name": true,
2146 - "syscheck_audit_process_cwd": true,
2147 - "syscheck_audit_process_id": true,
2148 - "syscheck_audit_process_name": true,
2149 - "syscheck_audit_process_parent_cwd": true,
2150 - "syscheck_audit_process_parent_name": true,
2151 - "syscheck_audit_process_ppid": true,
2152 - "syscheck_audit_user_id": true,
2153 - "syscheck_audit_user_name": true,
2154 - "syscheck_changed_attributes": true,
2155 - "syscheck_event": true,
2156 - "syscheck_gid_after": true,
2157 - "syscheck_gname_after": true,
2158 - "syscheck_hard_links": true,
2159 - "syscheck_inode_after": true,
2160 - "syscheck_inode_before": true,
2161 - "syscheck_md5_after": true,
2162 - "syscheck_md5_before": true,
2163 - "syscheck_mode": true,
2164 - "syscheck_mtime_after": true,
2165 - "syscheck_mtime_before": true,
2166 - "syscheck_path": true,
2167 - "syscheck_perm_after": true,
2168 - "syscheck_perm_before": true,
2169 - "syscheck_sha1_after": true,
2170 - "syscheck_sha1_before": true,
2171 - "syscheck_sha256_after": true,
2172 - "syscheck_sha256_before": true,
2173 - "syscheck_size_after": true,
2174 - "syscheck_size_before": true,
2175 - "syscheck_uid_after": true,
2176 - "syscheck_uname_after": true,
2177 - "syscheck_win_perm_after": true,
2178 - "syscheck_win_perm_after_0_allowed": true,
2179 - "syscheck_win_perm_after_0_name": true,
2180 - "syscheck_win_perm_after_1_allowed": true,
2181 - "syscheck_win_perm_after_1_name": true,
2182 - "syscheck_win_perm_after_2_allowed": true,
2183 - "syscheck_win_perm_after_2_name": true,
2184 - "syscheck_win_perm_after_3_allowed": true,
2185 - "syscheck_win_perm_after_3_name": true,
2186 - "syslog_customer": true,
2187 - "syslog_level": true,
2188 - "syslog_tag": true,
2189 - "syslog_type": true,
2190 - "sysmon_event_description": true,
2191 - "threat_ids": true,
2192 - "threat_indicated": true,
2193 - "threat_names": true,
2194 - "time": true,
2195 - "timestamp": true,
2196 - "true": true,
2197 - "user_name": true,
2198 - "win_registry_key": true,
2199 - "win_system_eventID": true,
2200 - "windows_auth_package": true,
2201 - "windows_domain": true,
2202 - "windows_event_id": true,
2203 - "windows_event_severity": true,
2204 - "windows_logon_type": true
2205 - },
2206 - "indexByName": {
2207 - "_id": 2,
2208 - "_index": 10,
2209 - "_type": 11,
2210 - "agent_id": 12,
2211 - "agent_name": 6,
2212 - "cluster_name": 13,
2213 - "cluster_node": 14,
2214 - "data_integration": 48,
2215 - "data_office365_Application": 49,
2216 - "data_office365_ClientIP": 4,
2217 - "data_office365_ClientIP_city_name": 15,
2218 - "data_office365_ClientIP_country_code": 16,
2219 - "data_office365_ClientIP_geolocation": 17,
2220 - "data_office365_CreationTime": 0,
2221 - "data_office365_DeviceName": 5,
2222 - "data_office365_FileSize": 50,
2223 - "data_office365_FileType": 51,
2224 - "data_office365_Hidden": 53,
2225 - "data_office365_Id": 18,
2226 - "data_office365_MDATPDeviceId": 54,
2227 - "data_office365_ObjectId": 52,
2228 - "data_office365_Operation": 24,
2229 - "data_office365_OrganizationId": 19,
2230 - "data_office365_Platform": 55,
2231 - "data_office365_RecordType": 20,
2232 - "data_office365_Scope": 56,
2233 - "data_office365_SourceLocationType": 57,
2234 - "data_office365_Subscription": 58,
2235 - "data_office365_UserId": 3,
2236 - "data_office365_UserKey": 21,
2237 - "data_office365_UserType": 22,
2238 - "data_office365_Version": 23,
2239 - "data_office365_Workload": 47,
2240 - "decoder_name": 25,
2241 - "gl2_accounted_message_size": 26,
2242 - "gl2_message_id": 27,
2243 - "gl2_processing_error": 28,
2244 - "gl2_remote_ip": 29,
2245 - "gl2_remote_port": 30,
2246 - "gl2_source_input": 31,
2247 - "gl2_source_node": 32,
2248 - "highlight": 33,
2249 - "id": 34,
2250 - "location": 35,
2251 - "manager_name": 36,
2252 - "message": 37,
2253 - "msg_timestamp": 59,
2254 - "rule_description": 7,
2255 - "rule_firedtimes": 38,
2256 - "rule_group1": 39,
2257 - "rule_group2": 60,
2258 - "rule_groups": 40,
2259 - "rule_hipaa": 61,
2260 - "rule_id": 9,
2261 - "rule_level": 8,
2262 - "rule_mail": 41,
2263 - "rule_pci_dss": 62,
2264 - "sort": 42,
2265 - "source": 43,
2266 - "source_reserved_ip": 63,
2267 - "streams": 44,
2268 - "syslog_type": 45,
2269 - "timestamp": 1,
2270 - "true": 46
2271 - },
2272 - "renameByName": {
2273 - "_id": "EVENT ID",
2274 - "agent_name": "",
2275 - "data_office365_ActorIpAddress": "SRC IP",
2276 - "data_office365_AffectedItems": "ITEMS",
2277 - "data_office365_Application": "APP",
2278 - "data_office365_BrowserName": "BROWSER",
2279 - "data_office365_ClientIP": "CLIENT IP",
2280 - "data_office365_ClientIP_city_name": "",
2281 - "data_office365_CreationTime": "EVENT TIME",
2282 - "data_office365_DeviceDisplayName": "",
2283 - "data_office365_DeviceName": "DEVICE",
2284 - "data_office365_FileType": "FILE TYPE",
2285 - "data_office365_Item_Attachments": "ATTACHMENT",
2286 - "data_office365_Item_ParentFolder_Path": "FOLDER",
2287 - "data_office365_Item_Subject": "SUBJECT",
2288 - "data_office365_ObjectId": "OBJECT",
2289 - "data_office365_ResultStatus": "RESULT",
2290 - "data_office365_UserAgent": "USER AGENT",
2291 - "data_office365_UserId": "ACCOUNT",
2292 - "rule_description": "DESCRIPTION",
2293 - "rule_id": "RULE ID",
2294 - "rule_level": "",
2295 - "rule_mitre_tactic": "MITRE TACTIC",
2296 - "rule_mitre_technique": "MITRE TECHNIQUE",
2297 - "timestamp": "Date/Time"
2298 - }
2299 - }
2300 - }
2301 - ],
2302 - "transparent": true,
2303 - "type": "table"
2304 - }
2305 - ],
2306 - "refresh": "",
2307 - "schemaVersion": 38,
2308 - "style": "dark",
2309 - "tags": [
2310 - "O365"
2311 - ],
2312 - "templating": {
2313 - "list": [
2314 - {
2315 - "datasource": {
2316 - "type": "elasticsearch",
2317 - "uid": "replace_datasource_uid"
2318 - },
2319 - "filters": [],
2320 - "hide": 0,
2321 - "label": "",
2322 - "name": "Filters",
2323 - "skipUrlSync": false,
2324 - "type": "adhoc"
2325 - },
2326 - {
2327 - "current": {
2328 - "selected": false,
2329 - "text": "All",
2330 - "value": "$__all"
2331 - },
2332 - "datasource": {
2333 - "type": "elasticsearch",
2334 - "uid": "replace_datasource_uid"
2335 - },
2336 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Endpoint\"}",
2337 - "hide": 0,
2338 - "includeAll": true,
2339 - "label": "Operation",
2340 - "multi": false,
2341 - "name": "operation",
2342 - "options": [],
2343 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Endpoint\"}",
2344 - "refresh": 2,
2345 - "regex": "",
2346 - "skipUrlSync": false,
2347 - "sort": 1,
2348 - "tagValuesQuery": "",
2349 - "tagsQuery": "",
2350 - "type": "query",
2351 - "useTags": false
2352 - },
2353 - {
2354 - "current": {
2355 - "selected": false,
2356 - "text": "All",
2357 - "value": "$__all"
2358 - },
2359 - "datasource": {
2360 - "type": "elasticsearch",
2361 - "uid": "replace_datasource_uid"
2362 - },
2363 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:Endpoint\"}",
2364 - "hide": 0,
2365 - "includeAll": true,
2366 - "label": "Rule Level",
2367 - "multi": false,
2368 - "name": "rule_level",
2369 - "options": [],
2370 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:Endpoint\"}",
2371 - "refresh": 2,
2372 - "regex": "",
2373 - "skipUrlSync": false,
2374 - "sort": 0,
2375 - "type": "query"
2376 - }
2377 - ]
2378 - },
2379 - "time": {
2380 - "from": "now-12h",
2381 - "to": "now"
2382 - },
2383 - "timepicker": {
2384 - "refresh_intervals": [
2385 - "5s",
2386 - "10s",
2387 - "30s",
2388 - "1m",
2389 - "5m",
2390 - "15m",
2391 - "30m",
2392 - "1h",
2393 - "2h",
2394 - "1d"
2395 - ],
2396 - "time_options": [
2397 - "5m",
2398 - "15m",
2399 - "1h",
2400 - "6h",
2401 - "12h",
2402 - "24h",
2403 - "2d",
2404 - "7d",
2405 - "30d"
2406 - ]
2407 - },
2408 - "timezone": "",
2409 - "title": "O365 - ENDPOINT",
2410 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "10.0.3",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:Endpoint",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "cellOptions": {
255 + "type": "auto"
256 + },
257 + "inspect": false
258 + },
259 + "mappings": [],
260 + "thresholds": {
261 + "mode": "absolute",
262 + "steps": [
263 + {
264 + "color": "red",
265 + "value": null
266 + }
267 + ]
268 + }
269 + },
270 + "overrides": [
271 + {
272 + "matcher": {
273 + "id": "byName",
274 + "options": "Count"
275 + },
276 + "properties": [
277 + {
278 + "id": "displayName",
279 + "value": "EVENTS"
280 + },
281 + {
282 + "id": "unit",
283 + "value": "short"
284 + },
285 + {
286 + "id": "decimals",
287 + "value": -1
288 + },
289 + {
290 + "id": "custom.align"
291 + },
292 + {
293 + "id": "thresholds",
294 + "value": {
295 + "mode": "absolute",
296 + "steps": [
297 + {
298 + "color": "red",
299 + "value": null
300 + }
301 + ]
302 + }
303 + }
304 + ]
305 + }
306 + ]
307 + },
308 + "gridPos": {
309 + "h": 7,
310 + "w": 6,
311 + "x": 8,
312 + "y": 0
313 + },
314 + "id": 54,
315 + "options": {
316 + "cellHeight": "sm",
317 + "footer": {
318 + "countRows": false,
319 + "fields": "",
320 + "reducer": ["sum"],
321 + "show": false
322 + },
323 + "showHeader": true
324 + },
325 + "pluginVersion": "10.0.3",
326 + "targets": [
327 + {
328 + "bucketAggs": [
329 + {
330 + "fake": true,
331 + "field": "data_office365_Operation",
332 + "id": "4",
333 + "settings": {
334 + "min_doc_count": 1,
335 + "order": "desc",
336 + "orderBy": "_count",
337 + "size": "0"
338 + },
339 + "type": "terms"
340 + }
341 + ],
342 + "datasource": {
343 + "type": "elasticsearch",
344 + "uid": "replace_datasource_uid"
345 + },
346 + "metrics": [
347 + {
348 + "field": "select field",
349 + "id": "1",
350 + "type": "count"
351 + }
352 + ],
353 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
354 + "refId": "A",
355 + "timeField": "timestamp"
356 + }
357 + ],
358 + "title": "EVENTS BY OPERATION",
359 + "transformations": [
360 + {
361 + "id": "merge",
362 + "options": {
363 + "reducers": []
364 + }
365 + },
366 + {
367 + "id": "organize",
368 + "options": {
369 + "excludeByName": {},
370 + "indexByName": {},
371 + "renameByName": {
372 + "Count": "EVENTS",
373 + "data_office365_Operation": "OPERATION"
374 + }
375 + }
376 + }
377 + ],
378 + "type": "table"
379 + },
380 + {
381 + "datasource": {
382 + "type": "elasticsearch",
383 + "uid": "replace_datasource_uid"
384 + },
385 + "fieldConfig": {
386 + "defaults": {
387 + "color": {
388 + "mode": "thresholds"
389 + },
390 + "custom": {
391 + "align": "auto",
392 + "cellOptions": {
393 + "type": "auto"
394 + },
395 + "inspect": false
396 + },
397 + "mappings": [],
398 + "thresholds": {
399 + "mode": "absolute",
400 + "steps": [
401 + {
402 + "color": "red",
403 + "value": null
404 + }
405 + ]
406 + }
407 + },
408 + "overrides": [
409 + {
410 + "matcher": {
411 + "id": "byName",
412 + "options": "Count"
413 + },
414 + "properties": [
415 + {
416 + "id": "displayName",
417 + "value": "EVENTS"
418 + },
419 + {
420 + "id": "unit",
421 + "value": "short"
422 + },
423 + {
424 + "id": "decimals",
425 + "value": -1
426 + },
427 + {
428 + "id": "custom.align"
429 + },
430 + {
431 + "id": "thresholds",
432 + "value": {
433 + "mode": "absolute",
434 + "steps": [
435 + {
436 + "color": "red",
437 + "value": null
438 + }
439 + ]
440 + }
441 + }
442 + ]
443 + }
444 + ]
445 + },
446 + "gridPos": {
447 + "h": 7,
448 + "w": 6,
449 + "x": 14,
450 + "y": 0
451 + },
452 + "id": 61,
453 + "options": {
454 + "cellHeight": "sm",
455 + "footer": {
456 + "countRows": false,
457 + "fields": "",
458 + "reducer": ["sum"],
459 + "show": false
460 + },
461 + "showHeader": true
462 + },
463 + "pluginVersion": "10.0.3",
464 + "targets": [
465 + {
466 + "bucketAggs": [
467 + {
468 + "fake": true,
469 + "field": "data_office365_Application",
470 + "id": "4",
471 + "settings": {
472 + "min_doc_count": 1,
473 + "order": "desc",
474 + "orderBy": "_count",
475 + "size": "0"
476 + },
477 + "type": "terms"
478 + }
479 + ],
480 + "datasource": {
481 + "type": "elasticsearch",
482 + "uid": "replace_datasource_uid"
483 + },
484 + "metrics": [
485 + {
486 + "field": "select field",
487 + "id": "1",
488 + "type": "count"
489 + }
490 + ],
491 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
492 + "refId": "A",
493 + "timeField": "timestamp"
494 + }
495 + ],
496 + "title": "EVENTS BY APPLICATION",
497 + "transformations": [
498 + {
499 + "id": "merge",
500 + "options": {
501 + "reducers": []
502 + }
503 + },
504 + {
505 + "id": "organize",
506 + "options": {
507 + "excludeByName": {},
508 + "indexByName": {},
509 + "renameByName": {
510 + "Count": "EVENTS",
511 + "data_office365_Application": "APP",
512 + "data_office365_DeviceName": "DEVICE",
513 + "data_office365_Operation": "OPERATION"
514 + }
515 + }
516 + }
517 + ],
518 + "type": "table"
519 + },
520 + {
521 + "datasource": {
522 + "type": "elasticsearch",
523 + "uid": "replace_datasource_uid"
524 + },
525 + "fieldConfig": {
526 + "defaults": {
527 + "color": {
528 + "mode": "thresholds"
529 + },
530 + "mappings": [
531 + {
532 + "options": {
533 + "match": "null",
534 + "result": {
535 + "text": "N/A"
536 + }
537 + },
538 + "type": "special"
539 + }
540 + ],
541 + "max": 15,
542 + "min": 0,
543 + "thresholds": {
544 + "mode": "absolute",
545 + "steps": [
546 + {
547 + "color": "#299c46",
548 + "value": null
549 + },
550 + {
551 + "color": "rgba(237, 129, 40, 0.89)",
552 + "value": 8
553 + },
554 + {
555 + "color": "#d44a3a",
556 + "value": 12
557 + }
558 + ]
559 + },
560 + "unit": "none"
561 + },
562 + "overrides": []
563 + },
564 + "gridPos": {
565 + "h": 7,
566 + "w": 4,
567 + "x": 0,
568 + "y": 7
569 + },
570 + "id": 16,
571 + "links": [],
572 + "options": {
573 + "orientation": "horizontal",
574 + "reduceOptions": {
575 + "calcs": ["max"],
576 + "fields": "",
577 + "values": false
578 + },
579 + "showThresholdLabels": false,
580 + "showThresholdMarkers": true,
581 + "text": {}
582 + },
583 + "pluginVersion": "10.0.3",
584 + "targets": [
585 + {
586 + "bucketAggs": [
587 + {
588 + "field": "timestamp",
589 + "id": "2",
590 + "settings": {
591 + "interval": "auto",
592 + "min_doc_count": 0,
593 + "trimEdges": 0
594 + },
595 + "type": "date_histogram"
596 + }
597 + ],
598 + "datasource": {
599 + "type": "elasticsearch",
600 + "uid": "replace_datasource_uid"
601 + },
602 + "metrics": [
603 + {
604 + "field": "rule_level",
605 + "id": "1",
606 + "meta": {},
607 + "settings": {},
608 + "type": "max"
609 + }
610 + ],
611 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
612 + "refId": "A",
613 + "timeField": "timestamp"
614 + }
615 + ],
616 + "title": "MAX SEVERITY (0 - 15)",
617 + "type": "gauge"
618 + },
619 + {
620 + "datasource": {
621 + "type": "elasticsearch",
622 + "uid": "replace_datasource_uid"
623 + },
624 + "fieldConfig": {
625 + "defaults": {
626 + "color": {
627 + "mode": "palette-classic"
628 + },
629 + "custom": {
630 + "axisCenteredZero": false,
631 + "axisColorMode": "text",
632 + "axisLabel": "",
633 + "axisPlacement": "auto",
634 + "barAlignment": 0,
635 + "drawStyle": "bars",
636 + "fillOpacity": 0,
637 + "gradientMode": "none",
638 + "hideFrom": {
639 + "legend": false,
640 + "tooltip": false,
641 + "viz": false
642 + },
643 + "lineInterpolation": "linear",
644 + "lineWidth": 1,
645 + "pointSize": 5,
646 + "scaleDistribution": {
647 + "type": "linear"
648 + },
649 + "showPoints": "auto",
650 + "spanNulls": false,
651 + "stacking": {
652 + "group": "A",
653 + "mode": "normal"
654 + },
655 + "thresholdsStyle": {
656 + "mode": "off"
657 + }
658 + },
659 + "mappings": [],
660 + "thresholds": {
661 + "mode": "absolute",
662 + "steps": [
663 + {
664 + "color": "green",
665 + "value": null
666 + },
667 + {
668 + "color": "red",
669 + "value": 80
670 + }
671 + ]
672 + }
673 + },
674 + "overrides": []
675 + },
676 + "gridPos": {
677 + "h": 13,
678 + "w": 20,
679 + "x": 4,
680 + "y": 7
681 + },
682 + "id": 60,
683 + "options": {
684 + "legend": {
685 + "calcs": [],
686 + "displayMode": "table",
687 + "placement": "right",
688 + "showLegend": true
689 + },
690 + "tooltip": {
691 + "mode": "single",
692 + "sort": "none"
693 + }
694 + },
695 + "targets": [
696 + {
697 + "alias": "",
698 + "bucketAggs": [
699 + {
700 + "field": "data_office365_Operation",
701 + "id": "3",
702 + "settings": {
703 + "min_doc_count": "1",
704 + "order": "desc",
705 + "orderBy": "_count",
706 + "size": "10"
707 + },
708 + "type": "terms"
709 + },
710 + {
711 + "field": "timestamp",
712 + "id": "2",
713 + "settings": {
714 + "interval": "auto"
715 + },
716 + "type": "date_histogram"
717 + }
718 + ],
719 + "datasource": {
720 + "type": "elasticsearch",
721 + "uid": "replace_datasource_uid"
722 + },
723 + "metrics": [
724 + {
725 + "id": "1",
726 + "type": "count"
727 + }
728 + ],
729 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
730 + "refId": "A",
731 + "timeField": "timestamp"
732 + }
733 + ],
734 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
735 + "transparent": true,
736 + "type": "timeseries"
737 + },
738 + {
739 + "datasource": {
740 + "type": "elasticsearch",
741 + "uid": "replace_datasource_uid"
742 + },
743 + "fieldConfig": {
744 + "defaults": {
745 + "mappings": [
746 + {
747 + "options": {
748 + "match": "null",
749 + "result": {
750 + "text": "N/A"
751 + }
752 + },
753 + "type": "special"
754 + }
755 + ],
756 + "thresholds": {
757 + "mode": "absolute",
758 + "steps": [
759 + {
760 + "color": "blue",
761 + "value": null
762 + }
763 + ]
764 + },
765 + "unit": "locale"
766 + },
767 + "overrides": []
768 + },
769 + "gridPos": {
770 + "h": 6,
771 + "w": 4,
772 + "x": 0,
773 + "y": 14
774 + },
775 + "id": 51,
776 + "links": [],
777 + "options": {
778 + "colorMode": "value",
779 + "graphMode": "area",
780 + "justifyMode": "auto",
781 + "orientation": "horizontal",
782 + "reduceOptions": {
783 + "calcs": ["sum"],
784 + "fields": "",
785 + "values": false
786 + },
787 + "text": {},
788 + "textMode": "auto"
789 + },
790 + "pluginVersion": "10.0.3",
791 + "targets": [
792 + {
793 + "bucketAggs": [
794 + {
795 + "$$hashKey": "object:331",
796 + "field": "timestamp",
797 + "id": "2",
798 + "settings": {
799 + "interval": "auto",
800 + "min_doc_count": 0,
801 + "trimEdges": 0
802 + },
803 + "type": "date_histogram"
804 + }
805 + ],
806 + "datasource": {
807 + "type": "elasticsearch",
808 + "uid": "replace_datasource_uid"
809 + },
810 + "metrics": [
811 + {
812 + "$$hashKey": "object:329",
813 + "field": "select field",
814 + "id": "1",
815 + "type": "count"
816 + }
817 + ],
818 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
819 + "refId": "A",
820 + "timeField": "timestamp"
821 + }
822 + ],
823 + "title": "EVENTS (Total)",
824 + "type": "stat"
825 + },
826 + {
827 + "datasource": {
828 + "type": "elasticsearch",
829 + "uid": "replace_datasource_uid"
830 + },
831 + "fieldConfig": {
832 + "defaults": {
833 + "color": {
834 + "mode": "thresholds"
835 + },
836 + "custom": {
837 + "align": "auto",
838 + "cellOptions": {
839 + "type": "auto"
840 + },
841 + "inspect": false
842 + },
843 + "mappings": [],
844 + "thresholds": {
845 + "mode": "absolute",
846 + "steps": [
847 + {
848 + "color": "red",
849 + "value": null
850 + }
851 + ]
852 + }
853 + },
854 + "overrides": [
855 + {
856 + "matcher": {
857 + "id": "byName",
858 + "options": "Count"
859 + },
860 + "properties": [
861 + {
862 + "id": "displayName",
863 + "value": "EVENTS"
864 + },
865 + {
866 + "id": "unit",
867 + "value": "short"
868 + },
869 + {
870 + "id": "decimals",
871 + "value": -1
872 + },
873 + {
874 + "id": "custom.align"
875 + },
876 + {
877 + "id": "thresholds",
878 + "value": {
879 + "mode": "absolute",
880 + "steps": [
881 + {
882 + "color": "red",
883 + "value": null
884 + }
885 + ]
886 + }
887 + }
888 + ]
889 + },
890 + {
891 + "matcher": {
892 + "id": "byName",
893 + "options": "DEVICE"
894 + },
895 + "properties": [
896 + {
897 + "id": "custom.width",
898 + "value": 324
899 + }
900 + ]
901 + }
902 + ]
903 + },
904 + "gridPos": {
905 + "h": 12,
906 + "w": 7,
907 + "x": 0,
908 + "y": 20
909 + },
910 + "id": 62,
911 + "options": {
912 + "cellHeight": "sm",
913 + "footer": {
914 + "countRows": false,
915 + "fields": "",
916 + "reducer": ["sum"],
917 + "show": false
918 + },
919 + "showHeader": true,
920 + "sortBy": []
921 + },
922 + "pluginVersion": "10.0.3",
923 + "targets": [
924 + {
925 + "bucketAggs": [
926 + {
927 + "fake": true,
928 + "field": "data_office365_DeviceName",
929 + "id": "4",
930 + "settings": {
931 + "min_doc_count": 1,
932 + "order": "desc",
933 + "orderBy": "_count",
934 + "size": "0"
935 + },
936 + "type": "terms"
937 + },
938 + {
939 + "field": "data_office365_ClientIP_country_code",
940 + "id": "5",
941 + "settings": {
942 + "min_doc_count": "1",
943 + "order": "desc",
944 + "orderBy": "_term",
945 + "size": "10"
946 + },
947 + "type": "terms"
948 + }
949 + ],
950 + "datasource": {
951 + "type": "elasticsearch",
952 + "uid": "replace_datasource_uid"
953 + },
954 + "metrics": [
955 + {
956 + "field": "select field",
957 + "id": "1",
958 + "type": "count"
959 + }
960 + ],
961 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
962 + "refId": "A",
963 + "timeField": "timestamp"
964 + }
965 + ],
966 + "title": "EVENTS BY DEVICE",
967 + "transformations": [
968 + {
969 + "id": "merge",
970 + "options": {
971 + "reducers": []
972 + }
973 + },
974 + {
975 + "id": "organize",
976 + "options": {
977 + "excludeByName": {},
978 + "indexByName": {},
979 + "renameByName": {
980 + "Count": "EVENTS",
981 + "data_office365_ClientIP_country_code": "COUNTRY",
982 + "data_office365_DeviceName": "DEVICE",
983 + "data_office365_Operation": "OPERATION"
984 + }
985 + }
986 + }
987 + ],
988 + "type": "table"
989 + },
990 + {
991 + "circleMaxSize": 30,
992 + "circleMinSize": 2,
993 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
994 + "datasource": {
995 + "type": "elasticsearch",
996 + "uid": "replace_datasource_uid"
997 + },
998 + "decimals": 0,
999 + "esMetric": "Count",
1000 + "gridPos": {
1001 + "h": 12,
1002 + "w": 8,
1003 + "x": 7,
1004 + "y": 20
1005 + },
1006 + "hideEmpty": false,
1007 + "hideZero": false,
1008 + "id": 50,
1009 + "initialZoom": 1,
1010 + "locationData": "countries",
1011 + "mapCenter": "(0°, 0°)",
1012 + "mapCenterLatitude": 0,
1013 + "mapCenterLongitude": 0,
1014 + "maxDataPoints": 1,
1015 + "mouseWheelZoom": false,
1016 + "showLegend": true,
1017 + "stickyLabels": false,
1018 + "tableQueryOptions": {
1019 + "geohashField": "geohash",
1020 + "latitudeField": "latitude",
1021 + "longitudeField": "longitude",
1022 + "metricField": "metric",
1023 + "queryType": "geohash"
1024 + },
1025 + "targets": [
1026 + {
1027 + "bucketAggs": [
1028 + {
1029 + "fake": true,
1030 + "field": "data_office365_ClientIP_country_code",
1031 + "id": "3",
1032 + "settings": {
1033 + "min_doc_count": 1,
1034 + "order": "desc",
1035 + "orderBy": "_count",
1036 + "size": "0"
1037 + },
1038 + "type": "terms"
1039 + },
1040 + {
1041 + "field": "timestamp",
1042 + "id": "2",
1043 + "settings": {
1044 + "interval": "auto",
1045 + "min_doc_count": 0,
1046 + "trimEdges": 0
1047 + },
1048 + "type": "date_histogram"
1049 + }
1050 + ],
1051 + "datasource": {
1052 + "type": "elasticsearch",
1053 + "uid": "replace_datasource_uid"
1054 + },
1055 + "metrics": [
1056 + {
1057 + "field": "select field",
1058 + "id": "1",
1059 + "type": "count"
1060 + }
1061 + ],
1062 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
1063 + "refId": "A",
1064 + "timeField": "timestamp"
1065 + }
1066 + ],
1067 + "thresholds": "0,10",
1068 + "title": "Endpoint - ALL EVENTS BY SRC COUNTRY",
1069 + "type": "grafana-worldmap-panel",
1070 + "unitPlural": "",
1071 + "unitSingle": "",
1072 + "valueName": "total"
1073 + },
1074 + {
1075 + "datasource": {
1076 + "type": "elasticsearch",
1077 + "uid": "replace_datasource_uid"
1078 + },
1079 + "fieldConfig": {
1080 + "defaults": {
1081 + "color": {
1082 + "mode": "thresholds"
1083 + },
1084 + "custom": {
1085 + "align": "auto",
1086 + "cellOptions": {
1087 + "type": "auto"
1088 + },
1089 + "inspect": false
1090 + },
1091 + "mappings": [],
1092 + "thresholds": {
1093 + "mode": "absolute",
1094 + "steps": [
1095 + {
1096 + "color": "orange",
1097 + "value": null
1098 + }
1099 + ]
1100 + }
1101 + },
1102 + "overrides": [
1103 + {
1104 + "matcher": {
1105 + "id": "byName",
1106 + "options": "Count"
1107 + },
1108 + "properties": [
1109 + {
1110 + "id": "displayName",
1111 + "value": "EVENTS"
1112 + },
1113 + {
1114 + "id": "unit",
1115 + "value": "short"
1116 + },
1117 + {
1118 + "id": "decimals",
1119 + "value": -1
1120 + },
1121 + {
1122 + "id": "custom.align"
1123 + }
1124 + ]
1125 + },
1126 + {
1127 + "matcher": {
1128 + "id": "byName",
1129 + "options": "AD ACCOUNT"
1130 + },
1131 + "properties": [
1132 + {
1133 + "id": "custom.width",
1134 + "value": 377
1135 + }
1136 + ]
1137 + }
1138 + ]
1139 + },
1140 + "gridPos": {
1141 + "h": 12,
1142 + "w": 9,
1143 + "x": 15,
1144 + "y": 20
1145 + },
1146 + "id": 58,
1147 + "options": {
1148 + "cellHeight": "sm",
1149 + "footer": {
1150 + "countRows": false,
1151 + "fields": "",
1152 + "reducer": ["sum"],
1153 + "show": false
1154 + },
1155 + "showHeader": true,
1156 + "sortBy": []
1157 + },
1158 + "pluginVersion": "10.0.3",
1159 + "targets": [
1160 + {
1161 + "bucketAggs": [
1162 + {
1163 + "fake": true,
1164 + "field": "data_office365_UserId",
1165 + "id": "4",
1166 + "settings": {
1167 + "min_doc_count": 1,
1168 + "order": "desc",
1169 + "orderBy": "_count",
1170 + "size": "0"
1171 + },
1172 + "type": "terms"
1173 + },
1174 + {
1175 + "field": "data_office365_ClientIP_country_code",
1176 + "id": "5",
1177 + "settings": {
1178 + "min_doc_count": "1",
1179 + "order": "desc",
1180 + "orderBy": "_term",
1181 + "size": "10"
1182 + },
1183 + "type": "terms"
1184 + }
1185 + ],
1186 + "datasource": {
1187 + "type": "elasticsearch",
1188 + "uid": "replace_datasource_uid"
1189 + },
1190 + "metrics": [
1191 + {
1192 + "field": "select field",
1193 + "id": "1",
1194 + "type": "count"
1195 + }
1196 + ],
1197 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
1198 + "refId": "A",
1199 + "timeField": "timestamp"
1200 + }
1201 + ],
1202 + "title": "Endpoint EVENTS BY ACCOUNT",
1203 + "transformations": [
1204 + {
1205 + "id": "merge",
1206 + "options": {
1207 + "reducers": []
1208 + }
1209 + },
1210 + {
1211 + "id": "organize",
1212 + "options": {
1213 + "excludeByName": {},
1214 + "indexByName": {},
1215 + "renameByName": {
1216 + "Count": "EVENTS",
1217 + "data_office365_ClientIP_country_code": "COUNTRY",
1218 + "data_office365_LogonError": "ERROR",
1219 + "data_office365_Operation": "WORKLOAD",
1220 + "data_office365_UserId": "AD ACCOUNT"
1221 + }
1222 + }
1223 + }
1224 + ],
1225 + "type": "table"
1226 + },
1227 + {
1228 + "datasource": {
1229 + "type": "elasticsearch",
1230 + "uid": "replace_datasource_uid"
1231 + },
1232 + "fieldConfig": {
1233 + "defaults": {
1234 + "color": {
1235 + "mode": "thresholds"
1236 + },
1237 + "custom": {
1238 + "align": "auto",
1239 + "cellOptions": {
1240 + "type": "auto"
1241 + },
1242 + "filterable": true,
1243 + "inspect": false
1244 + },
1245 + "mappings": [],
1246 + "thresholds": {
1247 + "mode": "absolute",
1248 + "steps": [
1249 + {
1250 + "color": "green",
1251 + "value": null
1252 + },
1253 + {
1254 + "color": "red",
1255 + "value": 80
1256 + }
1257 + ]
1258 + }
1259 + },
1260 + "overrides": [
1261 + {
1262 + "matcher": {
1263 + "id": "byName",
1264 + "options": "rule_level"
1265 + },
1266 + "properties": [
1267 + {
1268 + "id": "displayName",
1269 + "value": "RULE LEVEL"
1270 + },
1271 + {
1272 + "id": "unit",
1273 + "value": "short"
1274 + },
1275 + {
1276 + "id": "decimals",
1277 + "value": -1
1278 + },
1279 + {
1280 + "id": "custom.cellOptions",
1281 + "value": {
1282 + "mode": "gradient",
1283 + "type": "color-background"
1284 + }
1285 + },
1286 + {
1287 + "id": "custom.align"
1288 + },
1289 + {
1290 + "id": "thresholds",
1291 + "value": {
1292 + "mode": "absolute",
1293 + "steps": [
1294 + {
1295 + "color": "#37872D",
1296 + "value": null
1297 + },
1298 + {
1299 + "color": "rgba(237, 129, 40, 0.89)",
1300 + "value": 7
1301 + },
1302 + {
1303 + "color": "rgba(245, 54, 54, 0.9)",
1304 + "value": 12
1305 + }
1306 + ]
1307 + }
1308 + }
1309 + ]
1310 + },
1311 + {
1312 + "matcher": {
1313 + "id": "byName",
1314 + "options": "Date/Time"
1315 + },
1316 + "properties": [
1317 + {
1318 + "id": "custom.width",
1319 + "value": 242
1320 + }
1321 + ]
1322 + },
1323 + {
1324 + "matcher": {
1325 + "id": "byName",
1326 + "options": "MITRE TACTIC"
1327 + },
1328 + "properties": [
1329 + {
1330 + "id": "custom.width",
1331 + "value": 332
1332 + }
1333 + ]
1334 + },
1335 + {
1336 + "matcher": {
1337 + "id": "byName",
1338 + "options": "IP ADDRESS"
1339 + },
1340 + "properties": [
1341 + {
1342 + "id": "custom.width",
1343 + "value": 163
1344 + }
1345 + ]
1346 + },
1347 + {
1348 + "matcher": {
1349 + "id": "byName",
1350 + "options": "MITRE TECHNIQUE"
1351 + },
1352 + "properties": [
1353 + {
1354 + "id": "custom.width",
1355 + "value": 312
1356 + }
1357 + ]
1358 + },
1359 + {
1360 + "matcher": {
1361 + "id": "byName",
1362 + "options": "EVENT ID"
1363 + },
1364 + "properties": [
1365 + {
1366 + "id": "links",
1367 + "value": [
1368 + {
1369 + "targetBlank": true,
1370 + "title": "VIEW EVENT DETAILS",
1371 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1372 + }
1373 + ]
1374 + },
1375 + {
1376 + "id": "custom.width",
1377 + "value": 265
1378 + }
1379 + ]
1380 + },
1381 + {
1382 + "matcher": {
1383 + "id": "byName",
1384 + "options": "RESULT"
1385 + },
1386 + "properties": [
1387 + {
1388 + "id": "custom.width",
1389 + "value": 118
1390 + },
1391 + {
1392 + "id": "mappings",
1393 + "value": [
1394 + {
1395 + "options": {
1396 + "Failed": {
1397 + "color": "orange",
1398 + "index": 1
1399 + },
1400 + "Success": {
1401 + "color": "green",
1402 + "index": 0
1403 + }
1404 + },
1405 + "type": "value"
1406 + }
1407 + ]
1408 + },
1409 + {
1410 + "id": "custom.cellOptions",
1411 + "value": {
1412 + "type": "color-text"
1413 + }
1414 + }
1415 + ]
1416 + },
1417 + {
1418 + "matcher": {
1419 + "id": "byName",
1420 + "options": "SRC IP"
1421 + },
1422 + "properties": [
1423 + {
1424 + "id": "custom.width",
1425 + "value": 265
1426 + }
1427 + ]
1428 + },
1429 + {
1430 + "matcher": {
1431 + "id": "byName",
1432 + "options": "ACCOUNT"
1433 + },
1434 + "properties": [
1435 + {
1436 + "id": "custom.width",
1437 + "value": 193
1438 + }
1439 + ]
1440 + },
1441 + {
1442 + "matcher": {
1443 + "id": "byName",
1444 + "options": "EVENT TIME"
1445 + },
1446 + "properties": [
1447 + {
1448 + "id": "custom.width",
1449 + "value": 195
1450 + }
1451 + ]
1452 + },
1453 + {
1454 + "matcher": {
1455 + "id": "byName",
1456 + "options": "CLIENT IP"
1457 + },
1458 + "properties": [
1459 + {
1460 + "id": "custom.width",
1461 + "value": 143
1462 + }
1463 + ]
1464 + },
1465 + {
1466 + "matcher": {
1467 + "id": "byName",
1468 + "options": "DESCRIPTION"
1469 + },
1470 + "properties": [
1471 + {
1472 + "id": "custom.width",
1473 + "value": 296
1474 + }
1475 + ]
1476 + },
1477 + {
1478 + "matcher": {
1479 + "id": "byName",
1480 + "options": "DEVICE"
1481 + },
1482 + "properties": [
1483 + {
1484 + "id": "custom.width",
1485 + "value": 182
1486 + }
1487 + ]
1488 + },
1489 + {
1490 + "matcher": {
1491 + "id": "byName",
1492 + "options": "RULE LEVEL"
1493 + },
1494 + "properties": [
1495 + {
1496 + "id": "custom.width",
1497 + "value": 145
1498 + }
1499 + ]
1500 + },
1501 + {
1502 + "matcher": {
1503 + "id": "byName",
1504 + "options": "APP"
1505 + },
1506 + "properties": [
1507 + {
1508 + "id": "custom.width",
1509 + "value": 187
1510 + }
1511 + ]
1512 + },
1513 + {
1514 + "matcher": {
1515 + "id": "byName",
1516 + "options": "FILE TYPE"
1517 + },
1518 + "properties": [
1519 + {
1520 + "id": "custom.width",
1521 + "value": 157
1522 + }
1523 + ]
1524 + }
1525 + ]
1526 + },
1527 + "gridPos": {
1528 + "h": 16,
1529 + "w": 24,
1530 + "x": 0,
1531 + "y": 32
1532 + },
1533 + "id": 27,
1534 + "options": {
1535 + "cellHeight": "sm",
1536 + "footer": {
1537 + "countRows": false,
1538 + "enablePagination": true,
1539 + "fields": "",
1540 + "reducer": ["sum"],
1541 + "show": false
1542 + },
1543 + "showHeader": true,
1544 + "sortBy": []
1545 + },
1546 + "pluginVersion": "10.0.3",
1547 + "targets": [
1548 + {
1549 + "bucketAggs": [],
1550 + "datasource": {
1551 + "type": "elasticsearch",
1552 + "uid": "replace_datasource_uid"
1553 + },
1554 + "metrics": [
1555 + {
1556 + "id": "1",
1557 + "settings": {
1558 + "size": "250"
1559 + },
1560 + "type": "raw_data"
1561 + }
1562 + ],
1563 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:Endpoint",
1564 + "refId": "A",
1565 + "timeField": "timestamp"
1566 + }
1567 + ],
1568 + "title": "EVENTS",
1569 + "transformations": [
1570 + {
1571 + "id": "organize",
1572 + "options": {
1573 + "excludeByName": {
1574 + "@metadata_beat": true,
1575 + "@metadata_type": true,
1576 + "@metadata_version": true,
1577 + "IMPHASH": true,
1578 + "MD5": true,
1579 + "SHA1": true,
1580 + "SHA256": true,
1581 + "_id": false,
1582 + "_index": true,
1583 + "_type": true,
1584 + "agent_ephemeral_id": true,
1585 + "agent_hostname": true,
1586 + "agent_id": true,
1587 + "agent_ip_city_name": true,
1588 + "agent_ip_country_code": true,
1589 + "agent_ip_geolocation": true,
1590 + "agent_name": true,
1591 + "agent_type": true,
1592 + "agent_version": true,
1593 + "beats_type": true,
1594 + "cluster_name": true,
1595 + "cluster_node": true,
1596 + "collector_node_id": true,
1597 + "data_alert_action": true,
1598 + "data_alert_category": true,
1599 + "data_alert_gid": true,
1600 + "data_alert_rev": true,
1601 + "data_alert_severity": true,
1602 + "data_alert_signature": true,
1603 + "data_alert_signature_id": true,
1604 + "data_app_proto": true,
1605 + "data_audit_auid": true,
1606 + "data_audit_command": true,
1607 + "data_audit_euid": true,
1608 + "data_audit_exe": true,
1609 + "data_audit_gid": true,
1610 + "data_audit_id": true,
1611 + "data_audit_pid": true,
1612 + "data_audit_res": true,
1613 + "data_audit_session": true,
1614 + "data_audit_type": true,
1615 + "data_audit_uid": true,
1616 + "data_dest_ip": true,
1617 + "data_dest_port": true,
1618 + "data_dstuser": true,
1619 + "data_event_type": true,
1620 + "data_extra_data": true,
1621 + "data_file": true,
1622 + "data_flow_bytes_toclient": true,
1623 + "data_flow_bytes_toserver": true,
1624 + "data_flow_id": true,
1625 + "data_flow_pkts_toclient": true,
1626 + "data_flow_pkts_toserver": true,
1627 + "data_flow_start": true,
1628 + "data_http_http_content_type": true,
1629 + "data_http_http_port": true,
1630 + "data_http_length": true,
1631 + "data_http_status": true,
1632 + "data_http_url": true,
1633 + "data_id": true,
1634 + "data_in_iface": true,
1635 + "data_integration": true,
1636 + "data_metadata_flowbits": true,
1637 + "data_metadata_flowints_http_anomaly_count": true,
1638 + "data_metadata_flowints_tcp_retransmission_count": true,
1639 + "data_office365_AADGroupId": true,
1640 + "data_office365_Actor": true,
1641 + "data_office365_ActorContextId": true,
1642 + "data_office365_ActorIpAddress": false,
1643 + "data_office365_ActorIpAddress_city_name": true,
1644 + "data_office365_ActorIpAddress_country_code": true,
1645 + "data_office365_ActorIpAddress_geolocation": true,
1646 + "data_office365_AppAccessContext_AADSessionId": true,
1647 + "data_office365_AppAccessContext_APIId": true,
1648 + "data_office365_AppAccessContext_ClientAppId": true,
1649 + "data_office365_AppAccessContext_ClientAppName": true,
1650 + "data_office365_AppAccessContext_CorrelationId": true,
1651 + "data_office365_AppAccessContext_UniqueTokenId": true,
1652 + "data_office365_AppId": true,
1653 + "data_office365_Application": false,
1654 + "data_office365_ApplicationId": true,
1655 + "data_office365_ArtifactsShared": true,
1656 + "data_office365_Attendees": true,
1657 + "data_office365_AuthenticationType": true,
1658 + "data_office365_AzureActiveDirectoryEventType": true,
1659 + "data_office365_BrowserVersion": true,
1660 + "data_office365_ChannelGuid": true,
1661 + "data_office365_ChannelName": true,
1662 + "data_office365_ChatName": true,
1663 + "data_office365_ChatThreadId": true,
1664 + "data_office365_ClientAppId": true,
1665 + "data_office365_ClientIP": false,
1666 + "data_office365_ClientIPAddress": true,
1667 + "data_office365_ClientIPAddress_city_name": true,
1668 + "data_office365_ClientIPAddress_country_code": true,
1669 + "data_office365_ClientIPAddress_geolocation": true,
1670 + "data_office365_ClientIP_city_name": true,
1671 + "data_office365_ClientIP_country_code": true,
1672 + "data_office365_ClientIP_geolocation": true,
1673 + "data_office365_ClientInfoString": true,
1674 + "data_office365_ClientProcessName": true,
1675 + "data_office365_ClientRequestId": true,
1676 + "data_office365_ClientVersion": true,
1677 + "data_office365_CommunicationSubType": true,
1678 + "data_office365_CommunicationType": true,
1679 + "data_office365_CorrelationId": true,
1680 + "data_office365_CreationTime": false,
1681 + "data_office365_CrossMailboxOperation": true,
1682 + "data_office365_DestFolder_Id": true,
1683 + "data_office365_DestFolder_Path": true,
1684 + "data_office365_DestinationLocationType": true,
1685 + "data_office365_DeviceDisplayName": true,
1686 + "data_office365_DeviceDisplayName_city_name": true,
1687 + "data_office365_DeviceDisplayName_country_code": true,
1688 + "data_office365_DeviceDisplayName_geolocation": true,
1689 + "data_office365_DeviceId": true,
1690 + "data_office365_DeviceInformation": true,
1691 + "data_office365_DeviceName": false,
1692 + "data_office365_DeviceProperties": true,
1693 + "data_office365_DlpOriginalFilePath": true,
1694 + "data_office365_EndTime": true,
1695 + "data_office365_EnforcementMode": true,
1696 + "data_office365_ErrorNumber": true,
1697 + "data_office365_EventSource": true,
1698 + "data_office365_ExchangeId": true,
1699 + "data_office365_ExtendedProperties": true,
1700 + "data_office365_ExternalAccess": true,
1701 + "data_office365_ExtraProperties": true,
1702 + "data_office365_FileExtension": true,
1703 + "data_office365_FileSize": true,
1704 + "data_office365_FileSizeBytes": true,
1705 + "data_office365_Folder_Id": true,
1706 + "data_office365_Folder_Path": true,
1707 + "data_office365_Hidden": true,
1708 + "data_office365_HighPriorityMediaProcessing": true,
1709 + "data_office365_HostedContents": true,
1710 + "data_office365_ICalUid": true,
1711 + "data_office365_Id": true,
1712 + "data_office365_InterSystemsId": true,
1713 + "data_office365_InternalLogonType": true,
1714 + "data_office365_IntraSystemId": true,
1715 + "data_office365_IsManagedDevice": true,
1716 + "data_office365_ItemName": true,
1717 + "data_office365_ItemType": true,
1718 + "data_office365_Item_Id": true,
1719 + "data_office365_Item_InternetMessageId": true,
1720 + "data_office365_Item_IsRecord": true,
1721 + "data_office365_Item_ParentFolder_Id": true,
1722 + "data_office365_Item_SizeInBytes": true,
1723 + "data_office365_JitTriggered": true,
1724 + "data_office365_JoinTime": true,
1725 + "data_office365_LeaveTime": true,
1726 + "data_office365_ListBaseType": true,
1727 + "data_office365_ListId": true,
1728 + "data_office365_ListItemUniqueId": true,
1729 + "data_office365_ListServerTemplate": true,
1730 + "data_office365_LogonError": true,
1731 + "data_office365_LogonType": true,
1732 + "data_office365_LogonUserSid": true,
1733 + "data_office365_MDATPDeviceId": true,
1734 + "data_office365_MailboxGuid": true,
1735 + "data_office365_MailboxOwnerSid": true,
1736 + "data_office365_MailboxOwnerUPN": true,
1737 + "data_office365_MeetingDetailId": true,
1738 + "data_office365_MeetingURL": true,
1739 + "data_office365_Members": true,
1740 + "data_office365_MessageId": true,
1741 + "data_office365_MessageSizeInBytes": true,
1742 + "data_office365_MessageURLs": true,
1743 + "data_office365_MessageVersion": true,
1744 + "data_office365_Modalities": true,
1745 + "data_office365_ModifiedProperties": true,
1746 + "data_office365_Name": true,
1747 + "data_office365_NewValue": true,
1748 + "data_office365_ObjectId": false,
1749 + "data_office365_Operation": true,
1750 + "data_office365_OperationScope": true,
1751 + "data_office365_OrganizationId": true,
1752 + "data_office365_OrganizationName": true,
1753 + "data_office365_Organizer_OrganizationId": true,
1754 + "data_office365_Organizer_RecipientType": true,
1755 + "data_office365_Organizer_Role": true,
1756 + "data_office365_Organizer_UserObjectId": true,
1757 + "data_office365_OriginatingDomain": true,
1758 + "data_office365_OriginatingServer": true,
1759 + "data_office365_Parameters": true,
1760 + "data_office365_ParentMessageId": true,
1761 + "data_office365_Platform": true,
1762 + "data_office365_PreviousFileName": true,
1763 + "data_office365_ProviderTypes": true,
1764 + "data_office365_RMSEncrypted": true,
1765 + "data_office365_RecordType": true,
1766 + "data_office365_ResultStatus": true,
1767 + "data_office365_Scope": true,
1768 + "data_office365_SensitiveInfoTypeData": true,
1769 + "data_office365_SessionId": true,
1770 + "data_office365_Sha1": true,
1771 + "data_office365_Sha256": true,
1772 + "data_office365_Site": true,
1773 + "data_office365_SiteUrl": true,
1774 + "data_office365_SourceFileExtension": true,
1775 + "data_office365_SourceFileName": true,
1776 + "data_office365_SourceLocationType": true,
1777 + "data_office365_SourceRelativeUrl": true,
1778 + "data_office365_StartTime": true,
1779 + "data_office365_Subscription": true,
1780 + "data_office365_SubscriptionId": true,
1781 + "data_office365_Target": true,
1782 + "data_office365_TargetContextId": true,
1783 + "data_office365_TargetFilePath": true,
1784 + "data_office365_TargetPrinterName": true,
1785 + "data_office365_TeamGuid": true,
1786 + "data_office365_TeamName": true,
1787 + "data_office365_UserId": false,
1788 + "data_office365_UserKey": true,
1789 + "data_office365_UserType": true,
1790 + "data_office365_Version": true,
1791 + "data_office365_WebId": true,
1792 + "data_office365_Workload": true,
1793 + "data_osquery_action": true,
1794 + "data_osquery_calendarTime": true,
1795 + "data_osquery_columns_address": true,
1796 + "data_osquery_columns_address_city_name": true,
1797 + "data_osquery_columns_address_country_code": true,
1798 + "data_osquery_columns_address_geolocation": true,
1799 + "data_osquery_columns_cmdline": true,
1800 + "data_osquery_columns_cwd": true,
1801 + "data_osquery_columns_description": true,
1802 + "data_osquery_columns_directory": true,
1803 + "data_osquery_columns_disk_bytes_read": true,
1804 + "data_osquery_columns_disk_bytes_written": true,
1805 + "data_osquery_columns_egid": true,
1806 + "data_osquery_columns_euid": true,
1807 + "data_osquery_columns_family": true,
1808 + "data_osquery_columns_fd": true,
1809 + "data_osquery_columns_gid": true,
1810 + "data_osquery_columns_gid_signed": true,
1811 + "data_osquery_columns_host": true,
1812 + "data_osquery_columns_interface": true,
1813 + "data_osquery_columns_local_address": true,
1814 + "data_osquery_columns_local_address_city_name": true,
1815 + "data_osquery_columns_local_address_country_code": true,
1816 + "data_osquery_columns_local_address_geolocation": true,
1817 + "data_osquery_columns_local_port": true,
1818 + "data_osquery_columns_mac": true,
1819 + "data_osquery_columns_name": true,
1820 + "data_osquery_columns_net_namespace": true,
1821 + "data_osquery_columns_nice": true,
1822 + "data_osquery_columns_on_disk": true,
1823 + "data_osquery_columns_parent": true,
1824 + "data_osquery_columns_path": true,
1825 + "data_osquery_columns_pgroup": true,
1826 + "data_osquery_columns_pid": true,
1827 + "data_osquery_columns_port": true,
1828 + "data_osquery_columns_protocol": true,
1829 + "data_osquery_columns_remote_address": true,
1830 + "data_osquery_columns_remote_address_city_name": true,
1831 + "data_osquery_columns_remote_address_country_code": true,
1832 + "data_osquery_columns_remote_address_geolocation": true,
1833 + "data_osquery_columns_remote_port": true,
1834 + "data_osquery_columns_resident_size": true,
1835 + "data_osquery_columns_root": true,
1836 + "data_osquery_columns_sgid": true,
1837 + "data_osquery_columns_shell": true,
1838 + "data_osquery_columns_socket": true,
1839 + "data_osquery_columns_start_time": true,
1840 + "data_osquery_columns_state": true,
1841 + "data_osquery_columns_suid": true,
1842 + "data_osquery_columns_system_time": true,
1843 + "data_osquery_columns_threads": true,
1844 + "data_osquery_columns_time_utc": true,
1845 + "data_osquery_columns_total_size": true,
1846 + "data_osquery_columns_tty": true,
1847 + "data_osquery_columns_type": true,
1848 + "data_osquery_columns_uid": true,
1849 + "data_osquery_columns_uid_signed": true,
1850 + "data_osquery_columns_user": true,
1851 + "data_osquery_columns_user_time": true,
1852 + "data_osquery_columns_username": true,
1853 + "data_osquery_columns_wired_size": true,
1854 + "data_osquery_counter": true,
1855 + "data_osquery_decorations_host_uuid": true,
1856 + "data_osquery_decorations_hostname": true,
1857 + "data_osquery_epoch": true,
1858 + "data_osquery_hostIdentifier": true,
1859 + "data_osquery_name": true,
1860 + "data_osquery_numerics": true,
1861 + "data_osquery_unixTime": true,
1862 + "data_proto": true,
1863 + "data_sca_check_command": true,
1864 + "data_sca_check_compliance_cis": true,
1865 + "data_sca_check_compliance_cis_csc": true,
1866 + "data_sca_check_compliance_gdpr_IV": true,
1867 + "data_sca_check_compliance_gpg_13": true,
1868 + "data_sca_check_compliance_hipaa": true,
1869 + "data_sca_check_compliance_nist_800_53": true,
1870 + "data_sca_check_compliance_pci_dss": true,
1871 + "data_sca_check_compliance_tsc": true,
1872 + "data_sca_check_description": true,
1873 + "data_sca_check_id": true,
1874 + "data_sca_check_previous_result": true,
1875 + "data_sca_check_rationale": true,
1876 + "data_sca_check_remediation": true,
1877 + "data_sca_check_result": true,
1878 + "data_sca_check_title": true,
1879 + "data_sca_description": true,
1880 + "data_sca_failed": true,
1881 + "data_sca_file": true,
1882 + "data_sca_invalid": true,
1883 + "data_sca_passed": true,
1884 + "data_sca_policy": true,
1885 + "data_sca_policy_id": true,
1886 + "data_sca_scan_id": true,
1887 + "data_sca_score": true,
1888 + "data_sca_total_checks": true,
1889 + "data_sca_type": true,
1890 + "data_script": true,
1891 + "data_src_ip": true,
1892 + "data_src_ip_city_name": true,
1893 + "data_src_ip_country_code": true,
1894 + "data_src_ip_geolocation": true,
1895 + "data_src_port": true,
1896 + "data_srcip": true,
1897 + "data_srcip_city_name": true,
1898 + "data_srcip_country_code": true,
1899 + "data_srcip_geolocation": true,
1900 + "data_srcuser": true,
1901 + "data_timestamp": true,
1902 + "data_title": true,
1903 + "data_tls_session_resumed": true,
1904 + "data_tls_version": true,
1905 + "data_tx_id": true,
1906 + "data_type": true,
1907 + "data_win_eventXML_binaryData": true,
1908 + "data_win_eventXML_binaryDataSize": true,
1909 + "data_win_eventXML_param1": true,
1910 + "data_win_eventdata_authenticationPackageName": true,
1911 + "data_win_eventdata_callTrace": true,
1912 + "data_win_eventdata_commandLine": true,
1913 + "data_win_eventdata_company": true,
1914 + "data_win_eventdata_creationUtcTime": true,
1915 + "data_win_eventdata_currentDirectory": true,
1916 + "data_win_eventdata_description": true,
1917 + "data_win_eventdata_destinationHostname": true,
1918 + "data_win_eventdata_destinationIp": true,
1919 + "data_win_eventdata_destinationIp_city_name": true,
1920 + "data_win_eventdata_destinationIp_country_code": true,
1921 + "data_win_eventdata_destinationIp_geolocation": true,
1922 + "data_win_eventdata_destinationIsIpv6": true,
1923 + "data_win_eventdata_destinationPort": true,
1924 + "data_win_eventdata_destinationPortName": true,
1925 + "data_win_eventdata_details": true,
1926 + "data_win_eventdata_elevatedToken": true,
1927 + "data_win_eventdata_eventType": true,
1928 + "data_win_eventdata_fileVersion": true,
1929 + "data_win_eventdata_fileVersion_city_name": true,
1930 + "data_win_eventdata_fileVersion_country_code": true,
1931 + "data_win_eventdata_fileVersion_geolocation": true,
1932 + "data_win_eventdata_grantedAccess": true,
1933 + "data_win_eventdata_hashes": true,
1934 + "data_win_eventdata_image": true,
1935 + "data_win_eventdata_imageLoaded": true,
1936 + "data_win_eventdata_impersonationLevel": true,
1937 + "data_win_eventdata_initiated": true,
1938 + "data_win_eventdata_integrityLevel": true,
1939 + "data_win_eventdata_ipAddress": true,
1940 + "data_win_eventdata_ipPort": true,
1941 + "data_win_eventdata_keyLength": true,
1942 + "data_win_eventdata_logonGuid": true,
1943 + "data_win_eventdata_logonId": true,
1944 + "data_win_eventdata_logonProcessName": true,
1945 + "data_win_eventdata_logonType": true,
1946 + "data_win_eventdata_originalFileName": true,
1947 + "data_win_eventdata_param1": true,
1948 + "data_win_eventdata_param2": true,
1949 + "data_win_eventdata_param3": true,
1950 + "data_win_eventdata_param4": true,
1951 + "data_win_eventdata_parentCommandLine": true,
1952 + "data_win_eventdata_parentImage": true,
1953 + "data_win_eventdata_parentProcessGuid": true,
1954 + "data_win_eventdata_parentProcessId": true,
1955 + "data_win_eventdata_processGuid": true,
1956 + "data_win_eventdata_processId": true,
1957 + "data_win_eventdata_processName": true,
1958 + "data_win_eventdata_product": true,
1959 + "data_win_eventdata_protocol": true,
1960 + "data_win_eventdata_queryName": true,
1961 + "data_win_eventdata_queryResults": true,
1962 + "data_win_eventdata_queryStatus": true,
1963 + "data_win_eventdata_ruleName": true,
1964 + "data_win_eventdata_serviceName": true,
1965 + "data_win_eventdata_serviceSid": true,
1966 + "data_win_eventdata_signature": true,
1967 + "data_win_eventdata_signatureStatus": true,
1968 + "data_win_eventdata_signed": true,
1969 + "data_win_eventdata_sourceHostname": true,
1970 + "data_win_eventdata_sourceImage": true,
1971 + "data_win_eventdata_sourceIp": true,
1972 + "data_win_eventdata_sourceIp_city_name": true,
1973 + "data_win_eventdata_sourceIp_country_code": true,
1974 + "data_win_eventdata_sourceIp_geolocation": true,
1975 + "data_win_eventdata_sourceIsIpv6": true,
1976 + "data_win_eventdata_sourcePort": true,
1977 + "data_win_eventdata_sourceProcessGUID": true,
1978 + "data_win_eventdata_sourceProcessId": true,
1979 + "data_win_eventdata_sourceThreadId": true,
1980 + "data_win_eventdata_status": true,
1981 + "data_win_eventdata_subjectDomainName": true,
1982 + "data_win_eventdata_subjectLogonId": true,
1983 + "data_win_eventdata_subjectUserName": true,
1984 + "data_win_eventdata_subjectUserSid": true,
1985 + "data_win_eventdata_targetDomainName": true,
1986 + "data_win_eventdata_targetFilename": true,
1987 + "data_win_eventdata_targetImage": true,
1988 + "data_win_eventdata_targetLinkedLogonId": true,
1989 + "data_win_eventdata_targetLogonId": true,
1990 + "data_win_eventdata_targetObject": true,
1991 + "data_win_eventdata_targetProcessGUID": true,
1992 + "data_win_eventdata_targetProcessId": true,
1993 + "data_win_eventdata_targetUserName": true,
1994 + "data_win_eventdata_targetUserSid": true,
1995 + "data_win_eventdata_terminalSessionId": true,
1996 + "data_win_eventdata_ticketEncryptionType": true,
1997 + "data_win_eventdata_ticketOptions": true,
1998 + "data_win_eventdata_user": true,
1999 + "data_win_eventdata_utcTime": true,
2000 + "data_win_eventdata_virtualAccount": true,
2001 + "data_win_system_channel": true,
2002 + "data_win_system_computer": true,
2003 + "data_win_system_eventID": true,
2004 + "data_win_system_eventRecordID": true,
2005 + "data_win_system_eventSourceName": true,
2006 + "data_win_system_keywords": true,
2007 + "data_win_system_level": true,
2008 + "data_win_system_message": true,
2009 + "data_win_system_opcode": true,
2010 + "data_win_system_processID": true,
2011 + "data_win_system_providerGuid": true,
2012 + "data_win_system_providerName": true,
2013 + "data_win_system_severityValue": true,
2014 + "data_win_system_systemTime": true,
2015 + "data_win_system_task": true,
2016 + "data_win_system_threadID": true,
2017 + "data_win_system_version": true,
2018 + "decoder_name": true,
2019 + "decoder_parent": true,
2020 + "dns_query": true,
2021 + "dns_query_threat_indicated": true,
2022 + "dst_ip": true,
2023 + "dst_ip_city_name": true,
2024 + "dst_ip_country_code": true,
2025 + "dst_ip_geolocation": true,
2026 + "dst_ip_threat_indicated": true,
2027 + "dst_port": true,
2028 + "ecs_version": true,
2029 + "error": true,
2030 + "event_hash": true,
2031 + "file_path": true,
2032 + "firewall_rule_name": true,
2033 + "full_log": false,
2034 + "gl2_accounted_message_size": true,
2035 + "gl2_message_id": true,
2036 + "gl2_processing_error": true,
2037 + "gl2_remote_ip": true,
2038 + "gl2_remote_port": true,
2039 + "gl2_source_collector": true,
2040 + "gl2_source_input": true,
2041 + "gl2_source_node": true,
2042 + "hash_md5": true,
2043 + "hash_sha1": true,
2044 + "hash_sha256": true,
2045 + "highlight": true,
2046 + "host_architecture": true,
2047 + "host_containerized": true,
2048 + "host_hostname": true,
2049 + "host_id": true,
2050 + "host_ip": true,
2051 + "host_mac": true,
2052 + "host_name": true,
2053 + "host_os_codename": true,
2054 + "host_os_kernel": true,
2055 + "host_os_name": true,
2056 + "host_os_platform": true,
2057 + "host_os_version": true,
2058 + "hostname": true,
2059 + "id": true,
2060 + "input_type": true,
2061 + "level": true,
2062 + "location": true,
2063 + "log_file_path": true,
2064 + "log_offset": true,
2065 + "manager_name": true,
2066 + "message": true,
2067 + "module": true,
2068 + "msg_timestamp": true,
2069 + "parent_process_cmd_line": true,
2070 + "parent_process_id": true,
2071 + "parent_process_image": true,
2072 + "pid": true,
2073 + "predecoder_hostname": true,
2074 + "predecoder_program_name": true,
2075 + "predecoder_timestamp": true,
2076 + "previous_log": true,
2077 + "previous_output": true,
2078 + "process_cmd_line": true,
2079 + "process_id": true,
2080 + "process_image": true,
2081 + "process_name": true,
2082 + "protocol": true,
2083 + "rule_cis": true,
2084 + "rule_cis_csc": true,
2085 + "rule_firedtimes": true,
2086 + "rule_gdpr": true,
2087 + "rule_gdpr_IV": true,
2088 + "rule_gpg13": true,
2089 + "rule_gpg_13": true,
2090 + "rule_group1": true,
2091 + "rule_group2": true,
2092 + "rule_groups": true,
2093 + "rule_hipaa": true,
2094 + "rule_id": true,
2095 + "rule_info": true,
2096 + "rule_mail": true,
2097 + "rule_mitre_id": true,
2098 + "rule_mitre_tactic": false,
2099 + "rule_nist_800_53": true,
2100 + "rule_pci_dss": true,
2101 + "rule_tsc": true,
2102 + "scanid": true,
2103 + "service": true,
2104 + "software_package": true,
2105 + "software_vendor": true,
2106 + "sort": true,
2107 + "source": true,
2108 + "source_reserved_ip": true,
2109 + "src_ip": true,
2110 + "src_ip_city_name": true,
2111 + "src_ip_country_code": true,
2112 + "src_ip_geolocation": true,
2113 + "src_port": true,
2114 + "streams": true,
2115 + "syscheck_attrs_after": true,
2116 + "syscheck_audit_effective_user_id": true,
2117 + "syscheck_audit_effective_user_name": true,
2118 + "syscheck_audit_group_id": true,
2119 + "syscheck_audit_group_name": true,
2120 + "syscheck_audit_login_user_id": true,
2121 + "syscheck_audit_login_user_name": true,
2122 + "syscheck_audit_process_cwd": true,
2123 + "syscheck_audit_process_id": true,
2124 + "syscheck_audit_process_name": true,
2125 + "syscheck_audit_process_parent_cwd": true,
2126 + "syscheck_audit_process_parent_name": true,
2127 + "syscheck_audit_process_ppid": true,
2128 + "syscheck_audit_user_id": true,
2129 + "syscheck_audit_user_name": true,
2130 + "syscheck_changed_attributes": true,
2131 + "syscheck_event": true,
2132 + "syscheck_gid_after": true,
2133 + "syscheck_gname_after": true,
2134 + "syscheck_hard_links": true,
2135 + "syscheck_inode_after": true,
2136 + "syscheck_inode_before": true,
2137 + "syscheck_md5_after": true,
2138 + "syscheck_md5_before": true,
2139 + "syscheck_mode": true,
2140 + "syscheck_mtime_after": true,
2141 + "syscheck_mtime_before": true,
2142 + "syscheck_path": true,
2143 + "syscheck_perm_after": true,
2144 + "syscheck_perm_before": true,
2145 + "syscheck_sha1_after": true,
2146 + "syscheck_sha1_before": true,
2147 + "syscheck_sha256_after": true,
2148 + "syscheck_sha256_before": true,
2149 + "syscheck_size_after": true,
2150 + "syscheck_size_before": true,
2151 + "syscheck_uid_after": true,
2152 + "syscheck_uname_after": true,
2153 + "syscheck_win_perm_after": true,
2154 + "syscheck_win_perm_after_0_allowed": true,
2155 + "syscheck_win_perm_after_0_name": true,
2156 + "syscheck_win_perm_after_1_allowed": true,
2157 + "syscheck_win_perm_after_1_name": true,
2158 + "syscheck_win_perm_after_2_allowed": true,
2159 + "syscheck_win_perm_after_2_name": true,
2160 + "syscheck_win_perm_after_3_allowed": true,
2161 + "syscheck_win_perm_after_3_name": true,
2162 + "syslog_customer": true,
2163 + "syslog_level": true,
2164 + "syslog_tag": true,
2165 + "syslog_type": true,
2166 + "sysmon_event_description": true,
2167 + "threat_ids": true,
2168 + "threat_indicated": true,
2169 + "threat_names": true,
2170 + "time": true,
2171 + "timestamp": true,
2172 + "true": true,
2173 + "user_name": true,
2174 + "win_registry_key": true,
2175 + "win_system_eventID": true,
2176 + "windows_auth_package": true,
2177 + "windows_domain": true,
2178 + "windows_event_id": true,
2179 + "windows_event_severity": true,
2180 + "windows_logon_type": true
2181 + },
2182 + "indexByName": {
2183 + "_id": 2,
2184 + "_index": 10,
2185 + "_type": 11,
2186 + "agent_id": 12,
2187 + "agent_name": 6,
2188 + "cluster_name": 13,
2189 + "cluster_node": 14,
2190 + "data_integration": 48,
2191 + "data_office365_Application": 49,
2192 + "data_office365_ClientIP": 4,
2193 + "data_office365_ClientIP_city_name": 15,
2194 + "data_office365_ClientIP_country_code": 16,
2195 + "data_office365_ClientIP_geolocation": 17,
2196 + "data_office365_CreationTime": 0,
2197 + "data_office365_DeviceName": 5,
2198 + "data_office365_FileSize": 50,
2199 + "data_office365_FileType": 51,
2200 + "data_office365_Hidden": 53,
2201 + "data_office365_Id": 18,
2202 + "data_office365_MDATPDeviceId": 54,
2203 + "data_office365_ObjectId": 52,
2204 + "data_office365_Operation": 24,
2205 + "data_office365_OrganizationId": 19,
2206 + "data_office365_Platform": 55,
2207 + "data_office365_RecordType": 20,
2208 + "data_office365_Scope": 56,
2209 + "data_office365_SourceLocationType": 57,
2210 + "data_office365_Subscription": 58,
2211 + "data_office365_UserId": 3,
2212 + "data_office365_UserKey": 21,
2213 + "data_office365_UserType": 22,
2214 + "data_office365_Version": 23,
2215 + "data_office365_Workload": 47,
2216 + "decoder_name": 25,
2217 + "gl2_accounted_message_size": 26,
2218 + "gl2_message_id": 27,
2219 + "gl2_processing_error": 28,
2220 + "gl2_remote_ip": 29,
2221 + "gl2_remote_port": 30,
2222 + "gl2_source_input": 31,
2223 + "gl2_source_node": 32,
2224 + "highlight": 33,
2225 + "id": 34,
2226 + "location": 35,
2227 + "manager_name": 36,
2228 + "message": 37,
2229 + "msg_timestamp": 59,
2230 + "rule_description": 7,
2231 + "rule_firedtimes": 38,
2232 + "rule_group1": 39,
2233 + "rule_group2": 60,
2234 + "rule_groups": 40,
2235 + "rule_hipaa": 61,
2236 + "rule_id": 9,
2237 + "rule_level": 8,
2238 + "rule_mail": 41,
2239 + "rule_pci_dss": 62,
2240 + "sort": 42,
2241 + "source": 43,
2242 + "source_reserved_ip": 63,
2243 + "streams": 44,
2244 + "syslog_type": 45,
2245 + "timestamp": 1,
2246 + "true": 46
2247 + },
2248 + "renameByName": {
2249 + "_id": "EVENT ID",
2250 + "agent_name": "",
2251 + "data_office365_ActorIpAddress": "SRC IP",
2252 + "data_office365_AffectedItems": "ITEMS",
2253 + "data_office365_Application": "APP",
2254 + "data_office365_BrowserName": "BROWSER",
2255 + "data_office365_ClientIP": "CLIENT IP",
2256 + "data_office365_ClientIP_city_name": "",
2257 + "data_office365_CreationTime": "EVENT TIME",
2258 + "data_office365_DeviceDisplayName": "",
2259 + "data_office365_DeviceName": "DEVICE",
2260 + "data_office365_FileType": "FILE TYPE",
2261 + "data_office365_Item_Attachments": "ATTACHMENT",
2262 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2263 + "data_office365_Item_Subject": "SUBJECT",
2264 + "data_office365_ObjectId": "OBJECT",
2265 + "data_office365_ResultStatus": "RESULT",
2266 + "data_office365_UserAgent": "USER AGENT",
2267 + "data_office365_UserId": "ACCOUNT",
2268 + "rule_description": "DESCRIPTION",
2269 + "rule_id": "RULE ID",
2270 + "rule_level": "",
2271 + "rule_mitre_tactic": "MITRE TACTIC",
2272 + "rule_mitre_technique": "MITRE TECHNIQUE",
2273 + "timestamp": "Date/Time"
2274 + }
2275 + }
2276 + }
2277 + ],
2278 + "transparent": true,
2279 + "type": "table"
2280 + }
2281 + ],
2282 + "refresh": "",
2283 + "schemaVersion": 38,
2284 + "style": "dark",
2285 + "tags": ["O365"],
2286 + "templating": {
2287 + "list": [
2288 + {
2289 + "datasource": {
2290 + "type": "elasticsearch",
2291 + "uid": "replace_datasource_uid"
2292 + },
2293 + "filters": [],
2294 + "hide": 0,
2295 + "label": "",
2296 + "name": "Filters",
2297 + "skipUrlSync": false,
2298 + "type": "adhoc"
2299 + },
2300 + {
2301 + "current": {
2302 + "selected": false,
2303 + "text": "All",
2304 + "value": "$__all"
2305 + },
2306 + "datasource": {
2307 + "type": "elasticsearch",
2308 + "uid": "replace_datasource_uid"
2309 + },
2310 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Endpoint\"}",
2311 + "hide": 0,
2312 + "includeAll": true,
2313 + "label": "Operation",
2314 + "multi": false,
2315 + "name": "operation",
2316 + "options": [],
2317 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Endpoint\"}",
2318 + "refresh": 2,
2319 + "regex": "",
2320 + "skipUrlSync": false,
2321 + "sort": 1,
2322 + "tagValuesQuery": "",
2323 + "tagsQuery": "",
2324 + "type": "query",
2325 + "useTags": false
2326 + },
2327 + {
2328 + "current": {
2329 + "selected": false,
2330 + "text": "All",
2331 + "value": "$__all"
2332 + },
2333 + "datasource": {
2334 + "type": "elasticsearch",
2335 + "uid": "replace_datasource_uid"
2336 + },
2337 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:Endpoint\"}",
2338 + "hide": 0,
2339 + "includeAll": true,
2340 + "label": "Rule Level",
2341 + "multi": false,
2342 + "name": "rule_level",
2343 + "options": [],
2344 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:Endpoint\"}",
2345 + "refresh": 2,
2346 + "regex": "",
2347 + "skipUrlSync": false,
2348 + "sort": 0,
2349 + "type": "query"
2350 + }
2351 + ]
2352 + },
2353 + "time": {
2354 + "from": "now-12h",
2355 + "to": "now"
2356 + },
2357 + "timepicker": {
2358 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2359 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2360 + },
2361 + "timezone": "",
2362 + "title": "O365 - ENDPOINT",
2363 + "weekStart": ""
2364 }
backend/app/connectors/grafana/dashboards/Office365/exchange.json
+2157 -2204
@@ -1,2206 +1,2159 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "10.0.3",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "cellOptions": {
261 - "type": "auto"
262 - },
263 - "inspect": false
264 - },
265 - "mappings": [],
266 - "thresholds": {
267 - "mode": "absolute",
268 - "steps": [
269 - {
270 - "color": "red",
271 - "value": null
272 - }
273 - ]
274 - }
275 - },
276 - "overrides": [
277 - {
278 - "matcher": {
279 - "id": "byName",
280 - "options": "Count"
281 - },
282 - "properties": [
283 - {
284 - "id": "displayName",
285 - "value": "EVENTS"
286 - },
287 - {
288 - "id": "unit",
289 - "value": "short"
290 - },
291 - {
292 - "id": "decimals",
293 - "value": -1
294 - },
295 - {
296 - "id": "custom.align"
297 - },
298 - {
299 - "id": "thresholds",
300 - "value": {
301 - "mode": "absolute",
302 - "steps": [
303 - {
304 - "color": "red",
305 - "value": null
306 - }
307 - ]
308 - }
309 - }
310 - ]
311 - }
312 - ]
313 - },
314 - "gridPos": {
315 - "h": 7,
316 - "w": 6,
317 - "x": 8,
318 - "y": 0
319 - },
320 - "id": 54,
321 - "options": {
322 - "cellHeight": "sm",
323 - "footer": {
324 - "countRows": false,
325 - "fields": "",
326 - "reducer": [
327 - "sum"
328 - ],
329 - "show": false
330 - },
331 - "showHeader": true
332 - },
333 - "pluginVersion": "10.0.3",
334 - "targets": [
335 - {
336 - "bucketAggs": [
337 - {
338 - "fake": true,
339 - "field": "data_office365_Operation",
340 - "id": "4",
341 - "settings": {
342 - "min_doc_count": 1,
343 - "order": "desc",
344 - "orderBy": "_count",
345 - "size": "0"
346 - },
347 - "type": "terms"
348 - }
349 - ],
350 - "datasource": {
351 - "type": "elasticsearch",
352 - "uid": "replace_datasource_uid"
353 - },
354 - "metrics": [
355 - {
356 - "field": "select field",
357 - "id": "1",
358 - "type": "count"
359 - }
360 - ],
361 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
362 - "refId": "A",
363 - "timeField": "timestamp"
364 - }
365 - ],
366 - "title": "EVENTS BY OPERATION",
367 - "transformations": [
368 - {
369 - "id": "merge",
370 - "options": {
371 - "reducers": []
372 - }
373 - },
374 - {
375 - "id": "organize",
376 - "options": {
377 - "excludeByName": {},
378 - "indexByName": {},
379 - "renameByName": {
380 - "Count": "EVENTS",
381 - "data_office365_Operation": "OPERATION"
382 - }
383 - }
384 - }
385 - ],
386 - "type": "table"
387 - },
388 - {
389 - "datasource": {
390 - "type": "elasticsearch",
391 - "uid": "replace_datasource_uid"
392 - },
393 - "fieldConfig": {
394 - "defaults": {
395 - "color": {
396 - "mode": "thresholds"
397 - },
398 - "mappings": [
399 - {
400 - "options": {
401 - "match": "null",
402 - "result": {
403 - "text": "N/A"
404 - }
405 - },
406 - "type": "special"
407 - }
408 - ],
409 - "max": 15,
410 - "min": 0,
411 - "thresholds": {
412 - "mode": "absolute",
413 - "steps": [
414 - {
415 - "color": "#299c46",
416 - "value": null
417 - },
418 - {
419 - "color": "rgba(237, 129, 40, 0.89)",
420 - "value": 8
421 - },
422 - {
423 - "color": "#d44a3a",
424 - "value": 12
425 - }
426 - ]
427 - },
428 - "unit": "none"
429 - },
430 - "overrides": []
431 - },
432 - "gridPos": {
433 - "h": 7,
434 - "w": 4,
435 - "x": 0,
436 - "y": 7
437 - },
438 - "id": 16,
439 - "links": [],
440 - "options": {
441 - "orientation": "horizontal",
442 - "reduceOptions": {
443 - "calcs": [
444 - "max"
445 - ],
446 - "fields": "",
447 - "values": false
448 - },
449 - "showThresholdLabels": false,
450 - "showThresholdMarkers": true,
451 - "text": {}
452 - },
453 - "pluginVersion": "10.0.3",
454 - "targets": [
455 - {
456 - "bucketAggs": [
457 - {
458 - "field": "timestamp",
459 - "id": "2",
460 - "settings": {
461 - "interval": "auto",
462 - "min_doc_count": 0,
463 - "trimEdges": 0
464 - },
465 - "type": "date_histogram"
466 - }
467 - ],
468 - "datasource": {
469 - "type": "elasticsearch",
470 - "uid": "replace_datasource_uid"
471 - },
472 - "metrics": [
473 - {
474 - "field": "rule_level",
475 - "id": "1",
476 - "meta": {},
477 - "settings": {},
478 - "type": "max"
479 - }
480 - ],
481 - "query": "data_office365_Operation:$operation",
482 - "refId": "A",
483 - "timeField": "timestamp"
484 - }
485 - ],
486 - "title": "MAX SEVERITY (0 - 15)",
487 - "type": "gauge"
488 - },
489 - {
490 - "datasource": {
491 - "type": "elasticsearch",
492 - "uid": "replace_datasource_uid"
493 - },
494 - "fieldConfig": {
495 - "defaults": {
496 - "color": {
497 - "mode": "palette-classic"
498 - },
499 - "custom": {
500 - "axisCenteredZero": false,
501 - "axisColorMode": "text",
502 - "axisLabel": "",
503 - "axisPlacement": "auto",
504 - "barAlignment": 0,
505 - "drawStyle": "bars",
506 - "fillOpacity": 0,
507 - "gradientMode": "none",
508 - "hideFrom": {
509 - "legend": false,
510 - "tooltip": false,
511 - "viz": false
512 - },
513 - "lineInterpolation": "linear",
514 - "lineWidth": 1,
515 - "pointSize": 5,
516 - "scaleDistribution": {
517 - "type": "linear"
518 - },
519 - "showPoints": "auto",
520 - "spanNulls": false,
521 - "stacking": {
522 - "group": "A",
523 - "mode": "normal"
524 - },
525 - "thresholdsStyle": {
526 - "mode": "off"
527 - }
528 - },
529 - "mappings": [],
530 - "thresholds": {
531 - "mode": "absolute",
532 - "steps": [
533 - {
534 - "color": "green",
535 - "value": null
536 - },
537 - {
538 - "color": "red",
539 - "value": 80
540 - }
541 - ]
542 - }
543 - },
544 - "overrides": []
545 - },
546 - "gridPos": {
547 - "h": 13,
548 - "w": 20,
549 - "x": 4,
550 - "y": 7
551 - },
552 - "id": 60,
553 - "options": {
554 - "legend": {
555 - "calcs": [],
556 - "displayMode": "table",
557 - "placement": "right",
558 - "showLegend": true
559 - },
560 - "tooltip": {
561 - "mode": "single",
562 - "sort": "none"
563 - }
564 - },
565 - "targets": [
566 - {
567 - "alias": "",
568 - "bucketAggs": [
569 - {
570 - "field": "data_office365_Operation",
571 - "id": "3",
572 - "settings": {
573 - "min_doc_count": "1",
574 - "order": "desc",
575 - "orderBy": "_count",
576 - "size": "10"
577 - },
578 - "type": "terms"
579 - },
580 - {
581 - "field": "timestamp",
582 - "id": "2",
583 - "settings": {
584 - "interval": "auto"
585 - },
586 - "type": "date_histogram"
587 - }
588 - ],
589 - "datasource": {
590 - "type": "elasticsearch",
591 - "uid": "replace_datasource_uid"
592 - },
593 - "metrics": [
594 - {
595 - "id": "1",
596 - "type": "count"
597 - }
598 - ],
599 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
600 - "refId": "A",
601 - "timeField": "timestamp"
602 - }
603 - ],
604 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
605 - "transparent": true,
606 - "type": "timeseries"
607 - },
608 - {
609 - "datasource": {
610 - "type": "elasticsearch",
611 - "uid": "replace_datasource_uid"
612 - },
613 - "fieldConfig": {
614 - "defaults": {
615 - "mappings": [
616 - {
617 - "options": {
618 - "match": "null",
619 - "result": {
620 - "text": "N/A"
621 - }
622 - },
623 - "type": "special"
624 - }
625 - ],
626 - "thresholds": {
627 - "mode": "absolute",
628 - "steps": [
629 - {
630 - "color": "blue",
631 - "value": null
632 - }
633 - ]
634 - },
635 - "unit": "locale"
636 - },
637 - "overrides": []
638 - },
639 - "gridPos": {
640 - "h": 6,
641 - "w": 4,
642 - "x": 0,
643 - "y": 14
644 - },
645 - "id": 51,
646 - "links": [],
647 - "options": {
648 - "colorMode": "value",
649 - "graphMode": "area",
650 - "justifyMode": "auto",
651 - "orientation": "horizontal",
652 - "reduceOptions": {
653 - "calcs": [
654 - "sum"
655 - ],
656 - "fields": "",
657 - "values": false
658 - },
659 - "text": {},
660 - "textMode": "auto"
661 - },
662 - "pluginVersion": "10.0.3",
663 - "targets": [
664 - {
665 - "bucketAggs": [
666 - {
667 - "$$hashKey": "object:331",
668 - "field": "timestamp",
669 - "id": "2",
670 - "settings": {
671 - "interval": "auto",
672 - "min_doc_count": 0,
673 - "trimEdges": 0
674 - },
675 - "type": "date_histogram"
676 - }
677 - ],
678 - "datasource": {
679 - "type": "elasticsearch",
680 - "uid": "replace_datasource_uid"
681 - },
682 - "metrics": [
683 - {
684 - "$$hashKey": "object:329",
685 - "field": "select field",
686 - "id": "1",
687 - "type": "count"
688 - }
689 - ],
690 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
691 - "refId": "A",
692 - "timeField": "timestamp"
693 - }
694 - ],
695 - "title": "EVENTS (Total)",
696 - "type": "stat"
697 - },
698 - {
699 - "datasource": {
700 - "type": "elasticsearch",
701 - "uid": "replace_datasource_uid"
702 - },
703 - "fieldConfig": {
704 - "defaults": {
705 - "mappings": [
706 - {
707 - "options": {
708 - "match": "null",
709 - "result": {
710 - "text": "N/A"
711 - }
712 - },
713 - "type": "special"
714 - }
715 - ],
716 - "thresholds": {
717 - "mode": "absolute",
718 - "steps": [
719 - {
720 - "color": "orange",
721 - "value": null
722 - }
723 - ]
724 - },
725 - "unit": "locale"
726 - },
727 - "overrides": []
728 - },
729 - "gridPos": {
730 - "h": 6,
731 - "w": 4,
732 - "x": 0,
733 - "y": 20
734 - },
735 - "id": 52,
736 - "links": [],
737 - "options": {
738 - "colorMode": "value",
739 - "graphMode": "area",
740 - "justifyMode": "auto",
741 - "orientation": "horizontal",
742 - "reduceOptions": {
743 - "calcs": [
744 - "sum"
745 - ],
746 - "fields": "",
747 - "values": false
748 - },
749 - "text": {},
750 - "textMode": "auto"
751 - },
752 - "pluginVersion": "10.0.3",
753 - "targets": [
754 - {
755 - "bucketAggs": [
756 - {
757 - "$$hashKey": "object:331",
758 - "field": "timestamp",
759 - "id": "2",
760 - "settings": {
761 - "interval": "auto",
762 - "min_doc_count": 0,
763 - "trimEdges": 0
764 - },
765 - "type": "date_histogram"
766 - }
767 - ],
768 - "datasource": {
769 - "type": "elasticsearch",
770 - "uid": "replace_datasource_uid"
771 - },
772 - "metrics": [
773 - {
774 - "$$hashKey": "object:329",
775 - "field": "select field",
776 - "id": "1",
777 - "type": "count"
778 - }
779 - ],
780 - "query": "data_office365_Operation:MessageCreatedHasLink AND rule_level:$rule_level",
781 - "refId": "A",
782 - "timeField": "timestamp"
783 - }
784 - ],
785 - "title": "EXCHANGE - MESSAGES CONTAINING LINK",
786 - "type": "stat"
787 - },
788 - {
789 - "circleMaxSize": 30,
790 - "circleMinSize": 2,
791 - "colors": [
792 - "rgba(245, 54, 54, 0.9)",
793 - "rgba(237, 129, 40, 0.89)",
794 - "rgba(50, 172, 45, 0.97)"
795 - ],
796 - "datasource": {
797 - "type": "elasticsearch",
798 - "uid": "replace_datasource_uid"
799 - },
800 - "decimals": 0,
801 - "esMetric": "Count",
802 - "gridPos": {
803 - "h": 12,
804 - "w": 10,
805 - "x": 4,
806 - "y": 20
807 - },
808 - "hideEmpty": false,
809 - "hideZero": false,
810 - "id": 50,
811 - "initialZoom": 1,
812 - "locationData": "countries",
813 - "mapCenter": "(0°, 0°)",
814 - "mapCenterLatitude": 0,
815 - "mapCenterLongitude": 0,
816 - "maxDataPoints": 1,
817 - "mouseWheelZoom": false,
818 - "showLegend": true,
819 - "stickyLabels": false,
820 - "tableQueryOptions": {
821 - "geohashField": "geohash",
822 - "latitudeField": "latitude",
823 - "longitudeField": "longitude",
824 - "metricField": "metric",
825 - "queryType": "geohash"
826 - },
827 - "targets": [
828 - {
829 - "bucketAggs": [
830 - {
831 - "fake": true,
832 - "field": "data_office365_ClientIP_country_code",
833 - "id": "3",
834 - "settings": {
835 - "min_doc_count": 1,
836 - "order": "desc",
837 - "orderBy": "_term",
838 - "size": "0"
839 - },
840 - "type": "terms"
841 - },
842 - {
843 - "field": "timestamp",
844 - "id": "2",
845 - "settings": {
846 - "interval": "auto",
847 - "min_doc_count": 0,
848 - "trimEdges": 0
849 - },
850 - "type": "date_histogram"
851 - }
852 - ],
853 - "datasource": {
854 - "type": "elasticsearch",
855 - "uid": "replace_datasource_uid"
856 - },
857 - "metrics": [
858 - {
859 - "field": "select field",
860 - "id": "1",
861 - "type": "count"
862 - }
863 - ],
864 - "query": "data_office365_Workload:Exchange AND rule_level:$rule_level",
865 - "refId": "A",
866 - "timeField": "timestamp"
867 - }
868 - ],
869 - "thresholds": "0,10",
870 - "title": "EXCHANGE - ALL EVENTS BY SRC COUNTRY",
871 - "type": "grafana-worldmap-panel",
872 - "unitPlural": "",
873 - "unitSingle": "",
874 - "valueName": "total"
875 - },
876 - {
877 - "datasource": {
878 - "type": "elasticsearch",
879 - "uid": "replace_datasource_uid"
880 - },
881 - "fieldConfig": {
882 - "defaults": {
883 - "color": {
884 - "mode": "thresholds"
885 - },
886 - "custom": {
887 - "align": "auto",
888 - "cellOptions": {
889 - "type": "auto"
890 - },
891 - "inspect": false
892 - },
893 - "mappings": [],
894 - "thresholds": {
895 - "mode": "absolute",
896 - "steps": [
897 - {
898 - "color": "orange",
899 - "value": null
900 - }
901 - ]
902 - }
903 - },
904 - "overrides": [
905 - {
906 - "matcher": {
907 - "id": "byName",
908 - "options": "Count"
909 - },
910 - "properties": [
911 - {
912 - "id": "displayName",
913 - "value": "EVENTS"
914 - },
915 - {
916 - "id": "unit",
917 - "value": "short"
918 - },
919 - {
920 - "id": "decimals",
921 - "value": -1
922 - },
923 - {
924 - "id": "custom.align"
925 - }
926 - ]
927 - },
928 - {
929 - "matcher": {
930 - "id": "byName",
931 - "options": "AD ACCOUNT"
932 - },
933 - "properties": [
934 - {
935 - "id": "custom.width",
936 - "value": 377
937 - }
938 - ]
939 - }
940 - ]
941 - },
942 - "gridPos": {
943 - "h": 12,
944 - "w": 10,
945 - "x": 14,
946 - "y": 20
947 - },
948 - "id": 58,
949 - "options": {
950 - "cellHeight": "sm",
951 - "footer": {
952 - "countRows": false,
953 - "fields": "",
954 - "reducer": [
955 - "sum"
956 - ],
957 - "show": false
958 - },
959 - "showHeader": true,
960 - "sortBy": []
961 - },
962 - "pluginVersion": "10.0.3",
963 - "targets": [
964 - {
965 - "bucketAggs": [
966 - {
967 - "fake": true,
968 - "field": "data_office365_UserId",
969 - "id": "4",
970 - "settings": {
971 - "min_doc_count": 1,
972 - "order": "desc",
973 - "orderBy": "_count",
974 - "size": "0"
975 - },
976 - "type": "terms"
977 - },
978 - {
979 - "field": "data_office365_ClientIP_country_code",
980 - "id": "5",
981 - "settings": {
982 - "min_doc_count": "1",
983 - "order": "desc",
984 - "orderBy": "_term",
985 - "size": "10"
986 - },
987 - "type": "terms"
988 - }
989 - ],
990 - "datasource": {
991 - "type": "elasticsearch",
992 - "uid": "replace_datasource_uid"
993 - },
994 - "metrics": [
995 - {
996 - "field": "select field",
997 - "id": "1",
998 - "type": "count"
999 - }
1000 - ],
1001 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1002 - "refId": "A",
1003 - "timeField": "timestamp"
1004 - }
1005 - ],
1006 - "title": "EXCHANGE EVENTS BY ACCOUNT",
1007 - "transformations": [
1008 - {
1009 - "id": "merge",
1010 - "options": {
1011 - "reducers": []
1012 - }
1013 - },
1014 - {
1015 - "id": "organize",
1016 - "options": {
1017 - "excludeByName": {},
1018 - "indexByName": {},
1019 - "renameByName": {
1020 - "Count": "EVENTS",
1021 - "data_office365_ClientIP_country_code": "COUNTRY",
1022 - "data_office365_LogonError": "ERROR",
1023 - "data_office365_Operation": "WORKLOAD",
1024 - "data_office365_UserId": "AD ACCOUNT"
1025 - }
1026 - }
1027 - }
1028 - ],
1029 - "type": "table"
1030 - },
1031 - {
1032 - "datasource": {
1033 - "type": "elasticsearch",
1034 - "uid": "replace_datasource_uid"
1035 - },
1036 - "fieldConfig": {
1037 - "defaults": {
1038 - "mappings": [
1039 - {
1040 - "options": {
1041 - "match": "null",
1042 - "result": {
1043 - "text": "N/A"
1044 - }
1045 - },
1046 - "type": "special"
1047 - }
1048 - ],
1049 - "thresholds": {
1050 - "mode": "absolute",
1051 - "steps": [
1052 - {
1053 - "color": "blue",
1054 - "value": null
1055 - }
1056 - ]
1057 - },
1058 - "unit": "locale"
1059 - },
1060 - "overrides": []
1061 - },
1062 - "gridPos": {
1063 - "h": 6,
1064 - "w": 4,
1065 - "x": 0,
1066 - "y": 26
1067 - },
1068 - "id": 18,
1069 - "links": [],
1070 - "options": {
1071 - "colorMode": "value",
1072 - "graphMode": "area",
1073 - "justifyMode": "auto",
1074 - "orientation": "horizontal",
1075 - "reduceOptions": {
1076 - "calcs": [
1077 - "sum"
1078 - ],
1079 - "fields": "",
1080 - "values": false
1081 - },
1082 - "text": {},
1083 - "textMode": "auto"
1084 - },
1085 - "pluginVersion": "10.0.3",
1086 - "targets": [
1087 - {
1088 - "bucketAggs": [
1089 - {
1090 - "$$hashKey": "object:331",
1091 - "field": "timestamp",
1092 - "id": "2",
1093 - "settings": {
1094 - "interval": "auto",
1095 - "min_doc_count": 0,
1096 - "trimEdges": 0
1097 - },
1098 - "type": "date_histogram"
1099 - }
1100 - ],
1101 - "datasource": {
1102 - "type": "elasticsearch",
1103 - "uid": "replace_datasource_uid"
1104 - },
1105 - "metrics": [
1106 - {
1107 - "$$hashKey": "object:329",
1108 - "field": "select field",
1109 - "id": "1",
1110 - "type": "count"
1111 - }
1112 - ],
1113 - "query": "data_office365_Operation:TeamsSessionStarted AND rule_level:$rule_level",
1114 - "refId": "A",
1115 - "timeField": "timestamp"
1116 - }
1117 - ],
1118 - "title": "EXCHANGE - SESSIONS STARTED",
1119 - "type": "stat"
1120 - },
1121 - {
1122 - "datasource": {
1123 - "type": "elasticsearch",
1124 - "uid": "replace_datasource_uid"
1125 - },
1126 - "fieldConfig": {
1127 - "defaults": {
1128 - "color": {
1129 - "mode": "thresholds"
1130 - },
1131 - "custom": {
1132 - "align": "auto",
1133 - "cellOptions": {
1134 - "type": "auto"
1135 - },
1136 - "filterable": true,
1137 - "inspect": false
1138 - },
1139 - "mappings": [],
1140 - "thresholds": {
1141 - "mode": "absolute",
1142 - "steps": [
1143 - {
1144 - "color": "green",
1145 - "value": null
1146 - },
1147 - {
1148 - "color": "red",
1149 - "value": 80
1150 - }
1151 - ]
1152 - }
1153 - },
1154 - "overrides": [
1155 - {
1156 - "matcher": {
1157 - "id": "byName",
1158 - "options": "rule_level"
1159 - },
1160 - "properties": [
1161 - {
1162 - "id": "displayName",
1163 - "value": "RULE LEVEL"
1164 - },
1165 - {
1166 - "id": "unit",
1167 - "value": "short"
1168 - },
1169 - {
1170 - "id": "decimals",
1171 - "value": -1
1172 - },
1173 - {
1174 - "id": "custom.cellOptions",
1175 - "value": {
1176 - "mode": "gradient",
1177 - "type": "color-background"
1178 - }
1179 - },
1180 - {
1181 - "id": "custom.align"
1182 - },
1183 - {
1184 - "id": "thresholds",
1185 - "value": {
1186 - "mode": "absolute",
1187 - "steps": [
1188 - {
1189 - "color": "#37872D",
1190 - "value": null
1191 - },
1192 - {
1193 - "color": "rgba(237, 129, 40, 0.89)",
1194 - "value": 7
1195 - },
1196 - {
1197 - "color": "rgba(245, 54, 54, 0.9)",
1198 - "value": 12
1199 - }
1200 - ]
1201 - }
1202 - }
1203 - ]
1204 - },
1205 - {
1206 - "matcher": {
1207 - "id": "byName",
1208 - "options": "Date/Time"
1209 - },
1210 - "properties": [
1211 - {
1212 - "id": "custom.width",
1213 - "value": 242
1214 - }
1215 - ]
1216 - },
1217 - {
1218 - "matcher": {
1219 - "id": "byName",
1220 - "options": "MITRE TACTIC"
1221 - },
1222 - "properties": [
1223 - {
1224 - "id": "custom.width",
1225 - "value": 332
1226 - }
1227 - ]
1228 - },
1229 - {
1230 - "matcher": {
1231 - "id": "byName",
1232 - "options": "IP ADDRESS"
1233 - },
1234 - "properties": [
1235 - {
1236 - "id": "custom.width",
1237 - "value": 163
1238 - }
1239 - ]
1240 - },
1241 - {
1242 - "matcher": {
1243 - "id": "byName",
1244 - "options": "MITRE TECHNIQUE"
1245 - },
1246 - "properties": [
1247 - {
1248 - "id": "custom.width",
1249 - "value": 312
1250 - }
1251 - ]
1252 - },
1253 - {
1254 - "matcher": {
1255 - "id": "byName",
1256 - "options": "EVENT ID"
1257 - },
1258 - "properties": [
1259 - {
1260 - "id": "links",
1261 - "value": [
1262 - {
1263 - "targetBlank": true,
1264 - "title": "VIEW EVENT DETAILS",
1265 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1266 - }
1267 - ]
1268 - },
1269 - {
1270 - "id": "custom.width",
1271 - "value": 265
1272 - }
1273 - ]
1274 - },
1275 - {
1276 - "matcher": {
1277 - "id": "byName",
1278 - "options": "RESULT"
1279 - },
1280 - "properties": [
1281 - {
1282 - "id": "custom.width",
1283 - "value": 118
1284 - },
1285 - {
1286 - "id": "mappings",
1287 - "value": [
1288 - {
1289 - "options": {
1290 - "Failed": {
1291 - "color": "orange",
1292 - "index": 1
1293 - },
1294 - "Success": {
1295 - "color": "green",
1296 - "index": 0
1297 - }
1298 - },
1299 - "type": "value"
1300 - }
1301 - ]
1302 - },
1303 - {
1304 - "id": "custom.cellOptions",
1305 - "value": {
1306 - "type": "color-text"
1307 - }
1308 - }
1309 - ]
1310 - },
1311 - {
1312 - "matcher": {
1313 - "id": "byName",
1314 - "options": "SRC IP"
1315 - },
1316 - "properties": [
1317 - {
1318 - "id": "custom.width",
1319 - "value": 265
1320 - }
1321 - ]
1322 - },
1323 - {
1324 - "matcher": {
1325 - "id": "byName",
1326 - "options": "ACCOUNT"
1327 - },
1328 - "properties": [
1329 - {
1330 - "id": "custom.width",
1331 - "value": 227
1332 - }
1333 - ]
1334 - },
1335 - {
1336 - "matcher": {
1337 - "id": "byName",
1338 - "options": "EVENT TIME"
1339 - },
1340 - "properties": [
1341 - {
1342 - "id": "custom.width",
1343 - "value": 195
1344 - }
1345 - ]
1346 - },
1347 - {
1348 - "matcher": {
1349 - "id": "byName",
1350 - "options": "CLIENT IP"
1351 - },
1352 - "properties": [
1353 - {
1354 - "id": "custom.width",
1355 - "value": 229
1356 - }
1357 - ]
1358 - },
1359 - {
1360 - "matcher": {
1361 - "id": "byName",
1362 - "options": "DESCRIPTION"
1363 - },
1364 - "properties": [
1365 - {
1366 - "id": "custom.width",
1367 - "value": 491
1368 - }
1369 - ]
1370 - }
1371 - ]
1372 - },
1373 - "gridPos": {
1374 - "h": 16,
1375 - "w": 24,
1376 - "x": 0,
1377 - "y": 32
1378 - },
1379 - "id": 27,
1380 - "options": {
1381 - "cellHeight": "sm",
1382 - "footer": {
1383 - "countRows": false,
1384 - "enablePagination": true,
1385 - "fields": "",
1386 - "reducer": [
1387 - "sum"
1388 - ],
1389 - "show": false
1390 - },
1391 - "showHeader": true,
1392 - "sortBy": []
1393 - },
1394 - "pluginVersion": "10.0.3",
1395 - "targets": [
1396 - {
1397 - "bucketAggs": [],
1398 - "datasource": {
1399 - "type": "elasticsearch",
1400 - "uid": "replace_datasource_uid"
1401 - },
1402 - "metrics": [
1403 - {
1404 - "id": "1",
1405 - "settings": {
1406 - "size": "250"
1407 - },
1408 - "type": "raw_data"
1409 - }
1410 - ],
1411 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1412 - "refId": "A",
1413 - "timeField": "timestamp"
1414 - }
1415 - ],
1416 - "title": "EVENTS",
1417 - "transformations": [
1418 - {
1419 - "id": "organize",
1420 - "options": {
1421 - "excludeByName": {
1422 - "@metadata_beat": true,
1423 - "@metadata_type": true,
1424 - "@metadata_version": true,
1425 - "IMPHASH": true,
1426 - "MD5": true,
1427 - "SHA1": true,
1428 - "SHA256": true,
1429 - "_id": false,
1430 - "_index": true,
1431 - "_type": true,
1432 - "agent_ephemeral_id": true,
1433 - "agent_hostname": true,
1434 - "agent_id": true,
1435 - "agent_ip_city_name": true,
1436 - "agent_ip_country_code": true,
1437 - "agent_ip_geolocation": true,
1438 - "agent_name": true,
1439 - "agent_type": true,
1440 - "agent_version": true,
1441 - "beats_type": true,
1442 - "cluster_name": true,
1443 - "cluster_node": true,
1444 - "collector_node_id": true,
1445 - "data_alert_action": true,
1446 - "data_alert_category": true,
1447 - "data_alert_gid": true,
1448 - "data_alert_rev": true,
1449 - "data_alert_severity": true,
1450 - "data_alert_signature": true,
1451 - "data_alert_signature_id": true,
1452 - "data_app_proto": true,
1453 - "data_audit_auid": true,
1454 - "data_audit_command": true,
1455 - "data_audit_euid": true,
1456 - "data_audit_exe": true,
1457 - "data_audit_gid": true,
1458 - "data_audit_id": true,
1459 - "data_audit_pid": true,
1460 - "data_audit_res": true,
1461 - "data_audit_session": true,
1462 - "data_audit_type": true,
1463 - "data_audit_uid": true,
1464 - "data_dest_ip": true,
1465 - "data_dest_port": true,
1466 - "data_dstuser": true,
1467 - "data_event_type": true,
1468 - "data_extra_data": true,
1469 - "data_file": true,
1470 - "data_flow_bytes_toclient": true,
1471 - "data_flow_bytes_toserver": true,
1472 - "data_flow_id": true,
1473 - "data_flow_pkts_toclient": true,
1474 - "data_flow_pkts_toserver": true,
1475 - "data_flow_start": true,
1476 - "data_http_http_content_type": true,
1477 - "data_http_http_port": true,
1478 - "data_http_length": true,
1479 - "data_http_status": true,
1480 - "data_http_url": true,
1481 - "data_id": true,
1482 - "data_in_iface": true,
1483 - "data_integration": true,
1484 - "data_metadata_flowbits": true,
1485 - "data_metadata_flowints_http_anomaly_count": true,
1486 - "data_metadata_flowints_tcp_retransmission_count": true,
1487 - "data_office365_AADGroupId": true,
1488 - "data_office365_Actor": true,
1489 - "data_office365_ActorContextId": true,
1490 - "data_office365_ActorIpAddress": false,
1491 - "data_office365_ActorIpAddress_city_name": true,
1492 - "data_office365_ActorIpAddress_country_code": true,
1493 - "data_office365_ActorIpAddress_geolocation": true,
1494 - "data_office365_AppAccessContext_APIId": true,
1495 - "data_office365_AppAccessContext_ClientAppId": true,
1496 - "data_office365_AppAccessContext_ClientAppName": true,
1497 - "data_office365_AppAccessContext_CorrelationId": true,
1498 - "data_office365_AppId": true,
1499 - "data_office365_ApplicationId": true,
1500 - "data_office365_ArtifactsShared": true,
1501 - "data_office365_Attendees": true,
1502 - "data_office365_AzureActiveDirectoryEventType": true,
1503 - "data_office365_ChannelGuid": true,
1504 - "data_office365_ChannelName": true,
1505 - "data_office365_ChatName": true,
1506 - "data_office365_ChatThreadId": true,
1507 - "data_office365_ClientAppId": true,
1508 - "data_office365_ClientIP": false,
1509 - "data_office365_ClientIPAddress": true,
1510 - "data_office365_ClientIPAddress_city_name": true,
1511 - "data_office365_ClientIPAddress_country_code": true,
1512 - "data_office365_ClientIPAddress_geolocation": true,
1513 - "data_office365_ClientIP_city_name": true,
1514 - "data_office365_ClientIP_country_code": true,
1515 - "data_office365_ClientIP_geolocation": true,
1516 - "data_office365_ClientInfoString": true,
1517 - "data_office365_ClientProcessName": true,
1518 - "data_office365_ClientRequestId": true,
1519 - "data_office365_ClientVersion": true,
1520 - "data_office365_CommunicationSubType": true,
1521 - "data_office365_CommunicationType": true,
1522 - "data_office365_CreationTime": false,
1523 - "data_office365_CrossMailboxOperation": true,
1524 - "data_office365_DestFolder_Id": true,
1525 - "data_office365_DestFolder_Path": true,
1526 - "data_office365_DeviceId": true,
1527 - "data_office365_DeviceInformation": true,
1528 - "data_office365_DeviceProperties": true,
1529 - "data_office365_EndTime": true,
1530 - "data_office365_ErrorNumber": true,
1531 - "data_office365_ExchangeId": true,
1532 - "data_office365_ExtendedProperties": true,
1533 - "data_office365_ExternalAccess": true,
1534 - "data_office365_ExtraProperties": true,
1535 - "data_office365_Folder_Id": true,
1536 - "data_office365_Folder_Path": true,
1537 - "data_office365_HostedContents": true,
1538 - "data_office365_ICalUid": true,
1539 - "data_office365_Id": true,
1540 - "data_office365_InterSystemsId": true,
1541 - "data_office365_InternalLogonType": true,
1542 - "data_office365_IntraSystemId": true,
1543 - "data_office365_ItemName": true,
1544 - "data_office365_Item_Id": true,
1545 - "data_office365_Item_InternetMessageId": true,
1546 - "data_office365_Item_IsRecord": true,
1547 - "data_office365_Item_ParentFolder_Id": true,
1548 - "data_office365_Item_SizeInBytes": true,
1549 - "data_office365_JoinTime": true,
1550 - "data_office365_LeaveTime": true,
1551 - "data_office365_LogonError": true,
1552 - "data_office365_LogonType": true,
1553 - "data_office365_LogonUserSid": true,
1554 - "data_office365_MailboxGuid": true,
1555 - "data_office365_MailboxOwnerSid": true,
1556 - "data_office365_MailboxOwnerUPN": true,
1557 - "data_office365_MeetingDetailId": true,
1558 - "data_office365_MeetingURL": true,
1559 - "data_office365_Members": true,
1560 - "data_office365_MessageId": true,
1561 - "data_office365_MessageSizeInBytes": true,
1562 - "data_office365_MessageURLs": true,
1563 - "data_office365_MessageVersion": true,
1564 - "data_office365_Modalities": true,
1565 - "data_office365_ModifiedProperties": true,
1566 - "data_office365_Name": true,
1567 - "data_office365_NewValue": true,
1568 - "data_office365_ObjectId": true,
1569 - "data_office365_Operation": true,
1570 - "data_office365_OperationScope": true,
1571 - "data_office365_OrganizationId": true,
1572 - "data_office365_OrganizationName": true,
1573 - "data_office365_Organizer_OrganizationId": true,
1574 - "data_office365_Organizer_RecipientType": true,
1575 - "data_office365_Organizer_Role": true,
1576 - "data_office365_Organizer_UserObjectId": true,
1577 - "data_office365_OriginatingServer": true,
1578 - "data_office365_Parameters": true,
1579 - "data_office365_ParentMessageId": true,
1580 - "data_office365_ProviderTypes": true,
1581 - "data_office365_RecordType": true,
1582 - "data_office365_ResultStatus": true,
1583 - "data_office365_SessionId": true,
1584 - "data_office365_StartTime": true,
1585 - "data_office365_Subscription": true,
1586 - "data_office365_SubscriptionId": true,
1587 - "data_office365_Target": true,
1588 - "data_office365_TargetContextId": true,
1589 - "data_office365_TeamGuid": true,
1590 - "data_office365_TeamName": true,
1591 - "data_office365_UserId": false,
1592 - "data_office365_UserKey": true,
1593 - "data_office365_UserType": true,
1594 - "data_office365_Version": true,
1595 - "data_office365_Workload": true,
1596 - "data_osquery_action": true,
1597 - "data_osquery_calendarTime": true,
1598 - "data_osquery_columns_address": true,
1599 - "data_osquery_columns_address_city_name": true,
1600 - "data_osquery_columns_address_country_code": true,
1601 - "data_osquery_columns_address_geolocation": true,
1602 - "data_osquery_columns_cmdline": true,
1603 - "data_osquery_columns_cwd": true,
1604 - "data_osquery_columns_description": true,
1605 - "data_osquery_columns_directory": true,
1606 - "data_osquery_columns_disk_bytes_read": true,
1607 - "data_osquery_columns_disk_bytes_written": true,
1608 - "data_osquery_columns_egid": true,
1609 - "data_osquery_columns_euid": true,
1610 - "data_osquery_columns_family": true,
1611 - "data_osquery_columns_fd": true,
1612 - "data_osquery_columns_gid": true,
1613 - "data_osquery_columns_gid_signed": true,
1614 - "data_osquery_columns_host": true,
1615 - "data_osquery_columns_interface": true,
1616 - "data_osquery_columns_local_address": true,
1617 - "data_osquery_columns_local_address_city_name": true,
1618 - "data_osquery_columns_local_address_country_code": true,
1619 - "data_osquery_columns_local_address_geolocation": true,
1620 - "data_osquery_columns_local_port": true,
1621 - "data_osquery_columns_mac": true,
1622 - "data_osquery_columns_name": true,
1623 - "data_osquery_columns_net_namespace": true,
1624 - "data_osquery_columns_nice": true,
1625 - "data_osquery_columns_on_disk": true,
1626 - "data_osquery_columns_parent": true,
1627 - "data_osquery_columns_path": true,
1628 - "data_osquery_columns_pgroup": true,
1629 - "data_osquery_columns_pid": true,
1630 - "data_osquery_columns_port": true,
1631 - "data_osquery_columns_protocol": true,
1632 - "data_osquery_columns_remote_address": true,
1633 - "data_osquery_columns_remote_address_city_name": true,
1634 - "data_osquery_columns_remote_address_country_code": true,
1635 - "data_osquery_columns_remote_address_geolocation": true,
1636 - "data_osquery_columns_remote_port": true,
1637 - "data_osquery_columns_resident_size": true,
1638 - "data_osquery_columns_root": true,
1639 - "data_osquery_columns_sgid": true,
1640 - "data_osquery_columns_shell": true,
1641 - "data_osquery_columns_socket": true,
1642 - "data_osquery_columns_start_time": true,
1643 - "data_osquery_columns_state": true,
1644 - "data_osquery_columns_suid": true,
1645 - "data_osquery_columns_system_time": true,
1646 - "data_osquery_columns_threads": true,
1647 - "data_osquery_columns_time_utc": true,
1648 - "data_osquery_columns_total_size": true,
1649 - "data_osquery_columns_tty": true,
1650 - "data_osquery_columns_type": true,
1651 - "data_osquery_columns_uid": true,
1652 - "data_osquery_columns_uid_signed": true,
1653 - "data_osquery_columns_user": true,
1654 - "data_osquery_columns_user_time": true,
1655 - "data_osquery_columns_username": true,
1656 - "data_osquery_columns_wired_size": true,
1657 - "data_osquery_counter": true,
1658 - "data_osquery_decorations_host_uuid": true,
1659 - "data_osquery_decorations_hostname": true,
1660 - "data_osquery_epoch": true,
1661 - "data_osquery_hostIdentifier": true,
1662 - "data_osquery_name": true,
1663 - "data_osquery_numerics": true,
1664 - "data_osquery_unixTime": true,
1665 - "data_proto": true,
1666 - "data_sca_check_command": true,
1667 - "data_sca_check_compliance_cis": true,
1668 - "data_sca_check_compliance_cis_csc": true,
1669 - "data_sca_check_compliance_gdpr_IV": true,
1670 - "data_sca_check_compliance_gpg_13": true,
1671 - "data_sca_check_compliance_hipaa": true,
1672 - "data_sca_check_compliance_nist_800_53": true,
1673 - "data_sca_check_compliance_pci_dss": true,
1674 - "data_sca_check_compliance_tsc": true,
1675 - "data_sca_check_description": true,
1676 - "data_sca_check_id": true,
1677 - "data_sca_check_previous_result": true,
1678 - "data_sca_check_rationale": true,
1679 - "data_sca_check_remediation": true,
1680 - "data_sca_check_result": true,
1681 - "data_sca_check_title": true,
1682 - "data_sca_description": true,
1683 - "data_sca_failed": true,
1684 - "data_sca_file": true,
1685 - "data_sca_invalid": true,
1686 - "data_sca_passed": true,
1687 - "data_sca_policy": true,
1688 - "data_sca_policy_id": true,
1689 - "data_sca_scan_id": true,
1690 - "data_sca_score": true,
1691 - "data_sca_total_checks": true,
1692 - "data_sca_type": true,
1693 - "data_script": true,
1694 - "data_src_ip": true,
1695 - "data_src_ip_city_name": true,
1696 - "data_src_ip_country_code": true,
1697 - "data_src_ip_geolocation": true,
1698 - "data_src_port": true,
1699 - "data_srcip": true,
1700 - "data_srcip_city_name": true,
1701 - "data_srcip_country_code": true,
1702 - "data_srcip_geolocation": true,
1703 - "data_srcuser": true,
1704 - "data_timestamp": true,
1705 - "data_title": true,
1706 - "data_tls_session_resumed": true,
1707 - "data_tls_version": true,
1708 - "data_tx_id": true,
1709 - "data_type": true,
1710 - "data_win_eventXML_binaryData": true,
1711 - "data_win_eventXML_binaryDataSize": true,
1712 - "data_win_eventXML_param1": true,
1713 - "data_win_eventdata_authenticationPackageName": true,
1714 - "data_win_eventdata_callTrace": true,
1715 - "data_win_eventdata_commandLine": true,
1716 - "data_win_eventdata_company": true,
1717 - "data_win_eventdata_creationUtcTime": true,
1718 - "data_win_eventdata_currentDirectory": true,
1719 - "data_win_eventdata_description": true,
1720 - "data_win_eventdata_destinationHostname": true,
1721 - "data_win_eventdata_destinationIp": true,
1722 - "data_win_eventdata_destinationIp_city_name": true,
1723 - "data_win_eventdata_destinationIp_country_code": true,
1724 - "data_win_eventdata_destinationIp_geolocation": true,
1725 - "data_win_eventdata_destinationIsIpv6": true,
1726 - "data_win_eventdata_destinationPort": true,
1727 - "data_win_eventdata_destinationPortName": true,
1728 - "data_win_eventdata_details": true,
1729 - "data_win_eventdata_elevatedToken": true,
1730 - "data_win_eventdata_eventType": true,
1731 - "data_win_eventdata_fileVersion": true,
1732 - "data_win_eventdata_fileVersion_city_name": true,
1733 - "data_win_eventdata_fileVersion_country_code": true,
1734 - "data_win_eventdata_fileVersion_geolocation": true,
1735 - "data_win_eventdata_grantedAccess": true,
1736 - "data_win_eventdata_hashes": true,
1737 - "data_win_eventdata_image": true,
1738 - "data_win_eventdata_imageLoaded": true,
1739 - "data_win_eventdata_impersonationLevel": true,
1740 - "data_win_eventdata_initiated": true,
1741 - "data_win_eventdata_integrityLevel": true,
1742 - "data_win_eventdata_ipAddress": true,
1743 - "data_win_eventdata_ipPort": true,
1744 - "data_win_eventdata_keyLength": true,
1745 - "data_win_eventdata_logonGuid": true,
1746 - "data_win_eventdata_logonId": true,
1747 - "data_win_eventdata_logonProcessName": true,
1748 - "data_win_eventdata_logonType": true,
1749 - "data_win_eventdata_originalFileName": true,
1750 - "data_win_eventdata_param1": true,
1751 - "data_win_eventdata_param2": true,
1752 - "data_win_eventdata_param3": true,
1753 - "data_win_eventdata_param4": true,
1754 - "data_win_eventdata_parentCommandLine": true,
1755 - "data_win_eventdata_parentImage": true,
1756 - "data_win_eventdata_parentProcessGuid": true,
1757 - "data_win_eventdata_parentProcessId": true,
1758 - "data_win_eventdata_processGuid": true,
1759 - "data_win_eventdata_processId": true,
1760 - "data_win_eventdata_processName": true,
1761 - "data_win_eventdata_product": true,
1762 - "data_win_eventdata_protocol": true,
1763 - "data_win_eventdata_queryName": true,
1764 - "data_win_eventdata_queryResults": true,
1765 - "data_win_eventdata_queryStatus": true,
1766 - "data_win_eventdata_ruleName": true,
1767 - "data_win_eventdata_serviceName": true,
1768 - "data_win_eventdata_serviceSid": true,
1769 - "data_win_eventdata_signature": true,
1770 - "data_win_eventdata_signatureStatus": true,
1771 - "data_win_eventdata_signed": true,
1772 - "data_win_eventdata_sourceHostname": true,
1773 - "data_win_eventdata_sourceImage": true,
1774 - "data_win_eventdata_sourceIp": true,
1775 - "data_win_eventdata_sourceIp_city_name": true,
1776 - "data_win_eventdata_sourceIp_country_code": true,
1777 - "data_win_eventdata_sourceIp_geolocation": true,
1778 - "data_win_eventdata_sourceIsIpv6": true,
1779 - "data_win_eventdata_sourcePort": true,
1780 - "data_win_eventdata_sourceProcessGUID": true,
1781 - "data_win_eventdata_sourceProcessId": true,
1782 - "data_win_eventdata_sourceThreadId": true,
1783 - "data_win_eventdata_status": true,
1784 - "data_win_eventdata_subjectDomainName": true,
1785 - "data_win_eventdata_subjectLogonId": true,
1786 - "data_win_eventdata_subjectUserName": true,
1787 - "data_win_eventdata_subjectUserSid": true,
1788 - "data_win_eventdata_targetDomainName": true,
1789 - "data_win_eventdata_targetFilename": true,
1790 - "data_win_eventdata_targetImage": true,
1791 - "data_win_eventdata_targetLinkedLogonId": true,
1792 - "data_win_eventdata_targetLogonId": true,
1793 - "data_win_eventdata_targetObject": true,
1794 - "data_win_eventdata_targetProcessGUID": true,
1795 - "data_win_eventdata_targetProcessId": true,
1796 - "data_win_eventdata_targetUserName": true,
1797 - "data_win_eventdata_targetUserSid": true,
1798 - "data_win_eventdata_terminalSessionId": true,
1799 - "data_win_eventdata_ticketEncryptionType": true,
1800 - "data_win_eventdata_ticketOptions": true,
1801 - "data_win_eventdata_user": true,
1802 - "data_win_eventdata_utcTime": true,
1803 - "data_win_eventdata_virtualAccount": true,
1804 - "data_win_system_channel": true,
1805 - "data_win_system_computer": true,
1806 - "data_win_system_eventID": true,
1807 - "data_win_system_eventRecordID": true,
1808 - "data_win_system_eventSourceName": true,
1809 - "data_win_system_keywords": true,
1810 - "data_win_system_level": true,
1811 - "data_win_system_message": true,
1812 - "data_win_system_opcode": true,
1813 - "data_win_system_processID": true,
1814 - "data_win_system_providerGuid": true,
1815 - "data_win_system_providerName": true,
1816 - "data_win_system_severityValue": true,
1817 - "data_win_system_systemTime": true,
1818 - "data_win_system_task": true,
1819 - "data_win_system_threadID": true,
1820 - "data_win_system_version": true,
1821 - "decoder_name": true,
1822 - "decoder_parent": true,
1823 - "dns_query": true,
1824 - "dns_query_threat_indicated": true,
1825 - "dst_ip": true,
1826 - "dst_ip_city_name": true,
1827 - "dst_ip_country_code": true,
1828 - "dst_ip_geolocation": true,
1829 - "dst_ip_threat_indicated": true,
1830 - "dst_port": true,
1831 - "ecs_version": true,
1832 - "error": true,
1833 - "event_hash": true,
1834 - "file_path": true,
1835 - "firewall_rule_name": true,
1836 - "full_log": false,
1837 - "gl2_accounted_message_size": true,
1838 - "gl2_message_id": true,
1839 - "gl2_processing_error": true,
1840 - "gl2_remote_ip": true,
1841 - "gl2_remote_port": true,
1842 - "gl2_source_collector": true,
1843 - "gl2_source_input": true,
1844 - "gl2_source_node": true,
1845 - "hash_md5": true,
1846 - "hash_sha1": true,
1847 - "hash_sha256": true,
1848 - "highlight": true,
1849 - "host_architecture": true,
1850 - "host_containerized": true,
1851 - "host_hostname": true,
1852 - "host_id": true,
1853 - "host_ip": true,
1854 - "host_mac": true,
1855 - "host_name": true,
1856 - "host_os_codename": true,
1857 - "host_os_kernel": true,
1858 - "host_os_name": true,
1859 - "host_os_platform": true,
1860 - "host_os_version": true,
1861 - "hostname": true,
1862 - "id": true,
1863 - "input_type": true,
1864 - "level": true,
1865 - "location": true,
1866 - "log_file_path": true,
1867 - "log_offset": true,
1868 - "manager_name": true,
1869 - "message": true,
1870 - "module": true,
1871 - "msg_timestamp": true,
1872 - "parent_process_cmd_line": true,
1873 - "parent_process_id": true,
1874 - "parent_process_image": true,
1875 - "pid": true,
1876 - "predecoder_hostname": true,
1877 - "predecoder_program_name": true,
1878 - "predecoder_timestamp": true,
1879 - "previous_log": true,
1880 - "previous_output": true,
1881 - "process_cmd_line": true,
1882 - "process_id": true,
1883 - "process_image": true,
1884 - "process_name": true,
1885 - "protocol": true,
1886 - "rule_cis": true,
1887 - "rule_cis_csc": true,
1888 - "rule_firedtimes": true,
1889 - "rule_gdpr": true,
1890 - "rule_gdpr_IV": true,
1891 - "rule_gpg13": true,
1892 - "rule_gpg_13": true,
1893 - "rule_group1": true,
1894 - "rule_group2": true,
1895 - "rule_groups": true,
1896 - "rule_hipaa": true,
1897 - "rule_id": true,
1898 - "rule_info": true,
1899 - "rule_mail": true,
1900 - "rule_mitre_id": true,
1901 - "rule_mitre_tactic": false,
1902 - "rule_nist_800_53": true,
1903 - "rule_pci_dss": true,
1904 - "rule_tsc": true,
1905 - "scanid": true,
1906 - "service": true,
1907 - "software_package": true,
1908 - "software_vendor": true,
1909 - "sort": true,
1910 - "source": true,
1911 - "source_reserved_ip": true,
1912 - "src_ip": true,
1913 - "src_ip_city_name": true,
1914 - "src_ip_country_code": true,
1915 - "src_ip_geolocation": true,
1916 - "src_port": true,
1917 - "streams": true,
1918 - "syscheck_attrs_after": true,
1919 - "syscheck_audit_effective_user_id": true,
1920 - "syscheck_audit_effective_user_name": true,
1921 - "syscheck_audit_group_id": true,
1922 - "syscheck_audit_group_name": true,
1923 - "syscheck_audit_login_user_id": true,
1924 - "syscheck_audit_login_user_name": true,
1925 - "syscheck_audit_process_cwd": true,
1926 - "syscheck_audit_process_id": true,
1927 - "syscheck_audit_process_name": true,
1928 - "syscheck_audit_process_parent_cwd": true,
1929 - "syscheck_audit_process_parent_name": true,
1930 - "syscheck_audit_process_ppid": true,
1931 - "syscheck_audit_user_id": true,
1932 - "syscheck_audit_user_name": true,
1933 - "syscheck_changed_attributes": true,
1934 - "syscheck_event": true,
1935 - "syscheck_gid_after": true,
1936 - "syscheck_gname_after": true,
1937 - "syscheck_hard_links": true,
1938 - "syscheck_inode_after": true,
1939 - "syscheck_inode_before": true,
1940 - "syscheck_md5_after": true,
1941 - "syscheck_md5_before": true,
1942 - "syscheck_mode": true,
1943 - "syscheck_mtime_after": true,
1944 - "syscheck_mtime_before": true,
1945 - "syscheck_path": true,
1946 - "syscheck_perm_after": true,
1947 - "syscheck_perm_before": true,
1948 - "syscheck_sha1_after": true,
1949 - "syscheck_sha1_before": true,
1950 - "syscheck_sha256_after": true,
1951 - "syscheck_sha256_before": true,
1952 - "syscheck_size_after": true,
1953 - "syscheck_size_before": true,
1954 - "syscheck_uid_after": true,
1955 - "syscheck_uname_after": true,
1956 - "syscheck_win_perm_after": true,
1957 - "syscheck_win_perm_after_0_allowed": true,
1958 - "syscheck_win_perm_after_0_name": true,
1959 - "syscheck_win_perm_after_1_allowed": true,
1960 - "syscheck_win_perm_after_1_name": true,
1961 - "syscheck_win_perm_after_2_allowed": true,
1962 - "syscheck_win_perm_after_2_name": true,
1963 - "syscheck_win_perm_after_3_allowed": true,
1964 - "syscheck_win_perm_after_3_name": true,
1965 - "syslog_customer": true,
1966 - "syslog_level": true,
1967 - "syslog_tag": true,
1968 - "syslog_type": true,
1969 - "sysmon_event_description": true,
1970 - "threat_ids": true,
1971 - "threat_indicated": true,
1972 - "threat_names": true,
1973 - "time": true,
1974 - "timestamp": true,
1975 - "true": true,
1976 - "user_name": true,
1977 - "win_registry_key": true,
1978 - "win_system_eventID": true,
1979 - "windows_auth_package": true,
1980 - "windows_domain": true,
1981 - "windows_event_id": true,
1982 - "windows_event_severity": true,
1983 - "windows_logon_type": true
1984 - },
1985 - "indexByName": {
1986 - "_id": 2,
1987 - "_index": 9,
1988 - "_type": 10,
1989 - "agent_id": 11,
1990 - "agent_name": 5,
1991 - "cluster_name": 12,
1992 - "cluster_node": 13,
1993 - "data_office365_AppAccessContext_APIId": 49,
1994 - "data_office365_AppAccessContext_ClientAppId": 50,
1995 - "data_office365_AppAccessContext_ClientAppName": 51,
1996 - "data_office365_AppAccessContext_CorrelationId": 52,
1997 - "data_office365_ArtifactsShared": 53,
1998 - "data_office365_Attendees": 54,
1999 - "data_office365_ChatName": 55,
2000 - "data_office365_ChatThreadId": 56,
2001 - "data_office365_ClientIP": 4,
2002 - "data_office365_ClientIP_city_name": 14,
2003 - "data_office365_ClientIP_country_code": 15,
2004 - "data_office365_ClientIP_geolocation": 16,
2005 - "data_office365_CommunicationSubType": 57,
2006 - "data_office365_CommunicationType": 58,
2007 - "data_office365_CreationTime": 0,
2008 - "data_office365_DeviceId": 59,
2009 - "data_office365_DeviceInformation": 60,
2010 - "data_office365_EndTime": 61,
2011 - "data_office365_ExchangeId": 62,
2012 - "data_office365_ExtraProperties": 63,
2013 - "data_office365_ICalUid": 64,
2014 - "data_office365_Id": 17,
2015 - "data_office365_ItemName": 65,
2016 - "data_office365_JoinTime": 66,
2017 - "data_office365_LeaveTime": 67,
2018 - "data_office365_MeetingDetailId": 68,
2019 - "data_office365_MeetingURL": 69,
2020 - "data_office365_Members": 70,
2021 - "data_office365_MessageId": 71,
2022 - "data_office365_MessageSizeInBytes": 72,
2023 - "data_office365_MessageURLs": 73,
2024 - "data_office365_MessageVersion": 74,
2025 - "data_office365_Modalities": 75,
2026 - "data_office365_Name": 76,
2027 - "data_office365_NewValue": 77,
2028 - "data_office365_ObjectId": 18,
2029 - "data_office365_Operation": 24,
2030 - "data_office365_OperationScope": 78,
2031 - "data_office365_OrganizationId": 19,
2032 - "data_office365_Organizer_OrganizationId": 79,
2033 - "data_office365_Organizer_RecipientType": 80,
2034 - "data_office365_Organizer_Role": 81,
2035 - "data_office365_Organizer_UserObjectId": 82,
2036 - "data_office365_ProviderTypes": 83,
2037 - "data_office365_RecordType": 20,
2038 - "data_office365_StartTime": 84,
2039 - "data_office365_SubscriptionId": 85,
2040 - "data_office365_TeamGuid": 86,
2041 - "data_office365_UserId": 3,
2042 - "data_office365_UserKey": 21,
2043 - "data_office365_UserType": 22,
2044 - "data_office365_Version": 23,
2045 - "data_office365_Workload": 48,
2046 - "decoder_name": 25,
2047 - "gl2_accounted_message_size": 26,
2048 - "gl2_message_id": 27,
2049 - "gl2_processing_error": 28,
2050 - "gl2_remote_ip": 29,
2051 - "gl2_remote_port": 30,
2052 - "gl2_source_input": 31,
2053 - "gl2_source_node": 32,
2054 - "highlight": 33,
2055 - "id": 34,
2056 - "location": 35,
2057 - "manager_name": 36,
2058 - "message": 37,
2059 - "rule_description": 6,
2060 - "rule_firedtimes": 38,
2061 - "rule_group1": 39,
2062 - "rule_groups": 40,
2063 - "rule_id": 8,
2064 - "rule_level": 7,
2065 - "rule_mail": 41,
2066 - "sort": 42,
2067 - "source": 43,
2068 - "streams": 44,
2069 - "syslog_level": 45,
2070 - "syslog_type": 46,
2071 - "timestamp": 1,
2072 - "true": 47
2073 - },
2074 - "renameByName": {
2075 - "_id": "EVENT ID",
2076 - "agent_name": "",
2077 - "data_office365_ActorIpAddress": "SRC IP",
2078 - "data_office365_AffectedItems": "ITEMS",
2079 - "data_office365_ClientIP": "CLIENT IP",
2080 - "data_office365_ClientIP_city_name": "",
2081 - "data_office365_CreationTime": "EVENT TIME",
2082 - "data_office365_Item_Attachments": "ATTACHMENT",
2083 - "data_office365_Item_ParentFolder_Path": "FOLDER",
2084 - "data_office365_Item_Subject": "SUBJECT",
2085 - "data_office365_ResultStatus": "RESULT",
2086 - "data_office365_UserId": "ACCOUNT",
2087 - "rule_description": "DESCRIPTION",
2088 - "rule_id": "RULE ID",
2089 - "rule_level": "",
2090 - "rule_mitre_tactic": "MITRE TACTIC",
2091 - "rule_mitre_technique": "MITRE TECHNIQUE",
2092 - "timestamp": "Date/Time"
2093 - }
2094 - }
2095 - }
2096 - ],
2097 - "transparent": true,
2098 - "type": "table"
2099 - }
2100 - ],
2101 - "refresh": "",
2102 - "schemaVersion": 38,
2103 - "style": "dark",
2104 - "tags": [
2105 - "O365"
2106 - ],
2107 - "templating": {
2108 - "list": [
2109 - {
2110 - "datasource": {
2111 - "type": "elasticsearch",
2112 - "uid": "replace_datasource_uid"
2113 - },
2114 - "filters": [],
2115 - "hide": 0,
2116 - "label": "",
2117 - "name": "Filters",
2118 - "skipUrlSync": false,
2119 - "type": "adhoc"
2120 - },
2121 - {
2122 - "current": {
2123 - "selected": false,
2124 - "text": "All",
2125 - "value": "$__all"
2126 - },
2127 - "datasource": {
2128 - "type": "elasticsearch",
2129 - "uid": "replace_datasource_uid"
2130 - },
2131 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Exchange\"}",
2132 - "hide": 0,
2133 - "includeAll": true,
2134 - "label": "Operation",
2135 - "multi": false,
2136 - "name": "operation",
2137 - "options": [],
2138 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Exchange\"}",
2139 - "refresh": 2,
2140 - "regex": "",
2141 - "skipUrlSync": false,
2142 - "sort": 1,
2143 - "tagValuesQuery": "",
2144 - "tagsQuery": "",
2145 - "type": "query",
2146 - "useTags": false
2147 - },
2148 - {
2149 - "current": {
2150 - "selected": false,
2151 - "text": "All",
2152 - "value": "$__all"
2153 - },
2154 - "datasource": {
2155 - "type": "elasticsearch",
2156 - "uid": "replace_datasource_uid"
2157 - },
2158 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2159 - "hide": 0,
2160 - "includeAll": true,
2161 - "label": "Rule Level",
2162 - "multi": false,
2163 - "name": "rule_level",
2164 - "options": [],
2165 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2166 - "refresh": 2,
2167 - "regex": "",
2168 - "skipUrlSync": false,
2169 - "sort": 0,
2170 - "type": "query"
2171 - }
2172 - ]
2173 - },
2174 - "time": {
2175 - "from": "now-12h",
2176 - "to": "now"
2177 - },
2178 - "timepicker": {
2179 - "refresh_intervals": [
2180 - "5s",
2181 - "10s",
2182 - "30s",
2183 - "1m",
2184 - "5m",
2185 - "15m",
2186 - "30m",
2187 - "1h",
2188 - "2h",
2189 - "1d"
2190 - ],
2191 - "time_options": [
2192 - "5m",
2193 - "15m",
2194 - "1h",
2195 - "6h",
2196 - "12h",
2197 - "24h",
2198 - "2d",
2199 - "7d",
2200 - "30d"
2201 - ]
2202 - },
2203 - "timezone": "",
2204 - "title": "O365 - EXCHANGE",
2205 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "10.0.3",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "cellOptions": {
255 + "type": "auto"
256 + },
257 + "inspect": false
258 + },
259 + "mappings": [],
260 + "thresholds": {
261 + "mode": "absolute",
262 + "steps": [
263 + {
264 + "color": "red",
265 + "value": null
266 + }
267 + ]
268 + }
269 + },
270 + "overrides": [
271 + {
272 + "matcher": {
273 + "id": "byName",
274 + "options": "Count"
275 + },
276 + "properties": [
277 + {
278 + "id": "displayName",
279 + "value": "EVENTS"
280 + },
281 + {
282 + "id": "unit",
283 + "value": "short"
284 + },
285 + {
286 + "id": "decimals",
287 + "value": -1
288 + },
289 + {
290 + "id": "custom.align"
291 + },
292 + {
293 + "id": "thresholds",
294 + "value": {
295 + "mode": "absolute",
296 + "steps": [
297 + {
298 + "color": "red",
299 + "value": null
300 + }
301 + ]
302 + }
303 + }
304 + ]
305 + }
306 + ]
307 + },
308 + "gridPos": {
309 + "h": 7,
310 + "w": 6,
311 + "x": 8,
312 + "y": 0
313 + },
314 + "id": 54,
315 + "options": {
316 + "cellHeight": "sm",
317 + "footer": {
318 + "countRows": false,
319 + "fields": "",
320 + "reducer": ["sum"],
321 + "show": false
322 + },
323 + "showHeader": true
324 + },
325 + "pluginVersion": "10.0.3",
326 + "targets": [
327 + {
328 + "bucketAggs": [
329 + {
330 + "fake": true,
331 + "field": "data_office365_Operation",
332 + "id": "4",
333 + "settings": {
334 + "min_doc_count": 1,
335 + "order": "desc",
336 + "orderBy": "_count",
337 + "size": "0"
338 + },
339 + "type": "terms"
340 + }
341 + ],
342 + "datasource": {
343 + "type": "elasticsearch",
344 + "uid": "replace_datasource_uid"
345 + },
346 + "metrics": [
347 + {
348 + "field": "select field",
349 + "id": "1",
350 + "type": "count"
351 + }
352 + ],
353 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
354 + "refId": "A",
355 + "timeField": "timestamp"
356 + }
357 + ],
358 + "title": "EVENTS BY OPERATION",
359 + "transformations": [
360 + {
361 + "id": "merge",
362 + "options": {
363 + "reducers": []
364 + }
365 + },
366 + {
367 + "id": "organize",
368 + "options": {
369 + "excludeByName": {},
370 + "indexByName": {},
371 + "renameByName": {
372 + "Count": "EVENTS",
373 + "data_office365_Operation": "OPERATION"
374 + }
375 + }
376 + }
377 + ],
378 + "type": "table"
379 + },
380 + {
381 + "datasource": {
382 + "type": "elasticsearch",
383 + "uid": "replace_datasource_uid"
384 + },
385 + "fieldConfig": {
386 + "defaults": {
387 + "color": {
388 + "mode": "thresholds"
389 + },
390 + "mappings": [
391 + {
392 + "options": {
393 + "match": "null",
394 + "result": {
395 + "text": "N/A"
396 + }
397 + },
398 + "type": "special"
399 + }
400 + ],
401 + "max": 15,
402 + "min": 0,
403 + "thresholds": {
404 + "mode": "absolute",
405 + "steps": [
406 + {
407 + "color": "#299c46",
408 + "value": null
409 + },
410 + {
411 + "color": "rgba(237, 129, 40, 0.89)",
412 + "value": 8
413 + },
414 + {
415 + "color": "#d44a3a",
416 + "value": 12
417 + }
418 + ]
419 + },
420 + "unit": "none"
421 + },
422 + "overrides": []
423 + },
424 + "gridPos": {
425 + "h": 7,
426 + "w": 4,
427 + "x": 0,
428 + "y": 7
429 + },
430 + "id": 16,
431 + "links": [],
432 + "options": {
433 + "orientation": "horizontal",
434 + "reduceOptions": {
435 + "calcs": ["max"],
436 + "fields": "",
437 + "values": false
438 + },
439 + "showThresholdLabels": false,
440 + "showThresholdMarkers": true,
441 + "text": {}
442 + },
443 + "pluginVersion": "10.0.3",
444 + "targets": [
445 + {
446 + "bucketAggs": [
447 + {
448 + "field": "timestamp",
449 + "id": "2",
450 + "settings": {
451 + "interval": "auto",
452 + "min_doc_count": 0,
453 + "trimEdges": 0
454 + },
455 + "type": "date_histogram"
456 + }
457 + ],
458 + "datasource": {
459 + "type": "elasticsearch",
460 + "uid": "replace_datasource_uid"
461 + },
462 + "metrics": [
463 + {
464 + "field": "rule_level",
465 + "id": "1",
466 + "meta": {},
467 + "settings": {},
468 + "type": "max"
469 + }
470 + ],
471 + "query": "data_office365_Operation:$operation",
472 + "refId": "A",
473 + "timeField": "timestamp"
474 + }
475 + ],
476 + "title": "MAX SEVERITY (0 - 15)",
477 + "type": "gauge"
478 + },
479 + {
480 + "datasource": {
481 + "type": "elasticsearch",
482 + "uid": "replace_datasource_uid"
483 + },
484 + "fieldConfig": {
485 + "defaults": {
486 + "color": {
487 + "mode": "palette-classic"
488 + },
489 + "custom": {
490 + "axisCenteredZero": false,
491 + "axisColorMode": "text",
492 + "axisLabel": "",
493 + "axisPlacement": "auto",
494 + "barAlignment": 0,
495 + "drawStyle": "bars",
496 + "fillOpacity": 0,
497 + "gradientMode": "none",
498 + "hideFrom": {
499 + "legend": false,
500 + "tooltip": false,
501 + "viz": false
502 + },
503 + "lineInterpolation": "linear",
504 + "lineWidth": 1,
505 + "pointSize": 5,
506 + "scaleDistribution": {
507 + "type": "linear"
508 + },
509 + "showPoints": "auto",
510 + "spanNulls": false,
511 + "stacking": {
512 + "group": "A",
513 + "mode": "normal"
514 + },
515 + "thresholdsStyle": {
516 + "mode": "off"
517 + }
518 + },
519 + "mappings": [],
520 + "thresholds": {
521 + "mode": "absolute",
522 + "steps": [
523 + {
524 + "color": "green",
525 + "value": null
526 + },
527 + {
528 + "color": "red",
529 + "value": 80
530 + }
531 + ]
532 + }
533 + },
534 + "overrides": []
535 + },
536 + "gridPos": {
537 + "h": 13,
538 + "w": 20,
539 + "x": 4,
540 + "y": 7
541 + },
542 + "id": 60,
543 + "options": {
544 + "legend": {
545 + "calcs": [],
546 + "displayMode": "table",
547 + "placement": "right",
548 + "showLegend": true
549 + },
550 + "tooltip": {
551 + "mode": "single",
552 + "sort": "none"
553 + }
554 + },
555 + "targets": [
556 + {
557 + "alias": "",
558 + "bucketAggs": [
559 + {
560 + "field": "data_office365_Operation",
561 + "id": "3",
562 + "settings": {
563 + "min_doc_count": "1",
564 + "order": "desc",
565 + "orderBy": "_count",
566 + "size": "10"
567 + },
568 + "type": "terms"
569 + },
570 + {
571 + "field": "timestamp",
572 + "id": "2",
573 + "settings": {
574 + "interval": "auto"
575 + },
576 + "type": "date_histogram"
577 + }
578 + ],
579 + "datasource": {
580 + "type": "elasticsearch",
581 + "uid": "replace_datasource_uid"
582 + },
583 + "metrics": [
584 + {
585 + "id": "1",
586 + "type": "count"
587 + }
588 + ],
589 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
590 + "refId": "A",
591 + "timeField": "timestamp"
592 + }
593 + ],
594 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
595 + "transparent": true,
596 + "type": "timeseries"
597 + },
598 + {
599 + "datasource": {
600 + "type": "elasticsearch",
601 + "uid": "replace_datasource_uid"
602 + },
603 + "fieldConfig": {
604 + "defaults": {
605 + "mappings": [
606 + {
607 + "options": {
608 + "match": "null",
609 + "result": {
610 + "text": "N/A"
611 + }
612 + },
613 + "type": "special"
614 + }
615 + ],
616 + "thresholds": {
617 + "mode": "absolute",
618 + "steps": [
619 + {
620 + "color": "blue",
621 + "value": null
622 + }
623 + ]
624 + },
625 + "unit": "locale"
626 + },
627 + "overrides": []
628 + },
629 + "gridPos": {
630 + "h": 6,
631 + "w": 4,
632 + "x": 0,
633 + "y": 14
634 + },
635 + "id": 51,
636 + "links": [],
637 + "options": {
638 + "colorMode": "value",
639 + "graphMode": "area",
640 + "justifyMode": "auto",
641 + "orientation": "horizontal",
642 + "reduceOptions": {
643 + "calcs": ["sum"],
644 + "fields": "",
645 + "values": false
646 + },
647 + "text": {},
648 + "textMode": "auto"
649 + },
650 + "pluginVersion": "10.0.3",
651 + "targets": [
652 + {
653 + "bucketAggs": [
654 + {
655 + "$$hashKey": "object:331",
656 + "field": "timestamp",
657 + "id": "2",
658 + "settings": {
659 + "interval": "auto",
660 + "min_doc_count": 0,
661 + "trimEdges": 0
662 + },
663 + "type": "date_histogram"
664 + }
665 + ],
666 + "datasource": {
667 + "type": "elasticsearch",
668 + "uid": "replace_datasource_uid"
669 + },
670 + "metrics": [
671 + {
672 + "$$hashKey": "object:329",
673 + "field": "select field",
674 + "id": "1",
675 + "type": "count"
676 + }
677 + ],
678 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
679 + "refId": "A",
680 + "timeField": "timestamp"
681 + }
682 + ],
683 + "title": "EVENTS (Total)",
684 + "type": "stat"
685 + },
686 + {
687 + "datasource": {
688 + "type": "elasticsearch",
689 + "uid": "replace_datasource_uid"
690 + },
691 + "fieldConfig": {
692 + "defaults": {
693 + "mappings": [
694 + {
695 + "options": {
696 + "match": "null",
697 + "result": {
698 + "text": "N/A"
699 + }
700 + },
701 + "type": "special"
702 + }
703 + ],
704 + "thresholds": {
705 + "mode": "absolute",
706 + "steps": [
707 + {
708 + "color": "orange",
709 + "value": null
710 + }
711 + ]
712 + },
713 + "unit": "locale"
714 + },
715 + "overrides": []
716 + },
717 + "gridPos": {
718 + "h": 6,
719 + "w": 4,
720 + "x": 0,
721 + "y": 20
722 + },
723 + "id": 52,
724 + "links": [],
725 + "options": {
726 + "colorMode": "value",
727 + "graphMode": "area",
728 + "justifyMode": "auto",
729 + "orientation": "horizontal",
730 + "reduceOptions": {
731 + "calcs": ["sum"],
732 + "fields": "",
733 + "values": false
734 + },
735 + "text": {},
736 + "textMode": "auto"
737 + },
738 + "pluginVersion": "10.0.3",
739 + "targets": [
740 + {
741 + "bucketAggs": [
742 + {
743 + "$$hashKey": "object:331",
744 + "field": "timestamp",
745 + "id": "2",
746 + "settings": {
747 + "interval": "auto",
748 + "min_doc_count": 0,
749 + "trimEdges": 0
750 + },
751 + "type": "date_histogram"
752 + }
753 + ],
754 + "datasource": {
755 + "type": "elasticsearch",
756 + "uid": "replace_datasource_uid"
757 + },
758 + "metrics": [
759 + {
760 + "$$hashKey": "object:329",
761 + "field": "select field",
762 + "id": "1",
763 + "type": "count"
764 + }
765 + ],
766 + "query": "data_office365_Operation:MessageCreatedHasLink AND rule_level:$rule_level",
767 + "refId": "A",
768 + "timeField": "timestamp"
769 + }
770 + ],
771 + "title": "EXCHANGE - MESSAGES CONTAINING LINK",
772 + "type": "stat"
773 + },
774 + {
775 + "circleMaxSize": 30,
776 + "circleMinSize": 2,
777 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
778 + "datasource": {
779 + "type": "elasticsearch",
780 + "uid": "replace_datasource_uid"
781 + },
782 + "decimals": 0,
783 + "esMetric": "Count",
784 + "gridPos": {
785 + "h": 12,
786 + "w": 10,
787 + "x": 4,
788 + "y": 20
789 + },
790 + "hideEmpty": false,
791 + "hideZero": false,
792 + "id": 50,
793 + "initialZoom": 1,
794 + "locationData": "countries",
795 + "mapCenter": "(0°, 0°)",
796 + "mapCenterLatitude": 0,
797 + "mapCenterLongitude": 0,
798 + "maxDataPoints": 1,
799 + "mouseWheelZoom": false,
800 + "showLegend": true,
801 + "stickyLabels": false,
802 + "tableQueryOptions": {
803 + "geohashField": "geohash",
804 + "latitudeField": "latitude",
805 + "longitudeField": "longitude",
806 + "metricField": "metric",
807 + "queryType": "geohash"
808 + },
809 + "targets": [
810 + {
811 + "bucketAggs": [
812 + {
813 + "fake": true,
814 + "field": "data_office365_ClientIP_country_code",
815 + "id": "3",
816 + "settings": {
817 + "min_doc_count": 1,
818 + "order": "desc",
819 + "orderBy": "_term",
820 + "size": "0"
821 + },
822 + "type": "terms"
823 + },
824 + {
825 + "field": "timestamp",
826 + "id": "2",
827 + "settings": {
828 + "interval": "auto",
829 + "min_doc_count": 0,
830 + "trimEdges": 0
831 + },
832 + "type": "date_histogram"
833 + }
834 + ],
835 + "datasource": {
836 + "type": "elasticsearch",
837 + "uid": "replace_datasource_uid"
838 + },
839 + "metrics": [
840 + {
841 + "field": "select field",
842 + "id": "1",
843 + "type": "count"
844 + }
845 + ],
846 + "query": "data_office365_Workload:Exchange AND rule_level:$rule_level",
847 + "refId": "A",
848 + "timeField": "timestamp"
849 + }
850 + ],
851 + "thresholds": "0,10",
852 + "title": "EXCHANGE - ALL EVENTS BY SRC COUNTRY",
853 + "type": "grafana-worldmap-panel",
854 + "unitPlural": "",
855 + "unitSingle": "",
856 + "valueName": "total"
857 + },
858 + {
859 + "datasource": {
860 + "type": "elasticsearch",
861 + "uid": "replace_datasource_uid"
862 + },
863 + "fieldConfig": {
864 + "defaults": {
865 + "color": {
866 + "mode": "thresholds"
867 + },
868 + "custom": {
869 + "align": "auto",
870 + "cellOptions": {
871 + "type": "auto"
872 + },
873 + "inspect": false
874 + },
875 + "mappings": [],
876 + "thresholds": {
877 + "mode": "absolute",
878 + "steps": [
879 + {
880 + "color": "orange",
881 + "value": null
882 + }
883 + ]
884 + }
885 + },
886 + "overrides": [
887 + {
888 + "matcher": {
889 + "id": "byName",
890 + "options": "Count"
891 + },
892 + "properties": [
893 + {
894 + "id": "displayName",
895 + "value": "EVENTS"
896 + },
897 + {
898 + "id": "unit",
899 + "value": "short"
900 + },
901 + {
902 + "id": "decimals",
903 + "value": -1
904 + },
905 + {
906 + "id": "custom.align"
907 + }
908 + ]
909 + },
910 + {
911 + "matcher": {
912 + "id": "byName",
913 + "options": "AD ACCOUNT"
914 + },
915 + "properties": [
916 + {
917 + "id": "custom.width",
918 + "value": 377
919 + }
920 + ]
921 + }
922 + ]
923 + },
924 + "gridPos": {
925 + "h": 12,
926 + "w": 10,
927 + "x": 14,
928 + "y": 20
929 + },
930 + "id": 58,
931 + "options": {
932 + "cellHeight": "sm",
933 + "footer": {
934 + "countRows": false,
935 + "fields": "",
936 + "reducer": ["sum"],
937 + "show": false
938 + },
939 + "showHeader": true,
940 + "sortBy": []
941 + },
942 + "pluginVersion": "10.0.3",
943 + "targets": [
944 + {
945 + "bucketAggs": [
946 + {
947 + "fake": true,
948 + "field": "data_office365_UserId",
949 + "id": "4",
950 + "settings": {
951 + "min_doc_count": 1,
952 + "order": "desc",
953 + "orderBy": "_count",
954 + "size": "0"
955 + },
956 + "type": "terms"
957 + },
958 + {
959 + "field": "data_office365_ClientIP_country_code",
960 + "id": "5",
961 + "settings": {
962 + "min_doc_count": "1",
963 + "order": "desc",
964 + "orderBy": "_term",
965 + "size": "10"
966 + },
967 + "type": "terms"
968 + }
969 + ],
970 + "datasource": {
971 + "type": "elasticsearch",
972 + "uid": "replace_datasource_uid"
973 + },
974 + "metrics": [
975 + {
976 + "field": "select field",
977 + "id": "1",
978 + "type": "count"
979 + }
980 + ],
981 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
982 + "refId": "A",
983 + "timeField": "timestamp"
984 + }
985 + ],
986 + "title": "EXCHANGE EVENTS BY ACCOUNT",
987 + "transformations": [
988 + {
989 + "id": "merge",
990 + "options": {
991 + "reducers": []
992 + }
993 + },
994 + {
995 + "id": "organize",
996 + "options": {
997 + "excludeByName": {},
998 + "indexByName": {},
999 + "renameByName": {
1000 + "Count": "EVENTS",
1001 + "data_office365_ClientIP_country_code": "COUNTRY",
1002 + "data_office365_LogonError": "ERROR",
1003 + "data_office365_Operation": "WORKLOAD",
1004 + "data_office365_UserId": "AD ACCOUNT"
1005 + }
1006 + }
1007 + }
1008 + ],
1009 + "type": "table"
1010 + },
1011 + {
1012 + "datasource": {
1013 + "type": "elasticsearch",
1014 + "uid": "replace_datasource_uid"
1015 + },
1016 + "fieldConfig": {
1017 + "defaults": {
1018 + "mappings": [
1019 + {
1020 + "options": {
1021 + "match": "null",
1022 + "result": {
1023 + "text": "N/A"
1024 + }
1025 + },
1026 + "type": "special"
1027 + }
1028 + ],
1029 + "thresholds": {
1030 + "mode": "absolute",
1031 + "steps": [
1032 + {
1033 + "color": "blue",
1034 + "value": null
1035 + }
1036 + ]
1037 + },
1038 + "unit": "locale"
1039 + },
1040 + "overrides": []
1041 + },
1042 + "gridPos": {
1043 + "h": 6,
1044 + "w": 4,
1045 + "x": 0,
1046 + "y": 26
1047 + },
1048 + "id": 18,
1049 + "links": [],
1050 + "options": {
1051 + "colorMode": "value",
1052 + "graphMode": "area",
1053 + "justifyMode": "auto",
1054 + "orientation": "horizontal",
1055 + "reduceOptions": {
1056 + "calcs": ["sum"],
1057 + "fields": "",
1058 + "values": false
1059 + },
1060 + "text": {},
1061 + "textMode": "auto"
1062 + },
1063 + "pluginVersion": "10.0.3",
1064 + "targets": [
1065 + {
1066 + "bucketAggs": [
1067 + {
1068 + "$$hashKey": "object:331",
1069 + "field": "timestamp",
1070 + "id": "2",
1071 + "settings": {
1072 + "interval": "auto",
1073 + "min_doc_count": 0,
1074 + "trimEdges": 0
1075 + },
1076 + "type": "date_histogram"
1077 + }
1078 + ],
1079 + "datasource": {
1080 + "type": "elasticsearch",
1081 + "uid": "replace_datasource_uid"
1082 + },
1083 + "metrics": [
1084 + {
1085 + "$$hashKey": "object:329",
1086 + "field": "select field",
1087 + "id": "1",
1088 + "type": "count"
1089 + }
1090 + ],
1091 + "query": "data_office365_Operation:TeamsSessionStarted AND rule_level:$rule_level",
1092 + "refId": "A",
1093 + "timeField": "timestamp"
1094 + }
1095 + ],
1096 + "title": "EXCHANGE - SESSIONS STARTED",
1097 + "type": "stat"
1098 + },
1099 + {
1100 + "datasource": {
1101 + "type": "elasticsearch",
1102 + "uid": "replace_datasource_uid"
1103 + },
1104 + "fieldConfig": {
1105 + "defaults": {
1106 + "color": {
1107 + "mode": "thresholds"
1108 + },
1109 + "custom": {
1110 + "align": "auto",
1111 + "cellOptions": {
1112 + "type": "auto"
1113 + },
1114 + "filterable": true,
1115 + "inspect": false
1116 + },
1117 + "mappings": [],
1118 + "thresholds": {
1119 + "mode": "absolute",
1120 + "steps": [
1121 + {
1122 + "color": "green",
1123 + "value": null
1124 + },
1125 + {
1126 + "color": "red",
1127 + "value": 80
1128 + }
1129 + ]
1130 + }
1131 + },
1132 + "overrides": [
1133 + {
1134 + "matcher": {
1135 + "id": "byName",
1136 + "options": "rule_level"
1137 + },
1138 + "properties": [
1139 + {
1140 + "id": "displayName",
1141 + "value": "RULE LEVEL"
1142 + },
1143 + {
1144 + "id": "unit",
1145 + "value": "short"
1146 + },
1147 + {
1148 + "id": "decimals",
1149 + "value": -1
1150 + },
1151 + {
1152 + "id": "custom.cellOptions",
1153 + "value": {
1154 + "mode": "gradient",
1155 + "type": "color-background"
1156 + }
1157 + },
1158 + {
1159 + "id": "custom.align"
1160 + },
1161 + {
1162 + "id": "thresholds",
1163 + "value": {
1164 + "mode": "absolute",
1165 + "steps": [
1166 + {
1167 + "color": "#37872D",
1168 + "value": null
1169 + },
1170 + {
1171 + "color": "rgba(237, 129, 40, 0.89)",
1172 + "value": 7
1173 + },
1174 + {
1175 + "color": "rgba(245, 54, 54, 0.9)",
1176 + "value": 12
1177 + }
1178 + ]
1179 + }
1180 + }
1181 + ]
1182 + },
1183 + {
1184 + "matcher": {
1185 + "id": "byName",
1186 + "options": "Date/Time"
1187 + },
1188 + "properties": [
1189 + {
1190 + "id": "custom.width",
1191 + "value": 242
1192 + }
1193 + ]
1194 + },
1195 + {
1196 + "matcher": {
1197 + "id": "byName",
1198 + "options": "MITRE TACTIC"
1199 + },
1200 + "properties": [
1201 + {
1202 + "id": "custom.width",
1203 + "value": 332
1204 + }
1205 + ]
1206 + },
1207 + {
1208 + "matcher": {
1209 + "id": "byName",
1210 + "options": "IP ADDRESS"
1211 + },
1212 + "properties": [
1213 + {
1214 + "id": "custom.width",
1215 + "value": 163
1216 + }
1217 + ]
1218 + },
1219 + {
1220 + "matcher": {
1221 + "id": "byName",
1222 + "options": "MITRE TECHNIQUE"
1223 + },
1224 + "properties": [
1225 + {
1226 + "id": "custom.width",
1227 + "value": 312
1228 + }
1229 + ]
1230 + },
1231 + {
1232 + "matcher": {
1233 + "id": "byName",
1234 + "options": "EVENT ID"
1235 + },
1236 + "properties": [
1237 + {
1238 + "id": "links",
1239 + "value": [
1240 + {
1241 + "targetBlank": true,
1242 + "title": "VIEW EVENT DETAILS",
1243 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1244 + }
1245 + ]
1246 + },
1247 + {
1248 + "id": "custom.width",
1249 + "value": 265
1250 + }
1251 + ]
1252 + },
1253 + {
1254 + "matcher": {
1255 + "id": "byName",
1256 + "options": "RESULT"
1257 + },
1258 + "properties": [
1259 + {
1260 + "id": "custom.width",
1261 + "value": 118
1262 + },
1263 + {
1264 + "id": "mappings",
1265 + "value": [
1266 + {
1267 + "options": {
1268 + "Failed": {
1269 + "color": "orange",
1270 + "index": 1
1271 + },
1272 + "Success": {
1273 + "color": "green",
1274 + "index": 0
1275 + }
1276 + },
1277 + "type": "value"
1278 + }
1279 + ]
1280 + },
1281 + {
1282 + "id": "custom.cellOptions",
1283 + "value": {
1284 + "type": "color-text"
1285 + }
1286 + }
1287 + ]
1288 + },
1289 + {
1290 + "matcher": {
1291 + "id": "byName",
1292 + "options": "SRC IP"
1293 + },
1294 + "properties": [
1295 + {
1296 + "id": "custom.width",
1297 + "value": 265
1298 + }
1299 + ]
1300 + },
1301 + {
1302 + "matcher": {
1303 + "id": "byName",
1304 + "options": "ACCOUNT"
1305 + },
1306 + "properties": [
1307 + {
1308 + "id": "custom.width",
1309 + "value": 227
1310 + }
1311 + ]
1312 + },
1313 + {
1314 + "matcher": {
1315 + "id": "byName",
1316 + "options": "EVENT TIME"
1317 + },
1318 + "properties": [
1319 + {
1320 + "id": "custom.width",
1321 + "value": 195
1322 + }
1323 + ]
1324 + },
1325 + {
1326 + "matcher": {
1327 + "id": "byName",
1328 + "options": "CLIENT IP"
1329 + },
1330 + "properties": [
1331 + {
1332 + "id": "custom.width",
1333 + "value": 229
1334 + }
1335 + ]
1336 + },
1337 + {
1338 + "matcher": {
1339 + "id": "byName",
1340 + "options": "DESCRIPTION"
1341 + },
1342 + "properties": [
1343 + {
1344 + "id": "custom.width",
1345 + "value": 491
1346 + }
1347 + ]
1348 + }
1349 + ]
1350 + },
1351 + "gridPos": {
1352 + "h": 16,
1353 + "w": 24,
1354 + "x": 0,
1355 + "y": 32
1356 + },
1357 + "id": 27,
1358 + "options": {
1359 + "cellHeight": "sm",
1360 + "footer": {
1361 + "countRows": false,
1362 + "enablePagination": true,
1363 + "fields": "",
1364 + "reducer": ["sum"],
1365 + "show": false
1366 + },
1367 + "showHeader": true,
1368 + "sortBy": []
1369 + },
1370 + "pluginVersion": "10.0.3",
1371 + "targets": [
1372 + {
1373 + "bucketAggs": [],
1374 + "datasource": {
1375 + "type": "elasticsearch",
1376 + "uid": "replace_datasource_uid"
1377 + },
1378 + "metrics": [
1379 + {
1380 + "id": "1",
1381 + "settings": {
1382 + "size": "250"
1383 + },
1384 + "type": "raw_data"
1385 + }
1386 + ],
1387 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1388 + "refId": "A",
1389 + "timeField": "timestamp"
1390 + }
1391 + ],
1392 + "title": "EVENTS",
1393 + "transformations": [
1394 + {
1395 + "id": "organize",
1396 + "options": {
1397 + "excludeByName": {
1398 + "@metadata_beat": true,
1399 + "@metadata_type": true,
1400 + "@metadata_version": true,
1401 + "IMPHASH": true,
1402 + "MD5": true,
1403 + "SHA1": true,
1404 + "SHA256": true,
1405 + "_id": false,
1406 + "_index": true,
1407 + "_type": true,
1408 + "agent_ephemeral_id": true,
1409 + "agent_hostname": true,
1410 + "agent_id": true,
1411 + "agent_ip_city_name": true,
1412 + "agent_ip_country_code": true,
1413 + "agent_ip_geolocation": true,
1414 + "agent_name": true,
1415 + "agent_type": true,
1416 + "agent_version": true,
1417 + "beats_type": true,
1418 + "cluster_name": true,
1419 + "cluster_node": true,
1420 + "collector_node_id": true,
1421 + "data_alert_action": true,
1422 + "data_alert_category": true,
1423 + "data_alert_gid": true,
1424 + "data_alert_rev": true,
1425 + "data_alert_severity": true,
1426 + "data_alert_signature": true,
1427 + "data_alert_signature_id": true,
1428 + "data_app_proto": true,
1429 + "data_audit_auid": true,
1430 + "data_audit_command": true,
1431 + "data_audit_euid": true,
1432 + "data_audit_exe": true,
1433 + "data_audit_gid": true,
1434 + "data_audit_id": true,
1435 + "data_audit_pid": true,
1436 + "data_audit_res": true,
1437 + "data_audit_session": true,
1438 + "data_audit_type": true,
1439 + "data_audit_uid": true,
1440 + "data_dest_ip": true,
1441 + "data_dest_port": true,
1442 + "data_dstuser": true,
1443 + "data_event_type": true,
1444 + "data_extra_data": true,
1445 + "data_file": true,
1446 + "data_flow_bytes_toclient": true,
1447 + "data_flow_bytes_toserver": true,
1448 + "data_flow_id": true,
1449 + "data_flow_pkts_toclient": true,
1450 + "data_flow_pkts_toserver": true,
1451 + "data_flow_start": true,
1452 + "data_http_http_content_type": true,
1453 + "data_http_http_port": true,
1454 + "data_http_length": true,
1455 + "data_http_status": true,
1456 + "data_http_url": true,
1457 + "data_id": true,
1458 + "data_in_iface": true,
1459 + "data_integration": true,
1460 + "data_metadata_flowbits": true,
1461 + "data_metadata_flowints_http_anomaly_count": true,
1462 + "data_metadata_flowints_tcp_retransmission_count": true,
1463 + "data_office365_AADGroupId": true,
1464 + "data_office365_Actor": true,
1465 + "data_office365_ActorContextId": true,
1466 + "data_office365_ActorIpAddress": false,
1467 + "data_office365_ActorIpAddress_city_name": true,
1468 + "data_office365_ActorIpAddress_country_code": true,
1469 + "data_office365_ActorIpAddress_geolocation": true,
1470 + "data_office365_AppAccessContext_APIId": true,
1471 + "data_office365_AppAccessContext_ClientAppId": true,
1472 + "data_office365_AppAccessContext_ClientAppName": true,
1473 + "data_office365_AppAccessContext_CorrelationId": true,
1474 + "data_office365_AppId": true,
1475 + "data_office365_ApplicationId": true,
1476 + "data_office365_ArtifactsShared": true,
1477 + "data_office365_Attendees": true,
1478 + "data_office365_AzureActiveDirectoryEventType": true,
1479 + "data_office365_ChannelGuid": true,
1480 + "data_office365_ChannelName": true,
1481 + "data_office365_ChatName": true,
1482 + "data_office365_ChatThreadId": true,
1483 + "data_office365_ClientAppId": true,
1484 + "data_office365_ClientIP": false,
1485 + "data_office365_ClientIPAddress": true,
1486 + "data_office365_ClientIPAddress_city_name": true,
1487 + "data_office365_ClientIPAddress_country_code": true,
1488 + "data_office365_ClientIPAddress_geolocation": true,
1489 + "data_office365_ClientIP_city_name": true,
1490 + "data_office365_ClientIP_country_code": true,
1491 + "data_office365_ClientIP_geolocation": true,
1492 + "data_office365_ClientInfoString": true,
1493 + "data_office365_ClientProcessName": true,
1494 + "data_office365_ClientRequestId": true,
1495 + "data_office365_ClientVersion": true,
1496 + "data_office365_CommunicationSubType": true,
1497 + "data_office365_CommunicationType": true,
1498 + "data_office365_CreationTime": false,
1499 + "data_office365_CrossMailboxOperation": true,
1500 + "data_office365_DestFolder_Id": true,
1501 + "data_office365_DestFolder_Path": true,
1502 + "data_office365_DeviceId": true,
1503 + "data_office365_DeviceInformation": true,
1504 + "data_office365_DeviceProperties": true,
1505 + "data_office365_EndTime": true,
1506 + "data_office365_ErrorNumber": true,
1507 + "data_office365_ExchangeId": true,
1508 + "data_office365_ExtendedProperties": true,
1509 + "data_office365_ExternalAccess": true,
1510 + "data_office365_ExtraProperties": true,
1511 + "data_office365_Folder_Id": true,
1512 + "data_office365_Folder_Path": true,
1513 + "data_office365_HostedContents": true,
1514 + "data_office365_ICalUid": true,
1515 + "data_office365_Id": true,
1516 + "data_office365_InterSystemsId": true,
1517 + "data_office365_InternalLogonType": true,
1518 + "data_office365_IntraSystemId": true,
1519 + "data_office365_ItemName": true,
1520 + "data_office365_Item_Id": true,
1521 + "data_office365_Item_InternetMessageId": true,
1522 + "data_office365_Item_IsRecord": true,
1523 + "data_office365_Item_ParentFolder_Id": true,
1524 + "data_office365_Item_SizeInBytes": true,
1525 + "data_office365_JoinTime": true,
1526 + "data_office365_LeaveTime": true,
1527 + "data_office365_LogonError": true,
1528 + "data_office365_LogonType": true,
1529 + "data_office365_LogonUserSid": true,
1530 + "data_office365_MailboxGuid": true,
1531 + "data_office365_MailboxOwnerSid": true,
1532 + "data_office365_MailboxOwnerUPN": true,
1533 + "data_office365_MeetingDetailId": true,
1534 + "data_office365_MeetingURL": true,
1535 + "data_office365_Members": true,
1536 + "data_office365_MessageId": true,
1537 + "data_office365_MessageSizeInBytes": true,
1538 + "data_office365_MessageURLs": true,
1539 + "data_office365_MessageVersion": true,
1540 + "data_office365_Modalities": true,
1541 + "data_office365_ModifiedProperties": true,
1542 + "data_office365_Name": true,
1543 + "data_office365_NewValue": true,
1544 + "data_office365_ObjectId": true,
1545 + "data_office365_Operation": true,
1546 + "data_office365_OperationScope": true,
1547 + "data_office365_OrganizationId": true,
1548 + "data_office365_OrganizationName": true,
1549 + "data_office365_Organizer_OrganizationId": true,
1550 + "data_office365_Organizer_RecipientType": true,
1551 + "data_office365_Organizer_Role": true,
1552 + "data_office365_Organizer_UserObjectId": true,
1553 + "data_office365_OriginatingServer": true,
1554 + "data_office365_Parameters": true,
1555 + "data_office365_ParentMessageId": true,
1556 + "data_office365_ProviderTypes": true,
1557 + "data_office365_RecordType": true,
1558 + "data_office365_ResultStatus": true,
1559 + "data_office365_SessionId": true,
1560 + "data_office365_StartTime": true,
1561 + "data_office365_Subscription": true,
1562 + "data_office365_SubscriptionId": true,
1563 + "data_office365_Target": true,
1564 + "data_office365_TargetContextId": true,
1565 + "data_office365_TeamGuid": true,
1566 + "data_office365_TeamName": true,
1567 + "data_office365_UserId": false,
1568 + "data_office365_UserKey": true,
1569 + "data_office365_UserType": true,
1570 + "data_office365_Version": true,
1571 + "data_office365_Workload": true,
1572 + "data_osquery_action": true,
1573 + "data_osquery_calendarTime": true,
1574 + "data_osquery_columns_address": true,
1575 + "data_osquery_columns_address_city_name": true,
1576 + "data_osquery_columns_address_country_code": true,
1577 + "data_osquery_columns_address_geolocation": true,
1578 + "data_osquery_columns_cmdline": true,
1579 + "data_osquery_columns_cwd": true,
1580 + "data_osquery_columns_description": true,
1581 + "data_osquery_columns_directory": true,
1582 + "data_osquery_columns_disk_bytes_read": true,
1583 + "data_osquery_columns_disk_bytes_written": true,
1584 + "data_osquery_columns_egid": true,
1585 + "data_osquery_columns_euid": true,
1586 + "data_osquery_columns_family": true,
1587 + "data_osquery_columns_fd": true,
1588 + "data_osquery_columns_gid": true,
1589 + "data_osquery_columns_gid_signed": true,
1590 + "data_osquery_columns_host": true,
1591 + "data_osquery_columns_interface": true,
1592 + "data_osquery_columns_local_address": true,
1593 + "data_osquery_columns_local_address_city_name": true,
1594 + "data_osquery_columns_local_address_country_code": true,
1595 + "data_osquery_columns_local_address_geolocation": true,
1596 + "data_osquery_columns_local_port": true,
1597 + "data_osquery_columns_mac": true,
1598 + "data_osquery_columns_name": true,
1599 + "data_osquery_columns_net_namespace": true,
1600 + "data_osquery_columns_nice": true,
1601 + "data_osquery_columns_on_disk": true,
1602 + "data_osquery_columns_parent": true,
1603 + "data_osquery_columns_path": true,
1604 + "data_osquery_columns_pgroup": true,
1605 + "data_osquery_columns_pid": true,
1606 + "data_osquery_columns_port": true,
1607 + "data_osquery_columns_protocol": true,
1608 + "data_osquery_columns_remote_address": true,
1609 + "data_osquery_columns_remote_address_city_name": true,
1610 + "data_osquery_columns_remote_address_country_code": true,
1611 + "data_osquery_columns_remote_address_geolocation": true,
1612 + "data_osquery_columns_remote_port": true,
1613 + "data_osquery_columns_resident_size": true,
1614 + "data_osquery_columns_root": true,
1615 + "data_osquery_columns_sgid": true,
1616 + "data_osquery_columns_shell": true,
1617 + "data_osquery_columns_socket": true,
1618 + "data_osquery_columns_start_time": true,
1619 + "data_osquery_columns_state": true,
1620 + "data_osquery_columns_suid": true,
1621 + "data_osquery_columns_system_time": true,
1622 + "data_osquery_columns_threads": true,
1623 + "data_osquery_columns_time_utc": true,
1624 + "data_osquery_columns_total_size": true,
1625 + "data_osquery_columns_tty": true,
1626 + "data_osquery_columns_type": true,
1627 + "data_osquery_columns_uid": true,
1628 + "data_osquery_columns_uid_signed": true,
1629 + "data_osquery_columns_user": true,
1630 + "data_osquery_columns_user_time": true,
1631 + "data_osquery_columns_username": true,
1632 + "data_osquery_columns_wired_size": true,
1633 + "data_osquery_counter": true,
1634 + "data_osquery_decorations_host_uuid": true,
1635 + "data_osquery_decorations_hostname": true,
1636 + "data_osquery_epoch": true,
1637 + "data_osquery_hostIdentifier": true,
1638 + "data_osquery_name": true,
1639 + "data_osquery_numerics": true,
1640 + "data_osquery_unixTime": true,
1641 + "data_proto": true,
1642 + "data_sca_check_command": true,
1643 + "data_sca_check_compliance_cis": true,
1644 + "data_sca_check_compliance_cis_csc": true,
1645 + "data_sca_check_compliance_gdpr_IV": true,
1646 + "data_sca_check_compliance_gpg_13": true,
1647 + "data_sca_check_compliance_hipaa": true,
1648 + "data_sca_check_compliance_nist_800_53": true,
1649 + "data_sca_check_compliance_pci_dss": true,
1650 + "data_sca_check_compliance_tsc": true,
1651 + "data_sca_check_description": true,
1652 + "data_sca_check_id": true,
1653 + "data_sca_check_previous_result": true,
1654 + "data_sca_check_rationale": true,
1655 + "data_sca_check_remediation": true,
1656 + "data_sca_check_result": true,
1657 + "data_sca_check_title": true,
1658 + "data_sca_description": true,
1659 + "data_sca_failed": true,
1660 + "data_sca_file": true,
1661 + "data_sca_invalid": true,
1662 + "data_sca_passed": true,
1663 + "data_sca_policy": true,
1664 + "data_sca_policy_id": true,
1665 + "data_sca_scan_id": true,
1666 + "data_sca_score": true,
1667 + "data_sca_total_checks": true,
1668 + "data_sca_type": true,
1669 + "data_script": true,
1670 + "data_src_ip": true,
1671 + "data_src_ip_city_name": true,
1672 + "data_src_ip_country_code": true,
1673 + "data_src_ip_geolocation": true,
1674 + "data_src_port": true,
1675 + "data_srcip": true,
1676 + "data_srcip_city_name": true,
1677 + "data_srcip_country_code": true,
1678 + "data_srcip_geolocation": true,
1679 + "data_srcuser": true,
1680 + "data_timestamp": true,
1681 + "data_title": true,
1682 + "data_tls_session_resumed": true,
1683 + "data_tls_version": true,
1684 + "data_tx_id": true,
1685 + "data_type": true,
1686 + "data_win_eventXML_binaryData": true,
1687 + "data_win_eventXML_binaryDataSize": true,
1688 + "data_win_eventXML_param1": true,
1689 + "data_win_eventdata_authenticationPackageName": true,
1690 + "data_win_eventdata_callTrace": true,
1691 + "data_win_eventdata_commandLine": true,
1692 + "data_win_eventdata_company": true,
1693 + "data_win_eventdata_creationUtcTime": true,
1694 + "data_win_eventdata_currentDirectory": true,
1695 + "data_win_eventdata_description": true,
1696 + "data_win_eventdata_destinationHostname": true,
1697 + "data_win_eventdata_destinationIp": true,
1698 + "data_win_eventdata_destinationIp_city_name": true,
1699 + "data_win_eventdata_destinationIp_country_code": true,
1700 + "data_win_eventdata_destinationIp_geolocation": true,
1701 + "data_win_eventdata_destinationIsIpv6": true,
1702 + "data_win_eventdata_destinationPort": true,
1703 + "data_win_eventdata_destinationPortName": true,
1704 + "data_win_eventdata_details": true,
1705 + "data_win_eventdata_elevatedToken": true,
1706 + "data_win_eventdata_eventType": true,
1707 + "data_win_eventdata_fileVersion": true,
1708 + "data_win_eventdata_fileVersion_city_name": true,
1709 + "data_win_eventdata_fileVersion_country_code": true,
1710 + "data_win_eventdata_fileVersion_geolocation": true,
1711 + "data_win_eventdata_grantedAccess": true,
1712 + "data_win_eventdata_hashes": true,
1713 + "data_win_eventdata_image": true,
1714 + "data_win_eventdata_imageLoaded": true,
1715 + "data_win_eventdata_impersonationLevel": true,
1716 + "data_win_eventdata_initiated": true,
1717 + "data_win_eventdata_integrityLevel": true,
1718 + "data_win_eventdata_ipAddress": true,
1719 + "data_win_eventdata_ipPort": true,
1720 + "data_win_eventdata_keyLength": true,
1721 + "data_win_eventdata_logonGuid": true,
1722 + "data_win_eventdata_logonId": true,
1723 + "data_win_eventdata_logonProcessName": true,
1724 + "data_win_eventdata_logonType": true,
1725 + "data_win_eventdata_originalFileName": true,
1726 + "data_win_eventdata_param1": true,
1727 + "data_win_eventdata_param2": true,
1728 + "data_win_eventdata_param3": true,
1729 + "data_win_eventdata_param4": true,
1730 + "data_win_eventdata_parentCommandLine": true,
1731 + "data_win_eventdata_parentImage": true,
1732 + "data_win_eventdata_parentProcessGuid": true,
1733 + "data_win_eventdata_parentProcessId": true,
1734 + "data_win_eventdata_processGuid": true,
1735 + "data_win_eventdata_processId": true,
1736 + "data_win_eventdata_processName": true,
1737 + "data_win_eventdata_product": true,
1738 + "data_win_eventdata_protocol": true,
1739 + "data_win_eventdata_queryName": true,
1740 + "data_win_eventdata_queryResults": true,
1741 + "data_win_eventdata_queryStatus": true,
1742 + "data_win_eventdata_ruleName": true,
1743 + "data_win_eventdata_serviceName": true,
1744 + "data_win_eventdata_serviceSid": true,
1745 + "data_win_eventdata_signature": true,
1746 + "data_win_eventdata_signatureStatus": true,
1747 + "data_win_eventdata_signed": true,
1748 + "data_win_eventdata_sourceHostname": true,
1749 + "data_win_eventdata_sourceImage": true,
1750 + "data_win_eventdata_sourceIp": true,
1751 + "data_win_eventdata_sourceIp_city_name": true,
1752 + "data_win_eventdata_sourceIp_country_code": true,
1753 + "data_win_eventdata_sourceIp_geolocation": true,
1754 + "data_win_eventdata_sourceIsIpv6": true,
1755 + "data_win_eventdata_sourcePort": true,
1756 + "data_win_eventdata_sourceProcessGUID": true,
1757 + "data_win_eventdata_sourceProcessId": true,
1758 + "data_win_eventdata_sourceThreadId": true,
1759 + "data_win_eventdata_status": true,
1760 + "data_win_eventdata_subjectDomainName": true,
1761 + "data_win_eventdata_subjectLogonId": true,
1762 + "data_win_eventdata_subjectUserName": true,
1763 + "data_win_eventdata_subjectUserSid": true,
1764 + "data_win_eventdata_targetDomainName": true,
1765 + "data_win_eventdata_targetFilename": true,
1766 + "data_win_eventdata_targetImage": true,
1767 + "data_win_eventdata_targetLinkedLogonId": true,
1768 + "data_win_eventdata_targetLogonId": true,
1769 + "data_win_eventdata_targetObject": true,
1770 + "data_win_eventdata_targetProcessGUID": true,
1771 + "data_win_eventdata_targetProcessId": true,
1772 + "data_win_eventdata_targetUserName": true,
1773 + "data_win_eventdata_targetUserSid": true,
1774 + "data_win_eventdata_terminalSessionId": true,
1775 + "data_win_eventdata_ticketEncryptionType": true,
1776 + "data_win_eventdata_ticketOptions": true,
1777 + "data_win_eventdata_user": true,
1778 + "data_win_eventdata_utcTime": true,
1779 + "data_win_eventdata_virtualAccount": true,
1780 + "data_win_system_channel": true,
1781 + "data_win_system_computer": true,
1782 + "data_win_system_eventID": true,
1783 + "data_win_system_eventRecordID": true,
1784 + "data_win_system_eventSourceName": true,
1785 + "data_win_system_keywords": true,
1786 + "data_win_system_level": true,
1787 + "data_win_system_message": true,
1788 + "data_win_system_opcode": true,
1789 + "data_win_system_processID": true,
1790 + "data_win_system_providerGuid": true,
1791 + "data_win_system_providerName": true,
1792 + "data_win_system_severityValue": true,
1793 + "data_win_system_systemTime": true,
1794 + "data_win_system_task": true,
1795 + "data_win_system_threadID": true,
1796 + "data_win_system_version": true,
1797 + "decoder_name": true,
1798 + "decoder_parent": true,
1799 + "dns_query": true,
1800 + "dns_query_threat_indicated": true,
1801 + "dst_ip": true,
1802 + "dst_ip_city_name": true,
1803 + "dst_ip_country_code": true,
1804 + "dst_ip_geolocation": true,
1805 + "dst_ip_threat_indicated": true,
1806 + "dst_port": true,
1807 + "ecs_version": true,
1808 + "error": true,
1809 + "event_hash": true,
1810 + "file_path": true,
1811 + "firewall_rule_name": true,
1812 + "full_log": false,
1813 + "gl2_accounted_message_size": true,
1814 + "gl2_message_id": true,
1815 + "gl2_processing_error": true,
1816 + "gl2_remote_ip": true,
1817 + "gl2_remote_port": true,
1818 + "gl2_source_collector": true,
1819 + "gl2_source_input": true,
1820 + "gl2_source_node": true,
1821 + "hash_md5": true,
1822 + "hash_sha1": true,
1823 + "hash_sha256": true,
1824 + "highlight": true,
1825 + "host_architecture": true,
1826 + "host_containerized": true,
1827 + "host_hostname": true,
1828 + "host_id": true,
1829 + "host_ip": true,
1830 + "host_mac": true,
1831 + "host_name": true,
1832 + "host_os_codename": true,
1833 + "host_os_kernel": true,
1834 + "host_os_name": true,
1835 + "host_os_platform": true,
1836 + "host_os_version": true,
1837 + "hostname": true,
1838 + "id": true,
1839 + "input_type": true,
1840 + "level": true,
1841 + "location": true,
1842 + "log_file_path": true,
1843 + "log_offset": true,
1844 + "manager_name": true,
1845 + "message": true,
1846 + "module": true,
1847 + "msg_timestamp": true,
1848 + "parent_process_cmd_line": true,
1849 + "parent_process_id": true,
1850 + "parent_process_image": true,
1851 + "pid": true,
1852 + "predecoder_hostname": true,
1853 + "predecoder_program_name": true,
1854 + "predecoder_timestamp": true,
1855 + "previous_log": true,
1856 + "previous_output": true,
1857 + "process_cmd_line": true,
1858 + "process_id": true,
1859 + "process_image": true,
1860 + "process_name": true,
1861 + "protocol": true,
1862 + "rule_cis": true,
1863 + "rule_cis_csc": true,
1864 + "rule_firedtimes": true,
1865 + "rule_gdpr": true,
1866 + "rule_gdpr_IV": true,
1867 + "rule_gpg13": true,
1868 + "rule_gpg_13": true,
1869 + "rule_group1": true,
1870 + "rule_group2": true,
1871 + "rule_groups": true,
1872 + "rule_hipaa": true,
1873 + "rule_id": true,
1874 + "rule_info": true,
1875 + "rule_mail": true,
1876 + "rule_mitre_id": true,
1877 + "rule_mitre_tactic": false,
1878 + "rule_nist_800_53": true,
1879 + "rule_pci_dss": true,
1880 + "rule_tsc": true,
1881 + "scanid": true,
1882 + "service": true,
1883 + "software_package": true,
1884 + "software_vendor": true,
1885 + "sort": true,
1886 + "source": true,
1887 + "source_reserved_ip": true,
1888 + "src_ip": true,
1889 + "src_ip_city_name": true,
1890 + "src_ip_country_code": true,
1891 + "src_ip_geolocation": true,
1892 + "src_port": true,
1893 + "streams": true,
1894 + "syscheck_attrs_after": true,
1895 + "syscheck_audit_effective_user_id": true,
1896 + "syscheck_audit_effective_user_name": true,
1897 + "syscheck_audit_group_id": true,
1898 + "syscheck_audit_group_name": true,
1899 + "syscheck_audit_login_user_id": true,
1900 + "syscheck_audit_login_user_name": true,
1901 + "syscheck_audit_process_cwd": true,
1902 + "syscheck_audit_process_id": true,
1903 + "syscheck_audit_process_name": true,
1904 + "syscheck_audit_process_parent_cwd": true,
1905 + "syscheck_audit_process_parent_name": true,
1906 + "syscheck_audit_process_ppid": true,
1907 + "syscheck_audit_user_id": true,
1908 + "syscheck_audit_user_name": true,
1909 + "syscheck_changed_attributes": true,
1910 + "syscheck_event": true,
1911 + "syscheck_gid_after": true,
1912 + "syscheck_gname_after": true,
1913 + "syscheck_hard_links": true,
1914 + "syscheck_inode_after": true,
1915 + "syscheck_inode_before": true,
1916 + "syscheck_md5_after": true,
1917 + "syscheck_md5_before": true,
1918 + "syscheck_mode": true,
1919 + "syscheck_mtime_after": true,
1920 + "syscheck_mtime_before": true,
1921 + "syscheck_path": true,
1922 + "syscheck_perm_after": true,
1923 + "syscheck_perm_before": true,
1924 + "syscheck_sha1_after": true,
1925 + "syscheck_sha1_before": true,
1926 + "syscheck_sha256_after": true,
1927 + "syscheck_sha256_before": true,
1928 + "syscheck_size_after": true,
1929 + "syscheck_size_before": true,
1930 + "syscheck_uid_after": true,
1931 + "syscheck_uname_after": true,
1932 + "syscheck_win_perm_after": true,
1933 + "syscheck_win_perm_after_0_allowed": true,
1934 + "syscheck_win_perm_after_0_name": true,
1935 + "syscheck_win_perm_after_1_allowed": true,
1936 + "syscheck_win_perm_after_1_name": true,
1937 + "syscheck_win_perm_after_2_allowed": true,
1938 + "syscheck_win_perm_after_2_name": true,
1939 + "syscheck_win_perm_after_3_allowed": true,
1940 + "syscheck_win_perm_after_3_name": true,
1941 + "syslog_customer": true,
1942 + "syslog_level": true,
1943 + "syslog_tag": true,
1944 + "syslog_type": true,
1945 + "sysmon_event_description": true,
1946 + "threat_ids": true,
1947 + "threat_indicated": true,
1948 + "threat_names": true,
1949 + "time": true,
1950 + "timestamp": true,
1951 + "true": true,
1952 + "user_name": true,
1953 + "win_registry_key": true,
1954 + "win_system_eventID": true,
1955 + "windows_auth_package": true,
1956 + "windows_domain": true,
1957 + "windows_event_id": true,
1958 + "windows_event_severity": true,
1959 + "windows_logon_type": true
1960 + },
1961 + "indexByName": {
1962 + "_id": 2,
1963 + "_index": 9,
1964 + "_type": 10,
1965 + "agent_id": 11,
1966 + "agent_name": 5,
1967 + "cluster_name": 12,
1968 + "cluster_node": 13,
1969 + "data_office365_AppAccessContext_APIId": 49,
1970 + "data_office365_AppAccessContext_ClientAppId": 50,
1971 + "data_office365_AppAccessContext_ClientAppName": 51,
1972 + "data_office365_AppAccessContext_CorrelationId": 52,
1973 + "data_office365_ArtifactsShared": 53,
1974 + "data_office365_Attendees": 54,
1975 + "data_office365_ChatName": 55,
1976 + "data_office365_ChatThreadId": 56,
1977 + "data_office365_ClientIP": 4,
1978 + "data_office365_ClientIP_city_name": 14,
1979 + "data_office365_ClientIP_country_code": 15,
1980 + "data_office365_ClientIP_geolocation": 16,
1981 + "data_office365_CommunicationSubType": 57,
1982 + "data_office365_CommunicationType": 58,
1983 + "data_office365_CreationTime": 0,
1984 + "data_office365_DeviceId": 59,
1985 + "data_office365_DeviceInformation": 60,
1986 + "data_office365_EndTime": 61,
1987 + "data_office365_ExchangeId": 62,
1988 + "data_office365_ExtraProperties": 63,
1989 + "data_office365_ICalUid": 64,
1990 + "data_office365_Id": 17,
1991 + "data_office365_ItemName": 65,
1992 + "data_office365_JoinTime": 66,
1993 + "data_office365_LeaveTime": 67,
1994 + "data_office365_MeetingDetailId": 68,
1995 + "data_office365_MeetingURL": 69,
1996 + "data_office365_Members": 70,
1997 + "data_office365_MessageId": 71,
1998 + "data_office365_MessageSizeInBytes": 72,
1999 + "data_office365_MessageURLs": 73,
2000 + "data_office365_MessageVersion": 74,
2001 + "data_office365_Modalities": 75,
2002 + "data_office365_Name": 76,
2003 + "data_office365_NewValue": 77,
2004 + "data_office365_ObjectId": 18,
2005 + "data_office365_Operation": 24,
2006 + "data_office365_OperationScope": 78,
2007 + "data_office365_OrganizationId": 19,
2008 + "data_office365_Organizer_OrganizationId": 79,
2009 + "data_office365_Organizer_RecipientType": 80,
2010 + "data_office365_Organizer_Role": 81,
2011 + "data_office365_Organizer_UserObjectId": 82,
2012 + "data_office365_ProviderTypes": 83,
2013 + "data_office365_RecordType": 20,
2014 + "data_office365_StartTime": 84,
2015 + "data_office365_SubscriptionId": 85,
2016 + "data_office365_TeamGuid": 86,
2017 + "data_office365_UserId": 3,
2018 + "data_office365_UserKey": 21,
2019 + "data_office365_UserType": 22,
2020 + "data_office365_Version": 23,
2021 + "data_office365_Workload": 48,
2022 + "decoder_name": 25,
2023 + "gl2_accounted_message_size": 26,
2024 + "gl2_message_id": 27,
2025 + "gl2_processing_error": 28,
2026 + "gl2_remote_ip": 29,
2027 + "gl2_remote_port": 30,
2028 + "gl2_source_input": 31,
2029 + "gl2_source_node": 32,
2030 + "highlight": 33,
2031 + "id": 34,
2032 + "location": 35,
2033 + "manager_name": 36,
2034 + "message": 37,
2035 + "rule_description": 6,
2036 + "rule_firedtimes": 38,
2037 + "rule_group1": 39,
2038 + "rule_groups": 40,
2039 + "rule_id": 8,
2040 + "rule_level": 7,
2041 + "rule_mail": 41,
2042 + "sort": 42,
2043 + "source": 43,
2044 + "streams": 44,
2045 + "syslog_level": 45,
2046 + "syslog_type": 46,
2047 + "timestamp": 1,
2048 + "true": 47
2049 + },
2050 + "renameByName": {
2051 + "_id": "EVENT ID",
2052 + "agent_name": "",
2053 + "data_office365_ActorIpAddress": "SRC IP",
2054 + "data_office365_AffectedItems": "ITEMS",
2055 + "data_office365_ClientIP": "CLIENT IP",
2056 + "data_office365_ClientIP_city_name": "",
2057 + "data_office365_CreationTime": "EVENT TIME",
2058 + "data_office365_Item_Attachments": "ATTACHMENT",
2059 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2060 + "data_office365_Item_Subject": "SUBJECT",
2061 + "data_office365_ResultStatus": "RESULT",
2062 + "data_office365_UserId": "ACCOUNT",
2063 + "rule_description": "DESCRIPTION",
2064 + "rule_id": "RULE ID",
2065 + "rule_level": "",
2066 + "rule_mitre_tactic": "MITRE TACTIC",
2067 + "rule_mitre_technique": "MITRE TECHNIQUE",
2068 + "timestamp": "Date/Time"
2069 + }
2070 + }
2071 + }
2072 + ],
2073 + "transparent": true,
2074 + "type": "table"
2075 + }
2076 + ],
2077 + "refresh": "",
2078 + "schemaVersion": 38,
2079 + "style": "dark",
2080 + "tags": ["O365"],
2081 + "templating": {
2082 + "list": [
2083 + {
2084 + "datasource": {
2085 + "type": "elasticsearch",
2086 + "uid": "replace_datasource_uid"
2087 + },
2088 + "filters": [],
2089 + "hide": 0,
2090 + "label": "",
2091 + "name": "Filters",
2092 + "skipUrlSync": false,
2093 + "type": "adhoc"
2094 + },
2095 + {
2096 + "current": {
2097 + "selected": false,
2098 + "text": "All",
2099 + "value": "$__all"
2100 + },
2101 + "datasource": {
2102 + "type": "elasticsearch",
2103 + "uid": "replace_datasource_uid"
2104 + },
2105 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Exchange\"}",
2106 + "hide": 0,
2107 + "includeAll": true,
2108 + "label": "Operation",
2109 + "multi": false,
2110 + "name": "operation",
2111 + "options": [],
2112 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:Exchange\"}",
2113 + "refresh": 2,
2114 + "regex": "",
2115 + "skipUrlSync": false,
2116 + "sort": 1,
2117 + "tagValuesQuery": "",
2118 + "tagsQuery": "",
2119 + "type": "query",
2120 + "useTags": false
2121 + },
2122 + {
2123 + "current": {
2124 + "selected": false,
2125 + "text": "All",
2126 + "value": "$__all"
2127 + },
2128 + "datasource": {
2129 + "type": "elasticsearch",
2130 + "uid": "replace_datasource_uid"
2131 + },
2132 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2133 + "hide": 0,
2134 + "includeAll": true,
2135 + "label": "Rule Level",
2136 + "multi": false,
2137 + "name": "rule_level",
2138 + "options": [],
2139 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2140 + "refresh": 2,
2141 + "regex": "",
2142 + "skipUrlSync": false,
2143 + "sort": 0,
2144 + "type": "query"
2145 + }
2146 + ]
2147 + },
2148 + "time": {
2149 + "from": "now-12h",
2150 + "to": "now"
2151 + },
2152 + "timepicker": {
2153 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2154 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2155 + },
2156 + "timezone": "",
2157 + "title": "O365 - EXCHANGE",
2158 + "weekStart": ""
2159 }
backend/app/connectors/grafana/dashboards/Office365/forms.json
+2361 -2408
@@ -1,2410 +1,2363 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "10.0.3",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:MicrosoftForms",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "cellOptions": {
261 - "type": "auto"
262 - },
263 - "inspect": false
264 - },
265 - "mappings": [],
266 - "thresholds": {
267 - "mode": "absolute",
268 - "steps": [
269 - {
270 - "color": "red",
271 - "value": null
272 - }
273 - ]
274 - }
275 - },
276 - "overrides": [
277 - {
278 - "matcher": {
279 - "id": "byName",
280 - "options": "Count"
281 - },
282 - "properties": [
283 - {
284 - "id": "displayName",
285 - "value": "EVENTS"
286 - },
287 - {
288 - "id": "unit",
289 - "value": "short"
290 - },
291 - {
292 - "id": "decimals",
293 - "value": -1
294 - },
295 - {
296 - "id": "custom.align"
297 - },
298 - {
299 - "id": "thresholds",
300 - "value": {
301 - "mode": "absolute",
302 - "steps": [
303 - {
304 - "color": "red",
305 - "value": null
306 - }
307 - ]
308 - }
309 - }
310 - ]
311 - }
312 - ]
313 - },
314 - "gridPos": {
315 - "h": 7,
316 - "w": 6,
317 - "x": 8,
318 - "y": 0
319 - },
320 - "id": 54,
321 - "options": {
322 - "cellHeight": "sm",
323 - "footer": {
324 - "countRows": false,
325 - "fields": "",
326 - "reducer": [
327 - "sum"
328 - ],
329 - "show": false
330 - },
331 - "showHeader": true
332 - },
333 - "pluginVersion": "10.0.3",
334 - "targets": [
335 - {
336 - "bucketAggs": [
337 - {
338 - "fake": true,
339 - "field": "data_office365_Operation",
340 - "id": "4",
341 - "settings": {
342 - "min_doc_count": 1,
343 - "order": "desc",
344 - "orderBy": "_count",
345 - "size": "0"
346 - },
347 - "type": "terms"
348 - }
349 - ],
350 - "datasource": {
351 - "type": "elasticsearch",
352 - "uid": "replace_datasource_uid"
353 - },
354 - "metrics": [
355 - {
356 - "field": "select field",
357 - "id": "1",
358 - "type": "count"
359 - }
360 - ],
361 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
362 - "refId": "A",
363 - "timeField": "timestamp"
364 - }
365 - ],
366 - "title": "EVENTS BY OPERATION",
367 - "transformations": [
368 - {
369 - "id": "merge",
370 - "options": {
371 - "reducers": []
372 - }
373 - },
374 - {
375 - "id": "organize",
376 - "options": {
377 - "excludeByName": {},
378 - "indexByName": {},
379 - "renameByName": {
380 - "Count": "EVENTS",
381 - "data_office365_Operation": "OPERATION"
382 - }
383 - }
384 - }
385 - ],
386 - "type": "table"
387 - },
388 - {
389 - "datasource": {
390 - "type": "elasticsearch",
391 - "uid": "replace_datasource_uid"
392 - },
393 - "fieldConfig": {
394 - "defaults": {
395 - "color": {
396 - "mode": "thresholds"
397 - },
398 - "custom": {
399 - "align": "auto",
400 - "cellOptions": {
401 - "type": "auto"
402 - },
403 - "inspect": false
404 - },
405 - "mappings": [],
406 - "thresholds": {
407 - "mode": "absolute",
408 - "steps": [
409 - {
410 - "color": "red",
411 - "value": null
412 - }
413 - ]
414 - }
415 - },
416 - "overrides": [
417 - {
418 - "matcher": {
419 - "id": "byName",
420 - "options": "Count"
421 - },
422 - "properties": [
423 - {
424 - "id": "displayName",
425 - "value": "EVENTS"
426 - },
427 - {
428 - "id": "unit",
429 - "value": "short"
430 - },
431 - {
432 - "id": "decimals",
433 - "value": -1
434 - },
435 - {
436 - "id": "custom.align"
437 - },
438 - {
439 - "id": "thresholds",
440 - "value": {
441 - "mode": "absolute",
442 - "steps": [
443 - {
444 - "color": "red",
445 - "value": null
446 - }
447 - ]
448 - }
449 - }
450 - ]
451 - }
452 - ]
453 - },
454 - "gridPos": {
455 - "h": 7,
456 - "w": 6,
457 - "x": 14,
458 - "y": 0
459 - },
460 - "id": 62,
461 - "options": {
462 - "cellHeight": "sm",
463 - "footer": {
464 - "countRows": false,
465 - "fields": "",
466 - "reducer": [
467 - "sum"
468 - ],
469 - "show": false
470 - },
471 - "showHeader": true
472 - },
473 - "pluginVersion": "10.0.3",
474 - "targets": [
475 - {
476 - "bucketAggs": [
477 - {
478 - "fake": true,
479 - "field": "data_office365_SourceApp",
480 - "id": "4",
481 - "settings": {
482 - "min_doc_count": 1,
483 - "order": "desc",
484 - "orderBy": "_count",
485 - "size": "0"
486 - },
487 - "type": "terms"
488 - }
489 - ],
490 - "datasource": {
491 - "type": "elasticsearch",
492 - "uid": "replace_datasource_uid"
493 - },
494 - "metrics": [
495 - {
496 - "field": "select field",
497 - "id": "1",
498 - "type": "count"
499 - }
500 - ],
501 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
502 - "refId": "A",
503 - "timeField": "timestamp"
504 - }
505 - ],
506 - "title": "EVENTS BY APP",
507 - "transformations": [
508 - {
509 - "id": "merge",
510 - "options": {
511 - "reducers": []
512 - }
513 - },
514 - {
515 - "id": "organize",
516 - "options": {
517 - "excludeByName": {},
518 - "indexByName": {},
519 - "renameByName": {
520 - "Count": "EVENTS",
521 - "data_office365_Operation": "OPERATION",
522 - "data_office365_SourceApp": "SOURCE APP",
523 - "data_office365_UserAgent": "USER AGENT"
524 - }
525 - }
526 - }
527 - ],
528 - "type": "table"
529 - },
530 - {
531 - "datasource": {
532 - "type": "elasticsearch",
533 - "uid": "replace_datasource_uid"
534 - },
535 - "fieldConfig": {
536 - "defaults": {
537 - "color": {
538 - "mode": "thresholds"
539 - },
540 - "mappings": [
541 - {
542 - "options": {
543 - "match": "null",
544 - "result": {
545 - "text": "N/A"
546 - }
547 - },
548 - "type": "special"
549 - }
550 - ],
551 - "max": 15,
552 - "min": 0,
553 - "thresholds": {
554 - "mode": "absolute",
555 - "steps": [
556 - {
557 - "color": "#299c46",
558 - "value": null
559 - },
560 - {
561 - "color": "rgba(237, 129, 40, 0.89)",
562 - "value": 8
563 - },
564 - {
565 - "color": "#d44a3a",
566 - "value": 12
567 - }
568 - ]
569 - },
570 - "unit": "none"
571 - },
572 - "overrides": []
573 - },
574 - "gridPos": {
575 - "h": 7,
576 - "w": 4,
577 - "x": 0,
578 - "y": 7
579 - },
580 - "id": 16,
581 - "links": [],
582 - "options": {
583 - "orientation": "horizontal",
584 - "reduceOptions": {
585 - "calcs": [
586 - "max"
587 - ],
588 - "fields": "",
589 - "values": false
590 - },
591 - "showThresholdLabels": false,
592 - "showThresholdMarkers": true,
593 - "text": {}
594 - },
595 - "pluginVersion": "10.0.3",
596 - "targets": [
597 - {
598 - "bucketAggs": [
599 - {
600 - "field": "timestamp",
601 - "id": "2",
602 - "settings": {
603 - "interval": "auto",
604 - "min_doc_count": 0,
605 - "trimEdges": 0
606 - },
607 - "type": "date_histogram"
608 - }
609 - ],
610 - "datasource": {
611 - "type": "elasticsearch",
612 - "uid": "replace_datasource_uid"
613 - },
614 - "metrics": [
615 - {
616 - "field": "rule_level",
617 - "id": "1",
618 - "meta": {},
619 - "settings": {},
620 - "type": "max"
621 - }
622 - ],
623 - "query": "data_office365_Operation:$operation AND data_office365_Workload:MicrosoftForms",
624 - "refId": "A",
625 - "timeField": "timestamp"
626 - }
627 - ],
628 - "title": "MAX SEVERITY (0 - 15)",
629 - "type": "gauge"
630 - },
631 - {
632 - "datasource": {
633 - "type": "elasticsearch",
634 - "uid": "replace_datasource_uid"
635 - },
636 - "fieldConfig": {
637 - "defaults": {
638 - "color": {
639 - "mode": "palette-classic"
640 - },
641 - "custom": {
642 - "axisCenteredZero": false,
643 - "axisColorMode": "text",
644 - "axisLabel": "",
645 - "axisPlacement": "auto",
646 - "barAlignment": 0,
647 - "drawStyle": "bars",
648 - "fillOpacity": 0,
649 - "gradientMode": "none",
650 - "hideFrom": {
651 - "legend": false,
652 - "tooltip": false,
653 - "viz": false
654 - },
655 - "lineInterpolation": "linear",
656 - "lineWidth": 1,
657 - "pointSize": 5,
658 - "scaleDistribution": {
659 - "type": "linear"
660 - },
661 - "showPoints": "auto",
662 - "spanNulls": false,
663 - "stacking": {
664 - "group": "A",
665 - "mode": "normal"
666 - },
667 - "thresholdsStyle": {
668 - "mode": "off"
669 - }
670 - },
671 - "mappings": [],
672 - "thresholds": {
673 - "mode": "absolute",
674 - "steps": [
675 - {
676 - "color": "green",
677 - "value": null
678 - },
679 - {
680 - "color": "red",
681 - "value": 80
682 - }
683 - ]
684 - }
685 - },
686 - "overrides": []
687 - },
688 - "gridPos": {
689 - "h": 13,
690 - "w": 20,
691 - "x": 4,
692 - "y": 7
693 - },
694 - "id": 60,
695 - "options": {
696 - "legend": {
697 - "calcs": [],
698 - "displayMode": "table",
699 - "placement": "right",
700 - "showLegend": true
701 - },
702 - "tooltip": {
703 - "mode": "single",
704 - "sort": "none"
705 - }
706 - },
707 - "targets": [
708 - {
709 - "alias": "",
710 - "bucketAggs": [
711 - {
712 - "field": "data_office365_Operation",
713 - "id": "3",
714 - "settings": {
715 - "min_doc_count": "1",
716 - "order": "desc",
717 - "orderBy": "_count",
718 - "size": "10"
719 - },
720 - "type": "terms"
721 - },
722 - {
723 - "field": "timestamp",
724 - "id": "2",
725 - "settings": {
726 - "interval": "auto"
727 - },
728 - "type": "date_histogram"
729 - }
730 - ],
731 - "datasource": {
732 - "type": "elasticsearch",
733 - "uid": "replace_datasource_uid"
734 - },
735 - "metrics": [
736 - {
737 - "id": "1",
738 - "type": "count"
739 - }
740 - ],
741 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
742 - "refId": "A",
743 - "timeField": "timestamp"
744 - }
745 - ],
746 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
747 - "transparent": true,
748 - "type": "timeseries"
749 - },
750 - {
751 - "datasource": {
752 - "type": "elasticsearch",
753 - "uid": "replace_datasource_uid"
754 - },
755 - "fieldConfig": {
756 - "defaults": {
757 - "mappings": [
758 - {
759 - "options": {
760 - "match": "null",
761 - "result": {
762 - "text": "N/A"
763 - }
764 - },
765 - "type": "special"
766 - }
767 - ],
768 - "thresholds": {
769 - "mode": "absolute",
770 - "steps": [
771 - {
772 - "color": "blue",
773 - "value": null
774 - }
775 - ]
776 - },
777 - "unit": "locale"
778 - },
779 - "overrides": []
780 - },
781 - "gridPos": {
782 - "h": 6,
783 - "w": 4,
784 - "x": 0,
785 - "y": 14
786 - },
787 - "id": 51,
788 - "links": [],
789 - "options": {
790 - "colorMode": "value",
791 - "graphMode": "area",
792 - "justifyMode": "auto",
793 - "orientation": "horizontal",
794 - "reduceOptions": {
795 - "calcs": [
796 - "sum"
797 - ],
798 - "fields": "",
799 - "values": false
800 - },
801 - "text": {},
802 - "textMode": "auto"
803 - },
804 - "pluginVersion": "10.0.3",
805 - "targets": [
806 - {
807 - "bucketAggs": [
808 - {
809 - "$$hashKey": "object:331",
810 - "field": "timestamp",
811 - "id": "2",
812 - "settings": {
813 - "interval": "auto",
814 - "min_doc_count": 0,
815 - "trimEdges": 0
816 - },
817 - "type": "date_histogram"
818 - }
819 - ],
820 - "datasource": {
821 - "type": "elasticsearch",
822 - "uid": "replace_datasource_uid"
823 - },
824 - "metrics": [
825 - {
826 - "$$hashKey": "object:329",
827 - "field": "select field",
828 - "id": "1",
829 - "type": "count"
830 - }
831 - ],
832 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
833 - "refId": "A",
834 - "timeField": "timestamp"
835 - }
836 - ],
837 - "title": "EVENTS (Total)",
838 - "type": "stat"
839 - },
840 - {
841 - "datasource": {
842 - "type": "elasticsearch",
843 - "uid": "replace_datasource_uid"
844 - },
845 - "fieldConfig": {
846 - "defaults": {
847 - "color": {
848 - "mode": "thresholds"
849 - },
850 - "custom": {
851 - "align": "auto",
852 - "cellOptions": {
853 - "type": "auto"
854 - },
855 - "inspect": false
856 - },
857 - "mappings": [],
858 - "thresholds": {
859 - "mode": "absolute",
860 - "steps": [
861 - {
862 - "color": "orange",
863 - "value": null
864 - }
865 - ]
866 - }
867 - },
868 - "overrides": [
869 - {
870 - "matcher": {
871 - "id": "byName",
872 - "options": "Count"
873 - },
874 - "properties": [
875 - {
876 - "id": "displayName",
877 - "value": "EVENTS"
878 - },
879 - {
880 - "id": "unit",
881 - "value": "short"
882 - },
883 - {
884 - "id": "decimals",
885 - "value": -1
886 - },
887 - {
888 - "id": "custom.align"
889 - }
890 - ]
891 - },
892 - {
893 - "matcher": {
894 - "id": "byName",
895 - "options": "AD ACCOUNT"
896 - },
897 - "properties": [
898 - {
899 - "id": "custom.width",
900 - "value": 377
901 - }
902 - ]
903 - }
904 - ]
905 - },
906 - "gridPos": {
907 - "h": 12,
908 - "w": 8,
909 - "x": 0,
910 - "y": 20
911 - },
912 - "id": 61,
913 - "options": {
914 - "cellHeight": "sm",
915 - "footer": {
916 - "countRows": false,
917 - "fields": "",
918 - "reducer": [
919 - "sum"
920 - ],
921 - "show": false
922 - },
923 - "showHeader": true,
924 - "sortBy": []
925 - },
926 - "pluginVersion": "10.0.3",
927 - "targets": [
928 - {
929 - "bucketAggs": [
930 - {
931 - "fake": true,
932 - "field": "data_office365_FormName",
933 - "id": "4",
934 - "settings": {
935 - "min_doc_count": 1,
936 - "order": "desc",
937 - "orderBy": "_count",
938 - "size": "0"
939 - },
940 - "type": "terms"
941 - }
942 - ],
943 - "datasource": {
944 - "type": "elasticsearch",
945 - "uid": "replace_datasource_uid"
946 - },
947 - "metrics": [
948 - {
949 - "field": "select field",
950 - "id": "1",
951 - "type": "count"
952 - }
953 - ],
954 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
955 - "refId": "A",
956 - "timeField": "timestamp"
957 - }
958 - ],
959 - "title": "MS-FORMS EVENTS BY FORM NAME",
960 - "transformations": [
961 - {
962 - "id": "merge",
963 - "options": {
964 - "reducers": []
965 - }
966 - },
967 - {
968 - "id": "organize",
969 - "options": {
970 - "excludeByName": {},
971 - "indexByName": {},
972 - "renameByName": {
973 - "Count": "EVENTS",
974 - "data_office365_AuthenticationType": "AUTH TYPE",
975 - "data_office365_ClientIP_country_code": "COUNTRY",
976 - "data_office365_FormName": "FORM NAME",
977 - "data_office365_LogonError": "ERROR",
978 - "data_office365_Operation": "WORKLOAD",
979 - "data_office365_UserId": "AD ACCOUNT"
980 - }
981 - }
982 - }
983 - ],
984 - "type": "table"
985 - },
986 - {
987 - "circleMaxSize": 30,
988 - "circleMinSize": 2,
989 - "colors": [
990 - "rgba(245, 54, 54, 0.9)",
991 - "rgba(237, 129, 40, 0.89)",
992 - "rgba(50, 172, 45, 0.97)"
993 - ],
994 - "datasource": {
995 - "type": "elasticsearch",
996 - "uid": "replace_datasource_uid"
997 - },
998 - "decimals": 0,
999 - "esMetric": "Count",
1000 - "gridPos": {
1001 - "h": 12,
1002 - "w": 8,
1003 - "x": 8,
1004 - "y": 20
1005 - },
1006 - "hideEmpty": false,
1007 - "hideZero": false,
1008 - "id": 50,
1009 - "initialZoom": 1,
1010 - "locationData": "countries",
1011 - "mapCenter": "(0°, 0°)",
1012 - "mapCenterLatitude": 0,
1013 - "mapCenterLongitude": 0,
1014 - "maxDataPoints": 1,
1015 - "mouseWheelZoom": false,
1016 - "showLegend": true,
1017 - "stickyLabels": false,
1018 - "tableQueryOptions": {
1019 - "geohashField": "geohash",
1020 - "latitudeField": "latitude",
1021 - "longitudeField": "longitude",
1022 - "metricField": "metric",
1023 - "queryType": "geohash"
1024 - },
1025 - "targets": [
1026 - {
1027 - "bucketAggs": [
1028 - {
1029 - "fake": true,
1030 - "field": "data_office365_ClientIP_country_code",
1031 - "id": "3",
1032 - "settings": {
1033 - "min_doc_count": 1,
1034 - "order": "desc",
1035 - "orderBy": "_term",
1036 - "size": "0"
1037 - },
1038 - "type": "terms"
1039 - },
1040 - {
1041 - "field": "timestamp",
1042 - "id": "2",
1043 - "settings": {
1044 - "interval": "auto",
1045 - "min_doc_count": 0,
1046 - "trimEdges": 0
1047 - },
1048 - "type": "date_histogram"
1049 - }
1050 - ],
1051 - "datasource": {
1052 - "type": "elasticsearch",
1053 - "uid": "replace_datasource_uid"
1054 - },
1055 - "metrics": [
1056 - {
1057 - "field": "select field",
1058 - "id": "1",
1059 - "type": "count"
1060 - }
1061 - ],
1062 - "query": "data_office365_Workload:MicrosoftForms AND rule_level:$rule_level",
1063 - "refId": "A",
1064 - "timeField": "timestamp"
1065 - }
1066 - ],
1067 - "thresholds": "0,10",
1068 - "title": "MS-FORMS - ALL EVENTS BY SRC COUNTRY",
1069 - "type": "grafana-worldmap-panel",
1070 - "unitPlural": "",
1071 - "unitSingle": "",
1072 - "valueName": "total"
1073 - },
1074 - {
1075 - "datasource": {
1076 - "type": "elasticsearch",
1077 - "uid": "replace_datasource_uid"
1078 - },
1079 - "fieldConfig": {
1080 - "defaults": {
1081 - "color": {
1082 - "mode": "thresholds"
1083 - },
1084 - "custom": {
1085 - "align": "auto",
1086 - "cellOptions": {
1087 - "type": "auto"
1088 - },
1089 - "inspect": false
1090 - },
1091 - "mappings": [],
1092 - "thresholds": {
1093 - "mode": "absolute",
1094 - "steps": [
1095 - {
1096 - "color": "orange",
1097 - "value": null
1098 - }
1099 - ]
1100 - }
1101 - },
1102 - "overrides": [
1103 - {
1104 - "matcher": {
1105 - "id": "byName",
1106 - "options": "Count"
1107 - },
1108 - "properties": [
1109 - {
1110 - "id": "displayName",
1111 - "value": "EVENTS"
1112 - },
1113 - {
1114 - "id": "unit",
1115 - "value": "short"
1116 - },
1117 - {
1118 - "id": "decimals",
1119 - "value": -1
1120 - },
1121 - {
1122 - "id": "custom.align"
1123 - }
1124 - ]
1125 - },
1126 - {
1127 - "matcher": {
1128 - "id": "byName",
1129 - "options": "AD ACCOUNT"
1130 - },
1131 - "properties": [
1132 - {
1133 - "id": "custom.width",
1134 - "value": 377
1135 - }
1136 - ]
1137 - }
1138 - ]
1139 - },
1140 - "gridPos": {
1141 - "h": 12,
1142 - "w": 8,
1143 - "x": 16,
1144 - "y": 20
1145 - },
1146 - "id": 58,
1147 - "options": {
1148 - "cellHeight": "sm",
1149 - "footer": {
1150 - "countRows": false,
1151 - "fields": "",
1152 - "reducer": [
1153 - "sum"
1154 - ],
1155 - "show": false
1156 - },
1157 - "showHeader": true,
1158 - "sortBy": []
1159 - },
1160 - "pluginVersion": "10.0.3",
1161 - "targets": [
1162 - {
1163 - "bucketAggs": [
1164 - {
1165 - "fake": true,
1166 - "field": "data_office365_UserId",
1167 - "id": "4",
1168 - "settings": {
1169 - "min_doc_count": 1,
1170 - "order": "desc",
1171 - "orderBy": "_count",
1172 - "size": "0"
1173 - },
1174 - "type": "terms"
1175 - },
1176 - {
1177 - "field": "data_office365_ClientIP_country_code",
1178 - "id": "5",
1179 - "settings": {
1180 - "min_doc_count": "1",
1181 - "order": "desc",
1182 - "orderBy": "_term",
1183 - "size": "10"
1184 - },
1185 - "type": "terms"
1186 - }
1187 - ],
1188 - "datasource": {
1189 - "type": "elasticsearch",
1190 - "uid": "replace_datasource_uid"
1191 - },
1192 - "metrics": [
1193 - {
1194 - "field": "select field",
1195 - "id": "1",
1196 - "type": "count"
1197 - }
1198 - ],
1199 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
1200 - "refId": "A",
1201 - "timeField": "timestamp"
1202 - }
1203 - ],
1204 - "title": "MS-FORMS EVENTS BY ACCOUNT",
1205 - "transformations": [
1206 - {
1207 - "id": "merge",
1208 - "options": {
1209 - "reducers": []
1210 - }
1211 - },
1212 - {
1213 - "id": "organize",
1214 - "options": {
1215 - "excludeByName": {},
1216 - "indexByName": {},
1217 - "renameByName": {
1218 - "Count": "EVENTS",
1219 - "data_office365_ClientIP_country_code": "COUNTRY",
1220 - "data_office365_LogonError": "ERROR",
1221 - "data_office365_Operation": "WORKLOAD",
1222 - "data_office365_UserId": "AD ACCOUNT"
1223 - }
1224 - }
1225 - }
1226 - ],
1227 - "type": "table"
1228 - },
1229 - {
1230 - "datasource": {
1231 - "type": "elasticsearch",
1232 - "uid": "replace_datasource_uid"
1233 - },
1234 - "fieldConfig": {
1235 - "defaults": {
1236 - "color": {
1237 - "mode": "thresholds"
1238 - },
1239 - "custom": {
1240 - "align": "auto",
1241 - "cellOptions": {
1242 - "type": "auto"
1243 - },
1244 - "filterable": true,
1245 - "inspect": false
1246 - },
1247 - "mappings": [],
1248 - "thresholds": {
1249 - "mode": "absolute",
1250 - "steps": [
1251 - {
1252 - "color": "green",
1253 - "value": null
1254 - },
1255 - {
1256 - "color": "red",
1257 - "value": 80
1258 - }
1259 - ]
1260 - }
1261 - },
1262 - "overrides": [
1263 - {
1264 - "matcher": {
1265 - "id": "byName",
1266 - "options": "rule_level"
1267 - },
1268 - "properties": [
1269 - {
1270 - "id": "displayName",
1271 - "value": "RULE LEVEL"
1272 - },
1273 - {
1274 - "id": "unit",
1275 - "value": "short"
1276 - },
1277 - {
1278 - "id": "decimals",
1279 - "value": -1
1280 - },
1281 - {
1282 - "id": "custom.cellOptions",
1283 - "value": {
1284 - "mode": "gradient",
1285 - "type": "color-background"
1286 - }
1287 - },
1288 - {
1289 - "id": "custom.align"
1290 - },
1291 - {
1292 - "id": "thresholds",
1293 - "value": {
1294 - "mode": "absolute",
1295 - "steps": [
1296 - {
1297 - "color": "#37872D",
1298 - "value": null
1299 - },
1300 - {
1301 - "color": "rgba(237, 129, 40, 0.89)",
1302 - "value": 7
1303 - },
1304 - {
1305 - "color": "rgba(245, 54, 54, 0.9)",
1306 - "value": 12
1307 - }
1308 - ]
1309 - }
1310 - }
1311 - ]
1312 - },
1313 - {
1314 - "matcher": {
1315 - "id": "byName",
1316 - "options": "Date/Time"
1317 - },
1318 - "properties": [
1319 - {
1320 - "id": "custom.width",
1321 - "value": 242
1322 - }
1323 - ]
1324 - },
1325 - {
1326 - "matcher": {
1327 - "id": "byName",
1328 - "options": "MITRE TACTIC"
1329 - },
1330 - "properties": [
1331 - {
1332 - "id": "custom.width",
1333 - "value": 332
1334 - }
1335 - ]
1336 - },
1337 - {
1338 - "matcher": {
1339 - "id": "byName",
1340 - "options": "IP ADDRESS"
1341 - },
1342 - "properties": [
1343 - {
1344 - "id": "custom.width",
1345 - "value": 163
1346 - }
1347 - ]
1348 - },
1349 - {
1350 - "matcher": {
1351 - "id": "byName",
1352 - "options": "MITRE TECHNIQUE"
1353 - },
1354 - "properties": [
1355 - {
1356 - "id": "custom.width",
1357 - "value": 312
1358 - }
1359 - ]
1360 - },
1361 - {
1362 - "matcher": {
1363 - "id": "byName",
1364 - "options": "EVENT ID"
1365 - },
1366 - "properties": [
1367 - {
1368 - "id": "links",
1369 - "value": [
1370 - {
1371 - "targetBlank": true,
1372 - "title": "VIEW EVENT DETAILS",
1373 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1374 - }
1375 - ]
1376 - },
1377 - {
1378 - "id": "custom.width",
1379 - "value": 265
1380 - }
1381 - ]
1382 - },
1383 - {
1384 - "matcher": {
1385 - "id": "byName",
1386 - "options": "RESULT"
1387 - },
1388 - "properties": [
1389 - {
1390 - "id": "custom.width",
1391 - "value": 118
1392 - },
1393 - {
1394 - "id": "mappings",
1395 - "value": [
1396 - {
1397 - "options": {
1398 - "Failed": {
1399 - "color": "orange",
1400 - "index": 1
1401 - },
1402 - "Success": {
1403 - "color": "green",
1404 - "index": 0
1405 - }
1406 - },
1407 - "type": "value"
1408 - }
1409 - ]
1410 - },
1411 - {
1412 - "id": "custom.cellOptions",
1413 - "value": {
1414 - "type": "color-text"
1415 - }
1416 - }
1417 - ]
1418 - },
1419 - {
1420 - "matcher": {
1421 - "id": "byName",
1422 - "options": "SRC IP"
1423 - },
1424 - "properties": [
1425 - {
1426 - "id": "custom.width",
1427 - "value": 265
1428 - }
1429 - ]
1430 - },
1431 - {
1432 - "matcher": {
1433 - "id": "byName",
1434 - "options": "ACCOUNT"
1435 - },
1436 - "properties": [
1437 - {
1438 - "id": "custom.width",
1439 - "value": 227
1440 - }
1441 - ]
1442 - },
1443 - {
1444 - "matcher": {
1445 - "id": "byName",
1446 - "options": "EVENT TIME"
1447 - },
1448 - "properties": [
1449 - {
1450 - "id": "custom.width",
1451 - "value": 195
1452 - }
1453 - ]
1454 - },
1455 - {
1456 - "matcher": {
1457 - "id": "byName",
1458 - "options": "CLIENT IP"
1459 - },
1460 - "properties": [
1461 - {
1462 - "id": "custom.width",
1463 - "value": 191
1464 - }
1465 - ]
1466 - },
1467 - {
1468 - "matcher": {
1469 - "id": "byName",
1470 - "options": "DESCRIPTION"
1471 - },
1472 - "properties": [
1473 - {
1474 - "id": "custom.width",
1475 - "value": 367
1476 - }
1477 - ]
1478 - },
1479 - {
1480 - "matcher": {
1481 - "id": "byName",
1482 - "options": "FILE"
1483 - },
1484 - "properties": [
1485 - {
1486 - "id": "custom.width",
1487 - "value": 855
1488 - }
1489 - ]
1490 - },
1491 - {
1492 - "matcher": {
1493 - "id": "byName",
1494 - "options": "BROWSER"
1495 - },
1496 - "properties": [
1497 - {
1498 - "id": "custom.width",
1499 - "value": 205
1500 - }
1501 - ]
1502 - },
1503 - {
1504 - "matcher": {
1505 - "id": "byName",
1506 - "options": "RULE LEVEL"
1507 - },
1508 - "properties": [
1509 - {
1510 - "id": "custom.width",
1511 - "value": 197
1512 - }
1513 - ]
1514 - }
1515 - ]
1516 - },
1517 - "gridPos": {
1518 - "h": 16,
1519 - "w": 24,
1520 - "x": 0,
1521 - "y": 32
1522 - },
1523 - "id": 27,
1524 - "options": {
1525 - "cellHeight": "sm",
1526 - "footer": {
1527 - "countRows": false,
1528 - "enablePagination": true,
1529 - "fields": "",
1530 - "reducer": [
1531 - "sum"
1532 - ],
1533 - "show": false
1534 - },
1535 - "showHeader": true,
1536 - "sortBy": []
1537 - },
1538 - "pluginVersion": "10.0.3",
1539 - "targets": [
1540 - {
1541 - "bucketAggs": [],
1542 - "datasource": {
1543 - "type": "elasticsearch",
1544 - "uid": "replace_datasource_uid"
1545 - },
1546 - "metrics": [
1547 - {
1548 - "id": "1",
1549 - "settings": {
1550 - "size": "250"
1551 - },
1552 - "type": "raw_data"
1553 - }
1554 - ],
1555 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
1556 - "refId": "A",
1557 - "timeField": "timestamp"
1558 - }
1559 - ],
1560 - "title": "EVENTS",
1561 - "transformations": [
1562 - {
1563 - "id": "organize",
1564 - "options": {
1565 - "excludeByName": {
1566 - "@metadata_beat": true,
1567 - "@metadata_type": true,
1568 - "@metadata_version": true,
1569 - "IMPHASH": true,
1570 - "MD5": true,
1571 - "SHA1": true,
1572 - "SHA256": true,
1573 - "_id": false,
1574 - "_index": true,
1575 - "_type": true,
1576 - "agent_ephemeral_id": true,
1577 - "agent_hostname": true,
1578 - "agent_id": true,
1579 - "agent_ip_city_name": true,
1580 - "agent_ip_country_code": true,
1581 - "agent_ip_geolocation": true,
1582 - "agent_name": true,
1583 - "agent_type": true,
1584 - "agent_version": true,
1585 - "beats_type": true,
1586 - "cluster_name": true,
1587 - "cluster_node": true,
1588 - "collector_node_id": true,
1589 - "data_alert_action": true,
1590 - "data_alert_category": true,
1591 - "data_alert_gid": true,
1592 - "data_alert_rev": true,
1593 - "data_alert_severity": true,
1594 - "data_alert_signature": true,
1595 - "data_alert_signature_id": true,
1596 - "data_app_proto": true,
1597 - "data_audit_auid": true,
1598 - "data_audit_command": true,
1599 - "data_audit_euid": true,
1600 - "data_audit_exe": true,
1601 - "data_audit_gid": true,
1602 - "data_audit_id": true,
1603 - "data_audit_pid": true,
1604 - "data_audit_res": true,
1605 - "data_audit_session": true,
1606 - "data_audit_type": true,
1607 - "data_audit_uid": true,
1608 - "data_dest_ip": true,
1609 - "data_dest_port": true,
1610 - "data_dstuser": true,
1611 - "data_event_type": true,
1612 - "data_extra_data": true,
1613 - "data_file": true,
1614 - "data_flow_bytes_toclient": true,
1615 - "data_flow_bytes_toserver": true,
1616 - "data_flow_id": true,
1617 - "data_flow_pkts_toclient": true,
1618 - "data_flow_pkts_toserver": true,
1619 - "data_flow_start": true,
1620 - "data_http_http_content_type": true,
1621 - "data_http_http_port": true,
1622 - "data_http_length": true,
1623 - "data_http_status": true,
1624 - "data_http_url": true,
1625 - "data_id": true,
1626 - "data_in_iface": true,
1627 - "data_integration": true,
1628 - "data_metadata_flowbits": true,
1629 - "data_metadata_flowints_http_anomaly_count": true,
1630 - "data_metadata_flowints_tcp_retransmission_count": true,
1631 - "data_office365_AADGroupId": true,
1632 - "data_office365_ActivityParameters": true,
1633 - "data_office365_Actor": true,
1634 - "data_office365_ActorContextId": true,
1635 - "data_office365_ActorIpAddress": false,
1636 - "data_office365_ActorIpAddress_city_name": true,
1637 - "data_office365_ActorIpAddress_country_code": true,
1638 - "data_office365_ActorIpAddress_geolocation": true,
1639 - "data_office365_AppAccessContext_AADSessionId": true,
1640 - "data_office365_AppAccessContext_APIId": true,
1641 - "data_office365_AppAccessContext_ClientAppId": true,
1642 - "data_office365_AppAccessContext_ClientAppName": true,
1643 - "data_office365_AppAccessContext_CorrelationId": true,
1644 - "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1645 - "data_office365_AppAccessContext_UniqueTokenId": true,
1646 - "data_office365_AppId": true,
1647 - "data_office365_ApplicationDisplayName": true,
1648 - "data_office365_ApplicationId": true,
1649 - "data_office365_ArtifactsShared": true,
1650 - "data_office365_AssertingApplicationId": true,
1651 - "data_office365_Attendees": true,
1652 - "data_office365_AuthenticationType": true,
1653 - "data_office365_AzureActiveDirectoryEventType": true,
1654 - "data_office365_BrowserVersion": true,
1655 - "data_office365_BrowserVersion_city_name": true,
1656 - "data_office365_BrowserVersion_country_code": true,
1657 - "data_office365_BrowserVersion_geolocation": true,
1658 - "data_office365_ChannelGuid": true,
1659 - "data_office365_ChannelName": true,
1660 - "data_office365_ChatName": true,
1661 - "data_office365_ChatThreadId": true,
1662 - "data_office365_ClientAppId": true,
1663 - "data_office365_ClientIP": false,
1664 - "data_office365_ClientIPAddress": true,
1665 - "data_office365_ClientIPAddress_city_name": true,
1666 - "data_office365_ClientIPAddress_country_code": true,
1667 - "data_office365_ClientIPAddress_geolocation": true,
1668 - "data_office365_ClientIP_city_name": true,
1669 - "data_office365_ClientIP_country_code": true,
1670 - "data_office365_ClientIP_geolocation": true,
1671 - "data_office365_ClientIP_reserved_ip": true,
1672 - "data_office365_ClientInfoString": true,
1673 - "data_office365_ClientProcessName": true,
1674 - "data_office365_ClientRequestId": true,
1675 - "data_office365_ClientVersion": true,
1676 - "data_office365_CommunicationSubType": true,
1677 - "data_office365_CommunicationType": true,
1678 - "data_office365_CorrelationId": true,
1679 - "data_office365_CreationTime": false,
1680 - "data_office365_CrossMailboxOperation": true,
1681 - "data_office365_CustomUniqueId": true,
1682 - "data_office365_CustomizedDoclib": true,
1683 - "data_office365_DestFolder_Id": true,
1684 - "data_office365_DestFolder_Path": true,
1685 - "data_office365_DestinationFileExtension": true,
1686 - "data_office365_DestinationFileName": true,
1687 - "data_office365_DestinationRelativeUrl": true,
1688 - "data_office365_DeviceDisplayName": true,
1689 - "data_office365_DeviceDisplayName_city_name": true,
1690 - "data_office365_DeviceDisplayName_country_code": true,
1691 - "data_office365_DeviceDisplayName_geolocation": true,
1692 - "data_office365_DeviceId": true,
1693 - "data_office365_DeviceInformation": true,
1694 - "data_office365_DeviceProperties": true,
1695 - "data_office365_DoNotDistributeEvent": true,
1696 - "data_office365_EndTime": true,
1697 - "data_office365_ErrorNumber": true,
1698 - "data_office365_EventData": true,
1699 - "data_office365_EventSource": true,
1700 - "data_office365_ExchangeId": true,
1701 - "data_office365_ExtendedProperties": true,
1702 - "data_office365_ExternalAccess": true,
1703 - "data_office365_ExtraProperties": true,
1704 - "data_office365_FileSizeBytes": true,
1705 - "data_office365_FileSyncBytesCommitted": true,
1706 - "data_office365_Folder_Id": true,
1707 - "data_office365_Folder_Path": true,
1708 - "data_office365_FormId": true,
1709 - "data_office365_FormsUserType": true,
1710 - "data_office365_FromApp": true,
1711 - "data_office365_HighPriorityMediaProcessing": true,
1712 - "data_office365_HostedContents": true,
1713 - "data_office365_ICalUid": true,
1714 - "data_office365_Id": true,
1715 - "data_office365_ImplicitShare": true,
1716 - "data_office365_InterSystemsId": true,
1717 - "data_office365_InternalLogonType": true,
1718 - "data_office365_IntraSystemId": true,
1719 - "data_office365_IsManagedDevice": true,
1720 - "data_office365_ItemCount": true,
1721 - "data_office365_ItemName": true,
1722 - "data_office365_ItemType": true,
1723 - "data_office365_Item_Id": true,
1724 - "data_office365_Item_InternetMessageId": true,
1725 - "data_office365_Item_IsRecord": true,
1726 - "data_office365_Item_ParentFolder_Id": true,
1727 - "data_office365_Item_SizeInBytes": true,
1728 - "data_office365_JoinTime": true,
1729 - "data_office365_LeaveTime": true,
1730 - "data_office365_ListBaseTemplateType": true,
1731 - "data_office365_ListBaseType": true,
1732 - "data_office365_ListId": true,
1733 - "data_office365_ListItemUniqueId": true,
1734 - "data_office365_ListServerTemplate": true,
1735 - "data_office365_ListTitle": true,
1736 - "data_office365_LogonError": true,
1737 - "data_office365_LogonType": true,
1738 - "data_office365_LogonUserSid": true,
1739 - "data_office365_MachineId": true,
1740 - "data_office365_MailboxGuid": true,
1741 - "data_office365_MailboxOwnerSid": true,
1742 - "data_office365_MailboxOwnerUPN": true,
1743 - "data_office365_MeetingDetailId": true,
1744 - "data_office365_MeetingURL": true,
1745 - "data_office365_Members": true,
1746 - "data_office365_MessageId": true,
1747 - "data_office365_MessageSizeInBytes": true,
1748 - "data_office365_MessageURLs": true,
1749 - "data_office365_MessageVersion": true,
1750 - "data_office365_Modalities": true,
1751 - "data_office365_ModifiedProperties": true,
1752 - "data_office365_Name": true,
1753 - "data_office365_NewValue": true,
1754 - "data_office365_ObjectId": true,
1755 - "data_office365_Operation": true,
1756 - "data_office365_OperationScope": true,
1757 - "data_office365_OrganizationId": true,
1758 - "data_office365_OrganizationName": true,
1759 - "data_office365_Organizer_OrganizationId": true,
1760 - "data_office365_Organizer_RecipientType": true,
1761 - "data_office365_Organizer_Role": true,
1762 - "data_office365_Organizer_UserObjectId": true,
1763 - "data_office365_OriginatingServer": true,
1764 - "data_office365_Parameters": true,
1765 - "data_office365_ParentMessageId": true,
1766 - "data_office365_Platform": true,
1767 - "data_office365_ProviderTypes": true,
1768 - "data_office365_RecordType": true,
1769 - "data_office365_ResultStatus": false,
1770 - "data_office365_SearchQueryText": true,
1771 - "data_office365_SessionId": true,
1772 - "data_office365_Site": true,
1773 - "data_office365_SiteUrl": true,
1774 - "data_office365_SkipForServiceWorker": true,
1775 - "data_office365_Source": true,
1776 - "data_office365_SourceFileExtension": true,
1777 - "data_office365_SourceRelativeUrl": true,
1778 - "data_office365_StartTime": true,
1779 - "data_office365_Subscription": true,
1780 - "data_office365_SubscriptionId": true,
1781 - "data_office365_Target": true,
1782 - "data_office365_TargetContextId": true,
1783 - "data_office365_TargetUserOrGroupName": true,
1784 - "data_office365_TargetUserOrGroupType": true,
1785 - "data_office365_TeamGuid": true,
1786 - "data_office365_TeamName": true,
1787 - "data_office365_UniqueSharingId": true,
1788 - "data_office365_UserAgent": true,
1789 - "data_office365_UserId": false,
1790 - "data_office365_UserKey": true,
1791 - "data_office365_UserType": true,
1792 - "data_office365_Version": true,
1793 - "data_office365_WebId": true,
1794 - "data_office365_Workload": true,
1795 - "data_osquery_action": true,
1796 - "data_osquery_calendarTime": true,
1797 - "data_osquery_columns_address": true,
1798 - "data_osquery_columns_address_city_name": true,
1799 - "data_osquery_columns_address_country_code": true,
1800 - "data_osquery_columns_address_geolocation": true,
1801 - "data_osquery_columns_cmdline": true,
1802 - "data_osquery_columns_cwd": true,
1803 - "data_osquery_columns_description": true,
1804 - "data_osquery_columns_directory": true,
1805 - "data_osquery_columns_disk_bytes_read": true,
1806 - "data_osquery_columns_disk_bytes_written": true,
1807 - "data_osquery_columns_egid": true,
1808 - "data_osquery_columns_euid": true,
1809 - "data_osquery_columns_family": true,
1810 - "data_osquery_columns_fd": true,
1811 - "data_osquery_columns_gid": true,
1812 - "data_osquery_columns_gid_signed": true,
1813 - "data_osquery_columns_host": true,
1814 - "data_osquery_columns_interface": true,
1815 - "data_osquery_columns_local_address": true,
1816 - "data_osquery_columns_local_address_city_name": true,
1817 - "data_osquery_columns_local_address_country_code": true,
1818 - "data_osquery_columns_local_address_geolocation": true,
1819 - "data_osquery_columns_local_port": true,
1820 - "data_osquery_columns_mac": true,
1821 - "data_osquery_columns_name": true,
1822 - "data_osquery_columns_net_namespace": true,
1823 - "data_osquery_columns_nice": true,
1824 - "data_osquery_columns_on_disk": true,
1825 - "data_osquery_columns_parent": true,
1826 - "data_osquery_columns_path": true,
1827 - "data_osquery_columns_pgroup": true,
1828 - "data_osquery_columns_pid": true,
1829 - "data_osquery_columns_port": true,
1830 - "data_osquery_columns_protocol": true,
1831 - "data_osquery_columns_remote_address": true,
1832 - "data_osquery_columns_remote_address_city_name": true,
1833 - "data_osquery_columns_remote_address_country_code": true,
1834 - "data_osquery_columns_remote_address_geolocation": true,
1835 - "data_osquery_columns_remote_port": true,
1836 - "data_osquery_columns_resident_size": true,
1837 - "data_osquery_columns_root": true,
1838 - "data_osquery_columns_sgid": true,
1839 - "data_osquery_columns_shell": true,
1840 - "data_osquery_columns_socket": true,
1841 - "data_osquery_columns_start_time": true,
1842 - "data_osquery_columns_state": true,
1843 - "data_osquery_columns_suid": true,
1844 - "data_osquery_columns_system_time": true,
1845 - "data_osquery_columns_threads": true,
1846 - "data_osquery_columns_time_utc": true,
1847 - "data_osquery_columns_total_size": true,
1848 - "data_osquery_columns_tty": true,
1849 - "data_osquery_columns_type": true,
1850 - "data_osquery_columns_uid": true,
1851 - "data_osquery_columns_uid_signed": true,
1852 - "data_osquery_columns_user": true,
1853 - "data_osquery_columns_user_time": true,
1854 - "data_osquery_columns_username": true,
1855 - "data_osquery_columns_wired_size": true,
1856 - "data_osquery_counter": true,
1857 - "data_osquery_decorations_host_uuid": true,
1858 - "data_osquery_decorations_hostname": true,
1859 - "data_osquery_epoch": true,
1860 - "data_osquery_hostIdentifier": true,
1861 - "data_osquery_name": true,
1862 - "data_osquery_numerics": true,
1863 - "data_osquery_unixTime": true,
1864 - "data_proto": true,
1865 - "data_sca_check_command": true,
1866 - "data_sca_check_compliance_cis": true,
1867 - "data_sca_check_compliance_cis_csc": true,
1868 - "data_sca_check_compliance_gdpr_IV": true,
1869 - "data_sca_check_compliance_gpg_13": true,
1870 - "data_sca_check_compliance_hipaa": true,
1871 - "data_sca_check_compliance_nist_800_53": true,
1872 - "data_sca_check_compliance_pci_dss": true,
1873 - "data_sca_check_compliance_tsc": true,
1874 - "data_sca_check_description": true,
1875 - "data_sca_check_id": true,
1876 - "data_sca_check_previous_result": true,
1877 - "data_sca_check_rationale": true,
1878 - "data_sca_check_remediation": true,
1879 - "data_sca_check_result": true,
1880 - "data_sca_check_title": true,
1881 - "data_sca_description": true,
1882 - "data_sca_failed": true,
1883 - "data_sca_file": true,
1884 - "data_sca_invalid": true,
1885 - "data_sca_passed": true,
1886 - "data_sca_policy": true,
1887 - "data_sca_policy_id": true,
1888 - "data_sca_scan_id": true,
1889 - "data_sca_score": true,
1890 - "data_sca_total_checks": true,
1891 - "data_sca_type": true,
1892 - "data_script": true,
1893 - "data_src_ip": true,
1894 - "data_src_ip_city_name": true,
1895 - "data_src_ip_country_code": true,
1896 - "data_src_ip_geolocation": true,
1897 - "data_src_port": true,
1898 - "data_srcip": true,
1899 - "data_srcip_city_name": true,
1900 - "data_srcip_country_code": true,
1901 - "data_srcip_geolocation": true,
1902 - "data_srcuser": true,
1903 - "data_timestamp": true,
1904 - "data_title": true,
1905 - "data_tls_session_resumed": true,
1906 - "data_tls_version": true,
1907 - "data_tx_id": true,
1908 - "data_type": true,
1909 - "data_win_eventXML_binaryData": true,
1910 - "data_win_eventXML_binaryDataSize": true,
1911 - "data_win_eventXML_param1": true,
1912 - "data_win_eventdata_authenticationPackageName": true,
1913 - "data_win_eventdata_callTrace": true,
1914 - "data_win_eventdata_commandLine": true,
1915 - "data_win_eventdata_company": true,
1916 - "data_win_eventdata_creationUtcTime": true,
1917 - "data_win_eventdata_currentDirectory": true,
1918 - "data_win_eventdata_description": true,
1919 - "data_win_eventdata_destinationHostname": true,
1920 - "data_win_eventdata_destinationIp": true,
1921 - "data_win_eventdata_destinationIp_city_name": true,
1922 - "data_win_eventdata_destinationIp_country_code": true,
1923 - "data_win_eventdata_destinationIp_geolocation": true,
1924 - "data_win_eventdata_destinationIsIpv6": true,
1925 - "data_win_eventdata_destinationPort": true,
1926 - "data_win_eventdata_destinationPortName": true,
1927 - "data_win_eventdata_details": true,
1928 - "data_win_eventdata_elevatedToken": true,
1929 - "data_win_eventdata_eventType": true,
1930 - "data_win_eventdata_fileVersion": true,
1931 - "data_win_eventdata_fileVersion_city_name": true,
1932 - "data_win_eventdata_fileVersion_country_code": true,
1933 - "data_win_eventdata_fileVersion_geolocation": true,
1934 - "data_win_eventdata_grantedAccess": true,
1935 - "data_win_eventdata_hashes": true,
1936 - "data_win_eventdata_image": true,
1937 - "data_win_eventdata_imageLoaded": true,
1938 - "data_win_eventdata_impersonationLevel": true,
1939 - "data_win_eventdata_initiated": true,
1940 - "data_win_eventdata_integrityLevel": true,
1941 - "data_win_eventdata_ipAddress": true,
1942 - "data_win_eventdata_ipPort": true,
1943 - "data_win_eventdata_keyLength": true,
1944 - "data_win_eventdata_logonGuid": true,
1945 - "data_win_eventdata_logonId": true,
1946 - "data_win_eventdata_logonProcessName": true,
1947 - "data_win_eventdata_logonType": true,
1948 - "data_win_eventdata_originalFileName": true,
1949 - "data_win_eventdata_param1": true,
1950 - "data_win_eventdata_param2": true,
1951 - "data_win_eventdata_param3": true,
1952 - "data_win_eventdata_param4": true,
1953 - "data_win_eventdata_parentCommandLine": true,
1954 - "data_win_eventdata_parentImage": true,
1955 - "data_win_eventdata_parentProcessGuid": true,
1956 - "data_win_eventdata_parentProcessId": true,
1957 - "data_win_eventdata_processGuid": true,
1958 - "data_win_eventdata_processId": true,
1959 - "data_win_eventdata_processName": true,
1960 - "data_win_eventdata_product": true,
1961 - "data_win_eventdata_protocol": true,
1962 - "data_win_eventdata_queryName": true,
1963 - "data_win_eventdata_queryResults": true,
1964 - "data_win_eventdata_queryStatus": true,
1965 - "data_win_eventdata_ruleName": true,
1966 - "data_win_eventdata_serviceName": true,
1967 - "data_win_eventdata_serviceSid": true,
1968 - "data_win_eventdata_signature": true,
1969 - "data_win_eventdata_signatureStatus": true,
1970 - "data_win_eventdata_signed": true,
1971 - "data_win_eventdata_sourceHostname": true,
1972 - "data_win_eventdata_sourceImage": true,
1973 - "data_win_eventdata_sourceIp": true,
1974 - "data_win_eventdata_sourceIp_city_name": true,
1975 - "data_win_eventdata_sourceIp_country_code": true,
1976 - "data_win_eventdata_sourceIp_geolocation": true,
1977 - "data_win_eventdata_sourceIsIpv6": true,
1978 - "data_win_eventdata_sourcePort": true,
1979 - "data_win_eventdata_sourceProcessGUID": true,
1980 - "data_win_eventdata_sourceProcessId": true,
1981 - "data_win_eventdata_sourceThreadId": true,
1982 - "data_win_eventdata_status": true,
1983 - "data_win_eventdata_subjectDomainName": true,
1984 - "data_win_eventdata_subjectLogonId": true,
1985 - "data_win_eventdata_subjectUserName": true,
1986 - "data_win_eventdata_subjectUserSid": true,
1987 - "data_win_eventdata_targetDomainName": true,
1988 - "data_win_eventdata_targetFilename": true,
1989 - "data_win_eventdata_targetImage": true,
1990 - "data_win_eventdata_targetLinkedLogonId": true,
1991 - "data_win_eventdata_targetLogonId": true,
1992 - "data_win_eventdata_targetObject": true,
1993 - "data_win_eventdata_targetProcessGUID": true,
1994 - "data_win_eventdata_targetProcessId": true,
1995 - "data_win_eventdata_targetUserName": true,
1996 - "data_win_eventdata_targetUserSid": true,
1997 - "data_win_eventdata_terminalSessionId": true,
1998 - "data_win_eventdata_ticketEncryptionType": true,
1999 - "data_win_eventdata_ticketOptions": true,
2000 - "data_win_eventdata_user": true,
2001 - "data_win_eventdata_utcTime": true,
2002 - "data_win_eventdata_virtualAccount": true,
2003 - "data_win_system_channel": true,
2004 - "data_win_system_computer": true,
2005 - "data_win_system_eventID": true,
2006 - "data_win_system_eventRecordID": true,
2007 - "data_win_system_eventSourceName": true,
2008 - "data_win_system_keywords": true,
2009 - "data_win_system_level": true,
2010 - "data_win_system_message": true,
2011 - "data_win_system_opcode": true,
2012 - "data_win_system_processID": true,
2013 - "data_win_system_providerGuid": true,
2014 - "data_win_system_providerName": true,
2015 - "data_win_system_severityValue": true,
2016 - "data_win_system_systemTime": true,
2017 - "data_win_system_task": true,
2018 - "data_win_system_threadID": true,
2019 - "data_win_system_version": true,
2020 - "decoder_name": true,
2021 - "decoder_parent": true,
2022 - "dns_query": true,
2023 - "dns_query_threat_indicated": true,
2024 - "dst_ip": true,
2025 - "dst_ip_city_name": true,
2026 - "dst_ip_country_code": true,
2027 - "dst_ip_geolocation": true,
2028 - "dst_ip_threat_indicated": true,
2029 - "dst_port": true,
2030 - "ecs_version": true,
2031 - "error": true,
2032 - "event_hash": true,
2033 - "file_path": true,
2034 - "firewall_rule_name": true,
2035 - "full_log": false,
2036 - "gl2_accounted_message_size": true,
2037 - "gl2_message_id": true,
2038 - "gl2_processing_error": true,
2039 - "gl2_remote_ip": true,
2040 - "gl2_remote_port": true,
2041 - "gl2_source_collector": true,
2042 - "gl2_source_input": true,
2043 - "gl2_source_node": true,
2044 - "hash_md5": true,
2045 - "hash_sha1": true,
2046 - "hash_sha256": true,
2047 - "highlight": true,
2048 - "host_architecture": true,
2049 - "host_containerized": true,
2050 - "host_hostname": true,
2051 - "host_id": true,
2052 - "host_ip": true,
2053 - "host_mac": true,
2054 - "host_name": true,
2055 - "host_os_codename": true,
2056 - "host_os_kernel": true,
2057 - "host_os_name": true,
2058 - "host_os_platform": true,
2059 - "host_os_version": true,
2060 - "hostname": true,
2061 - "id": true,
2062 - "input_type": true,
2063 - "level": true,
2064 - "location": true,
2065 - "log_file_path": true,
2066 - "log_offset": true,
2067 - "manager_name": true,
2068 - "message": true,
2069 - "module": true,
2070 - "msg_timestamp": true,
2071 - "parent_process_cmd_line": true,
2072 - "parent_process_id": true,
2073 - "parent_process_image": true,
2074 - "pid": true,
2075 - "predecoder_hostname": true,
2076 - "predecoder_program_name": true,
2077 - "predecoder_timestamp": true,
2078 - "previous_log": true,
2079 - "previous_output": true,
2080 - "process_cmd_line": true,
2081 - "process_id": true,
2082 - "process_image": true,
2083 - "process_name": true,
2084 - "protocol": true,
2085 - "rule_cis": true,
2086 - "rule_cis_csc": true,
2087 - "rule_firedtimes": true,
2088 - "rule_gdpr": true,
2089 - "rule_gdpr_IV": true,
2090 - "rule_gpg13": true,
2091 - "rule_gpg_13": true,
2092 - "rule_group1": true,
2093 - "rule_group2": true,
2094 - "rule_group3": true,
2095 - "rule_groups": true,
2096 - "rule_hipaa": true,
2097 - "rule_id": true,
2098 - "rule_info": true,
2099 - "rule_mail": true,
2100 - "rule_mitre_id": true,
2101 - "rule_mitre_tactic": false,
2102 - "rule_nist_800_53": true,
2103 - "rule_pci_dss": true,
2104 - "rule_tsc": true,
2105 - "scanid": true,
2106 - "service": true,
2107 - "software_package": true,
2108 - "software_vendor": true,
2109 - "sort": true,
2110 - "source": true,
2111 - "source_reserved_ip": true,
2112 - "src_ip": true,
2113 - "src_ip_city_name": true,
2114 - "src_ip_country_code": true,
2115 - "src_ip_geolocation": true,
2116 - "src_port": true,
2117 - "streams": true,
2118 - "syscheck_attrs_after": true,
2119 - "syscheck_audit_effective_user_id": true,
2120 - "syscheck_audit_effective_user_name": true,
2121 - "syscheck_audit_group_id": true,
2122 - "syscheck_audit_group_name": true,
2123 - "syscheck_audit_login_user_id": true,
2124 - "syscheck_audit_login_user_name": true,
2125 - "syscheck_audit_process_cwd": true,
2126 - "syscheck_audit_process_id": true,
2127 - "syscheck_audit_process_name": true,
2128 - "syscheck_audit_process_parent_cwd": true,
2129 - "syscheck_audit_process_parent_name": true,
2130 - "syscheck_audit_process_ppid": true,
2131 - "syscheck_audit_user_id": true,
2132 - "syscheck_audit_user_name": true,
2133 - "syscheck_changed_attributes": true,
2134 - "syscheck_event": true,
2135 - "syscheck_gid_after": true,
2136 - "syscheck_gname_after": true,
2137 - "syscheck_hard_links": true,
2138 - "syscheck_inode_after": true,
2139 - "syscheck_inode_before": true,
2140 - "syscheck_md5_after": true,
2141 - "syscheck_md5_before": true,
2142 - "syscheck_mode": true,
2143 - "syscheck_mtime_after": true,
2144 - "syscheck_mtime_before": true,
2145 - "syscheck_path": true,
2146 - "syscheck_perm_after": true,
2147 - "syscheck_perm_before": true,
2148 - "syscheck_sha1_after": true,
2149 - "syscheck_sha1_before": true,
2150 - "syscheck_sha256_after": true,
2151 - "syscheck_sha256_before": true,
2152 - "syscheck_size_after": true,
2153 - "syscheck_size_before": true,
2154 - "syscheck_uid_after": true,
2155 - "syscheck_uname_after": true,
2156 - "syscheck_win_perm_after": true,
2157 - "syscheck_win_perm_after_0_allowed": true,
2158 - "syscheck_win_perm_after_0_name": true,
2159 - "syscheck_win_perm_after_1_allowed": true,
2160 - "syscheck_win_perm_after_1_name": true,
2161 - "syscheck_win_perm_after_2_allowed": true,
2162 - "syscheck_win_perm_after_2_name": true,
2163 - "syscheck_win_perm_after_3_allowed": true,
2164 - "syscheck_win_perm_after_3_name": true,
2165 - "syslog_customer": true,
2166 - "syslog_level": true,
2167 - "syslog_tag": true,
2168 - "syslog_type": true,
2169 - "sysmon_event_description": true,
2170 - "threat_ids": true,
2171 - "threat_indicated": true,
2172 - "threat_names": true,
2173 - "time": true,
2174 - "timestamp": true,
2175 - "true": true,
2176 - "user_name": true,
2177 - "win_registry_key": true,
2178 - "win_system_eventID": true,
2179 - "windows_auth_package": true,
2180 - "windows_domain": true,
2181 - "windows_event_id": true,
2182 - "windows_event_severity": true,
2183 - "windows_logon_type": true
2184 - },
2185 - "indexByName": {
2186 - "_id": 2,
2187 - "_index": 9,
2188 - "_type": 10,
2189 - "agent_id": 11,
2190 - "agent_name": 5,
2191 - "cluster_name": 12,
2192 - "cluster_node": 13,
2193 - "data_office365_AppAccessContext_APIId": 49,
2194 - "data_office365_AppAccessContext_ClientAppId": 50,
2195 - "data_office365_AppAccessContext_ClientAppName": 51,
2196 - "data_office365_AppAccessContext_CorrelationId": 52,
2197 - "data_office365_ArtifactsShared": 53,
2198 - "data_office365_Attendees": 54,
2199 - "data_office365_ChatName": 55,
2200 - "data_office365_ChatThreadId": 56,
2201 - "data_office365_ClientIP": 4,
2202 - "data_office365_ClientIP_city_name": 14,
2203 - "data_office365_ClientIP_country_code": 15,
2204 - "data_office365_ClientIP_geolocation": 16,
2205 - "data_office365_CommunicationSubType": 57,
2206 - "data_office365_CommunicationType": 58,
2207 - "data_office365_CreationTime": 0,
2208 - "data_office365_DeviceId": 59,
2209 - "data_office365_DeviceInformation": 60,
2210 - "data_office365_EndTime": 61,
2211 - "data_office365_ExchangeId": 62,
2212 - "data_office365_ExtraProperties": 63,
2213 - "data_office365_ICalUid": 64,
2214 - "data_office365_Id": 17,
2215 - "data_office365_ItemName": 65,
2216 - "data_office365_JoinTime": 66,
2217 - "data_office365_LeaveTime": 67,
2218 - "data_office365_MeetingDetailId": 68,
2219 - "data_office365_MeetingURL": 69,
2220 - "data_office365_Members": 70,
2221 - "data_office365_MessageId": 71,
2222 - "data_office365_MessageSizeInBytes": 72,
2223 - "data_office365_MessageURLs": 73,
2224 - "data_office365_MessageVersion": 74,
2225 - "data_office365_Modalities": 75,
2226 - "data_office365_Name": 76,
2227 - "data_office365_NewValue": 77,
2228 - "data_office365_ObjectId": 18,
2229 - "data_office365_Operation": 24,
2230 - "data_office365_OperationScope": 78,
2231 - "data_office365_OrganizationId": 19,
2232 - "data_office365_Organizer_OrganizationId": 79,
2233 - "data_office365_Organizer_RecipientType": 80,
2234 - "data_office365_Organizer_Role": 81,
2235 - "data_office365_Organizer_UserObjectId": 82,
2236 - "data_office365_ProviderTypes": 83,
2237 - "data_office365_RecordType": 20,
2238 - "data_office365_StartTime": 84,
2239 - "data_office365_SubscriptionId": 85,
2240 - "data_office365_TeamGuid": 86,
2241 - "data_office365_UserId": 3,
2242 - "data_office365_UserKey": 21,
2243 - "data_office365_UserType": 22,
2244 - "data_office365_Version": 23,
2245 - "data_office365_Workload": 48,
2246 - "decoder_name": 25,
2247 - "gl2_accounted_message_size": 26,
2248 - "gl2_message_id": 27,
2249 - "gl2_processing_error": 28,
2250 - "gl2_remote_ip": 29,
2251 - "gl2_remote_port": 30,
2252 - "gl2_source_input": 31,
2253 - "gl2_source_node": 32,
2254 - "highlight": 33,
2255 - "id": 34,
2256 - "location": 35,
2257 - "manager_name": 36,
2258 - "message": 37,
2259 - "rule_description": 6,
2260 - "rule_firedtimes": 38,
2261 - "rule_group1": 39,
2262 - "rule_groups": 40,
2263 - "rule_id": 8,
2264 - "rule_level": 7,
2265 - "rule_mail": 41,
2266 - "sort": 42,
2267 - "source": 43,
2268 - "streams": 44,
2269 - "syslog_level": 45,
2270 - "syslog_type": 46,
2271 - "timestamp": 1,
2272 - "true": 47
2273 - },
2274 - "renameByName": {
2275 - "_id": "EVENT ID",
2276 - "agent_name": "",
2277 - "data_office365_ActorIpAddress": "SRC IP",
2278 - "data_office365_AffectedItems": "ITEMS",
2279 - "data_office365_BrowserName": "BROWSER",
2280 - "data_office365_ClientIP": "CLIENT IP",
2281 - "data_office365_ClientIP_city_name": "",
2282 - "data_office365_CreationTime": "EVENT TIME",
2283 - "data_office365_FormName": "FORM",
2284 - "data_office365_Item_Attachments": "ATTACHMENT",
2285 - "data_office365_Item_ParentFolder_Path": "FOLDER",
2286 - "data_office365_Item_Subject": "SUBJECT",
2287 - "data_office365_ResultStatus": "RESULT",
2288 - "data_office365_SourceApp": "SRC APP",
2289 - "data_office365_SourceFileName": "FILE",
2290 - "data_office365_UserId": "ACCOUNT",
2291 - "rule_description": "DESCRIPTION",
2292 - "rule_id": "RULE ID",
2293 - "rule_level": "",
2294 - "rule_mitre_tactic": "MITRE TACTIC",
2295 - "rule_mitre_technique": "MITRE TECHNIQUE",
2296 - "timestamp": "Date/Time"
2297 - }
2298 - }
2299 - }
2300 - ],
2301 - "transparent": true,
2302 - "type": "table"
2303 - }
2304 - ],
2305 - "refresh": "",
2306 - "schemaVersion": 38,
2307 - "style": "dark",
2308 - "tags": [
2309 - "O365"
2310 - ],
2311 - "templating": {
2312 - "list": [
2313 - {
2314 - "datasource": {
2315 - "type": "elasticsearch",
2316 - "uid": "replace_datasource_uid"
2317 - },
2318 - "filters": [],
2319 - "hide": 0,
2320 - "label": "",
2321 - "name": "Filters",
2322 - "skipUrlSync": false,
2323 - "type": "adhoc"
2324 - },
2325 - {
2326 - "current": {
2327 - "selected": false,
2328 - "text": "All",
2329 - "value": "$__all"
2330 - },
2331 - "datasource": {
2332 - "type": "elasticsearch",
2333 - "uid": "replace_datasource_uid"
2334 - },
2335 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2336 - "hide": 0,
2337 - "includeAll": true,
2338 - "label": "Operation",
2339 - "multi": false,
2340 - "name": "operation",
2341 - "options": [],
2342 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2343 - "refresh": 2,
2344 - "regex": "",
2345 - "skipUrlSync": false,
2346 - "sort": 1,
2347 - "tagValuesQuery": "",
2348 - "tagsQuery": "",
2349 - "type": "query",
2350 - "useTags": false
2351 - },
2352 - {
2353 - "current": {
2354 - "selected": false,
2355 - "text": "All",
2356 - "value": "$__all"
2357 - },
2358 - "datasource": {
2359 - "type": "elasticsearch",
2360 - "uid": "replace_datasource_uid"
2361 - },
2362 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2363 - "hide": 0,
2364 - "includeAll": true,
2365 - "label": "Rule Level",
2366 - "multi": false,
2367 - "name": "rule_level",
2368 - "options": [],
2369 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2370 - "refresh": 2,
2371 - "regex": "",
2372 - "skipUrlSync": false,
2373 - "sort": 0,
2374 - "type": "query"
2375 - }
2376 - ]
2377 - },
2378 - "time": {
2379 - "from": "now-2d",
2380 - "to": "now"
2381 - },
2382 - "timepicker": {
2383 - "refresh_intervals": [
2384 - "5s",
2385 - "10s",
2386 - "30s",
2387 - "1m",
2388 - "5m",
2389 - "15m",
2390 - "30m",
2391 - "1h",
2392 - "2h",
2393 - "1d"
2394 - ],
2395 - "time_options": [
2396 - "5m",
2397 - "15m",
2398 - "1h",
2399 - "6h",
2400 - "12h",
2401 - "24h",
2402 - "2d",
2403 - "7d",
2404 - "30d"
2405 - ]
2406 - },
2407 - "timezone": "",
2408 - "title": "O365 - MICROSOFT FORMS",
2409 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "10.0.3",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:MicrosoftForms",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "cellOptions": {
255 + "type": "auto"
256 + },
257 + "inspect": false
258 + },
259 + "mappings": [],
260 + "thresholds": {
261 + "mode": "absolute",
262 + "steps": [
263 + {
264 + "color": "red",
265 + "value": null
266 + }
267 + ]
268 + }
269 + },
270 + "overrides": [
271 + {
272 + "matcher": {
273 + "id": "byName",
274 + "options": "Count"
275 + },
276 + "properties": [
277 + {
278 + "id": "displayName",
279 + "value": "EVENTS"
280 + },
281 + {
282 + "id": "unit",
283 + "value": "short"
284 + },
285 + {
286 + "id": "decimals",
287 + "value": -1
288 + },
289 + {
290 + "id": "custom.align"
291 + },
292 + {
293 + "id": "thresholds",
294 + "value": {
295 + "mode": "absolute",
296 + "steps": [
297 + {
298 + "color": "red",
299 + "value": null
300 + }
301 + ]
302 + }
303 + }
304 + ]
305 + }
306 + ]
307 + },
308 + "gridPos": {
309 + "h": 7,
310 + "w": 6,
311 + "x": 8,
312 + "y": 0
313 + },
314 + "id": 54,
315 + "options": {
316 + "cellHeight": "sm",
317 + "footer": {
318 + "countRows": false,
319 + "fields": "",
320 + "reducer": ["sum"],
321 + "show": false
322 + },
323 + "showHeader": true
324 + },
325 + "pluginVersion": "10.0.3",
326 + "targets": [
327 + {
328 + "bucketAggs": [
329 + {
330 + "fake": true,
331 + "field": "data_office365_Operation",
332 + "id": "4",
333 + "settings": {
334 + "min_doc_count": 1,
335 + "order": "desc",
336 + "orderBy": "_count",
337 + "size": "0"
338 + },
339 + "type": "terms"
340 + }
341 + ],
342 + "datasource": {
343 + "type": "elasticsearch",
344 + "uid": "replace_datasource_uid"
345 + },
346 + "metrics": [
347 + {
348 + "field": "select field",
349 + "id": "1",
350 + "type": "count"
351 + }
352 + ],
353 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
354 + "refId": "A",
355 + "timeField": "timestamp"
356 + }
357 + ],
358 + "title": "EVENTS BY OPERATION",
359 + "transformations": [
360 + {
361 + "id": "merge",
362 + "options": {
363 + "reducers": []
364 + }
365 + },
366 + {
367 + "id": "organize",
368 + "options": {
369 + "excludeByName": {},
370 + "indexByName": {},
371 + "renameByName": {
372 + "Count": "EVENTS",
373 + "data_office365_Operation": "OPERATION"
374 + }
375 + }
376 + }
377 + ],
378 + "type": "table"
379 + },
380 + {
381 + "datasource": {
382 + "type": "elasticsearch",
383 + "uid": "replace_datasource_uid"
384 + },
385 + "fieldConfig": {
386 + "defaults": {
387 + "color": {
388 + "mode": "thresholds"
389 + },
390 + "custom": {
391 + "align": "auto",
392 + "cellOptions": {
393 + "type": "auto"
394 + },
395 + "inspect": false
396 + },
397 + "mappings": [],
398 + "thresholds": {
399 + "mode": "absolute",
400 + "steps": [
401 + {
402 + "color": "red",
403 + "value": null
404 + }
405 + ]
406 + }
407 + },
408 + "overrides": [
409 + {
410 + "matcher": {
411 + "id": "byName",
412 + "options": "Count"
413 + },
414 + "properties": [
415 + {
416 + "id": "displayName",
417 + "value": "EVENTS"
418 + },
419 + {
420 + "id": "unit",
421 + "value": "short"
422 + },
423 + {
424 + "id": "decimals",
425 + "value": -1
426 + },
427 + {
428 + "id": "custom.align"
429 + },
430 + {
431 + "id": "thresholds",
432 + "value": {
433 + "mode": "absolute",
434 + "steps": [
435 + {
436 + "color": "red",
437 + "value": null
438 + }
439 + ]
440 + }
441 + }
442 + ]
443 + }
444 + ]
445 + },
446 + "gridPos": {
447 + "h": 7,
448 + "w": 6,
449 + "x": 14,
450 + "y": 0
451 + },
452 + "id": 62,
453 + "options": {
454 + "cellHeight": "sm",
455 + "footer": {
456 + "countRows": false,
457 + "fields": "",
458 + "reducer": ["sum"],
459 + "show": false
460 + },
461 + "showHeader": true
462 + },
463 + "pluginVersion": "10.0.3",
464 + "targets": [
465 + {
466 + "bucketAggs": [
467 + {
468 + "fake": true,
469 + "field": "data_office365_SourceApp",
470 + "id": "4",
471 + "settings": {
472 + "min_doc_count": 1,
473 + "order": "desc",
474 + "orderBy": "_count",
475 + "size": "0"
476 + },
477 + "type": "terms"
478 + }
479 + ],
480 + "datasource": {
481 + "type": "elasticsearch",
482 + "uid": "replace_datasource_uid"
483 + },
484 + "metrics": [
485 + {
486 + "field": "select field",
487 + "id": "1",
488 + "type": "count"
489 + }
490 + ],
491 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
492 + "refId": "A",
493 + "timeField": "timestamp"
494 + }
495 + ],
496 + "title": "EVENTS BY APP",
497 + "transformations": [
498 + {
499 + "id": "merge",
500 + "options": {
501 + "reducers": []
502 + }
503 + },
504 + {
505 + "id": "organize",
506 + "options": {
507 + "excludeByName": {},
508 + "indexByName": {},
509 + "renameByName": {
510 + "Count": "EVENTS",
511 + "data_office365_Operation": "OPERATION",
512 + "data_office365_SourceApp": "SOURCE APP",
513 + "data_office365_UserAgent": "USER AGENT"
514 + }
515 + }
516 + }
517 + ],
518 + "type": "table"
519 + },
520 + {
521 + "datasource": {
522 + "type": "elasticsearch",
523 + "uid": "replace_datasource_uid"
524 + },
525 + "fieldConfig": {
526 + "defaults": {
527 + "color": {
528 + "mode": "thresholds"
529 + },
530 + "mappings": [
531 + {
532 + "options": {
533 + "match": "null",
534 + "result": {
535 + "text": "N/A"
536 + }
537 + },
538 + "type": "special"
539 + }
540 + ],
541 + "max": 15,
542 + "min": 0,
543 + "thresholds": {
544 + "mode": "absolute",
545 + "steps": [
546 + {
547 + "color": "#299c46",
548 + "value": null
549 + },
550 + {
551 + "color": "rgba(237, 129, 40, 0.89)",
552 + "value": 8
553 + },
554 + {
555 + "color": "#d44a3a",
556 + "value": 12
557 + }
558 + ]
559 + },
560 + "unit": "none"
561 + },
562 + "overrides": []
563 + },
564 + "gridPos": {
565 + "h": 7,
566 + "w": 4,
567 + "x": 0,
568 + "y": 7
569 + },
570 + "id": 16,
571 + "links": [],
572 + "options": {
573 + "orientation": "horizontal",
574 + "reduceOptions": {
575 + "calcs": ["max"],
576 + "fields": "",
577 + "values": false
578 + },
579 + "showThresholdLabels": false,
580 + "showThresholdMarkers": true,
581 + "text": {}
582 + },
583 + "pluginVersion": "10.0.3",
584 + "targets": [
585 + {
586 + "bucketAggs": [
587 + {
588 + "field": "timestamp",
589 + "id": "2",
590 + "settings": {
591 + "interval": "auto",
592 + "min_doc_count": 0,
593 + "trimEdges": 0
594 + },
595 + "type": "date_histogram"
596 + }
597 + ],
598 + "datasource": {
599 + "type": "elasticsearch",
600 + "uid": "replace_datasource_uid"
601 + },
602 + "metrics": [
603 + {
604 + "field": "rule_level",
605 + "id": "1",
606 + "meta": {},
607 + "settings": {},
608 + "type": "max"
609 + }
610 + ],
611 + "query": "data_office365_Operation:$operation AND data_office365_Workload:MicrosoftForms",
612 + "refId": "A",
613 + "timeField": "timestamp"
614 + }
615 + ],
616 + "title": "MAX SEVERITY (0 - 15)",
617 + "type": "gauge"
618 + },
619 + {
620 + "datasource": {
621 + "type": "elasticsearch",
622 + "uid": "replace_datasource_uid"
623 + },
624 + "fieldConfig": {
625 + "defaults": {
626 + "color": {
627 + "mode": "palette-classic"
628 + },
629 + "custom": {
630 + "axisCenteredZero": false,
631 + "axisColorMode": "text",
632 + "axisLabel": "",
633 + "axisPlacement": "auto",
634 + "barAlignment": 0,
635 + "drawStyle": "bars",
636 + "fillOpacity": 0,
637 + "gradientMode": "none",
638 + "hideFrom": {
639 + "legend": false,
640 + "tooltip": false,
641 + "viz": false
642 + },
643 + "lineInterpolation": "linear",
644 + "lineWidth": 1,
645 + "pointSize": 5,
646 + "scaleDistribution": {
647 + "type": "linear"
648 + },
649 + "showPoints": "auto",
650 + "spanNulls": false,
651 + "stacking": {
652 + "group": "A",
653 + "mode": "normal"
654 + },
655 + "thresholdsStyle": {
656 + "mode": "off"
657 + }
658 + },
659 + "mappings": [],
660 + "thresholds": {
661 + "mode": "absolute",
662 + "steps": [
663 + {
664 + "color": "green",
665 + "value": null
666 + },
667 + {
668 + "color": "red",
669 + "value": 80
670 + }
671 + ]
672 + }
673 + },
674 + "overrides": []
675 + },
676 + "gridPos": {
677 + "h": 13,
678 + "w": 20,
679 + "x": 4,
680 + "y": 7
681 + },
682 + "id": 60,
683 + "options": {
684 + "legend": {
685 + "calcs": [],
686 + "displayMode": "table",
687 + "placement": "right",
688 + "showLegend": true
689 + },
690 + "tooltip": {
691 + "mode": "single",
692 + "sort": "none"
693 + }
694 + },
695 + "targets": [
696 + {
697 + "alias": "",
698 + "bucketAggs": [
699 + {
700 + "field": "data_office365_Operation",
701 + "id": "3",
702 + "settings": {
703 + "min_doc_count": "1",
704 + "order": "desc",
705 + "orderBy": "_count",
706 + "size": "10"
707 + },
708 + "type": "terms"
709 + },
710 + {
711 + "field": "timestamp",
712 + "id": "2",
713 + "settings": {
714 + "interval": "auto"
715 + },
716 + "type": "date_histogram"
717 + }
718 + ],
719 + "datasource": {
720 + "type": "elasticsearch",
721 + "uid": "replace_datasource_uid"
722 + },
723 + "metrics": [
724 + {
725 + "id": "1",
726 + "type": "count"
727 + }
728 + ],
729 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
730 + "refId": "A",
731 + "timeField": "timestamp"
732 + }
733 + ],
734 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
735 + "transparent": true,
736 + "type": "timeseries"
737 + },
738 + {
739 + "datasource": {
740 + "type": "elasticsearch",
741 + "uid": "replace_datasource_uid"
742 + },
743 + "fieldConfig": {
744 + "defaults": {
745 + "mappings": [
746 + {
747 + "options": {
748 + "match": "null",
749 + "result": {
750 + "text": "N/A"
751 + }
752 + },
753 + "type": "special"
754 + }
755 + ],
756 + "thresholds": {
757 + "mode": "absolute",
758 + "steps": [
759 + {
760 + "color": "blue",
761 + "value": null
762 + }
763 + ]
764 + },
765 + "unit": "locale"
766 + },
767 + "overrides": []
768 + },
769 + "gridPos": {
770 + "h": 6,
771 + "w": 4,
772 + "x": 0,
773 + "y": 14
774 + },
775 + "id": 51,
776 + "links": [],
777 + "options": {
778 + "colorMode": "value",
779 + "graphMode": "area",
780 + "justifyMode": "auto",
781 + "orientation": "horizontal",
782 + "reduceOptions": {
783 + "calcs": ["sum"],
784 + "fields": "",
785 + "values": false
786 + },
787 + "text": {},
788 + "textMode": "auto"
789 + },
790 + "pluginVersion": "10.0.3",
791 + "targets": [
792 + {
793 + "bucketAggs": [
794 + {
795 + "$$hashKey": "object:331",
796 + "field": "timestamp",
797 + "id": "2",
798 + "settings": {
799 + "interval": "auto",
800 + "min_doc_count": 0,
801 + "trimEdges": 0
802 + },
803 + "type": "date_histogram"
804 + }
805 + ],
806 + "datasource": {
807 + "type": "elasticsearch",
808 + "uid": "replace_datasource_uid"
809 + },
810 + "metrics": [
811 + {
812 + "$$hashKey": "object:329",
813 + "field": "select field",
814 + "id": "1",
815 + "type": "count"
816 + }
817 + ],
818 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
819 + "refId": "A",
820 + "timeField": "timestamp"
821 + }
822 + ],
823 + "title": "EVENTS (Total)",
824 + "type": "stat"
825 + },
826 + {
827 + "datasource": {
828 + "type": "elasticsearch",
829 + "uid": "replace_datasource_uid"
830 + },
831 + "fieldConfig": {
832 + "defaults": {
833 + "color": {
834 + "mode": "thresholds"
835 + },
836 + "custom": {
837 + "align": "auto",
838 + "cellOptions": {
839 + "type": "auto"
840 + },
841 + "inspect": false
842 + },
843 + "mappings": [],
844 + "thresholds": {
845 + "mode": "absolute",
846 + "steps": [
847 + {
848 + "color": "orange",
849 + "value": null
850 + }
851 + ]
852 + }
853 + },
854 + "overrides": [
855 + {
856 + "matcher": {
857 + "id": "byName",
858 + "options": "Count"
859 + },
860 + "properties": [
861 + {
862 + "id": "displayName",
863 + "value": "EVENTS"
864 + },
865 + {
866 + "id": "unit",
867 + "value": "short"
868 + },
869 + {
870 + "id": "decimals",
871 + "value": -1
872 + },
873 + {
874 + "id": "custom.align"
875 + }
876 + ]
877 + },
878 + {
879 + "matcher": {
880 + "id": "byName",
881 + "options": "AD ACCOUNT"
882 + },
883 + "properties": [
884 + {
885 + "id": "custom.width",
886 + "value": 377
887 + }
888 + ]
889 + }
890 + ]
891 + },
892 + "gridPos": {
893 + "h": 12,
894 + "w": 8,
895 + "x": 0,
896 + "y": 20
897 + },
898 + "id": 61,
899 + "options": {
900 + "cellHeight": "sm",
901 + "footer": {
902 + "countRows": false,
903 + "fields": "",
904 + "reducer": ["sum"],
905 + "show": false
906 + },
907 + "showHeader": true,
908 + "sortBy": []
909 + },
910 + "pluginVersion": "10.0.3",
911 + "targets": [
912 + {
913 + "bucketAggs": [
914 + {
915 + "fake": true,
916 + "field": "data_office365_FormName",
917 + "id": "4",
918 + "settings": {
919 + "min_doc_count": 1,
920 + "order": "desc",
921 + "orderBy": "_count",
922 + "size": "0"
923 + },
924 + "type": "terms"
925 + }
926 + ],
927 + "datasource": {
928 + "type": "elasticsearch",
929 + "uid": "replace_datasource_uid"
930 + },
931 + "metrics": [
932 + {
933 + "field": "select field",
934 + "id": "1",
935 + "type": "count"
936 + }
937 + ],
938 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
939 + "refId": "A",
940 + "timeField": "timestamp"
941 + }
942 + ],
943 + "title": "MS-FORMS EVENTS BY FORM NAME",
944 + "transformations": [
945 + {
946 + "id": "merge",
947 + "options": {
948 + "reducers": []
949 + }
950 + },
951 + {
952 + "id": "organize",
953 + "options": {
954 + "excludeByName": {},
955 + "indexByName": {},
956 + "renameByName": {
957 + "Count": "EVENTS",
958 + "data_office365_AuthenticationType": "AUTH TYPE",
959 + "data_office365_ClientIP_country_code": "COUNTRY",
960 + "data_office365_FormName": "FORM NAME",
961 + "data_office365_LogonError": "ERROR",
962 + "data_office365_Operation": "WORKLOAD",
963 + "data_office365_UserId": "AD ACCOUNT"
964 + }
965 + }
966 + }
967 + ],
968 + "type": "table"
969 + },
970 + {
971 + "circleMaxSize": 30,
972 + "circleMinSize": 2,
973 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
974 + "datasource": {
975 + "type": "elasticsearch",
976 + "uid": "replace_datasource_uid"
977 + },
978 + "decimals": 0,
979 + "esMetric": "Count",
980 + "gridPos": {
981 + "h": 12,
982 + "w": 8,
983 + "x": 8,
984 + "y": 20
985 + },
986 + "hideEmpty": false,
987 + "hideZero": false,
988 + "id": 50,
989 + "initialZoom": 1,
990 + "locationData": "countries",
991 + "mapCenter": "(0°, 0°)",
992 + "mapCenterLatitude": 0,
993 + "mapCenterLongitude": 0,
994 + "maxDataPoints": 1,
995 + "mouseWheelZoom": false,
996 + "showLegend": true,
997 + "stickyLabels": false,
998 + "tableQueryOptions": {
999 + "geohashField": "geohash",
1000 + "latitudeField": "latitude",
1001 + "longitudeField": "longitude",
1002 + "metricField": "metric",
1003 + "queryType": "geohash"
1004 + },
1005 + "targets": [
1006 + {
1007 + "bucketAggs": [
1008 + {
1009 + "fake": true,
1010 + "field": "data_office365_ClientIP_country_code",
1011 + "id": "3",
1012 + "settings": {
1013 + "min_doc_count": 1,
1014 + "order": "desc",
1015 + "orderBy": "_term",
1016 + "size": "0"
1017 + },
1018 + "type": "terms"
1019 + },
1020 + {
1021 + "field": "timestamp",
1022 + "id": "2",
1023 + "settings": {
1024 + "interval": "auto",
1025 + "min_doc_count": 0,
1026 + "trimEdges": 0
1027 + },
1028 + "type": "date_histogram"
1029 + }
1030 + ],
1031 + "datasource": {
1032 + "type": "elasticsearch",
1033 + "uid": "replace_datasource_uid"
1034 + },
1035 + "metrics": [
1036 + {
1037 + "field": "select field",
1038 + "id": "1",
1039 + "type": "count"
1040 + }
1041 + ],
1042 + "query": "data_office365_Workload:MicrosoftForms AND rule_level:$rule_level",
1043 + "refId": "A",
1044 + "timeField": "timestamp"
1045 + }
1046 + ],
1047 + "thresholds": "0,10",
1048 + "title": "MS-FORMS - ALL EVENTS BY SRC COUNTRY",
1049 + "type": "grafana-worldmap-panel",
1050 + "unitPlural": "",
1051 + "unitSingle": "",
1052 + "valueName": "total"
1053 + },
1054 + {
1055 + "datasource": {
1056 + "type": "elasticsearch",
1057 + "uid": "replace_datasource_uid"
1058 + },
1059 + "fieldConfig": {
1060 + "defaults": {
1061 + "color": {
1062 + "mode": "thresholds"
1063 + },
1064 + "custom": {
1065 + "align": "auto",
1066 + "cellOptions": {
1067 + "type": "auto"
1068 + },
1069 + "inspect": false
1070 + },
1071 + "mappings": [],
1072 + "thresholds": {
1073 + "mode": "absolute",
1074 + "steps": [
1075 + {
1076 + "color": "orange",
1077 + "value": null
1078 + }
1079 + ]
1080 + }
1081 + },
1082 + "overrides": [
1083 + {
1084 + "matcher": {
1085 + "id": "byName",
1086 + "options": "Count"
1087 + },
1088 + "properties": [
1089 + {
1090 + "id": "displayName",
1091 + "value": "EVENTS"
1092 + },
1093 + {
1094 + "id": "unit",
1095 + "value": "short"
1096 + },
1097 + {
1098 + "id": "decimals",
1099 + "value": -1
1100 + },
1101 + {
1102 + "id": "custom.align"
1103 + }
1104 + ]
1105 + },
1106 + {
1107 + "matcher": {
1108 + "id": "byName",
1109 + "options": "AD ACCOUNT"
1110 + },
1111 + "properties": [
1112 + {
1113 + "id": "custom.width",
1114 + "value": 377
1115 + }
1116 + ]
1117 + }
1118 + ]
1119 + },
1120 + "gridPos": {
1121 + "h": 12,
1122 + "w": 8,
1123 + "x": 16,
1124 + "y": 20
1125 + },
1126 + "id": 58,
1127 + "options": {
1128 + "cellHeight": "sm",
1129 + "footer": {
1130 + "countRows": false,
1131 + "fields": "",
1132 + "reducer": ["sum"],
1133 + "show": false
1134 + },
1135 + "showHeader": true,
1136 + "sortBy": []
1137 + },
1138 + "pluginVersion": "10.0.3",
1139 + "targets": [
1140 + {
1141 + "bucketAggs": [
1142 + {
1143 + "fake": true,
1144 + "field": "data_office365_UserId",
1145 + "id": "4",
1146 + "settings": {
1147 + "min_doc_count": 1,
1148 + "order": "desc",
1149 + "orderBy": "_count",
1150 + "size": "0"
1151 + },
1152 + "type": "terms"
1153 + },
1154 + {
1155 + "field": "data_office365_ClientIP_country_code",
1156 + "id": "5",
1157 + "settings": {
1158 + "min_doc_count": "1",
1159 + "order": "desc",
1160 + "orderBy": "_term",
1161 + "size": "10"
1162 + },
1163 + "type": "terms"
1164 + }
1165 + ],
1166 + "datasource": {
1167 + "type": "elasticsearch",
1168 + "uid": "replace_datasource_uid"
1169 + },
1170 + "metrics": [
1171 + {
1172 + "field": "select field",
1173 + "id": "1",
1174 + "type": "count"
1175 + }
1176 + ],
1177 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
1178 + "refId": "A",
1179 + "timeField": "timestamp"
1180 + }
1181 + ],
1182 + "title": "MS-FORMS EVENTS BY ACCOUNT",
1183 + "transformations": [
1184 + {
1185 + "id": "merge",
1186 + "options": {
1187 + "reducers": []
1188 + }
1189 + },
1190 + {
1191 + "id": "organize",
1192 + "options": {
1193 + "excludeByName": {},
1194 + "indexByName": {},
1195 + "renameByName": {
1196 + "Count": "EVENTS",
1197 + "data_office365_ClientIP_country_code": "COUNTRY",
1198 + "data_office365_LogonError": "ERROR",
1199 + "data_office365_Operation": "WORKLOAD",
1200 + "data_office365_UserId": "AD ACCOUNT"
1201 + }
1202 + }
1203 + }
1204 + ],
1205 + "type": "table"
1206 + },
1207 + {
1208 + "datasource": {
1209 + "type": "elasticsearch",
1210 + "uid": "replace_datasource_uid"
1211 + },
1212 + "fieldConfig": {
1213 + "defaults": {
1214 + "color": {
1215 + "mode": "thresholds"
1216 + },
1217 + "custom": {
1218 + "align": "auto",
1219 + "cellOptions": {
1220 + "type": "auto"
1221 + },
1222 + "filterable": true,
1223 + "inspect": false
1224 + },
1225 + "mappings": [],
1226 + "thresholds": {
1227 + "mode": "absolute",
1228 + "steps": [
1229 + {
1230 + "color": "green",
1231 + "value": null
1232 + },
1233 + {
1234 + "color": "red",
1235 + "value": 80
1236 + }
1237 + ]
1238 + }
1239 + },
1240 + "overrides": [
1241 + {
1242 + "matcher": {
1243 + "id": "byName",
1244 + "options": "rule_level"
1245 + },
1246 + "properties": [
1247 + {
1248 + "id": "displayName",
1249 + "value": "RULE LEVEL"
1250 + },
1251 + {
1252 + "id": "unit",
1253 + "value": "short"
1254 + },
1255 + {
1256 + "id": "decimals",
1257 + "value": -1
1258 + },
1259 + {
1260 + "id": "custom.cellOptions",
1261 + "value": {
1262 + "mode": "gradient",
1263 + "type": "color-background"
1264 + }
1265 + },
1266 + {
1267 + "id": "custom.align"
1268 + },
1269 + {
1270 + "id": "thresholds",
1271 + "value": {
1272 + "mode": "absolute",
1273 + "steps": [
1274 + {
1275 + "color": "#37872D",
1276 + "value": null
1277 + },
1278 + {
1279 + "color": "rgba(237, 129, 40, 0.89)",
1280 + "value": 7
1281 + },
1282 + {
1283 + "color": "rgba(245, 54, 54, 0.9)",
1284 + "value": 12
1285 + }
1286 + ]
1287 + }
1288 + }
1289 + ]
1290 + },
1291 + {
1292 + "matcher": {
1293 + "id": "byName",
1294 + "options": "Date/Time"
1295 + },
1296 + "properties": [
1297 + {
1298 + "id": "custom.width",
1299 + "value": 242
1300 + }
1301 + ]
1302 + },
1303 + {
1304 + "matcher": {
1305 + "id": "byName",
1306 + "options": "MITRE TACTIC"
1307 + },
1308 + "properties": [
1309 + {
1310 + "id": "custom.width",
1311 + "value": 332
1312 + }
1313 + ]
1314 + },
1315 + {
1316 + "matcher": {
1317 + "id": "byName",
1318 + "options": "IP ADDRESS"
1319 + },
1320 + "properties": [
1321 + {
1322 + "id": "custom.width",
1323 + "value": 163
1324 + }
1325 + ]
1326 + },
1327 + {
1328 + "matcher": {
1329 + "id": "byName",
1330 + "options": "MITRE TECHNIQUE"
1331 + },
1332 + "properties": [
1333 + {
1334 + "id": "custom.width",
1335 + "value": 312
1336 + }
1337 + ]
1338 + },
1339 + {
1340 + "matcher": {
1341 + "id": "byName",
1342 + "options": "EVENT ID"
1343 + },
1344 + "properties": [
1345 + {
1346 + "id": "links",
1347 + "value": [
1348 + {
1349 + "targetBlank": true,
1350 + "title": "VIEW EVENT DETAILS",
1351 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1352 + }
1353 + ]
1354 + },
1355 + {
1356 + "id": "custom.width",
1357 + "value": 265
1358 + }
1359 + ]
1360 + },
1361 + {
1362 + "matcher": {
1363 + "id": "byName",
1364 + "options": "RESULT"
1365 + },
1366 + "properties": [
1367 + {
1368 + "id": "custom.width",
1369 + "value": 118
1370 + },
1371 + {
1372 + "id": "mappings",
1373 + "value": [
1374 + {
1375 + "options": {
1376 + "Failed": {
1377 + "color": "orange",
1378 + "index": 1
1379 + },
1380 + "Success": {
1381 + "color": "green",
1382 + "index": 0
1383 + }
1384 + },
1385 + "type": "value"
1386 + }
1387 + ]
1388 + },
1389 + {
1390 + "id": "custom.cellOptions",
1391 + "value": {
1392 + "type": "color-text"
1393 + }
1394 + }
1395 + ]
1396 + },
1397 + {
1398 + "matcher": {
1399 + "id": "byName",
1400 + "options": "SRC IP"
1401 + },
1402 + "properties": [
1403 + {
1404 + "id": "custom.width",
1405 + "value": 265
1406 + }
1407 + ]
1408 + },
1409 + {
1410 + "matcher": {
1411 + "id": "byName",
1412 + "options": "ACCOUNT"
1413 + },
1414 + "properties": [
1415 + {
1416 + "id": "custom.width",
1417 + "value": 227
1418 + }
1419 + ]
1420 + },
1421 + {
1422 + "matcher": {
1423 + "id": "byName",
1424 + "options": "EVENT TIME"
1425 + },
1426 + "properties": [
1427 + {
1428 + "id": "custom.width",
1429 + "value": 195
1430 + }
1431 + ]
1432 + },
1433 + {
1434 + "matcher": {
1435 + "id": "byName",
1436 + "options": "CLIENT IP"
1437 + },
1438 + "properties": [
1439 + {
1440 + "id": "custom.width",
1441 + "value": 191
1442 + }
1443 + ]
1444 + },
1445 + {
1446 + "matcher": {
1447 + "id": "byName",
1448 + "options": "DESCRIPTION"
1449 + },
1450 + "properties": [
1451 + {
1452 + "id": "custom.width",
1453 + "value": 367
1454 + }
1455 + ]
1456 + },
1457 + {
1458 + "matcher": {
1459 + "id": "byName",
1460 + "options": "FILE"
1461 + },
1462 + "properties": [
1463 + {
1464 + "id": "custom.width",
1465 + "value": 855
1466 + }
1467 + ]
1468 + },
1469 + {
1470 + "matcher": {
1471 + "id": "byName",
1472 + "options": "BROWSER"
1473 + },
1474 + "properties": [
1475 + {
1476 + "id": "custom.width",
1477 + "value": 205
1478 + }
1479 + ]
1480 + },
1481 + {
1482 + "matcher": {
1483 + "id": "byName",
1484 + "options": "RULE LEVEL"
1485 + },
1486 + "properties": [
1487 + {
1488 + "id": "custom.width",
1489 + "value": 197
1490 + }
1491 + ]
1492 + }
1493 + ]
1494 + },
1495 + "gridPos": {
1496 + "h": 16,
1497 + "w": 24,
1498 + "x": 0,
1499 + "y": 32
1500 + },
1501 + "id": 27,
1502 + "options": {
1503 + "cellHeight": "sm",
1504 + "footer": {
1505 + "countRows": false,
1506 + "enablePagination": true,
1507 + "fields": "",
1508 + "reducer": ["sum"],
1509 + "show": false
1510 + },
1511 + "showHeader": true,
1512 + "sortBy": []
1513 + },
1514 + "pluginVersion": "10.0.3",
1515 + "targets": [
1516 + {
1517 + "bucketAggs": [],
1518 + "datasource": {
1519 + "type": "elasticsearch",
1520 + "uid": "replace_datasource_uid"
1521 + },
1522 + "metrics": [
1523 + {
1524 + "id": "1",
1525 + "settings": {
1526 + "size": "250"
1527 + },
1528 + "type": "raw_data"
1529 + }
1530 + ],
1531 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:MicrosoftForms",
1532 + "refId": "A",
1533 + "timeField": "timestamp"
1534 + }
1535 + ],
1536 + "title": "EVENTS",
1537 + "transformations": [
1538 + {
1539 + "id": "organize",
1540 + "options": {
1541 + "excludeByName": {
1542 + "@metadata_beat": true,
1543 + "@metadata_type": true,
1544 + "@metadata_version": true,
1545 + "IMPHASH": true,
1546 + "MD5": true,
1547 + "SHA1": true,
1548 + "SHA256": true,
1549 + "_id": false,
1550 + "_index": true,
1551 + "_type": true,
1552 + "agent_ephemeral_id": true,
1553 + "agent_hostname": true,
1554 + "agent_id": true,
1555 + "agent_ip_city_name": true,
1556 + "agent_ip_country_code": true,
1557 + "agent_ip_geolocation": true,
1558 + "agent_name": true,
1559 + "agent_type": true,
1560 + "agent_version": true,
1561 + "beats_type": true,
1562 + "cluster_name": true,
1563 + "cluster_node": true,
1564 + "collector_node_id": true,
1565 + "data_alert_action": true,
1566 + "data_alert_category": true,
1567 + "data_alert_gid": true,
1568 + "data_alert_rev": true,
1569 + "data_alert_severity": true,
1570 + "data_alert_signature": true,
1571 + "data_alert_signature_id": true,
1572 + "data_app_proto": true,
1573 + "data_audit_auid": true,
1574 + "data_audit_command": true,
1575 + "data_audit_euid": true,
1576 + "data_audit_exe": true,
1577 + "data_audit_gid": true,
1578 + "data_audit_id": true,
1579 + "data_audit_pid": true,
1580 + "data_audit_res": true,
1581 + "data_audit_session": true,
1582 + "data_audit_type": true,
1583 + "data_audit_uid": true,
1584 + "data_dest_ip": true,
1585 + "data_dest_port": true,
1586 + "data_dstuser": true,
1587 + "data_event_type": true,
1588 + "data_extra_data": true,
1589 + "data_file": true,
1590 + "data_flow_bytes_toclient": true,
1591 + "data_flow_bytes_toserver": true,
1592 + "data_flow_id": true,
1593 + "data_flow_pkts_toclient": true,
1594 + "data_flow_pkts_toserver": true,
1595 + "data_flow_start": true,
1596 + "data_http_http_content_type": true,
1597 + "data_http_http_port": true,
1598 + "data_http_length": true,
1599 + "data_http_status": true,
1600 + "data_http_url": true,
1601 + "data_id": true,
1602 + "data_in_iface": true,
1603 + "data_integration": true,
1604 + "data_metadata_flowbits": true,
1605 + "data_metadata_flowints_http_anomaly_count": true,
1606 + "data_metadata_flowints_tcp_retransmission_count": true,
1607 + "data_office365_AADGroupId": true,
1608 + "data_office365_ActivityParameters": true,
1609 + "data_office365_Actor": true,
1610 + "data_office365_ActorContextId": true,
1611 + "data_office365_ActorIpAddress": false,
1612 + "data_office365_ActorIpAddress_city_name": true,
1613 + "data_office365_ActorIpAddress_country_code": true,
1614 + "data_office365_ActorIpAddress_geolocation": true,
1615 + "data_office365_AppAccessContext_AADSessionId": true,
1616 + "data_office365_AppAccessContext_APIId": true,
1617 + "data_office365_AppAccessContext_ClientAppId": true,
1618 + "data_office365_AppAccessContext_ClientAppName": true,
1619 + "data_office365_AppAccessContext_CorrelationId": true,
1620 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1621 + "data_office365_AppAccessContext_UniqueTokenId": true,
1622 + "data_office365_AppId": true,
1623 + "data_office365_ApplicationDisplayName": true,
1624 + "data_office365_ApplicationId": true,
1625 + "data_office365_ArtifactsShared": true,
1626 + "data_office365_AssertingApplicationId": true,
1627 + "data_office365_Attendees": true,
1628 + "data_office365_AuthenticationType": true,
1629 + "data_office365_AzureActiveDirectoryEventType": true,
1630 + "data_office365_BrowserVersion": true,
1631 + "data_office365_BrowserVersion_city_name": true,
1632 + "data_office365_BrowserVersion_country_code": true,
1633 + "data_office365_BrowserVersion_geolocation": true,
1634 + "data_office365_ChannelGuid": true,
1635 + "data_office365_ChannelName": true,
1636 + "data_office365_ChatName": true,
1637 + "data_office365_ChatThreadId": true,
1638 + "data_office365_ClientAppId": true,
1639 + "data_office365_ClientIP": false,
1640 + "data_office365_ClientIPAddress": true,
1641 + "data_office365_ClientIPAddress_city_name": true,
1642 + "data_office365_ClientIPAddress_country_code": true,
1643 + "data_office365_ClientIPAddress_geolocation": true,
1644 + "data_office365_ClientIP_city_name": true,
1645 + "data_office365_ClientIP_country_code": true,
1646 + "data_office365_ClientIP_geolocation": true,
1647 + "data_office365_ClientIP_reserved_ip": true,
1648 + "data_office365_ClientInfoString": true,
1649 + "data_office365_ClientProcessName": true,
1650 + "data_office365_ClientRequestId": true,
1651 + "data_office365_ClientVersion": true,
1652 + "data_office365_CommunicationSubType": true,
1653 + "data_office365_CommunicationType": true,
1654 + "data_office365_CorrelationId": true,
1655 + "data_office365_CreationTime": false,
1656 + "data_office365_CrossMailboxOperation": true,
1657 + "data_office365_CustomUniqueId": true,
1658 + "data_office365_CustomizedDoclib": true,
1659 + "data_office365_DestFolder_Id": true,
1660 + "data_office365_DestFolder_Path": true,
1661 + "data_office365_DestinationFileExtension": true,
1662 + "data_office365_DestinationFileName": true,
1663 + "data_office365_DestinationRelativeUrl": true,
1664 + "data_office365_DeviceDisplayName": true,
1665 + "data_office365_DeviceDisplayName_city_name": true,
1666 + "data_office365_DeviceDisplayName_country_code": true,
1667 + "data_office365_DeviceDisplayName_geolocation": true,
1668 + "data_office365_DeviceId": true,
1669 + "data_office365_DeviceInformation": true,
1670 + "data_office365_DeviceProperties": true,
1671 + "data_office365_DoNotDistributeEvent": true,
1672 + "data_office365_EndTime": true,
1673 + "data_office365_ErrorNumber": true,
1674 + "data_office365_EventData": true,
1675 + "data_office365_EventSource": true,
1676 + "data_office365_ExchangeId": true,
1677 + "data_office365_ExtendedProperties": true,
1678 + "data_office365_ExternalAccess": true,
1679 + "data_office365_ExtraProperties": true,
1680 + "data_office365_FileSizeBytes": true,
1681 + "data_office365_FileSyncBytesCommitted": true,
1682 + "data_office365_Folder_Id": true,
1683 + "data_office365_Folder_Path": true,
1684 + "data_office365_FormId": true,
1685 + "data_office365_FormsUserType": true,
1686 + "data_office365_FromApp": true,
1687 + "data_office365_HighPriorityMediaProcessing": true,
1688 + "data_office365_HostedContents": true,
1689 + "data_office365_ICalUid": true,
1690 + "data_office365_Id": true,
1691 + "data_office365_ImplicitShare": true,
1692 + "data_office365_InterSystemsId": true,
1693 + "data_office365_InternalLogonType": true,
1694 + "data_office365_IntraSystemId": true,
1695 + "data_office365_IsManagedDevice": true,
1696 + "data_office365_ItemCount": true,
1697 + "data_office365_ItemName": true,
1698 + "data_office365_ItemType": true,
1699 + "data_office365_Item_Id": true,
1700 + "data_office365_Item_InternetMessageId": true,
1701 + "data_office365_Item_IsRecord": true,
1702 + "data_office365_Item_ParentFolder_Id": true,
1703 + "data_office365_Item_SizeInBytes": true,
1704 + "data_office365_JoinTime": true,
1705 + "data_office365_LeaveTime": true,
1706 + "data_office365_ListBaseTemplateType": true,
1707 + "data_office365_ListBaseType": true,
1708 + "data_office365_ListId": true,
1709 + "data_office365_ListItemUniqueId": true,
1710 + "data_office365_ListServerTemplate": true,
1711 + "data_office365_ListTitle": true,
1712 + "data_office365_LogonError": true,
1713 + "data_office365_LogonType": true,
1714 + "data_office365_LogonUserSid": true,
1715 + "data_office365_MachineId": true,
1716 + "data_office365_MailboxGuid": true,
1717 + "data_office365_MailboxOwnerSid": true,
1718 + "data_office365_MailboxOwnerUPN": true,
1719 + "data_office365_MeetingDetailId": true,
1720 + "data_office365_MeetingURL": true,
1721 + "data_office365_Members": true,
1722 + "data_office365_MessageId": true,
1723 + "data_office365_MessageSizeInBytes": true,
1724 + "data_office365_MessageURLs": true,
1725 + "data_office365_MessageVersion": true,
1726 + "data_office365_Modalities": true,
1727 + "data_office365_ModifiedProperties": true,
1728 + "data_office365_Name": true,
1729 + "data_office365_NewValue": true,
1730 + "data_office365_ObjectId": true,
1731 + "data_office365_Operation": true,
1732 + "data_office365_OperationScope": true,
1733 + "data_office365_OrganizationId": true,
1734 + "data_office365_OrganizationName": true,
1735 + "data_office365_Organizer_OrganizationId": true,
1736 + "data_office365_Organizer_RecipientType": true,
1737 + "data_office365_Organizer_Role": true,
1738 + "data_office365_Organizer_UserObjectId": true,
1739 + "data_office365_OriginatingServer": true,
1740 + "data_office365_Parameters": true,
1741 + "data_office365_ParentMessageId": true,
1742 + "data_office365_Platform": true,
1743 + "data_office365_ProviderTypes": true,
1744 + "data_office365_RecordType": true,
1745 + "data_office365_ResultStatus": false,
1746 + "data_office365_SearchQueryText": true,
1747 + "data_office365_SessionId": true,
1748 + "data_office365_Site": true,
1749 + "data_office365_SiteUrl": true,
1750 + "data_office365_SkipForServiceWorker": true,
1751 + "data_office365_Source": true,
1752 + "data_office365_SourceFileExtension": true,
1753 + "data_office365_SourceRelativeUrl": true,
1754 + "data_office365_StartTime": true,
1755 + "data_office365_Subscription": true,
1756 + "data_office365_SubscriptionId": true,
1757 + "data_office365_Target": true,
1758 + "data_office365_TargetContextId": true,
1759 + "data_office365_TargetUserOrGroupName": true,
1760 + "data_office365_TargetUserOrGroupType": true,
1761 + "data_office365_TeamGuid": true,
1762 + "data_office365_TeamName": true,
1763 + "data_office365_UniqueSharingId": true,
1764 + "data_office365_UserAgent": true,
1765 + "data_office365_UserId": false,
1766 + "data_office365_UserKey": true,
1767 + "data_office365_UserType": true,
1768 + "data_office365_Version": true,
1769 + "data_office365_WebId": true,
1770 + "data_office365_Workload": true,
1771 + "data_osquery_action": true,
1772 + "data_osquery_calendarTime": true,
1773 + "data_osquery_columns_address": true,
1774 + "data_osquery_columns_address_city_name": true,
1775 + "data_osquery_columns_address_country_code": true,
1776 + "data_osquery_columns_address_geolocation": true,
1777 + "data_osquery_columns_cmdline": true,
1778 + "data_osquery_columns_cwd": true,
1779 + "data_osquery_columns_description": true,
1780 + "data_osquery_columns_directory": true,
1781 + "data_osquery_columns_disk_bytes_read": true,
1782 + "data_osquery_columns_disk_bytes_written": true,
1783 + "data_osquery_columns_egid": true,
1784 + "data_osquery_columns_euid": true,
1785 + "data_osquery_columns_family": true,
1786 + "data_osquery_columns_fd": true,
1787 + "data_osquery_columns_gid": true,
1788 + "data_osquery_columns_gid_signed": true,
1789 + "data_osquery_columns_host": true,
1790 + "data_osquery_columns_interface": true,
1791 + "data_osquery_columns_local_address": true,
1792 + "data_osquery_columns_local_address_city_name": true,
1793 + "data_osquery_columns_local_address_country_code": true,
1794 + "data_osquery_columns_local_address_geolocation": true,
1795 + "data_osquery_columns_local_port": true,
1796 + "data_osquery_columns_mac": true,
1797 + "data_osquery_columns_name": true,
1798 + "data_osquery_columns_net_namespace": true,
1799 + "data_osquery_columns_nice": true,
1800 + "data_osquery_columns_on_disk": true,
1801 + "data_osquery_columns_parent": true,
1802 + "data_osquery_columns_path": true,
1803 + "data_osquery_columns_pgroup": true,
1804 + "data_osquery_columns_pid": true,
1805 + "data_osquery_columns_port": true,
1806 + "data_osquery_columns_protocol": true,
1807 + "data_osquery_columns_remote_address": true,
1808 + "data_osquery_columns_remote_address_city_name": true,
1809 + "data_osquery_columns_remote_address_country_code": true,
1810 + "data_osquery_columns_remote_address_geolocation": true,
1811 + "data_osquery_columns_remote_port": true,
1812 + "data_osquery_columns_resident_size": true,
1813 + "data_osquery_columns_root": true,
1814 + "data_osquery_columns_sgid": true,
1815 + "data_osquery_columns_shell": true,
1816 + "data_osquery_columns_socket": true,
1817 + "data_osquery_columns_start_time": true,
1818 + "data_osquery_columns_state": true,
1819 + "data_osquery_columns_suid": true,
1820 + "data_osquery_columns_system_time": true,
1821 + "data_osquery_columns_threads": true,
1822 + "data_osquery_columns_time_utc": true,
1823 + "data_osquery_columns_total_size": true,
1824 + "data_osquery_columns_tty": true,
1825 + "data_osquery_columns_type": true,
1826 + "data_osquery_columns_uid": true,
1827 + "data_osquery_columns_uid_signed": true,
1828 + "data_osquery_columns_user": true,
1829 + "data_osquery_columns_user_time": true,
1830 + "data_osquery_columns_username": true,
1831 + "data_osquery_columns_wired_size": true,
1832 + "data_osquery_counter": true,
1833 + "data_osquery_decorations_host_uuid": true,
1834 + "data_osquery_decorations_hostname": true,
1835 + "data_osquery_epoch": true,
1836 + "data_osquery_hostIdentifier": true,
1837 + "data_osquery_name": true,
1838 + "data_osquery_numerics": true,
1839 + "data_osquery_unixTime": true,
1840 + "data_proto": true,
1841 + "data_sca_check_command": true,
1842 + "data_sca_check_compliance_cis": true,
1843 + "data_sca_check_compliance_cis_csc": true,
1844 + "data_sca_check_compliance_gdpr_IV": true,
1845 + "data_sca_check_compliance_gpg_13": true,
1846 + "data_sca_check_compliance_hipaa": true,
1847 + "data_sca_check_compliance_nist_800_53": true,
1848 + "data_sca_check_compliance_pci_dss": true,
1849 + "data_sca_check_compliance_tsc": true,
1850 + "data_sca_check_description": true,
1851 + "data_sca_check_id": true,
1852 + "data_sca_check_previous_result": true,
1853 + "data_sca_check_rationale": true,
1854 + "data_sca_check_remediation": true,
1855 + "data_sca_check_result": true,
1856 + "data_sca_check_title": true,
1857 + "data_sca_description": true,
1858 + "data_sca_failed": true,
1859 + "data_sca_file": true,
1860 + "data_sca_invalid": true,
1861 + "data_sca_passed": true,
1862 + "data_sca_policy": true,
1863 + "data_sca_policy_id": true,
1864 + "data_sca_scan_id": true,
1865 + "data_sca_score": true,
1866 + "data_sca_total_checks": true,
1867 + "data_sca_type": true,
1868 + "data_script": true,
1869 + "data_src_ip": true,
1870 + "data_src_ip_city_name": true,
1871 + "data_src_ip_country_code": true,
1872 + "data_src_ip_geolocation": true,
1873 + "data_src_port": true,
1874 + "data_srcip": true,
1875 + "data_srcip_city_name": true,
1876 + "data_srcip_country_code": true,
1877 + "data_srcip_geolocation": true,
1878 + "data_srcuser": true,
1879 + "data_timestamp": true,
1880 + "data_title": true,
1881 + "data_tls_session_resumed": true,
1882 + "data_tls_version": true,
1883 + "data_tx_id": true,
1884 + "data_type": true,
1885 + "data_win_eventXML_binaryData": true,
1886 + "data_win_eventXML_binaryDataSize": true,
1887 + "data_win_eventXML_param1": true,
1888 + "data_win_eventdata_authenticationPackageName": true,
1889 + "data_win_eventdata_callTrace": true,
1890 + "data_win_eventdata_commandLine": true,
1891 + "data_win_eventdata_company": true,
1892 + "data_win_eventdata_creationUtcTime": true,
1893 + "data_win_eventdata_currentDirectory": true,
1894 + "data_win_eventdata_description": true,
1895 + "data_win_eventdata_destinationHostname": true,
1896 + "data_win_eventdata_destinationIp": true,
1897 + "data_win_eventdata_destinationIp_city_name": true,
1898 + "data_win_eventdata_destinationIp_country_code": true,
1899 + "data_win_eventdata_destinationIp_geolocation": true,
1900 + "data_win_eventdata_destinationIsIpv6": true,
1901 + "data_win_eventdata_destinationPort": true,
1902 + "data_win_eventdata_destinationPortName": true,
1903 + "data_win_eventdata_details": true,
1904 + "data_win_eventdata_elevatedToken": true,
1905 + "data_win_eventdata_eventType": true,
1906 + "data_win_eventdata_fileVersion": true,
1907 + "data_win_eventdata_fileVersion_city_name": true,
1908 + "data_win_eventdata_fileVersion_country_code": true,
1909 + "data_win_eventdata_fileVersion_geolocation": true,
1910 + "data_win_eventdata_grantedAccess": true,
1911 + "data_win_eventdata_hashes": true,
1912 + "data_win_eventdata_image": true,
1913 + "data_win_eventdata_imageLoaded": true,
1914 + "data_win_eventdata_impersonationLevel": true,
1915 + "data_win_eventdata_initiated": true,
1916 + "data_win_eventdata_integrityLevel": true,
1917 + "data_win_eventdata_ipAddress": true,
1918 + "data_win_eventdata_ipPort": true,
1919 + "data_win_eventdata_keyLength": true,
1920 + "data_win_eventdata_logonGuid": true,
1921 + "data_win_eventdata_logonId": true,
1922 + "data_win_eventdata_logonProcessName": true,
1923 + "data_win_eventdata_logonType": true,
1924 + "data_win_eventdata_originalFileName": true,
1925 + "data_win_eventdata_param1": true,
1926 + "data_win_eventdata_param2": true,
1927 + "data_win_eventdata_param3": true,
1928 + "data_win_eventdata_param4": true,
1929 + "data_win_eventdata_parentCommandLine": true,
1930 + "data_win_eventdata_parentImage": true,
1931 + "data_win_eventdata_parentProcessGuid": true,
1932 + "data_win_eventdata_parentProcessId": true,
1933 + "data_win_eventdata_processGuid": true,
1934 + "data_win_eventdata_processId": true,
1935 + "data_win_eventdata_processName": true,
1936 + "data_win_eventdata_product": true,
1937 + "data_win_eventdata_protocol": true,
1938 + "data_win_eventdata_queryName": true,
1939 + "data_win_eventdata_queryResults": true,
1940 + "data_win_eventdata_queryStatus": true,
1941 + "data_win_eventdata_ruleName": true,
1942 + "data_win_eventdata_serviceName": true,
1943 + "data_win_eventdata_serviceSid": true,
1944 + "data_win_eventdata_signature": true,
1945 + "data_win_eventdata_signatureStatus": true,
1946 + "data_win_eventdata_signed": true,
1947 + "data_win_eventdata_sourceHostname": true,
1948 + "data_win_eventdata_sourceImage": true,
1949 + "data_win_eventdata_sourceIp": true,
1950 + "data_win_eventdata_sourceIp_city_name": true,
1951 + "data_win_eventdata_sourceIp_country_code": true,
1952 + "data_win_eventdata_sourceIp_geolocation": true,
1953 + "data_win_eventdata_sourceIsIpv6": true,
1954 + "data_win_eventdata_sourcePort": true,
1955 + "data_win_eventdata_sourceProcessGUID": true,
1956 + "data_win_eventdata_sourceProcessId": true,
1957 + "data_win_eventdata_sourceThreadId": true,
1958 + "data_win_eventdata_status": true,
1959 + "data_win_eventdata_subjectDomainName": true,
1960 + "data_win_eventdata_subjectLogonId": true,
1961 + "data_win_eventdata_subjectUserName": true,
1962 + "data_win_eventdata_subjectUserSid": true,
1963 + "data_win_eventdata_targetDomainName": true,
1964 + "data_win_eventdata_targetFilename": true,
1965 + "data_win_eventdata_targetImage": true,
1966 + "data_win_eventdata_targetLinkedLogonId": true,
1967 + "data_win_eventdata_targetLogonId": true,
1968 + "data_win_eventdata_targetObject": true,
1969 + "data_win_eventdata_targetProcessGUID": true,
1970 + "data_win_eventdata_targetProcessId": true,
1971 + "data_win_eventdata_targetUserName": true,
1972 + "data_win_eventdata_targetUserSid": true,
1973 + "data_win_eventdata_terminalSessionId": true,
1974 + "data_win_eventdata_ticketEncryptionType": true,
1975 + "data_win_eventdata_ticketOptions": true,
1976 + "data_win_eventdata_user": true,
1977 + "data_win_eventdata_utcTime": true,
1978 + "data_win_eventdata_virtualAccount": true,
1979 + "data_win_system_channel": true,
1980 + "data_win_system_computer": true,
1981 + "data_win_system_eventID": true,
1982 + "data_win_system_eventRecordID": true,
1983 + "data_win_system_eventSourceName": true,
1984 + "data_win_system_keywords": true,
1985 + "data_win_system_level": true,
1986 + "data_win_system_message": true,
1987 + "data_win_system_opcode": true,
1988 + "data_win_system_processID": true,
1989 + "data_win_system_providerGuid": true,
1990 + "data_win_system_providerName": true,
1991 + "data_win_system_severityValue": true,
1992 + "data_win_system_systemTime": true,
1993 + "data_win_system_task": true,
1994 + "data_win_system_threadID": true,
1995 + "data_win_system_version": true,
1996 + "decoder_name": true,
1997 + "decoder_parent": true,
1998 + "dns_query": true,
1999 + "dns_query_threat_indicated": true,
2000 + "dst_ip": true,
2001 + "dst_ip_city_name": true,
2002 + "dst_ip_country_code": true,
2003 + "dst_ip_geolocation": true,
2004 + "dst_ip_threat_indicated": true,
2005 + "dst_port": true,
2006 + "ecs_version": true,
2007 + "error": true,
2008 + "event_hash": true,
2009 + "file_path": true,
2010 + "firewall_rule_name": true,
2011 + "full_log": false,
2012 + "gl2_accounted_message_size": true,
2013 + "gl2_message_id": true,
2014 + "gl2_processing_error": true,
2015 + "gl2_remote_ip": true,
2016 + "gl2_remote_port": true,
2017 + "gl2_source_collector": true,
2018 + "gl2_source_input": true,
2019 + "gl2_source_node": true,
2020 + "hash_md5": true,
2021 + "hash_sha1": true,
2022 + "hash_sha256": true,
2023 + "highlight": true,
2024 + "host_architecture": true,
2025 + "host_containerized": true,
2026 + "host_hostname": true,
2027 + "host_id": true,
2028 + "host_ip": true,
2029 + "host_mac": true,
2030 + "host_name": true,
2031 + "host_os_codename": true,
2032 + "host_os_kernel": true,
2033 + "host_os_name": true,
2034 + "host_os_platform": true,
2035 + "host_os_version": true,
2036 + "hostname": true,
2037 + "id": true,
2038 + "input_type": true,
2039 + "level": true,
2040 + "location": true,
2041 + "log_file_path": true,
2042 + "log_offset": true,
2043 + "manager_name": true,
2044 + "message": true,
2045 + "module": true,
2046 + "msg_timestamp": true,
2047 + "parent_process_cmd_line": true,
2048 + "parent_process_id": true,
2049 + "parent_process_image": true,
2050 + "pid": true,
2051 + "predecoder_hostname": true,
2052 + "predecoder_program_name": true,
2053 + "predecoder_timestamp": true,
2054 + "previous_log": true,
2055 + "previous_output": true,
2056 + "process_cmd_line": true,
2057 + "process_id": true,
2058 + "process_image": true,
2059 + "process_name": true,
2060 + "protocol": true,
2061 + "rule_cis": true,
2062 + "rule_cis_csc": true,
2063 + "rule_firedtimes": true,
2064 + "rule_gdpr": true,
2065 + "rule_gdpr_IV": true,
2066 + "rule_gpg13": true,
2067 + "rule_gpg_13": true,
2068 + "rule_group1": true,
2069 + "rule_group2": true,
2070 + "rule_group3": true,
2071 + "rule_groups": true,
2072 + "rule_hipaa": true,
2073 + "rule_id": true,
2074 + "rule_info": true,
2075 + "rule_mail": true,
2076 + "rule_mitre_id": true,
2077 + "rule_mitre_tactic": false,
2078 + "rule_nist_800_53": true,
2079 + "rule_pci_dss": true,
2080 + "rule_tsc": true,
2081 + "scanid": true,
2082 + "service": true,
2083 + "software_package": true,
2084 + "software_vendor": true,
2085 + "sort": true,
2086 + "source": true,
2087 + "source_reserved_ip": true,
2088 + "src_ip": true,
2089 + "src_ip_city_name": true,
2090 + "src_ip_country_code": true,
2091 + "src_ip_geolocation": true,
2092 + "src_port": true,
2093 + "streams": true,
2094 + "syscheck_attrs_after": true,
2095 + "syscheck_audit_effective_user_id": true,
2096 + "syscheck_audit_effective_user_name": true,
2097 + "syscheck_audit_group_id": true,
2098 + "syscheck_audit_group_name": true,
2099 + "syscheck_audit_login_user_id": true,
2100 + "syscheck_audit_login_user_name": true,
2101 + "syscheck_audit_process_cwd": true,
2102 + "syscheck_audit_process_id": true,
2103 + "syscheck_audit_process_name": true,
2104 + "syscheck_audit_process_parent_cwd": true,
2105 + "syscheck_audit_process_parent_name": true,
2106 + "syscheck_audit_process_ppid": true,
2107 + "syscheck_audit_user_id": true,
2108 + "syscheck_audit_user_name": true,
2109 + "syscheck_changed_attributes": true,
2110 + "syscheck_event": true,
2111 + "syscheck_gid_after": true,
2112 + "syscheck_gname_after": true,
2113 + "syscheck_hard_links": true,
2114 + "syscheck_inode_after": true,
2115 + "syscheck_inode_before": true,
2116 + "syscheck_md5_after": true,
2117 + "syscheck_md5_before": true,
2118 + "syscheck_mode": true,
2119 + "syscheck_mtime_after": true,
2120 + "syscheck_mtime_before": true,
2121 + "syscheck_path": true,
2122 + "syscheck_perm_after": true,
2123 + "syscheck_perm_before": true,
2124 + "syscheck_sha1_after": true,
2125 + "syscheck_sha1_before": true,
2126 + "syscheck_sha256_after": true,
2127 + "syscheck_sha256_before": true,
2128 + "syscheck_size_after": true,
2129 + "syscheck_size_before": true,
2130 + "syscheck_uid_after": true,
2131 + "syscheck_uname_after": true,
2132 + "syscheck_win_perm_after": true,
2133 + "syscheck_win_perm_after_0_allowed": true,
2134 + "syscheck_win_perm_after_0_name": true,
2135 + "syscheck_win_perm_after_1_allowed": true,
2136 + "syscheck_win_perm_after_1_name": true,
2137 + "syscheck_win_perm_after_2_allowed": true,
2138 + "syscheck_win_perm_after_2_name": true,
2139 + "syscheck_win_perm_after_3_allowed": true,
2140 + "syscheck_win_perm_after_3_name": true,
2141 + "syslog_customer": true,
2142 + "syslog_level": true,
2143 + "syslog_tag": true,
2144 + "syslog_type": true,
2145 + "sysmon_event_description": true,
2146 + "threat_ids": true,
2147 + "threat_indicated": true,
2148 + "threat_names": true,
2149 + "time": true,
2150 + "timestamp": true,
2151 + "true": true,
2152 + "user_name": true,
2153 + "win_registry_key": true,
2154 + "win_system_eventID": true,
2155 + "windows_auth_package": true,
2156 + "windows_domain": true,
2157 + "windows_event_id": true,
2158 + "windows_event_severity": true,
2159 + "windows_logon_type": true
2160 + },
2161 + "indexByName": {
2162 + "_id": 2,
2163 + "_index": 9,
2164 + "_type": 10,
2165 + "agent_id": 11,
2166 + "agent_name": 5,
2167 + "cluster_name": 12,
2168 + "cluster_node": 13,
2169 + "data_office365_AppAccessContext_APIId": 49,
2170 + "data_office365_AppAccessContext_ClientAppId": 50,
2171 + "data_office365_AppAccessContext_ClientAppName": 51,
2172 + "data_office365_AppAccessContext_CorrelationId": 52,
2173 + "data_office365_ArtifactsShared": 53,
2174 + "data_office365_Attendees": 54,
2175 + "data_office365_ChatName": 55,
2176 + "data_office365_ChatThreadId": 56,
2177 + "data_office365_ClientIP": 4,
2178 + "data_office365_ClientIP_city_name": 14,
2179 + "data_office365_ClientIP_country_code": 15,
2180 + "data_office365_ClientIP_geolocation": 16,
2181 + "data_office365_CommunicationSubType": 57,
2182 + "data_office365_CommunicationType": 58,
2183 + "data_office365_CreationTime": 0,
2184 + "data_office365_DeviceId": 59,
2185 + "data_office365_DeviceInformation": 60,
2186 + "data_office365_EndTime": 61,
2187 + "data_office365_ExchangeId": 62,
2188 + "data_office365_ExtraProperties": 63,
2189 + "data_office365_ICalUid": 64,
2190 + "data_office365_Id": 17,
2191 + "data_office365_ItemName": 65,
2192 + "data_office365_JoinTime": 66,
2193 + "data_office365_LeaveTime": 67,
2194 + "data_office365_MeetingDetailId": 68,
2195 + "data_office365_MeetingURL": 69,
2196 + "data_office365_Members": 70,
2197 + "data_office365_MessageId": 71,
2198 + "data_office365_MessageSizeInBytes": 72,
2199 + "data_office365_MessageURLs": 73,
2200 + "data_office365_MessageVersion": 74,
2201 + "data_office365_Modalities": 75,
2202 + "data_office365_Name": 76,
2203 + "data_office365_NewValue": 77,
2204 + "data_office365_ObjectId": 18,
2205 + "data_office365_Operation": 24,
2206 + "data_office365_OperationScope": 78,
2207 + "data_office365_OrganizationId": 19,
2208 + "data_office365_Organizer_OrganizationId": 79,
2209 + "data_office365_Organizer_RecipientType": 80,
2210 + "data_office365_Organizer_Role": 81,
2211 + "data_office365_Organizer_UserObjectId": 82,
2212 + "data_office365_ProviderTypes": 83,
2213 + "data_office365_RecordType": 20,
2214 + "data_office365_StartTime": 84,
2215 + "data_office365_SubscriptionId": 85,
2216 + "data_office365_TeamGuid": 86,
2217 + "data_office365_UserId": 3,
2218 + "data_office365_UserKey": 21,
2219 + "data_office365_UserType": 22,
2220 + "data_office365_Version": 23,
2221 + "data_office365_Workload": 48,
2222 + "decoder_name": 25,
2223 + "gl2_accounted_message_size": 26,
2224 + "gl2_message_id": 27,
2225 + "gl2_processing_error": 28,
2226 + "gl2_remote_ip": 29,
2227 + "gl2_remote_port": 30,
2228 + "gl2_source_input": 31,
2229 + "gl2_source_node": 32,
2230 + "highlight": 33,
2231 + "id": 34,
2232 + "location": 35,
2233 + "manager_name": 36,
2234 + "message": 37,
2235 + "rule_description": 6,
2236 + "rule_firedtimes": 38,
2237 + "rule_group1": 39,
2238 + "rule_groups": 40,
2239 + "rule_id": 8,
2240 + "rule_level": 7,
2241 + "rule_mail": 41,
2242 + "sort": 42,
2243 + "source": 43,
2244 + "streams": 44,
2245 + "syslog_level": 45,
2246 + "syslog_type": 46,
2247 + "timestamp": 1,
2248 + "true": 47
2249 + },
2250 + "renameByName": {
2251 + "_id": "EVENT ID",
2252 + "agent_name": "",
2253 + "data_office365_ActorIpAddress": "SRC IP",
2254 + "data_office365_AffectedItems": "ITEMS",
2255 + "data_office365_BrowserName": "BROWSER",
2256 + "data_office365_ClientIP": "CLIENT IP",
2257 + "data_office365_ClientIP_city_name": "",
2258 + "data_office365_CreationTime": "EVENT TIME",
2259 + "data_office365_FormName": "FORM",
2260 + "data_office365_Item_Attachments": "ATTACHMENT",
2261 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2262 + "data_office365_Item_Subject": "SUBJECT",
2263 + "data_office365_ResultStatus": "RESULT",
2264 + "data_office365_SourceApp": "SRC APP",
2265 + "data_office365_SourceFileName": "FILE",
2266 + "data_office365_UserId": "ACCOUNT",
2267 + "rule_description": "DESCRIPTION",
2268 + "rule_id": "RULE ID",
2269 + "rule_level": "",
2270 + "rule_mitre_tactic": "MITRE TACTIC",
2271 + "rule_mitre_technique": "MITRE TECHNIQUE",
2272 + "timestamp": "Date/Time"
2273 + }
2274 + }
2275 + }
2276 + ],
2277 + "transparent": true,
2278 + "type": "table"
2279 + }
2280 + ],
2281 + "refresh": "",
2282 + "schemaVersion": 38,
2283 + "style": "dark",
2284 + "tags": ["O365"],
2285 + "templating": {
2286 + "list": [
2287 + {
2288 + "datasource": {
2289 + "type": "elasticsearch",
2290 + "uid": "replace_datasource_uid"
2291 + },
2292 + "filters": [],
2293 + "hide": 0,
2294 + "label": "",
2295 + "name": "Filters",
2296 + "skipUrlSync": false,
2297 + "type": "adhoc"
2298 + },
2299 + {
2300 + "current": {
2301 + "selected": false,
2302 + "text": "All",
2303 + "value": "$__all"
2304 + },
2305 + "datasource": {
2306 + "type": "elasticsearch",
2307 + "uid": "replace_datasource_uid"
2308 + },
2309 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2310 + "hide": 0,
2311 + "includeAll": true,
2312 + "label": "Operation",
2313 + "multi": false,
2314 + "name": "operation",
2315 + "options": [],
2316 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2317 + "refresh": 2,
2318 + "regex": "",
2319 + "skipUrlSync": false,
2320 + "sort": 1,
2321 + "tagValuesQuery": "",
2322 + "tagsQuery": "",
2323 + "type": "query",
2324 + "useTags": false
2325 + },
2326 + {
2327 + "current": {
2328 + "selected": false,
2329 + "text": "All",
2330 + "value": "$__all"
2331 + },
2332 + "datasource": {
2333 + "type": "elasticsearch",
2334 + "uid": "replace_datasource_uid"
2335 + },
2336 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2337 + "hide": 0,
2338 + "includeAll": true,
2339 + "label": "Rule Level",
2340 + "multi": false,
2341 + "name": "rule_level",
2342 + "options": [],
2343 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:MicrosoftForms\"}",
2344 + "refresh": 2,
2345 + "regex": "",
2346 + "skipUrlSync": false,
2347 + "sort": 0,
2348 + "type": "query"
2349 + }
2350 + ]
2351 + },
2352 + "time": {
2353 + "from": "now-2d",
2354 + "to": "now"
2355 + },
2356 + "timepicker": {
2357 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2358 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2359 + },
2360 + "timezone": "",
2361 + "title": "O365 - MICROSOFT FORMS",
2362 + "weekStart": ""
2363 }
backend/app/connectors/grafana/dashboards/Office365/mitre.json
+1711 -1755
@@ -1,1757 +1,1713 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "$$hashKey": "object:325",
31 - "asDropdown": true,
32 - "icon": "external link",
33 - "includeVars": true,
34 - "keepTime": true,
35 - "tags": [
36 - "O365"
37 - ],
38 - "targetBlank": true,
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [],
52 - "thresholds": {
53 - "mode": "absolute",
54 - "steps": [
55 - {
56 - "color": "light-red",
57 - "value": null
58 - }
59 - ]
60 - }
61 - },
62 - "overrides": [
63 - {
64 - "matcher": {
65 - "id": "byName",
66 - "options": "MITRE ENRICHED EVENTS"
67 - },
68 - "properties": [
69 - {
70 - "id": "color",
71 - "value": {
72 - "mode": "palette-classic"
73 - }
74 - }
75 - ]
76 - },
77 - {
78 - "matcher": {
79 - "id": "byName",
80 - "options": "ALL EVENTS"
81 - },
82 - "properties": [
83 - {
84 - "id": "color",
85 - "value": {
86 - "mode": "palette-classic"
87 - }
88 - }
89 - ]
90 - }
91 - ]
92 - },
93 - "gridPos": {
94 - "h": 7,
95 - "w": 4,
96 - "x": 0,
97 - "y": 0
98 - },
99 - "id": 2,
100 - "options": {
101 - "colorMode": "value",
102 - "graphMode": "area",
103 - "justifyMode": "auto",
104 - "orientation": "horizontal",
105 - "reduceOptions": {
106 - "calcs": [
107 - "sum"
108 - ],
109 - "fields": "",
110 - "values": false
111 - },
112 - "text": {},
113 - "textMode": "auto"
114 - },
115 - "pluginVersion": "9.2.0",
116 - "targets": [
117 - {
118 - "alias": "MITRE ENRICHED EVENTS",
119 - "bucketAggs": [
120 - {
121 - "$$hashKey": "object:266",
122 - "field": "timestamp",
123 - "id": "2",
124 - "settings": {
125 - "interval": "auto",
126 - "min_doc_count": 0,
127 - "trimEdges": 0
128 - },
129 - "type": "date_histogram"
130 - }
131 - ],
132 - "datasource": {
133 - "type": "elasticsearch",
134 - "uid": "replace_datasource_uid"
135 - },
136 - "metrics": [
137 - {
138 - "$$hashKey": "object:264",
139 - "field": "select field",
140 - "id": "1",
141 - "type": "count"
142 - }
143 - ],
144 - "query": "_exists_:rule_mitre_id AND data_office365_Workload:$workload AND rule_level:$rule_level",
145 - "refId": "A",
146 - "timeField": "timestamp"
147 - },
148 - {
149 - "alias": "ALL EVENTS",
150 - "bucketAggs": [
151 - {
152 - "field": "timestamp",
153 - "id": "2",
154 - "settings": {
155 - "interval": "auto"
156 - },
157 - "type": "date_histogram"
158 - }
159 - ],
160 - "datasource": {
161 - "type": "elasticsearch",
162 - "uid": "replace_datasource_uid"
163 - },
164 - "hide": false,
165 - "metrics": [
166 - {
167 - "id": "1",
168 - "type": "count"
169 - }
170 - ],
171 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
172 - "refId": "B",
173 - "timeField": "timestamp"
174 - }
175 - ],
176 - "title": "MITRE ATT&CK EBRICHMENT",
177 - "type": "stat"
178 - },
179 - {
180 - "datasource": {
181 - "type": "elasticsearch",
182 - "uid": "replace_datasource_uid"
183 - },
184 - "fieldConfig": {
185 - "defaults": {
186 - "mappings": [],
187 - "thresholds": {
188 - "mode": "absolute",
189 - "steps": [
190 - {
191 - "color": "light-red",
192 - "value": null
193 - }
194 - ]
195 - }
196 - },
197 - "overrides": []
198 - },
199 - "gridPos": {
200 - "h": 7,
201 - "w": 4,
202 - "x": 4,
203 - "y": 0
204 - },
205 - "id": 35,
206 - "options": {
207 - "colorMode": "value",
208 - "graphMode": "area",
209 - "justifyMode": "auto",
210 - "orientation": "auto",
211 - "reduceOptions": {
212 - "calcs": [
213 - "sum"
214 - ],
215 - "fields": "",
216 - "values": false
217 - },
218 - "text": {},
219 - "textMode": "auto"
220 - },
221 - "pluginVersion": "9.2.0",
222 - "targets": [
223 - {
224 - "bucketAggs": [
225 - {
226 - "$$hashKey": "object:266",
227 - "field": "timestamp",
228 - "id": "2",
229 - "settings": {
230 - "interval": "auto",
231 - "min_doc_count": 0,
232 - "trimEdges": 0
233 - },
234 - "type": "date_histogram"
235 - }
236 - ],
237 - "datasource": {
238 - "type": "elasticsearch",
239 - "uid": "replace_datasource_uid"
240 - },
241 - "metrics": [
242 - {
243 - "$$hashKey": "object:264",
244 - "field": "select field",
245 - "id": "1",
246 - "type": "count"
247 - }
248 - ],
249 - "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND data_office365_Workload:$workload",
250 - "refId": "A",
251 - "timeField": "timestamp"
252 - }
253 - ],
254 - "title": "MITRE ATT&CK ALERTS",
255 - "type": "stat"
256 - },
257 - {
258 - "datasource": {
259 - "type": "elasticsearch",
260 - "uid": "replace_datasource_uid"
261 - },
262 - "fieldConfig": {
263 - "defaults": {
264 - "mappings": [],
265 - "thresholds": {
266 - "mode": "absolute",
267 - "steps": [
268 - {
269 - "color": "light-red",
270 - "value": null
271 - }
272 - ]
273 - }
274 - },
275 - "overrides": []
276 - },
277 - "gridPos": {
278 - "h": 7,
279 - "w": 4,
280 - "x": 8,
281 - "y": 0
282 - },
283 - "id": 12,
284 - "options": {
285 - "colorMode": "value",
286 - "graphMode": "area",
287 - "justifyMode": "auto",
288 - "orientation": "auto",
289 - "reduceOptions": {
290 - "calcs": [
291 - "sum"
292 - ],
293 - "fields": "",
294 - "values": false
295 - },
296 - "text": {},
297 - "textMode": "auto"
298 - },
299 - "pluginVersion": "9.2.0",
300 - "targets": [
301 - {
302 - "bucketAggs": [
303 - {
304 - "$$hashKey": "object:161",
305 - "field": "data_office365_ActorUserId",
306 - "id": "2",
307 - "settings": {
308 - "min_doc_count": 1,
309 - "order": "desc",
310 - "orderBy": "_term",
311 - "size": "10"
312 - },
313 - "type": "terms"
314 - }
315 - ],
316 - "datasource": {
317 - "type": "elasticsearch",
318 - "uid": "replace_datasource_uid"
319 - },
320 - "metrics": [
321 - {
322 - "$$hashKey": "object:159",
323 - "field": "data_office365_ActorUserId",
324 - "id": "1",
325 - "meta": {},
326 - "settings": {},
327 - "type": "cardinality"
328 - }
329 - ],
330 - "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND data_office365_Workload:$workload",
331 - "refId": "A",
332 - "timeField": "timestamp"
333 - }
334 - ],
335 - "title": "ACCOUNTS AFFECTED",
336 - "type": "stat"
337 - },
338 - {
339 - "datasource": {
340 - "type": "elasticsearch",
341 - "uid": "replace_datasource_uid"
342 - },
343 - "fieldConfig": {
344 - "defaults": {
345 - "color": {
346 - "mode": "thresholds"
347 - },
348 - "custom": {
349 - "align": "auto",
350 - "displayMode": "auto",
351 - "inspect": false
352 - },
353 - "mappings": [],
354 - "thresholds": {
355 - "mode": "absolute",
356 - "steps": [
357 - {
358 - "color": "light-red",
359 - "value": null
360 - }
361 - ]
362 - }
363 - },
364 - "overrides": []
365 - },
366 - "gridPos": {
367 - "h": 7,
368 - "w": 6,
369 - "x": 12,
370 - "y": 0
371 - },
372 - "id": 13,
373 - "options": {
374 - "footer": {
375 - "fields": "",
376 - "reducer": [
377 - "sum"
378 - ],
379 - "show": false
380 - },
381 - "showHeader": true
382 - },
383 - "pluginVersion": "9.2.0",
384 - "targets": [
385 - {
386 - "bucketAggs": [
387 - {
388 - "$$hashKey": "object:228",
389 - "field": "data_office365_ActorUserId",
390 - "id": "2",
391 - "settings": {
392 - "min_doc_count": 1,
393 - "order": "desc",
394 - "orderBy": "_term",
395 - "size": "10"
396 - },
397 - "type": "terms"
398 - }
399 - ],
400 - "datasource": {
401 - "type": "elasticsearch",
402 - "uid": "replace_datasource_uid"
403 - },
404 - "metrics": [
405 - {
406 - "$$hashKey": "object:226",
407 - "field": "data_office365_ActorUserId",
408 - "id": "1",
409 - "meta": {},
410 - "settings": {},
411 - "type": "cardinality"
412 - }
413 - ],
414 - "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND data_office365_Workload:$workload",
415 - "refId": "A",
416 - "timeField": "timestamp"
417 - }
418 - ],
419 - "title": "USERS/ACCOUNTS AFFECTED",
420 - "type": "table"
421 - },
422 - {
423 - "datasource": {
424 - "type": "elasticsearch",
425 - "uid": "replace_datasource_uid"
426 - },
427 - "fieldConfig": {
428 - "defaults": {
429 - "color": {
430 - "mode": "palette-classic"
431 - },
432 - "custom": {
433 - "hideFrom": {
434 - "legend": false,
435 - "tooltip": false,
436 - "viz": false
437 - }
438 - },
439 - "decimals": 0,
440 - "mappings": [],
441 - "unit": "short"
442 - },
443 - "overrides": []
444 - },
445 - "gridPos": {
446 - "h": 7,
447 - "w": 6,
448 - "x": 18,
449 - "y": 0
450 - },
451 - "id": 15,
452 - "links": [],
453 - "maxDataPoints": 3,
454 - "options": {
455 - "displayLabels": [],
456 - "legend": {
457 - "calcs": [],
458 - "displayMode": "table",
459 - "placement": "right",
460 - "showLegend": true,
461 - "values": [
462 - "value"
463 - ]
464 - },
465 - "pieType": "donut",
466 - "reduceOptions": {
467 - "calcs": [
468 - "sum"
469 - ],
470 - "fields": "",
471 - "values": false
472 - },
473 - "text": {},
474 - "tooltip": {
475 - "mode": "single",
476 - "sort": "none"
477 - }
478 - },
479 - "pluginVersion": "6.6.2",
480 - "targets": [
481 - {
482 - "bucketAggs": [
483 - {
484 - "$$hashKey": "object:188",
485 - "fake": true,
486 - "field": "data_office365_Workload",
487 - "id": "3",
488 - "settings": {
489 - "min_doc_count": 1,
490 - "order": "desc",
491 - "orderBy": "_count",
492 - "size": "0"
493 - },
494 - "type": "terms"
495 - },
496 - {
497 - "$$hashKey": "object:189",
498 - "field": "timestamp",
499 - "id": "2",
500 - "settings": {
501 - "interval": "auto",
502 - "min_doc_count": 0,
503 - "trimEdges": 0
504 - },
505 - "type": "date_histogram"
506 - }
507 - ],
508 - "datasource": {
509 - "type": "elasticsearch",
510 - "uid": "replace_datasource_uid"
511 - },
512 - "metrics": [
513 - {
514 - "$$hashKey": "object:186",
515 - "field": "select field",
516 - "id": "1",
517 - "type": "count"
518 - }
519 - ],
520 - "query": "_exists_:rule_mitre_tactic AND data_office365_Workload:$workload AND rule_level:$rule_level",
521 - "refId": "A",
522 - "timeField": "timestamp"
523 - }
524 - ],
525 - "title": "WORKLOADS",
526 - "type": "piechart"
527 - },
528 - {
529 - "datasource": {
530 - "type": "elasticsearch",
531 - "uid": "replace_datasource_uid"
532 - },
533 - "fieldConfig": {
534 - "defaults": {
535 - "color": {
536 - "mode": "palette-classic"
537 - },
538 - "custom": {
539 - "hideFrom": {
540 - "legend": false,
541 - "tooltip": false,
542 - "viz": false
543 - }
544 - },
545 - "decimals": 0,
546 - "mappings": [],
547 - "unit": "short"
548 - },
549 - "overrides": []
550 - },
551 - "gridPos": {
552 - "h": 11,
553 - "w": 5,
554 - "x": 0,
555 - "y": 7
556 - },
557 - "id": 16,
558 - "links": [],
559 - "options": {
560 - "displayLabels": [],
561 - "legend": {
562 - "calcs": [],
563 - "displayMode": "list",
564 - "placement": "right",
565 - "showLegend": false,
566 - "values": [
567 - "value"
568 - ]
569 - },
570 - "pieType": "pie",
571 - "reduceOptions": {
572 - "calcs": [
573 - "sum"
574 - ],
575 - "fields": "",
576 - "values": false
577 - },
578 - "text": {},
579 - "tooltip": {
580 - "mode": "single",
581 - "sort": "none"
582 - }
583 - },
584 - "pluginVersion": "7.1.0",
585 - "targets": [
586 - {
587 - "bucketAggs": [
588 - {
589 - "$$hashKey": "object:82",
590 - "fake": true,
591 - "field": "rule_mitre_tactic",
592 - "id": "3",
593 - "settings": {
594 - "min_doc_count": 1,
595 - "order": "desc",
596 - "orderBy": "_count",
597 - "size": "10"
598 - },
599 - "type": "terms"
600 - },
601 - {
602 - "$$hashKey": "object:83",
603 - "field": "timestamp",
604 - "id": "2",
605 - "settings": {
606 - "interval": "auto",
607 - "min_doc_count": 0,
608 - "trimEdges": 0
609 - },
610 - "type": "date_histogram"
611 - }
612 - ],
613 - "datasource": {
614 - "type": "elasticsearch",
615 - "uid": "replace_datasource_uid"
616 - },
617 - "metrics": [
618 - {
619 - "$$hashKey": "object:80",
620 - "field": "select field",
621 - "id": "1",
622 - "type": "count"
623 - }
624 - ],
625 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
626 - "refId": "A",
627 - "timeField": "timestamp"
628 - }
629 - ],
630 - "title": "MITRE ATT&CK TACTICS (TOP 10)",
631 - "type": "piechart"
632 - },
633 - {
634 - "datasource": {
635 - "type": "elasticsearch",
636 - "uid": "replace_datasource_uid"
637 - },
638 - "fieldConfig": {
639 - "defaults": {
640 - "custom": {
641 - "align": "auto",
642 - "displayMode": "auto",
643 - "filterable": false,
644 - "inspect": false
645 - },
646 - "mappings": [
647 - {
648 - "options": {
649 - "mitre_attack": {
650 - "text": "Total"
651 - }
652 - },
653 - "type": "value"
654 - }
655 - ],
656 - "thresholds": {
657 - "mode": "absolute",
658 - "steps": [
659 - {
660 - "color": "green",
661 - "value": null
662 - },
663 - {
664 - "color": "red",
665 - "value": 80
666 - }
667 - ]
668 - }
669 - },
670 - "overrides": [
671 - {
672 - "matcher": {
673 - "id": "byName",
674 - "options": "rule_mitre_tactic"
675 - },
676 - "properties": [
677 - {
678 - "id": "custom.width",
679 - "value": 441
680 - }
681 - ]
682 - }
683 - ]
684 - },
685 - "gridPos": {
686 - "h": 11,
687 - "w": 8,
688 - "x": 5,
689 - "y": 7
690 - },
691 - "id": 28,
692 - "links": [],
693 - "options": {
694 - "footer": {
695 - "fields": "",
696 - "reducer": [
697 - "sum"
698 - ],
699 - "show": false
700 - },
701 - "showHeader": true,
702 - "sortBy": []
703 - },
704 - "pluginVersion": "9.2.0",
705 - "targets": [
706 - {
707 - "bucketAggs": [
708 - {
709 - "$$hashKey": "object:615",
710 - "fake": true,
711 - "field": "rule_mitre_tactic",
712 - "id": "4",
713 - "settings": {
714 - "min_doc_count": "1",
715 - "order": "desc",
716 - "orderBy": "_count",
717 - "size": "0"
718 - },
719 - "type": "terms"
720 - }
721 - ],
722 - "datasource": {
723 - "type": "elasticsearch",
724 - "uid": "replace_datasource_uid"
725 - },
726 - "metrics": [
727 - {
728 - "$$hashKey": "object:80",
729 - "field": "select field",
730 - "id": "1",
731 - "type": "count"
732 - }
733 - ],
734 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
735 - "refId": "A",
736 - "timeField": "timestamp"
737 - }
738 - ],
739 - "title": "MITRE ATT&CK TACTICS",
740 - "transformations": [
741 - {
742 - "id": "organize",
743 - "options": {
744 - "excludeByName": {},
745 - "indexByName": {},
746 - "renameByName": {
747 - "rule_mitre_tactic": "MITRE TACTIC"
748 - }
749 - }
750 - }
751 - ],
752 - "type": "table"
753 - },
754 - {
755 - "datasource": {
756 - "type": "elasticsearch",
757 - "uid": "replace_datasource_uid"
758 - },
759 - "fieldConfig": {
760 - "defaults": {
761 - "custom": {
762 - "align": "auto",
763 - "displayMode": "auto",
764 - "filterable": false,
765 - "inspect": false
766 - },
767 - "mappings": [
768 - {
769 - "options": {
770 - "mitre_attack": {
771 - "text": "Total"
772 - }
773 - },
774 - "type": "value"
775 - }
776 - ],
777 - "thresholds": {
778 - "mode": "absolute",
779 - "steps": [
780 - {
781 - "color": "green",
782 - "value": null
783 - },
784 - {
785 - "color": "red",
786 - "value": 80
787 - }
788 - ]
789 - }
790 - },
791 - "overrides": []
792 - },
793 - "gridPos": {
794 - "h": 22,
795 - "w": 11,
796 - "x": 13,
797 - "y": 7
798 - },
799 - "id": 33,
800 - "links": [],
801 - "options": {
802 - "footer": {
803 - "fields": "",
804 - "reducer": [
805 - "sum"
806 - ],
807 - "show": false
808 - },
809 - "showHeader": true
810 - },
811 - "pluginVersion": "9.2.0",
812 - "targets": [
813 - {
814 - "bucketAggs": [
815 - {
816 - "$$hashKey": "object:615",
817 - "fake": true,
818 - "field": "rule_mitre_id",
819 - "id": "4",
820 - "settings": {
821 - "min_doc_count": "1",
822 - "order": "desc",
823 - "orderBy": "_count",
824 - "size": "0"
825 - },
826 - "type": "terms"
827 - }
828 - ],
829 - "datasource": {
830 - "type": "elasticsearch",
831 - "uid": "replace_datasource_uid"
832 - },
833 - "metrics": [
834 - {
835 - "$$hashKey": "object:80",
836 - "field": "select field",
837 - "id": "1",
838 - "type": "count"
839 - }
840 - ],
841 - "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
842 - "refId": "A",
843 - "timeField": "timestamp"
844 - }
845 - ],
846 - "title": "MITRE ATT&CK TECHNIQUES",
847 - "transformations": [
848 - {
849 - "id": "organize",
850 - "options": {
851 - "excludeByName": {},
852 - "indexByName": {},
853 - "renameByName": {
854 - "rule_mitre_id": "MITRE ID"
855 - }
856 - }
857 - }
858 - ],
859 - "transparent": true,
860 - "type": "table"
861 - },
862 - {
863 - "datasource": {
864 - "type": "elasticsearch",
865 - "uid": "replace_datasource_uid"
866 - },
867 - "fieldConfig": {
868 - "defaults": {
869 - "color": {
870 - "mode": "palette-classic"
871 - },
872 - "custom": {
873 - "hideFrom": {
874 - "legend": false,
875 - "tooltip": false,
876 - "viz": false
877 - }
878 - },
879 - "decimals": 0,
880 - "mappings": [],
881 - "unit": "short"
882 - },
883 - "overrides": []
884 - },
885 - "gridPos": {
886 - "h": 11,
887 - "w": 5,
888 - "x": 0,
889 - "y": 18
890 - },
891 - "id": 29,
892 - "links": [],
893 - "options": {
894 - "displayLabels": [],
895 - "legend": {
896 - "calcs": [],
897 - "displayMode": "list",
898 - "placement": "bottom",
899 - "showLegend": false,
900 - "values": [
901 - "value"
902 - ]
903 - },
904 - "pieType": "donut",
905 - "reduceOptions": {
906 - "calcs": [
907 - "sum"
908 - ],
909 - "fields": "",
910 - "values": false
911 - },
912 - "text": {},
913 - "tooltip": {
914 - "mode": "single",
915 - "sort": "none"
916 - }
917 - },
918 - "pluginVersion": "7.1.0",
919 - "targets": [
920 - {
921 - "bucketAggs": [
922 - {
923 - "$$hashKey": "object:82",
924 - "fake": true,
925 - "field": "rule_mitre_technique",
926 - "id": "3",
927 - "settings": {
928 - "min_doc_count": 1,
929 - "order": "desc",
930 - "orderBy": "_count",
931 - "size": "10"
932 - },
933 - "type": "terms"
934 - },
935 - {
936 - "$$hashKey": "object:83",
937 - "field": "timestamp",
938 - "id": "2",
939 - "settings": {
940 - "interval": "auto",
941 - "min_doc_count": 0,
942 - "trimEdges": 0
943 - },
944 - "type": "date_histogram"
945 - }
946 - ],
947 - "datasource": {
948 - "type": "elasticsearch",
949 - "uid": "replace_datasource_uid"
950 - },
951 - "metrics": [
952 - {
953 - "$$hashKey": "object:80",
954 - "field": "select field",
955 - "id": "1",
956 - "type": "count"
957 - }
958 - ],
959 - "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
960 - "refId": "A",
961 - "timeField": "timestamp"
962 - }
963 - ],
964 - "title": "MITRE ATT&CK TECHNIQUES (TOP 10)",
965 - "type": "piechart"
966 - },
967 - {
968 - "datasource": {
969 - "type": "elasticsearch",
970 - "uid": "replace_datasource_uid"
971 - },
972 - "fieldConfig": {
973 - "defaults": {
974 - "custom": {
975 - "align": "auto",
976 - "displayMode": "auto",
977 - "filterable": false,
978 - "inspect": false
979 - },
980 - "mappings": [
981 - {
982 - "options": {
983 - "mitre_attack": {
984 - "text": "Total"
985 - }
986 - },
987 - "type": "value"
988 - }
989 - ],
990 - "thresholds": {
991 - "mode": "absolute",
992 - "steps": [
993 - {
994 - "color": "green",
995 - "value": null
996 - },
997 - {
998 - "color": "red",
999 - "value": 80
1000 - }
1001 - ]
1002 - }
1003 - },
1004 - "overrides": [
1005 - {
1006 - "matcher": {
1007 - "id": "byName",
1008 - "options": "rule_mitre_technique"
1009 - },
1010 - "properties": [
1011 - {
1012 - "id": "custom.width",
1013 - "value": 381
1014 - }
1015 - ]
1016 - }
1017 - ]
1018 - },
1019 - "gridPos": {
1020 - "h": 11,
1021 - "w": 8,
1022 - "x": 5,
1023 - "y": 18
1024 - },
1025 - "id": 30,
1026 - "links": [],
1027 - "options": {
1028 - "footer": {
1029 - "fields": "",
1030 - "reducer": [
1031 - "sum"
1032 - ],
1033 - "show": false
1034 - },
1035 - "showHeader": true,
1036 - "sortBy": []
1037 - },
1038 - "pluginVersion": "9.2.0",
1039 - "targets": [
1040 - {
1041 - "bucketAggs": [
1042 - {
1043 - "$$hashKey": "object:615",
1044 - "fake": true,
1045 - "field": "rule_mitre_technique",
1046 - "id": "4",
1047 - "settings": {
1048 - "min_doc_count": "1",
1049 - "order": "desc",
1050 - "orderBy": "_count",
1051 - "size": "0"
1052 - },
1053 - "type": "terms"
1054 - }
1055 - ],
1056 - "datasource": {
1057 - "type": "elasticsearch",
1058 - "uid": "replace_datasource_uid"
1059 - },
1060 - "metrics": [
1061 - {
1062 - "$$hashKey": "object:80",
1063 - "field": "select field",
1064 - "id": "1",
1065 - "type": "count"
1066 - }
1067 - ],
1068 - "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1069 - "refId": "A",
1070 - "timeField": "timestamp"
1071 - }
1072 - ],
1073 - "title": "MITRE ATT&CK TECHNIQUES",
1074 - "transformations": [
1075 - {
1076 - "id": "organize",
1077 - "options": {
1078 - "excludeByName": {},
1079 - "indexByName": {},
1080 - "renameByName": {
1081 - "rule_mitre_technique": "MITRE TECHNIQUE"
1082 - }
1083 - }
1084 - }
1085 - ],
1086 - "type": "table"
1087 - },
1088 - {
1089 - "datasource": {
1090 - "type": "elasticsearch",
1091 - "uid": "replace_datasource_uid"
1092 - },
1093 - "fieldConfig": {
1094 - "defaults": {
1095 - "color": {
1096 - "mode": "thresholds"
1097 - },
1098 - "custom": {
1099 - "align": "auto",
1100 - "displayMode": "auto",
1101 - "inspect": false
1102 - },
1103 - "mappings": [
1104 - {
1105 - "options": {
1106 - "mitre_attack": {
1107 - "text": "Total"
1108 - }
1109 - },
1110 - "type": "value"
1111 - }
1112 - ],
1113 - "thresholds": {
1114 - "mode": "absolute",
1115 - "steps": [
1116 - {
1117 - "color": "green",
1118 - "value": null
1119 - },
1120 - {
1121 - "color": "red",
1122 - "value": 80
1123 - }
1124 - ]
1125 - }
1126 - },
1127 - "overrides": [
1128 - {
1129 - "matcher": {
1130 - "id": "byName",
1131 - "options": "ACCOUNT"
1132 - },
1133 - "properties": [
1134 - {
1135 - "id": "custom.width",
1136 - "value": 511
1137 - }
1138 - ]
1139 - }
1140 - ]
1141 - },
1142 - "gridPos": {
1143 - "h": 13,
1144 - "w": 9,
1145 - "x": 0,
1146 - "y": 29
1147 - },
1148 - "id": 17,
1149 - "options": {
1150 - "footer": {
1151 - "fields": "",
1152 - "reducer": [
1153 - "sum"
1154 - ],
1155 - "show": false
1156 - },
1157 - "showHeader": true,
1158 - "sortBy": []
1159 - },
1160 - "pluginVersion": "9.2.0",
1161 - "targets": [
1162 - {
1163 - "bucketAggs": [
1164 - {
1165 - "$$hashKey": "object:82",
1166 - "fake": true,
1167 - "field": "data_office365_UserId",
1168 - "id": "3",
1169 - "settings": {
1170 - "min_doc_count": 1,
1171 - "order": "desc",
1172 - "orderBy": "_count",
1173 - "size": "10"
1174 - },
1175 - "type": "terms"
1176 - }
1177 - ],
1178 - "datasource": {
1179 - "type": "elasticsearch",
1180 - "uid": "replace_datasource_uid"
1181 - },
1182 - "metrics": [
1183 - {
1184 - "$$hashKey": "object:80",
1185 - "field": "select field",
1186 - "id": "1",
1187 - "type": "count"
1188 - }
1189 - ],
1190 - "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1191 - "refId": "A",
1192 - "timeField": "timestamp"
1193 - }
1194 - ],
1195 - "title": "MITRE ATT&CK - TOP 10 ACCOUNTS",
1196 - "transformations": [
1197 - {
1198 - "id": "organize",
1199 - "options": {
1200 - "excludeByName": {},
1201 - "indexByName": {},
1202 - "renameByName": {
1203 - "data_office365_UserId": "ACCOUNT"
1204 - }
1205 - }
1206 - }
1207 - ],
1208 - "transparent": true,
1209 - "type": "table"
1210 - },
1211 - {
1212 - "datasource": {
1213 - "type": "elasticsearch",
1214 - "uid": "replace_datasource_uid"
1215 - },
1216 - "fieldConfig": {
1217 - "defaults": {
1218 - "color": {
1219 - "mode": "palette-classic"
1220 - },
1221 - "custom": {
1222 - "axisCenteredZero": false,
1223 - "axisColorMode": "text",
1224 - "axisLabel": "",
1225 - "axisPlacement": "auto",
1226 - "barAlignment": 0,
1227 - "drawStyle": "bars",
1228 - "fillOpacity": 0,
1229 - "gradientMode": "none",
1230 - "hideFrom": {
1231 - "legend": false,
1232 - "tooltip": false,
1233 - "viz": false
1234 - },
1235 - "lineInterpolation": "linear",
1236 - "lineWidth": 1,
1237 - "pointSize": 5,
1238 - "scaleDistribution": {
1239 - "type": "linear"
1240 - },
1241 - "showPoints": "auto",
1242 - "spanNulls": false,
1243 - "stacking": {
1244 - "group": "A",
1245 - "mode": "normal"
1246 - },
1247 - "thresholdsStyle": {
1248 - "mode": "off"
1249 - }
1250 - },
1251 - "mappings": [],
1252 - "thresholds": {
1253 - "mode": "absolute",
1254 - "steps": [
1255 - {
1256 - "color": "green",
1257 - "value": null
1258 - },
1259 - {
1260 - "color": "red",
1261 - "value": 80
1262 - }
1263 - ]
1264 - }
1265 - },
1266 - "overrides": []
1267 - },
1268 - "gridPos": {
1269 - "h": 13,
1270 - "w": 15,
1271 - "x": 9,
1272 - "y": 29
1273 - },
1274 - "id": 39,
1275 - "options": {
1276 - "legend": {
1277 - "calcs": [],
1278 - "displayMode": "table",
1279 - "placement": "right",
1280 - "showLegend": true
1281 - },
1282 - "tooltip": {
1283 - "mode": "single",
1284 - "sort": "none"
1285 - }
1286 - },
1287 - "targets": [
1288 - {
1289 - "alias": "",
1290 - "bucketAggs": [
1291 - {
1292 - "field": "data_office365_Operation",
1293 - "id": "3",
1294 - "settings": {
1295 - "min_doc_count": "1",
1296 - "order": "desc",
1297 - "orderBy": "_count",
1298 - "size": "10"
1299 - },
1300 - "type": "terms"
1301 - },
1302 - {
1303 - "field": "timestamp",
1304 - "id": "2",
1305 - "settings": {
1306 - "interval": "auto"
1307 - },
1308 - "type": "date_histogram"
1309 - }
1310 - ],
1311 - "datasource": {
1312 - "type": "elasticsearch",
1313 - "uid": "replace_datasource_uid"
1314 - },
1315 - "metrics": [
1316 - {
1317 - "id": "1",
1318 - "type": "count"
1319 - }
1320 - ],
1321 - "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1322 - "refId": "A",
1323 - "timeField": "timestamp"
1324 - }
1325 - ],
1326 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
1327 - "transparent": true,
1328 - "type": "timeseries"
1329 - },
1330 - {
1331 - "datasource": {
1332 - "type": "elasticsearch",
1333 - "uid": "replace_datasource_uid"
1334 - },
1335 - "fieldConfig": {
1336 - "defaults": {
1337 - "color": {
1338 - "mode": "thresholds"
1339 - },
1340 - "custom": {
1341 - "align": "auto",
1342 - "displayMode": "auto",
1343 - "inspect": false
1344 - },
1345 - "mappings": [],
1346 - "thresholds": {
1347 - "mode": "absolute",
1348 - "steps": [
1349 - {
1350 - "color": "green"
1351 - },
1352 - {
1353 - "color": "red",
1354 - "value": 80
1355 - }
1356 - ]
1357 - }
1358 - },
1359 - "overrides": [
1360 - {
1361 - "matcher": {
1362 - "id": "byName",
1363 - "options": "timestamp"
1364 - },
1365 - "properties": [
1366 - {
1367 - "id": "displayName",
1368 - "value": "Date/Time"
1369 - },
1370 - {
1371 - "id": "unit",
1372 - "value": "time: YYYY-MM-DD HH:mm:ss"
1373 - },
1374 - {
1375 - "id": "custom.align"
1376 - }
1377 - ]
1378 - },
1379 - {
1380 - "matcher": {
1381 - "id": "byName",
1382 - "options": "agent_name"
1383 - },
1384 - "properties": [
1385 - {
1386 - "id": "displayName",
1387 - "value": "AGENT"
1388 - },
1389 - {
1390 - "id": "unit",
1391 - "value": "short"
1392 - },
1393 - {
1394 - "id": "decimals",
1395 - "value": 2
1396 - },
1397 - {
1398 - "id": "custom.align"
1399 - }
1400 - ]
1401 - },
1402 - {
1403 - "matcher": {
1404 - "id": "byName",
1405 - "options": "full_log"
1406 - },
1407 - "properties": [
1408 - {
1409 - "id": "displayName",
1410 - "value": "EVENT"
1411 - },
1412 - {
1413 - "id": "unit",
1414 - "value": "short"
1415 - },
1416 - {
1417 - "id": "decimals",
1418 - "value": 2
1419 - }
1420 - ]
1421 - },
1422 - {
1423 - "matcher": {
1424 - "id": "byName",
1425 - "options": "rule_groups"
1426 - },
1427 - "properties": [
1428 - {
1429 - "id": "displayName",
1430 - "value": "RULE GROUPS"
1431 - },
1432 - {
1433 - "id": "unit",
1434 - "value": "short"
1435 - },
1436 - {
1437 - "id": "decimals",
1438 - "value": 2
1439 - },
1440 - {
1441 - "id": "custom.align"
1442 - }
1443 - ]
1444 - },
1445 - {
1446 - "matcher": {
1447 - "id": "byName",
1448 - "options": "rule_level"
1449 - },
1450 - "properties": [
1451 - {
1452 - "id": "displayName",
1453 - "value": "RULE LEVEL"
1454 - },
1455 - {
1456 - "id": "unit",
1457 - "value": "short"
1458 - },
1459 - {
1460 - "id": "decimals",
1461 - "value": -1
1462 - },
1463 - {
1464 - "id": "custom.displayMode",
1465 - "value": "color-background"
1466 - },
1467 - {
1468 - "id": "custom.align"
1469 - },
1470 - {
1471 - "id": "thresholds",
1472 - "value": {
1473 - "mode": "absolute",
1474 - "steps": [
1475 - {
1476 - "color": "#37872D"
1477 - },
1478 - {
1479 - "color": "rgba(237, 129, 40, 0.89)",
1480 - "value": 7
1481 - },
1482 - {
1483 - "color": "rgba(245, 54, 54, 0.9)",
1484 - "value": 12
1485 - }
1486 - ]
1487 - }
1488 - }
1489 - ]
1490 - },
1491 - {
1492 - "matcher": {
1493 - "id": "byName",
1494 - "options": "rule_description"
1495 - },
1496 - "properties": [
1497 - {
1498 - "id": "displayName",
1499 - "value": "RULE DESCRIPTION"
1500 - },
1501 - {
1502 - "id": "unit",
1503 - "value": "short"
1504 - },
1505 - {
1506 - "id": "decimals",
1507 - "value": 2
1508 - },
1509 - {
1510 - "id": "custom.align"
1511 - }
1512 - ]
1513 - },
1514 - {
1515 - "matcher": {
1516 - "id": "byName",
1517 - "options": "EVENT ID"
1518 - },
1519 - "properties": [
1520 - {
1521 - "id": "links",
1522 - "value": [
1523 - {
1524 - "targetBlank": true,
1525 - "title": "VIEW EVENT DETAILS",
1526 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1527 - }
1528 - ]
1529 - }
1530 - ]
1531 - },
1532 - {
1533 - "matcher": {
1534 - "id": "byName",
1535 - "options": "MITRE ID"
1536 - },
1537 - "properties": [
1538 - {
1539 - "id": "custom.width",
1540 - "value": 101
1541 - }
1542 - ]
1543 - },
1544 - {
1545 - "matcher": {
1546 - "id": "byName",
1547 - "options": "SRC IP"
1548 - },
1549 - "properties": [
1550 - {
1551 - "id": "custom.width",
1552 - "value": 140
1553 - }
1554 - ]
1555 - }
1556 - ]
1557 - },
1558 - "gridPos": {
1559 - "h": 16,
1560 - "w": 24,
1561 - "x": 0,
1562 - "y": 42
1563 - },
1564 - "id": 27,
1565 - "options": {
1566 - "footer": {
1567 - "fields": "",
1568 - "reducer": [
1569 - "sum"
1570 - ],
1571 - "show": false
1572 - },
1573 - "showHeader": true,
1574 - "sortBy": []
1575 - },
1576 - "pluginVersion": "9.0.0",
1577 - "targets": [
1578 - {
1579 - "bucketAggs": [],
1580 - "datasource": {
1581 - "type": "elasticsearch",
1582 - "uid": "replace_datasource_uid"
1583 - },
1584 - "metrics": [
1585 - {
1586 - "id": "1",
1587 - "settings": {
1588 - "size": "250"
1589 - },
1590 - "type": "raw_data"
1591 - }
1592 - ],
1593 - "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1594 - "refId": "A",
1595 - "timeField": "timestamp"
1596 - }
1597 - ],
1598 - "title": "MITRE ATT&CK - TELEMETRY",
1599 - "transformations": [
1600 - {
1601 - "id": "filterFieldsByName",
1602 - "options": {
1603 - "include": {
1604 - "names": [
1605 - "timestamp",
1606 - "_id",
1607 - "rule_description",
1608 - "rule_level",
1609 - "rule_mitre_id",
1610 - "rule_mitre_tactic",
1611 - "rule_mitre_technique",
1612 - "syslog_level",
1613 - "data_office365_Workload",
1614 - "data_office365_CreationTime",
1615 - "data_office365_UserId",
1616 - "data_office365_ClientIP"
1617 - ]
1618 - }
1619 - }
1620 - },
1621 - {
1622 - "id": "organize",
1623 - "options": {
1624 - "excludeByName": {
1625 - "agent_ip": true,
1626 - "timestamp": true
1627 - },
1628 - "indexByName": {
1629 - "_id": 2,
1630 - "data_office365_ClientIP": 4,
1631 - "data_office365_CreationTime": 0,
1632 - "data_office365_UserId": 3,
1633 - "data_office365_Workload": 5,
1634 - "rule_description": 6,
1635 - "rule_level": 7,
1636 - "rule_mitre_id": 8,
1637 - "rule_mitre_tactic": 9,
1638 - "rule_mitre_technique": 10,
1639 - "syslog_level": 11,
1640 - "timestamp": 1
1641 - },
1642 - "renameByName": {
1643 - "_id": "EVENT ID",
1644 - "agent_ip": "",
1645 - "data_office365_ClientIP": "SRC IP",
1646 - "data_office365_CreationTime": "EVENT TIME",
1647 - "data_office365_UserId": "ACCOUNT",
1648 - "data_office365_Workload": "WORKLOAD",
1649 - "rule_description": "",
1650 - "rule_mitre_id": "MITRE ID",
1651 - "rule_mitre_tactic": "TACTIC",
1652 - "rule_mitre_technique": "TECHNIQUE",
1653 - "syslog_level": "LEVEL",
1654 - "timestamp": "DATE/TIME"
1655 - }
1656 - }
1657 - }
1658 - ],
1659 - "type": "table"
1660 - }
1661 - ],
1662 - "refresh": "",
1663 - "schemaVersion": 37,
1664 - "style": "dark",
1665 - "tags": [
1666 - "O365"
1667 - ],
1668 - "templating": {
1669 - "list": [
1670 - {
1671 - "datasource": {
1672 - "type": "elasticsearch",
1673 - "uid": "replace_datasource_uid"
1674 - },
1675 - "filters": [],
1676 - "hide": 0,
1677 - "label": "Filters",
1678 - "name": "Filters",
1679 - "skipUrlSync": false,
1680 - "type": "adhoc"
1681 - },
1682 - {
1683 - "current": {
1684 - "selected": false,
1685 - "text": "All",
1686 - "value": "$__all"
1687 - },
1688 - "datasource": {
1689 - "type": "elasticsearch",
1690 - "uid": "replace_datasource_uid"
1691 - },
1692 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"_exists_:rule_mitre_tactic\"}",
1693 - "hide": 0,
1694 - "includeAll": true,
1695 - "label": "WORKLOAD",
1696 - "multi": false,
1697 - "name": "workload",
1698 - "options": [],
1699 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"_exists_:rule_mitre_tactic\"}",
1700 - "refresh": 2,
1701 - "regex": "",
1702 - "skipUrlSync": false,
1703 - "sort": 0,
1704 - "tagValuesQuery": "",
1705 - "tagsQuery": "",
1706 - "type": "query",
1707 - "useTags": false
1708 - },
1709 - {
1710 - "current": {
1711 - "selected": false,
1712 - "text": "All",
1713 - "value": "$__all"
1714 - },
1715 - "datasource": {
1716 - "type": "elasticsearch",
1717 - "uid": "replace_datasource_uid"
1718 - },
1719 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1720 - "hide": 0,
1721 - "includeAll": true,
1722 - "label": "Rule Level",
1723 - "multi": false,
1724 - "name": "rule_level",
1725 - "options": [],
1726 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1727 - "refresh": 2,
1728 - "regex": "",
1729 - "skipUrlSync": false,
1730 - "sort": 0,
1731 - "type": "query"
1732 - }
1733 - ]
1734 - },
1735 - "time": {
1736 - "from": "now-6h",
1737 - "to": "now"
1738 - },
1739 - "timepicker": {
1740 - "refresh_intervals": [
1741 - "10s",
1742 - "30s",
1743 - "1m",
1744 - "5m",
1745 - "15m",
1746 - "30m",
1747 - "1h",
1748 - "2h",
1749 - "1d"
1750 - ]
1751 - },
1752 - "timezone": "",
1753 - "title": "O365 - MITRE ATT&CK",
1754 - "uid": "Nipjnw37k",
1755 - "version": 1,
1756 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "$$hashKey": "object:325",
31 + "asDropdown": true,
32 + "icon": "external link",
33 + "includeVars": true,
34 + "keepTime": true,
35 + "tags": ["O365"],
36 + "targetBlank": true,
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [],
50 + "thresholds": {
51 + "mode": "absolute",
52 + "steps": [
53 + {
54 + "color": "light-red",
55 + "value": null
56 + }
57 + ]
58 + }
59 + },
60 + "overrides": [
61 + {
62 + "matcher": {
63 + "id": "byName",
64 + "options": "MITRE ENRICHED EVENTS"
65 + },
66 + "properties": [
67 + {
68 + "id": "color",
69 + "value": {
70 + "mode": "palette-classic"
71 + }
72 + }
73 + ]
74 + },
75 + {
76 + "matcher": {
77 + "id": "byName",
78 + "options": "ALL EVENTS"
79 + },
80 + "properties": [
81 + {
82 + "id": "color",
83 + "value": {
84 + "mode": "palette-classic"
85 + }
86 + }
87 + ]
88 + }
89 + ]
90 + },
91 + "gridPos": {
92 + "h": 7,
93 + "w": 4,
94 + "x": 0,
95 + "y": 0
96 + },
97 + "id": 2,
98 + "options": {
99 + "colorMode": "value",
100 + "graphMode": "area",
101 + "justifyMode": "auto",
102 + "orientation": "horizontal",
103 + "reduceOptions": {
104 + "calcs": ["sum"],
105 + "fields": "",
106 + "values": false
107 + },
108 + "text": {},
109 + "textMode": "auto"
110 + },
111 + "pluginVersion": "9.2.0",
112 + "targets": [
113 + {
114 + "alias": "MITRE ENRICHED EVENTS",
115 + "bucketAggs": [
116 + {
117 + "$$hashKey": "object:266",
118 + "field": "timestamp",
119 + "id": "2",
120 + "settings": {
121 + "interval": "auto",
122 + "min_doc_count": 0,
123 + "trimEdges": 0
124 + },
125 + "type": "date_histogram"
126 + }
127 + ],
128 + "datasource": {
129 + "type": "elasticsearch",
130 + "uid": "replace_datasource_uid"
131 + },
132 + "metrics": [
133 + {
134 + "$$hashKey": "object:264",
135 + "field": "select field",
136 + "id": "1",
137 + "type": "count"
138 + }
139 + ],
140 + "query": "_exists_:rule_mitre_id AND data_office365_Workload:$workload AND rule_level:$rule_level",
141 + "refId": "A",
142 + "timeField": "timestamp"
143 + },
144 + {
145 + "alias": "ALL EVENTS",
146 + "bucketAggs": [
147 + {
148 + "field": "timestamp",
149 + "id": "2",
150 + "settings": {
151 + "interval": "auto"
152 + },
153 + "type": "date_histogram"
154 + }
155 + ],
156 + "datasource": {
157 + "type": "elasticsearch",
158 + "uid": "replace_datasource_uid"
159 + },
160 + "hide": false,
161 + "metrics": [
162 + {
163 + "id": "1",
164 + "type": "count"
165 + }
166 + ],
167 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
168 + "refId": "B",
169 + "timeField": "timestamp"
170 + }
171 + ],
172 + "title": "MITRE ATT&CK EBRICHMENT",
173 + "type": "stat"
174 + },
175 + {
176 + "datasource": {
177 + "type": "elasticsearch",
178 + "uid": "replace_datasource_uid"
179 + },
180 + "fieldConfig": {
181 + "defaults": {
182 + "mappings": [],
183 + "thresholds": {
184 + "mode": "absolute",
185 + "steps": [
186 + {
187 + "color": "light-red",
188 + "value": null
189 + }
190 + ]
191 + }
192 + },
193 + "overrides": []
194 + },
195 + "gridPos": {
196 + "h": 7,
197 + "w": 4,
198 + "x": 4,
199 + "y": 0
200 + },
201 + "id": 35,
202 + "options": {
203 + "colorMode": "value",
204 + "graphMode": "area",
205 + "justifyMode": "auto",
206 + "orientation": "auto",
207 + "reduceOptions": {
208 + "calcs": ["sum"],
209 + "fields": "",
210 + "values": false
211 + },
212 + "text": {},
213 + "textMode": "auto"
214 + },
215 + "pluginVersion": "9.2.0",
216 + "targets": [
217 + {
218 + "bucketAggs": [
219 + {
220 + "$$hashKey": "object:266",
221 + "field": "timestamp",
222 + "id": "2",
223 + "settings": {
224 + "interval": "auto",
225 + "min_doc_count": 0,
226 + "trimEdges": 0
227 + },
228 + "type": "date_histogram"
229 + }
230 + ],
231 + "datasource": {
232 + "type": "elasticsearch",
233 + "uid": "replace_datasource_uid"
234 + },
235 + "metrics": [
236 + {
237 + "$$hashKey": "object:264",
238 + "field": "select field",
239 + "id": "1",
240 + "type": "count"
241 + }
242 + ],
243 + "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND data_office365_Workload:$workload",
244 + "refId": "A",
245 + "timeField": "timestamp"
246 + }
247 + ],
248 + "title": "MITRE ATT&CK ALERTS",
249 + "type": "stat"
250 + },
251 + {
252 + "datasource": {
253 + "type": "elasticsearch",
254 + "uid": "replace_datasource_uid"
255 + },
256 + "fieldConfig": {
257 + "defaults": {
258 + "mappings": [],
259 + "thresholds": {
260 + "mode": "absolute",
261 + "steps": [
262 + {
263 + "color": "light-red",
264 + "value": null
265 + }
266 + ]
267 + }
268 + },
269 + "overrides": []
270 + },
271 + "gridPos": {
272 + "h": 7,
273 + "w": 4,
274 + "x": 8,
275 + "y": 0
276 + },
277 + "id": 12,
278 + "options": {
279 + "colorMode": "value",
280 + "graphMode": "area",
281 + "justifyMode": "auto",
282 + "orientation": "auto",
283 + "reduceOptions": {
284 + "calcs": ["sum"],
285 + "fields": "",
286 + "values": false
287 + },
288 + "text": {},
289 + "textMode": "auto"
290 + },
291 + "pluginVersion": "9.2.0",
292 + "targets": [
293 + {
294 + "bucketAggs": [
295 + {
296 + "$$hashKey": "object:161",
297 + "field": "data_office365_ActorUserId",
298 + "id": "2",
299 + "settings": {
300 + "min_doc_count": 1,
301 + "order": "desc",
302 + "orderBy": "_term",
303 + "size": "10"
304 + },
305 + "type": "terms"
306 + }
307 + ],
308 + "datasource": {
309 + "type": "elasticsearch",
310 + "uid": "replace_datasource_uid"
311 + },
312 + "metrics": [
313 + {
314 + "$$hashKey": "object:159",
315 + "field": "data_office365_ActorUserId",
316 + "id": "1",
317 + "meta": {},
318 + "settings": {},
319 + "type": "cardinality"
320 + }
321 + ],
322 + "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND data_office365_Workload:$workload",
323 + "refId": "A",
324 + "timeField": "timestamp"
325 + }
326 + ],
327 + "title": "ACCOUNTS AFFECTED",
328 + "type": "stat"
329 + },
330 + {
331 + "datasource": {
332 + "type": "elasticsearch",
333 + "uid": "replace_datasource_uid"
334 + },
335 + "fieldConfig": {
336 + "defaults": {
337 + "color": {
338 + "mode": "thresholds"
339 + },
340 + "custom": {
341 + "align": "auto",
342 + "displayMode": "auto",
343 + "inspect": false
344 + },
345 + "mappings": [],
346 + "thresholds": {
347 + "mode": "absolute",
348 + "steps": [
349 + {
350 + "color": "light-red",
351 + "value": null
352 + }
353 + ]
354 + }
355 + },
356 + "overrides": []
357 + },
358 + "gridPos": {
359 + "h": 7,
360 + "w": 6,
361 + "x": 12,
362 + "y": 0
363 + },
364 + "id": 13,
365 + "options": {
366 + "footer": {
367 + "fields": "",
368 + "reducer": ["sum"],
369 + "show": false
370 + },
371 + "showHeader": true
372 + },
373 + "pluginVersion": "9.2.0",
374 + "targets": [
375 + {
376 + "bucketAggs": [
377 + {
378 + "$$hashKey": "object:228",
379 + "field": "data_office365_ActorUserId",
380 + "id": "2",
381 + "settings": {
382 + "min_doc_count": 1,
383 + "order": "desc",
384 + "orderBy": "_term",
385 + "size": "10"
386 + },
387 + "type": "terms"
388 + }
389 + ],
390 + "datasource": {
391 + "type": "elasticsearch",
392 + "uid": "replace_datasource_uid"
393 + },
394 + "metrics": [
395 + {
396 + "$$hashKey": "object:226",
397 + "field": "data_office365_ActorUserId",
398 + "id": "1",
399 + "meta": {},
400 + "settings": {},
401 + "type": "cardinality"
402 + }
403 + ],
404 + "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND data_office365_Workload:$workload",
405 + "refId": "A",
406 + "timeField": "timestamp"
407 + }
408 + ],
409 + "title": "USERS/ACCOUNTS AFFECTED",
410 + "type": "table"
411 + },
412 + {
413 + "datasource": {
414 + "type": "elasticsearch",
415 + "uid": "replace_datasource_uid"
416 + },
417 + "fieldConfig": {
418 + "defaults": {
419 + "color": {
420 + "mode": "palette-classic"
421 + },
422 + "custom": {
423 + "hideFrom": {
424 + "legend": false,
425 + "tooltip": false,
426 + "viz": false
427 + }
428 + },
429 + "decimals": 0,
430 + "mappings": [],
431 + "unit": "short"
432 + },
433 + "overrides": []
434 + },
435 + "gridPos": {
436 + "h": 7,
437 + "w": 6,
438 + "x": 18,
439 + "y": 0
440 + },
441 + "id": 15,
442 + "links": [],
443 + "maxDataPoints": 3,
444 + "options": {
445 + "displayLabels": [],
446 + "legend": {
447 + "calcs": [],
448 + "displayMode": "table",
449 + "placement": "right",
450 + "showLegend": true,
451 + "values": ["value"]
452 + },
453 + "pieType": "donut",
454 + "reduceOptions": {
455 + "calcs": ["sum"],
456 + "fields": "",
457 + "values": false
458 + },
459 + "text": {},
460 + "tooltip": {
461 + "mode": "single",
462 + "sort": "none"
463 + }
464 + },
465 + "pluginVersion": "6.6.2",
466 + "targets": [
467 + {
468 + "bucketAggs": [
469 + {
470 + "$$hashKey": "object:188",
471 + "fake": true,
472 + "field": "data_office365_Workload",
473 + "id": "3",
474 + "settings": {
475 + "min_doc_count": 1,
476 + "order": "desc",
477 + "orderBy": "_count",
478 + "size": "0"
479 + },
480 + "type": "terms"
481 + },
482 + {
483 + "$$hashKey": "object:189",
484 + "field": "timestamp",
485 + "id": "2",
486 + "settings": {
487 + "interval": "auto",
488 + "min_doc_count": 0,
489 + "trimEdges": 0
490 + },
491 + "type": "date_histogram"
492 + }
493 + ],
494 + "datasource": {
495 + "type": "elasticsearch",
496 + "uid": "replace_datasource_uid"
497 + },
498 + "metrics": [
499 + {
500 + "$$hashKey": "object:186",
501 + "field": "select field",
502 + "id": "1",
503 + "type": "count"
504 + }
505 + ],
506 + "query": "_exists_:rule_mitre_tactic AND data_office365_Workload:$workload AND rule_level:$rule_level",
507 + "refId": "A",
508 + "timeField": "timestamp"
509 + }
510 + ],
511 + "title": "WORKLOADS",
512 + "type": "piechart"
513 + },
514 + {
515 + "datasource": {
516 + "type": "elasticsearch",
517 + "uid": "replace_datasource_uid"
518 + },
519 + "fieldConfig": {
520 + "defaults": {
521 + "color": {
522 + "mode": "palette-classic"
523 + },
524 + "custom": {
525 + "hideFrom": {
526 + "legend": false,
527 + "tooltip": false,
528 + "viz": false
529 + }
530 + },
531 + "decimals": 0,
532 + "mappings": [],
533 + "unit": "short"
534 + },
535 + "overrides": []
536 + },
537 + "gridPos": {
538 + "h": 11,
539 + "w": 5,
540 + "x": 0,
541 + "y": 7
542 + },
543 + "id": 16,
544 + "links": [],
545 + "options": {
546 + "displayLabels": [],
547 + "legend": {
548 + "calcs": [],
549 + "displayMode": "list",
550 + "placement": "right",
551 + "showLegend": false,
552 + "values": ["value"]
553 + },
554 + "pieType": "pie",
555 + "reduceOptions": {
556 + "calcs": ["sum"],
557 + "fields": "",
558 + "values": false
559 + },
560 + "text": {},
561 + "tooltip": {
562 + "mode": "single",
563 + "sort": "none"
564 + }
565 + },
566 + "pluginVersion": "7.1.0",
567 + "targets": [
568 + {
569 + "bucketAggs": [
570 + {
571 + "$$hashKey": "object:82",
572 + "fake": true,
573 + "field": "rule_mitre_tactic",
574 + "id": "3",
575 + "settings": {
576 + "min_doc_count": 1,
577 + "order": "desc",
578 + "orderBy": "_count",
579 + "size": "10"
580 + },
581 + "type": "terms"
582 + },
583 + {
584 + "$$hashKey": "object:83",
585 + "field": "timestamp",
586 + "id": "2",
587 + "settings": {
588 + "interval": "auto",
589 + "min_doc_count": 0,
590 + "trimEdges": 0
591 + },
592 + "type": "date_histogram"
593 + }
594 + ],
595 + "datasource": {
596 + "type": "elasticsearch",
597 + "uid": "replace_datasource_uid"
598 + },
599 + "metrics": [
600 + {
601 + "$$hashKey": "object:80",
602 + "field": "select field",
603 + "id": "1",
604 + "type": "count"
605 + }
606 + ],
607 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
608 + "refId": "A",
609 + "timeField": "timestamp"
610 + }
611 + ],
612 + "title": "MITRE ATT&CK TACTICS (TOP 10)",
613 + "type": "piechart"
614 + },
615 + {
616 + "datasource": {
617 + "type": "elasticsearch",
618 + "uid": "replace_datasource_uid"
619 + },
620 + "fieldConfig": {
621 + "defaults": {
622 + "custom": {
623 + "align": "auto",
624 + "displayMode": "auto",
625 + "filterable": false,
626 + "inspect": false
627 + },
628 + "mappings": [
629 + {
630 + "options": {
631 + "mitre_attack": {
632 + "text": "Total"
633 + }
634 + },
635 + "type": "value"
636 + }
637 + ],
638 + "thresholds": {
639 + "mode": "absolute",
640 + "steps": [
641 + {
642 + "color": "green",
643 + "value": null
644 + },
645 + {
646 + "color": "red",
647 + "value": 80
648 + }
649 + ]
650 + }
651 + },
652 + "overrides": [
653 + {
654 + "matcher": {
655 + "id": "byName",
656 + "options": "rule_mitre_tactic"
657 + },
658 + "properties": [
659 + {
660 + "id": "custom.width",
661 + "value": 441
662 + }
663 + ]
664 + }
665 + ]
666 + },
667 + "gridPos": {
668 + "h": 11,
669 + "w": 8,
670 + "x": 5,
671 + "y": 7
672 + },
673 + "id": 28,
674 + "links": [],
675 + "options": {
676 + "footer": {
677 + "fields": "",
678 + "reducer": ["sum"],
679 + "show": false
680 + },
681 + "showHeader": true,
682 + "sortBy": []
683 + },
684 + "pluginVersion": "9.2.0",
685 + "targets": [
686 + {
687 + "bucketAggs": [
688 + {
689 + "$$hashKey": "object:615",
690 + "fake": true,
691 + "field": "rule_mitre_tactic",
692 + "id": "4",
693 + "settings": {
694 + "min_doc_count": "1",
695 + "order": "desc",
696 + "orderBy": "_count",
697 + "size": "0"
698 + },
699 + "type": "terms"
700 + }
701 + ],
702 + "datasource": {
703 + "type": "elasticsearch",
704 + "uid": "replace_datasource_uid"
705 + },
706 + "metrics": [
707 + {
708 + "$$hashKey": "object:80",
709 + "field": "select field",
710 + "id": "1",
711 + "type": "count"
712 + }
713 + ],
714 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
715 + "refId": "A",
716 + "timeField": "timestamp"
717 + }
718 + ],
719 + "title": "MITRE ATT&CK TACTICS",
720 + "transformations": [
721 + {
722 + "id": "organize",
723 + "options": {
724 + "excludeByName": {},
725 + "indexByName": {},
726 + "renameByName": {
727 + "rule_mitre_tactic": "MITRE TACTIC"
728 + }
729 + }
730 + }
731 + ],
732 + "type": "table"
733 + },
734 + {
735 + "datasource": {
736 + "type": "elasticsearch",
737 + "uid": "replace_datasource_uid"
738 + },
739 + "fieldConfig": {
740 + "defaults": {
741 + "custom": {
742 + "align": "auto",
743 + "displayMode": "auto",
744 + "filterable": false,
745 + "inspect": false
746 + },
747 + "mappings": [
748 + {
749 + "options": {
750 + "mitre_attack": {
751 + "text": "Total"
752 + }
753 + },
754 + "type": "value"
755 + }
756 + ],
757 + "thresholds": {
758 + "mode": "absolute",
759 + "steps": [
760 + {
761 + "color": "green",
762 + "value": null
763 + },
764 + {
765 + "color": "red",
766 + "value": 80
767 + }
768 + ]
769 + }
770 + },
771 + "overrides": []
772 + },
773 + "gridPos": {
774 + "h": 22,
775 + "w": 11,
776 + "x": 13,
777 + "y": 7
778 + },
779 + "id": 33,
780 + "links": [],
781 + "options": {
782 + "footer": {
783 + "fields": "",
784 + "reducer": ["sum"],
785 + "show": false
786 + },
787 + "showHeader": true
788 + },
789 + "pluginVersion": "9.2.0",
790 + "targets": [
791 + {
792 + "bucketAggs": [
793 + {
794 + "$$hashKey": "object:615",
795 + "fake": true,
796 + "field": "rule_mitre_id",
797 + "id": "4",
798 + "settings": {
799 + "min_doc_count": "1",
800 + "order": "desc",
801 + "orderBy": "_count",
802 + "size": "0"
803 + },
804 + "type": "terms"
805 + }
806 + ],
807 + "datasource": {
808 + "type": "elasticsearch",
809 + "uid": "replace_datasource_uid"
810 + },
811 + "metrics": [
812 + {
813 + "$$hashKey": "object:80",
814 + "field": "select field",
815 + "id": "1",
816 + "type": "count"
817 + }
818 + ],
819 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
820 + "refId": "A",
821 + "timeField": "timestamp"
822 + }
823 + ],
824 + "title": "MITRE ATT&CK TECHNIQUES",
825 + "transformations": [
826 + {
827 + "id": "organize",
828 + "options": {
829 + "excludeByName": {},
830 + "indexByName": {},
831 + "renameByName": {
832 + "rule_mitre_id": "MITRE ID"
833 + }
834 + }
835 + }
836 + ],
837 + "transparent": true,
838 + "type": "table"
839 + },
840 + {
841 + "datasource": {
842 + "type": "elasticsearch",
843 + "uid": "replace_datasource_uid"
844 + },
845 + "fieldConfig": {
846 + "defaults": {
847 + "color": {
848 + "mode": "palette-classic"
849 + },
850 + "custom": {
851 + "hideFrom": {
852 + "legend": false,
853 + "tooltip": false,
854 + "viz": false
855 + }
856 + },
857 + "decimals": 0,
858 + "mappings": [],
859 + "unit": "short"
860 + },
861 + "overrides": []
862 + },
863 + "gridPos": {
864 + "h": 11,
865 + "w": 5,
866 + "x": 0,
867 + "y": 18
868 + },
869 + "id": 29,
870 + "links": [],
871 + "options": {
872 + "displayLabels": [],
873 + "legend": {
874 + "calcs": [],
875 + "displayMode": "list",
876 + "placement": "bottom",
877 + "showLegend": false,
878 + "values": ["value"]
879 + },
880 + "pieType": "donut",
881 + "reduceOptions": {
882 + "calcs": ["sum"],
883 + "fields": "",
884 + "values": false
885 + },
886 + "text": {},
887 + "tooltip": {
888 + "mode": "single",
889 + "sort": "none"
890 + }
891 + },
892 + "pluginVersion": "7.1.0",
893 + "targets": [
894 + {
895 + "bucketAggs": [
896 + {
897 + "$$hashKey": "object:82",
898 + "fake": true,
899 + "field": "rule_mitre_technique",
900 + "id": "3",
901 + "settings": {
902 + "min_doc_count": 1,
903 + "order": "desc",
904 + "orderBy": "_count",
905 + "size": "10"
906 + },
907 + "type": "terms"
908 + },
909 + {
910 + "$$hashKey": "object:83",
911 + "field": "timestamp",
912 + "id": "2",
913 + "settings": {
914 + "interval": "auto",
915 + "min_doc_count": 0,
916 + "trimEdges": 0
917 + },
918 + "type": "date_histogram"
919 + }
920 + ],
921 + "datasource": {
922 + "type": "elasticsearch",
923 + "uid": "replace_datasource_uid"
924 + },
925 + "metrics": [
926 + {
927 + "$$hashKey": "object:80",
928 + "field": "select field",
929 + "id": "1",
930 + "type": "count"
931 + }
932 + ],
933 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
934 + "refId": "A",
935 + "timeField": "timestamp"
936 + }
937 + ],
938 + "title": "MITRE ATT&CK TECHNIQUES (TOP 10)",
939 + "type": "piechart"
940 + },
941 + {
942 + "datasource": {
943 + "type": "elasticsearch",
944 + "uid": "replace_datasource_uid"
945 + },
946 + "fieldConfig": {
947 + "defaults": {
948 + "custom": {
949 + "align": "auto",
950 + "displayMode": "auto",
951 + "filterable": false,
952 + "inspect": false
953 + },
954 + "mappings": [
955 + {
956 + "options": {
957 + "mitre_attack": {
958 + "text": "Total"
959 + }
960 + },
961 + "type": "value"
962 + }
963 + ],
964 + "thresholds": {
965 + "mode": "absolute",
966 + "steps": [
967 + {
968 + "color": "green",
969 + "value": null
970 + },
971 + {
972 + "color": "red",
973 + "value": 80
974 + }
975 + ]
976 + }
977 + },
978 + "overrides": [
979 + {
980 + "matcher": {
981 + "id": "byName",
982 + "options": "rule_mitre_technique"
983 + },
984 + "properties": [
985 + {
986 + "id": "custom.width",
987 + "value": 381
988 + }
989 + ]
990 + }
991 + ]
992 + },
993 + "gridPos": {
994 + "h": 11,
995 + "w": 8,
996 + "x": 5,
997 + "y": 18
998 + },
999 + "id": 30,
1000 + "links": [],
1001 + "options": {
1002 + "footer": {
1003 + "fields": "",
1004 + "reducer": ["sum"],
1005 + "show": false
1006 + },
1007 + "showHeader": true,
1008 + "sortBy": []
1009 + },
1010 + "pluginVersion": "9.2.0",
1011 + "targets": [
1012 + {
1013 + "bucketAggs": [
1014 + {
1015 + "$$hashKey": "object:615",
1016 + "fake": true,
1017 + "field": "rule_mitre_technique",
1018 + "id": "4",
1019 + "settings": {
1020 + "min_doc_count": "1",
1021 + "order": "desc",
1022 + "orderBy": "_count",
1023 + "size": "0"
1024 + },
1025 + "type": "terms"
1026 + }
1027 + ],
1028 + "datasource": {
1029 + "type": "elasticsearch",
1030 + "uid": "replace_datasource_uid"
1031 + },
1032 + "metrics": [
1033 + {
1034 + "$$hashKey": "object:80",
1035 + "field": "select field",
1036 + "id": "1",
1037 + "type": "count"
1038 + }
1039 + ],
1040 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1041 + "refId": "A",
1042 + "timeField": "timestamp"
1043 + }
1044 + ],
1045 + "title": "MITRE ATT&CK TECHNIQUES",
1046 + "transformations": [
1047 + {
1048 + "id": "organize",
1049 + "options": {
1050 + "excludeByName": {},
1051 + "indexByName": {},
1052 + "renameByName": {
1053 + "rule_mitre_technique": "MITRE TECHNIQUE"
1054 + }
1055 + }
1056 + }
1057 + ],
1058 + "type": "table"
1059 + },
1060 + {
1061 + "datasource": {
1062 + "type": "elasticsearch",
1063 + "uid": "replace_datasource_uid"
1064 + },
1065 + "fieldConfig": {
1066 + "defaults": {
1067 + "color": {
1068 + "mode": "thresholds"
1069 + },
1070 + "custom": {
1071 + "align": "auto",
1072 + "displayMode": "auto",
1073 + "inspect": false
1074 + },
1075 + "mappings": [
1076 + {
1077 + "options": {
1078 + "mitre_attack": {
1079 + "text": "Total"
1080 + }
1081 + },
1082 + "type": "value"
1083 + }
1084 + ],
1085 + "thresholds": {
1086 + "mode": "absolute",
1087 + "steps": [
1088 + {
1089 + "color": "green",
1090 + "value": null
1091 + },
1092 + {
1093 + "color": "red",
1094 + "value": 80
1095 + }
1096 + ]
1097 + }
1098 + },
1099 + "overrides": [
1100 + {
1101 + "matcher": {
1102 + "id": "byName",
1103 + "options": "ACCOUNT"
1104 + },
1105 + "properties": [
1106 + {
1107 + "id": "custom.width",
1108 + "value": 511
1109 + }
1110 + ]
1111 + }
1112 + ]
1113 + },
1114 + "gridPos": {
1115 + "h": 13,
1116 + "w": 9,
1117 + "x": 0,
1118 + "y": 29
1119 + },
1120 + "id": 17,
1121 + "options": {
1122 + "footer": {
1123 + "fields": "",
1124 + "reducer": ["sum"],
1125 + "show": false
1126 + },
1127 + "showHeader": true,
1128 + "sortBy": []
1129 + },
1130 + "pluginVersion": "9.2.0",
1131 + "targets": [
1132 + {
1133 + "bucketAggs": [
1134 + {
1135 + "$$hashKey": "object:82",
1136 + "fake": true,
1137 + "field": "data_office365_UserId",
1138 + "id": "3",
1139 + "settings": {
1140 + "min_doc_count": 1,
1141 + "order": "desc",
1142 + "orderBy": "_count",
1143 + "size": "10"
1144 + },
1145 + "type": "terms"
1146 + }
1147 + ],
1148 + "datasource": {
1149 + "type": "elasticsearch",
1150 + "uid": "replace_datasource_uid"
1151 + },
1152 + "metrics": [
1153 + {
1154 + "$$hashKey": "object:80",
1155 + "field": "select field",
1156 + "id": "1",
1157 + "type": "count"
1158 + }
1159 + ],
1160 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1161 + "refId": "A",
1162 + "timeField": "timestamp"
1163 + }
1164 + ],
1165 + "title": "MITRE ATT&CK - TOP 10 ACCOUNTS",
1166 + "transformations": [
1167 + {
1168 + "id": "organize",
1169 + "options": {
1170 + "excludeByName": {},
1171 + "indexByName": {},
1172 + "renameByName": {
1173 + "data_office365_UserId": "ACCOUNT"
1174 + }
1175 + }
1176 + }
1177 + ],
1178 + "transparent": true,
1179 + "type": "table"
1180 + },
1181 + {
1182 + "datasource": {
1183 + "type": "elasticsearch",
1184 + "uid": "replace_datasource_uid"
1185 + },
1186 + "fieldConfig": {
1187 + "defaults": {
1188 + "color": {
1189 + "mode": "palette-classic"
1190 + },
1191 + "custom": {
1192 + "axisCenteredZero": false,
1193 + "axisColorMode": "text",
1194 + "axisLabel": "",
1195 + "axisPlacement": "auto",
1196 + "barAlignment": 0,
1197 + "drawStyle": "bars",
1198 + "fillOpacity": 0,
1199 + "gradientMode": "none",
1200 + "hideFrom": {
1201 + "legend": false,
1202 + "tooltip": false,
1203 + "viz": false
1204 + },
1205 + "lineInterpolation": "linear",
1206 + "lineWidth": 1,
1207 + "pointSize": 5,
1208 + "scaleDistribution": {
1209 + "type": "linear"
1210 + },
1211 + "showPoints": "auto",
1212 + "spanNulls": false,
1213 + "stacking": {
1214 + "group": "A",
1215 + "mode": "normal"
1216 + },
1217 + "thresholdsStyle": {
1218 + "mode": "off"
1219 + }
1220 + },
1221 + "mappings": [],
1222 + "thresholds": {
1223 + "mode": "absolute",
1224 + "steps": [
1225 + {
1226 + "color": "green",
1227 + "value": null
1228 + },
1229 + {
1230 + "color": "red",
1231 + "value": 80
1232 + }
1233 + ]
1234 + }
1235 + },
1236 + "overrides": []
1237 + },
1238 + "gridPos": {
1239 + "h": 13,
1240 + "w": 15,
1241 + "x": 9,
1242 + "y": 29
1243 + },
1244 + "id": 39,
1245 + "options": {
1246 + "legend": {
1247 + "calcs": [],
1248 + "displayMode": "table",
1249 + "placement": "right",
1250 + "showLegend": true
1251 + },
1252 + "tooltip": {
1253 + "mode": "single",
1254 + "sort": "none"
1255 + }
1256 + },
1257 + "targets": [
1258 + {
1259 + "alias": "",
1260 + "bucketAggs": [
1261 + {
1262 + "field": "data_office365_Operation",
1263 + "id": "3",
1264 + "settings": {
1265 + "min_doc_count": "1",
1266 + "order": "desc",
1267 + "orderBy": "_count",
1268 + "size": "10"
1269 + },
1270 + "type": "terms"
1271 + },
1272 + {
1273 + "field": "timestamp",
1274 + "id": "2",
1275 + "settings": {
1276 + "interval": "auto"
1277 + },
1278 + "type": "date_histogram"
1279 + }
1280 + ],
1281 + "datasource": {
1282 + "type": "elasticsearch",
1283 + "uid": "replace_datasource_uid"
1284 + },
1285 + "metrics": [
1286 + {
1287 + "id": "1",
1288 + "type": "count"
1289 + }
1290 + ],
1291 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1292 + "refId": "A",
1293 + "timeField": "timestamp"
1294 + }
1295 + ],
1296 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
1297 + "transparent": true,
1298 + "type": "timeseries"
1299 + },
1300 + {
1301 + "datasource": {
1302 + "type": "elasticsearch",
1303 + "uid": "replace_datasource_uid"
1304 + },
1305 + "fieldConfig": {
1306 + "defaults": {
1307 + "color": {
1308 + "mode": "thresholds"
1309 + },
1310 + "custom": {
1311 + "align": "auto",
1312 + "displayMode": "auto",
1313 + "inspect": false
1314 + },
1315 + "mappings": [],
1316 + "thresholds": {
1317 + "mode": "absolute",
1318 + "steps": [
1319 + {
1320 + "color": "green"
1321 + },
1322 + {
1323 + "color": "red",
1324 + "value": 80
1325 + }
1326 + ]
1327 + }
1328 + },
1329 + "overrides": [
1330 + {
1331 + "matcher": {
1332 + "id": "byName",
1333 + "options": "timestamp"
1334 + },
1335 + "properties": [
1336 + {
1337 + "id": "displayName",
1338 + "value": "Date/Time"
1339 + },
1340 + {
1341 + "id": "unit",
1342 + "value": "time: YYYY-MM-DD HH:mm:ss"
1343 + },
1344 + {
1345 + "id": "custom.align"
1346 + }
1347 + ]
1348 + },
1349 + {
1350 + "matcher": {
1351 + "id": "byName",
1352 + "options": "agent_name"
1353 + },
1354 + "properties": [
1355 + {
1356 + "id": "displayName",
1357 + "value": "AGENT"
1358 + },
1359 + {
1360 + "id": "unit",
1361 + "value": "short"
1362 + },
1363 + {
1364 + "id": "decimals",
1365 + "value": 2
1366 + },
1367 + {
1368 + "id": "custom.align"
1369 + }
1370 + ]
1371 + },
1372 + {
1373 + "matcher": {
1374 + "id": "byName",
1375 + "options": "full_log"
1376 + },
1377 + "properties": [
1378 + {
1379 + "id": "displayName",
1380 + "value": "EVENT"
1381 + },
1382 + {
1383 + "id": "unit",
1384 + "value": "short"
1385 + },
1386 + {
1387 + "id": "decimals",
1388 + "value": 2
1389 + }
1390 + ]
1391 + },
1392 + {
1393 + "matcher": {
1394 + "id": "byName",
1395 + "options": "rule_groups"
1396 + },
1397 + "properties": [
1398 + {
1399 + "id": "displayName",
1400 + "value": "RULE GROUPS"
1401 + },
1402 + {
1403 + "id": "unit",
1404 + "value": "short"
1405 + },
1406 + {
1407 + "id": "decimals",
1408 + "value": 2
1409 + },
1410 + {
1411 + "id": "custom.align"
1412 + }
1413 + ]
1414 + },
1415 + {
1416 + "matcher": {
1417 + "id": "byName",
1418 + "options": "rule_level"
1419 + },
1420 + "properties": [
1421 + {
1422 + "id": "displayName",
1423 + "value": "RULE LEVEL"
1424 + },
1425 + {
1426 + "id": "unit",
1427 + "value": "short"
1428 + },
1429 + {
1430 + "id": "decimals",
1431 + "value": -1
1432 + },
1433 + {
1434 + "id": "custom.displayMode",
1435 + "value": "color-background"
1436 + },
1437 + {
1438 + "id": "custom.align"
1439 + },
1440 + {
1441 + "id": "thresholds",
1442 + "value": {
1443 + "mode": "absolute",
1444 + "steps": [
1445 + {
1446 + "color": "#37872D"
1447 + },
1448 + {
1449 + "color": "rgba(237, 129, 40, 0.89)",
1450 + "value": 7
1451 + },
1452 + {
1453 + "color": "rgba(245, 54, 54, 0.9)",
1454 + "value": 12
1455 + }
1456 + ]
1457 + }
1458 + }
1459 + ]
1460 + },
1461 + {
1462 + "matcher": {
1463 + "id": "byName",
1464 + "options": "rule_description"
1465 + },
1466 + "properties": [
1467 + {
1468 + "id": "displayName",
1469 + "value": "RULE DESCRIPTION"
1470 + },
1471 + {
1472 + "id": "unit",
1473 + "value": "short"
1474 + },
1475 + {
1476 + "id": "decimals",
1477 + "value": 2
1478 + },
1479 + {
1480 + "id": "custom.align"
1481 + }
1482 + ]
1483 + },
1484 + {
1485 + "matcher": {
1486 + "id": "byName",
1487 + "options": "EVENT ID"
1488 + },
1489 + "properties": [
1490 + {
1491 + "id": "links",
1492 + "value": [
1493 + {
1494 + "targetBlank": true,
1495 + "title": "VIEW EVENT DETAILS",
1496 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1497 + }
1498 + ]
1499 + }
1500 + ]
1501 + },
1502 + {
1503 + "matcher": {
1504 + "id": "byName",
1505 + "options": "MITRE ID"
1506 + },
1507 + "properties": [
1508 + {
1509 + "id": "custom.width",
1510 + "value": 101
1511 + }
1512 + ]
1513 + },
1514 + {
1515 + "matcher": {
1516 + "id": "byName",
1517 + "options": "SRC IP"
1518 + },
1519 + "properties": [
1520 + {
1521 + "id": "custom.width",
1522 + "value": 140
1523 + }
1524 + ]
1525 + }
1526 + ]
1527 + },
1528 + "gridPos": {
1529 + "h": 16,
1530 + "w": 24,
1531 + "x": 0,
1532 + "y": 42
1533 + },
1534 + "id": 27,
1535 + "options": {
1536 + "footer": {
1537 + "fields": "",
1538 + "reducer": ["sum"],
1539 + "show": false
1540 + },
1541 + "showHeader": true,
1542 + "sortBy": []
1543 + },
1544 + "pluginVersion": "9.0.0",
1545 + "targets": [
1546 + {
1547 + "bucketAggs": [],
1548 + "datasource": {
1549 + "type": "elasticsearch",
1550 + "uid": "replace_datasource_uid"
1551 + },
1552 + "metrics": [
1553 + {
1554 + "id": "1",
1555 + "settings": {
1556 + "size": "250"
1557 + },
1558 + "type": "raw_data"
1559 + }
1560 + ],
1561 + "query": "data_office365_Workload:$workload AND _exists_:rule_mitre_tactic AND rule_level:$rule_level",
1562 + "refId": "A",
1563 + "timeField": "timestamp"
1564 + }
1565 + ],
1566 + "title": "MITRE ATT&CK - TELEMETRY",
1567 + "transformations": [
1568 + {
1569 + "id": "filterFieldsByName",
1570 + "options": {
1571 + "include": {
1572 + "names": [
1573 + "timestamp",
1574 + "_id",
1575 + "rule_description",
1576 + "rule_level",
1577 + "rule_mitre_id",
1578 + "rule_mitre_tactic",
1579 + "rule_mitre_technique",
1580 + "syslog_level",
1581 + "data_office365_Workload",
1582 + "data_office365_CreationTime",
1583 + "data_office365_UserId",
1584 + "data_office365_ClientIP"
1585 + ]
1586 + }
1587 + }
1588 + },
1589 + {
1590 + "id": "organize",
1591 + "options": {
1592 + "excludeByName": {
1593 + "agent_ip": true,
1594 + "timestamp": true
1595 + },
1596 + "indexByName": {
1597 + "_id": 2,
1598 + "data_office365_ClientIP": 4,
1599 + "data_office365_CreationTime": 0,
1600 + "data_office365_UserId": 3,
1601 + "data_office365_Workload": 5,
1602 + "rule_description": 6,
1603 + "rule_level": 7,
1604 + "rule_mitre_id": 8,
1605 + "rule_mitre_tactic": 9,
1606 + "rule_mitre_technique": 10,
1607 + "syslog_level": 11,
1608 + "timestamp": 1
1609 + },
1610 + "renameByName": {
1611 + "_id": "EVENT ID",
1612 + "agent_ip": "",
1613 + "data_office365_ClientIP": "SRC IP",
1614 + "data_office365_CreationTime": "EVENT TIME",
1615 + "data_office365_UserId": "ACCOUNT",
1616 + "data_office365_Workload": "WORKLOAD",
1617 + "rule_description": "",
1618 + "rule_mitre_id": "MITRE ID",
1619 + "rule_mitre_tactic": "TACTIC",
1620 + "rule_mitre_technique": "TECHNIQUE",
1621 + "syslog_level": "LEVEL",
1622 + "timestamp": "DATE/TIME"
1623 + }
1624 + }
1625 + }
1626 + ],
1627 + "type": "table"
1628 + }
1629 + ],
1630 + "refresh": "",
1631 + "schemaVersion": 37,
1632 + "style": "dark",
1633 + "tags": ["O365"],
1634 + "templating": {
1635 + "list": [
1636 + {
1637 + "datasource": {
1638 + "type": "elasticsearch",
1639 + "uid": "replace_datasource_uid"
1640 + },
1641 + "filters": [],
1642 + "hide": 0,
1643 + "label": "Filters",
1644 + "name": "Filters",
1645 + "skipUrlSync": false,
1646 + "type": "adhoc"
1647 + },
1648 + {
1649 + "current": {
1650 + "selected": false,
1651 + "text": "All",
1652 + "value": "$__all"
1653 + },
1654 + "datasource": {
1655 + "type": "elasticsearch",
1656 + "uid": "replace_datasource_uid"
1657 + },
1658 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"_exists_:rule_mitre_tactic\"}",
1659 + "hide": 0,
1660 + "includeAll": true,
1661 + "label": "WORKLOAD",
1662 + "multi": false,
1663 + "name": "workload",
1664 + "options": [],
1665 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"_exists_:rule_mitre_tactic\"}",
1666 + "refresh": 2,
1667 + "regex": "",
1668 + "skipUrlSync": false,
1669 + "sort": 0,
1670 + "tagValuesQuery": "",
1671 + "tagsQuery": "",
1672 + "type": "query",
1673 + "useTags": false
1674 + },
1675 + {
1676 + "current": {
1677 + "selected": false,
1678 + "text": "All",
1679 + "value": "$__all"
1680 + },
1681 + "datasource": {
1682 + "type": "elasticsearch",
1683 + "uid": "replace_datasource_uid"
1684 + },
1685 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1686 + "hide": 0,
1687 + "includeAll": true,
1688 + "label": "Rule Level",
1689 + "multi": false,
1690 + "name": "rule_level",
1691 + "options": [],
1692 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
1693 + "refresh": 2,
1694 + "regex": "",
1695 + "skipUrlSync": false,
1696 + "sort": 0,
1697 + "type": "query"
1698 + }
1699 + ]
1700 + },
1701 + "time": {
1702 + "from": "now-6h",
1703 + "to": "now"
1704 + },
1705 + "timepicker": {
1706 + "refresh_intervals": ["10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"]
1707 + },
1708 + "timezone": "",
1709 + "title": "O365 - MITRE ATT&CK",
1710 + "uid": "Nipjnw37k",
1711 + "version": 1,
1712 + "weekStart": ""
1713 }
backend/app/connectors/grafana/dashboards/Office365/onedrive.json
+2211 -2258
@@ -1,2260 +1,2213 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "10.0.3",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "cellOptions": {
261 - "type": "auto"
262 - },
263 - "inspect": false
264 - },
265 - "mappings": [],
266 - "thresholds": {
267 - "mode": "absolute",
268 - "steps": [
269 - {
270 - "color": "red",
271 - "value": null
272 - }
273 - ]
274 - }
275 - },
276 - "overrides": [
277 - {
278 - "matcher": {
279 - "id": "byName",
280 - "options": "Count"
281 - },
282 - "properties": [
283 - {
284 - "id": "displayName",
285 - "value": "EVENTS"
286 - },
287 - {
288 - "id": "unit",
289 - "value": "short"
290 - },
291 - {
292 - "id": "decimals",
293 - "value": -1
294 - },
295 - {
296 - "id": "custom.align"
297 - },
298 - {
299 - "id": "thresholds",
300 - "value": {
301 - "mode": "absolute",
302 - "steps": [
303 - {
304 - "color": "red",
305 - "value": null
306 - }
307 - ]
308 - }
309 - }
310 - ]
311 - }
312 - ]
313 - },
314 - "gridPos": {
315 - "h": 7,
316 - "w": 6,
317 - "x": 8,
318 - "y": 0
319 - },
320 - "id": 54,
321 - "options": {
322 - "cellHeight": "sm",
323 - "footer": {
324 - "countRows": false,
325 - "fields": "",
326 - "reducer": [
327 - "sum"
328 - ],
329 - "show": false
330 - },
331 - "showHeader": true
332 - },
333 - "pluginVersion": "10.0.3",
334 - "targets": [
335 - {
336 - "bucketAggs": [
337 - {
338 - "fake": true,
339 - "field": "data_office365_Operation",
340 - "id": "4",
341 - "settings": {
342 - "min_doc_count": 1,
343 - "order": "desc",
344 - "orderBy": "_count",
345 - "size": "0"
346 - },
347 - "type": "terms"
348 - }
349 - ],
350 - "datasource": {
351 - "type": "elasticsearch",
352 - "uid": "replace_datasource_uid"
353 - },
354 - "metrics": [
355 - {
356 - "field": "select field",
357 - "id": "1",
358 - "type": "count"
359 - }
360 - ],
361 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
362 - "refId": "A",
363 - "timeField": "timestamp"
364 - }
365 - ],
366 - "title": "EVENTS BY OPERATION",
367 - "transformations": [
368 - {
369 - "id": "merge",
370 - "options": {
371 - "reducers": []
372 - }
373 - },
374 - {
375 - "id": "organize",
376 - "options": {
377 - "excludeByName": {},
378 - "indexByName": {},
379 - "renameByName": {
380 - "Count": "EVENTS",
381 - "data_office365_Operation": "OPERATION"
382 - }
383 - }
384 - }
385 - ],
386 - "type": "table"
387 - },
388 - {
389 - "datasource": {
390 - "type": "elasticsearch",
391 - "uid": "replace_datasource_uid"
392 - },
393 - "fieldConfig": {
394 - "defaults": {
395 - "color": {
396 - "mode": "thresholds"
397 - },
398 - "mappings": [
399 - {
400 - "options": {
401 - "match": "null",
402 - "result": {
403 - "text": "N/A"
404 - }
405 - },
406 - "type": "special"
407 - }
408 - ],
409 - "max": 15,
410 - "min": 0,
411 - "thresholds": {
412 - "mode": "absolute",
413 - "steps": [
414 - {
415 - "color": "#299c46",
416 - "value": null
417 - },
418 - {
419 - "color": "rgba(237, 129, 40, 0.89)",
420 - "value": 8
421 - },
422 - {
423 - "color": "#d44a3a",
424 - "value": 12
425 - }
426 - ]
427 - },
428 - "unit": "none"
429 - },
430 - "overrides": []
431 - },
432 - "gridPos": {
433 - "h": 7,
434 - "w": 4,
435 - "x": 0,
436 - "y": 7
437 - },
438 - "id": 16,
439 - "links": [],
440 - "options": {
441 - "orientation": "horizontal",
442 - "reduceOptions": {
443 - "calcs": [
444 - "max"
445 - ],
446 - "fields": "",
447 - "values": false
448 - },
449 - "showThresholdLabels": false,
450 - "showThresholdMarkers": true,
451 - "text": {}
452 - },
453 - "pluginVersion": "10.0.3",
454 - "targets": [
455 - {
456 - "bucketAggs": [
457 - {
458 - "field": "timestamp",
459 - "id": "2",
460 - "settings": {
461 - "interval": "auto",
462 - "min_doc_count": 0,
463 - "trimEdges": 0
464 - },
465 - "type": "date_histogram"
466 - }
467 - ],
468 - "datasource": {
469 - "type": "elasticsearch",
470 - "uid": "replace_datasource_uid"
471 - },
472 - "metrics": [
473 - {
474 - "field": "rule_level",
475 - "id": "1",
476 - "meta": {},
477 - "settings": {},
478 - "type": "max"
479 - }
480 - ],
481 - "query": "data_office365_Operation:$operation",
482 - "refId": "A",
483 - "timeField": "timestamp"
484 - }
485 - ],
486 - "title": "MAX SEVERITY (0 - 15)",
487 - "type": "gauge"
488 - },
489 - {
490 - "datasource": {
491 - "type": "elasticsearch",
492 - "uid": "replace_datasource_uid"
493 - },
494 - "fieldConfig": {
495 - "defaults": {
496 - "color": {
497 - "mode": "palette-classic"
498 - },
499 - "custom": {
500 - "axisCenteredZero": false,
501 - "axisColorMode": "text",
502 - "axisLabel": "",
503 - "axisPlacement": "auto",
504 - "barAlignment": 0,
505 - "drawStyle": "bars",
506 - "fillOpacity": 0,
507 - "gradientMode": "none",
508 - "hideFrom": {
509 - "legend": false,
510 - "tooltip": false,
511 - "viz": false
512 - },
513 - "lineInterpolation": "linear",
514 - "lineWidth": 1,
515 - "pointSize": 5,
516 - "scaleDistribution": {
517 - "type": "linear"
518 - },
519 - "showPoints": "auto",
520 - "spanNulls": false,
521 - "stacking": {
522 - "group": "A",
523 - "mode": "normal"
524 - },
525 - "thresholdsStyle": {
526 - "mode": "off"
527 - }
528 - },
529 - "mappings": [],
530 - "thresholds": {
531 - "mode": "absolute",
532 - "steps": [
533 - {
534 - "color": "green",
535 - "value": null
536 - },
537 - {
538 - "color": "red",
539 - "value": 80
540 - }
541 - ]
542 - }
543 - },
544 - "overrides": []
545 - },
546 - "gridPos": {
547 - "h": 13,
548 - "w": 20,
549 - "x": 4,
550 - "y": 7
551 - },
552 - "id": 60,
553 - "options": {
554 - "legend": {
555 - "calcs": [],
556 - "displayMode": "table",
557 - "placement": "right",
558 - "showLegend": true
559 - },
560 - "tooltip": {
561 - "mode": "single",
562 - "sort": "none"
563 - }
564 - },
565 - "targets": [
566 - {
567 - "alias": "",
568 - "bucketAggs": [
569 - {
570 - "field": "data_office365_Operation",
571 - "id": "3",
572 - "settings": {
573 - "min_doc_count": "1",
574 - "order": "desc",
575 - "orderBy": "_count",
576 - "size": "10"
577 - },
578 - "type": "terms"
579 - },
580 - {
581 - "field": "timestamp",
582 - "id": "2",
583 - "settings": {
584 - "interval": "auto"
585 - },
586 - "type": "date_histogram"
587 - }
588 - ],
589 - "datasource": {
590 - "type": "elasticsearch",
591 - "uid": "replace_datasource_uid"
592 - },
593 - "metrics": [
594 - {
595 - "id": "1",
596 - "type": "count"
597 - }
598 - ],
599 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
600 - "refId": "A",
601 - "timeField": "timestamp"
602 - }
603 - ],
604 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
605 - "transparent": true,
606 - "type": "timeseries"
607 - },
608 - {
609 - "datasource": {
610 - "type": "elasticsearch",
611 - "uid": "replace_datasource_uid"
612 - },
613 - "fieldConfig": {
614 - "defaults": {
615 - "mappings": [
616 - {
617 - "options": {
618 - "match": "null",
619 - "result": {
620 - "text": "N/A"
621 - }
622 - },
623 - "type": "special"
624 - }
625 - ],
626 - "thresholds": {
627 - "mode": "absolute",
628 - "steps": [
629 - {
630 - "color": "blue",
631 - "value": null
632 - }
633 - ]
634 - },
635 - "unit": "locale"
636 - },
637 - "overrides": []
638 - },
639 - "gridPos": {
640 - "h": 6,
641 - "w": 4,
642 - "x": 0,
643 - "y": 14
644 - },
645 - "id": 51,
646 - "links": [],
647 - "options": {
648 - "colorMode": "value",
649 - "graphMode": "area",
650 - "justifyMode": "auto",
651 - "orientation": "horizontal",
652 - "reduceOptions": {
653 - "calcs": [
654 - "sum"
655 - ],
656 - "fields": "",
657 - "values": false
658 - },
659 - "text": {},
660 - "textMode": "auto"
661 - },
662 - "pluginVersion": "10.0.3",
663 - "targets": [
664 - {
665 - "bucketAggs": [
666 - {
667 - "$$hashKey": "object:331",
668 - "field": "timestamp",
669 - "id": "2",
670 - "settings": {
671 - "interval": "auto",
672 - "min_doc_count": 0,
673 - "trimEdges": 0
674 - },
675 - "type": "date_histogram"
676 - }
677 - ],
678 - "datasource": {
679 - "type": "elasticsearch",
680 - "uid": "replace_datasource_uid"
681 - },
682 - "metrics": [
683 - {
684 - "$$hashKey": "object:329",
685 - "field": "select field",
686 - "id": "1",
687 - "type": "count"
688 - }
689 - ],
690 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
691 - "refId": "A",
692 - "timeField": "timestamp"
693 - }
694 - ],
695 - "title": "EVENTS (Total)",
696 - "type": "stat"
697 - },
698 - {
699 - "datasource": {
700 - "type": "elasticsearch",
701 - "uid": "replace_datasource_uid"
702 - },
703 - "fieldConfig": {
704 - "defaults": {
705 - "mappings": [
706 - {
707 - "options": {
708 - "match": "null",
709 - "result": {
710 - "text": "N/A"
711 - }
712 - },
713 - "type": "special"
714 - }
715 - ],
716 - "thresholds": {
717 - "mode": "absolute",
718 - "steps": [
719 - {
720 - "color": "orange",
721 - "value": null
722 - }
723 - ]
724 - },
725 - "unit": "locale"
726 - },
727 - "overrides": []
728 - },
729 - "gridPos": {
730 - "h": 6,
731 - "w": 4,
732 - "x": 0,
733 - "y": 20
734 - },
735 - "id": 52,
736 - "links": [],
737 - "options": {
738 - "colorMode": "value",
739 - "graphMode": "area",
740 - "justifyMode": "auto",
741 - "orientation": "horizontal",
742 - "reduceOptions": {
743 - "calcs": [
744 - "sum"
745 - ],
746 - "fields": "",
747 - "values": false
748 - },
749 - "text": {},
750 - "textMode": "auto"
751 - },
752 - "pluginVersion": "10.0.3",
753 - "targets": [
754 - {
755 - "bucketAggs": [
756 - {
757 - "$$hashKey": "object:331",
758 - "field": "timestamp",
759 - "id": "2",
760 - "settings": {
761 - "interval": "auto",
762 - "min_doc_count": 0,
763 - "trimEdges": 0
764 - },
765 - "type": "date_histogram"
766 - }
767 - ],
768 - "datasource": {
769 - "type": "elasticsearch",
770 - "uid": "replace_datasource_uid"
771 - },
772 - "metrics": [
773 - {
774 - "$$hashKey": "object:329",
775 - "field": "select field",
776 - "id": "1",
777 - "type": "count"
778 - }
779 - ],
780 - "query": "data_office365_Operation:MessageCreatedHasLink AND rule_level:$rule_level",
781 - "refId": "A",
782 - "timeField": "timestamp"
783 - }
784 - ],
785 - "title": "ONEDRIVE - MESSAGES CONTAINING LINK",
786 - "type": "stat"
787 - },
788 - {
789 - "circleMaxSize": 30,
790 - "circleMinSize": 2,
791 - "colors": [
792 - "rgba(245, 54, 54, 0.9)",
793 - "rgba(237, 129, 40, 0.89)",
794 - "rgba(50, 172, 45, 0.97)"
795 - ],
796 - "datasource": {
797 - "type": "elasticsearch",
798 - "uid": "replace_datasource_uid"
799 - },
800 - "decimals": 0,
801 - "esMetric": "Count",
802 - "gridPos": {
803 - "h": 12,
804 - "w": 10,
805 - "x": 4,
806 - "y": 20
807 - },
808 - "hideEmpty": false,
809 - "hideZero": false,
810 - "id": 50,
811 - "initialZoom": 1,
812 - "locationData": "countries",
813 - "mapCenter": "(0°, 0°)",
814 - "mapCenterLatitude": 0,
815 - "mapCenterLongitude": 0,
816 - "maxDataPoints": 1,
817 - "mouseWheelZoom": false,
818 - "showLegend": true,
819 - "stickyLabels": false,
820 - "tableQueryOptions": {
821 - "geohashField": "geohash",
822 - "latitudeField": "latitude",
823 - "longitudeField": "longitude",
824 - "metricField": "metric",
825 - "queryType": "geohash"
826 - },
827 - "targets": [
828 - {
829 - "bucketAggs": [
830 - {
831 - "fake": true,
832 - "field": "data_office365_ClientIP_country_code",
833 - "id": "3",
834 - "settings": {
835 - "min_doc_count": 1,
836 - "order": "desc",
837 - "orderBy": "_term",
838 - "size": "0"
839 - },
840 - "type": "terms"
841 - },
842 - {
843 - "field": "timestamp",
844 - "id": "2",
845 - "settings": {
846 - "interval": "auto",
847 - "min_doc_count": 0,
848 - "trimEdges": 0
849 - },
850 - "type": "date_histogram"
851 - }
852 - ],
853 - "datasource": {
854 - "type": "elasticsearch",
855 - "uid": "replace_datasource_uid"
856 - },
857 - "metrics": [
858 - {
859 - "field": "select field",
860 - "id": "1",
861 - "type": "count"
862 - }
863 - ],
864 - "query": "data_office365_Workload:OneDrive AND rule_level:$rule_level",
865 - "refId": "A",
866 - "timeField": "timestamp"
867 - }
868 - ],
869 - "thresholds": "0,10",
870 - "title": "ONEDRIVE - ALL EVENTS BY SRC COUNTRY",
871 - "type": "grafana-worldmap-panel",
872 - "unitPlural": "",
873 - "unitSingle": "",
874 - "valueName": "total"
875 - },
876 - {
877 - "datasource": {
878 - "type": "elasticsearch",
879 - "uid": "replace_datasource_uid"
880 - },
881 - "fieldConfig": {
882 - "defaults": {
883 - "color": {
884 - "mode": "thresholds"
885 - },
886 - "custom": {
887 - "align": "auto",
888 - "cellOptions": {
889 - "type": "auto"
890 - },
891 - "inspect": false
892 - },
893 - "mappings": [],
894 - "thresholds": {
895 - "mode": "absolute",
896 - "steps": [
897 - {
898 - "color": "orange",
899 - "value": null
900 - }
901 - ]
902 - }
903 - },
904 - "overrides": [
905 - {
906 - "matcher": {
907 - "id": "byName",
908 - "options": "Count"
909 - },
910 - "properties": [
911 - {
912 - "id": "displayName",
913 - "value": "EVENTS"
914 - },
915 - {
916 - "id": "unit",
917 - "value": "short"
918 - },
919 - {
920 - "id": "decimals",
921 - "value": -1
922 - },
923 - {
924 - "id": "custom.align"
925 - }
926 - ]
927 - },
928 - {
929 - "matcher": {
930 - "id": "byName",
931 - "options": "AD ACCOUNT"
932 - },
933 - "properties": [
934 - {
935 - "id": "custom.width",
936 - "value": 377
937 - }
938 - ]
939 - }
940 - ]
941 - },
942 - "gridPos": {
943 - "h": 12,
944 - "w": 10,
945 - "x": 14,
946 - "y": 20
947 - },
948 - "id": 58,
949 - "options": {
950 - "cellHeight": "sm",
951 - "footer": {
952 - "countRows": false,
953 - "fields": "",
954 - "reducer": [
955 - "sum"
956 - ],
957 - "show": false
958 - },
959 - "showHeader": true,
960 - "sortBy": []
961 - },
962 - "pluginVersion": "10.0.3",
963 - "targets": [
964 - {
965 - "bucketAggs": [
966 - {
967 - "fake": true,
968 - "field": "data_office365_UserId",
969 - "id": "4",
970 - "settings": {
971 - "min_doc_count": 1,
972 - "order": "desc",
973 - "orderBy": "_count",
974 - "size": "0"
975 - },
976 - "type": "terms"
977 - },
978 - {
979 - "field": "data_office365_ClientIP_country_code",
980 - "id": "5",
981 - "settings": {
982 - "min_doc_count": "1",
983 - "order": "desc",
984 - "orderBy": "_term",
985 - "size": "10"
986 - },
987 - "type": "terms"
988 - }
989 - ],
990 - "datasource": {
991 - "type": "elasticsearch",
992 - "uid": "replace_datasource_uid"
993 - },
994 - "metrics": [
995 - {
996 - "field": "select field",
997 - "id": "1",
998 - "type": "count"
999 - }
1000 - ],
1001 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1002 - "refId": "A",
1003 - "timeField": "timestamp"
1004 - }
1005 - ],
1006 - "title": "ONEDRIVE EVENTS BY ACCOUNT",
1007 - "transformations": [
1008 - {
1009 - "id": "merge",
1010 - "options": {
1011 - "reducers": []
1012 - }
1013 - },
1014 - {
1015 - "id": "organize",
1016 - "options": {
1017 - "excludeByName": {},
1018 - "indexByName": {},
1019 - "renameByName": {
1020 - "Count": "EVENTS",
1021 - "data_office365_ClientIP_country_code": "COUNTRY",
1022 - "data_office365_LogonError": "ERROR",
1023 - "data_office365_Operation": "WORKLOAD",
1024 - "data_office365_UserId": "AD ACCOUNT"
1025 - }
1026 - }
1027 - }
1028 - ],
1029 - "type": "table"
1030 - },
1031 - {
1032 - "datasource": {
1033 - "type": "elasticsearch",
1034 - "uid": "replace_datasource_uid"
1035 - },
1036 - "fieldConfig": {
1037 - "defaults": {
1038 - "mappings": [
1039 - {
1040 - "options": {
1041 - "match": "null",
1042 - "result": {
1043 - "text": "N/A"
1044 - }
1045 - },
1046 - "type": "special"
1047 - }
1048 - ],
1049 - "thresholds": {
1050 - "mode": "absolute",
1051 - "steps": [
1052 - {
1053 - "color": "blue",
1054 - "value": null
1055 - }
1056 - ]
1057 - },
1058 - "unit": "locale"
1059 - },
1060 - "overrides": []
1061 - },
1062 - "gridPos": {
1063 - "h": 6,
1064 - "w": 4,
1065 - "x": 0,
1066 - "y": 26
1067 - },
1068 - "id": 18,
1069 - "links": [],
1070 - "options": {
1071 - "colorMode": "value",
1072 - "graphMode": "area",
1073 - "justifyMode": "auto",
1074 - "orientation": "horizontal",
1075 - "reduceOptions": {
1076 - "calcs": [
1077 - "sum"
1078 - ],
1079 - "fields": "",
1080 - "values": false
1081 - },
1082 - "text": {},
1083 - "textMode": "auto"
1084 - },
1085 - "pluginVersion": "10.0.3",
1086 - "targets": [
1087 - {
1088 - "bucketAggs": [
1089 - {
1090 - "$$hashKey": "object:331",
1091 - "field": "timestamp",
1092 - "id": "2",
1093 - "settings": {
1094 - "interval": "auto",
1095 - "min_doc_count": 0,
1096 - "trimEdges": 0
1097 - },
1098 - "type": "date_histogram"
1099 - }
1100 - ],
1101 - "datasource": {
1102 - "type": "elasticsearch",
1103 - "uid": "replace_datasource_uid"
1104 - },
1105 - "metrics": [
1106 - {
1107 - "$$hashKey": "object:329",
1108 - "field": "select field",
1109 - "id": "1",
1110 - "type": "count"
1111 - }
1112 - ],
1113 - "query": "data_office365_Operation:TeamsSessionStarted AND rule_level:$rule_level",
1114 - "refId": "A",
1115 - "timeField": "timestamp"
1116 - }
1117 - ],
1118 - "title": "ONEDRIVE - SESSIONS STARTED",
1119 - "type": "stat"
1120 - },
1121 - {
1122 - "datasource": {
1123 - "type": "elasticsearch",
1124 - "uid": "replace_datasource_uid"
1125 - },
1126 - "fieldConfig": {
1127 - "defaults": {
1128 - "color": {
1129 - "mode": "thresholds"
1130 - },
1131 - "custom": {
1132 - "align": "auto",
1133 - "cellOptions": {
1134 - "type": "auto"
1135 - },
1136 - "filterable": true,
1137 - "inspect": false
1138 - },
1139 - "mappings": [],
1140 - "thresholds": {
1141 - "mode": "absolute",
1142 - "steps": [
1143 - {
1144 - "color": "green",
1145 - "value": null
1146 - },
1147 - {
1148 - "color": "red",
1149 - "value": 80
1150 - }
1151 - ]
1152 - }
1153 - },
1154 - "overrides": [
1155 - {
1156 - "matcher": {
1157 - "id": "byName",
1158 - "options": "rule_level"
1159 - },
1160 - "properties": [
1161 - {
1162 - "id": "displayName",
1163 - "value": "RULE LEVEL"
1164 - },
1165 - {
1166 - "id": "unit",
1167 - "value": "short"
1168 - },
1169 - {
1170 - "id": "decimals",
1171 - "value": -1
1172 - },
1173 - {
1174 - "id": "custom.cellOptions",
1175 - "value": {
1176 - "mode": "gradient",
1177 - "type": "color-background"
1178 - }
1179 - },
1180 - {
1181 - "id": "custom.align"
1182 - },
1183 - {
1184 - "id": "thresholds",
1185 - "value": {
1186 - "mode": "absolute",
1187 - "steps": [
1188 - {
1189 - "color": "#37872D",
1190 - "value": null
1191 - },
1192 - {
1193 - "color": "rgba(237, 129, 40, 0.89)",
1194 - "value": 7
1195 - },
1196 - {
1197 - "color": "rgba(245, 54, 54, 0.9)",
1198 - "value": 12
1199 - }
1200 - ]
1201 - }
1202 - }
1203 - ]
1204 - },
1205 - {
1206 - "matcher": {
1207 - "id": "byName",
1208 - "options": "Date/Time"
1209 - },
1210 - "properties": [
1211 - {
1212 - "id": "custom.width",
1213 - "value": 242
1214 - }
1215 - ]
1216 - },
1217 - {
1218 - "matcher": {
1219 - "id": "byName",
1220 - "options": "MITRE TACTIC"
1221 - },
1222 - "properties": [
1223 - {
1224 - "id": "custom.width",
1225 - "value": 332
1226 - }
1227 - ]
1228 - },
1229 - {
1230 - "matcher": {
1231 - "id": "byName",
1232 - "options": "IP ADDRESS"
1233 - },
1234 - "properties": [
1235 - {
1236 - "id": "custom.width",
1237 - "value": 163
1238 - }
1239 - ]
1240 - },
1241 - {
1242 - "matcher": {
1243 - "id": "byName",
1244 - "options": "MITRE TECHNIQUE"
1245 - },
1246 - "properties": [
1247 - {
1248 - "id": "custom.width",
1249 - "value": 312
1250 - }
1251 - ]
1252 - },
1253 - {
1254 - "matcher": {
1255 - "id": "byName",
1256 - "options": "EVENT ID"
1257 - },
1258 - "properties": [
1259 - {
1260 - "id": "links",
1261 - "value": [
1262 - {
1263 - "targetBlank": true,
1264 - "title": "VIEW EVENT DETAILS",
1265 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1266 - }
1267 - ]
1268 - },
1269 - {
1270 - "id": "custom.width",
1271 - "value": 265
1272 - }
1273 - ]
1274 - },
1275 - {
1276 - "matcher": {
1277 - "id": "byName",
1278 - "options": "RESULT"
1279 - },
1280 - "properties": [
1281 - {
1282 - "id": "custom.width",
1283 - "value": 118
1284 - },
1285 - {
1286 - "id": "mappings",
1287 - "value": [
1288 - {
1289 - "options": {
1290 - "Failed": {
1291 - "color": "orange",
1292 - "index": 1
1293 - },
1294 - "Success": {
1295 - "color": "green",
1296 - "index": 0
1297 - }
1298 - },
1299 - "type": "value"
1300 - }
1301 - ]
1302 - },
1303 - {
1304 - "id": "custom.cellOptions",
1305 - "value": {
1306 - "type": "color-text"
1307 - }
1308 - }
1309 - ]
1310 - },
1311 - {
1312 - "matcher": {
1313 - "id": "byName",
1314 - "options": "SRC IP"
1315 - },
1316 - "properties": [
1317 - {
1318 - "id": "custom.width",
1319 - "value": 265
1320 - }
1321 - ]
1322 - },
1323 - {
1324 - "matcher": {
1325 - "id": "byName",
1326 - "options": "ACCOUNT"
1327 - },
1328 - "properties": [
1329 - {
1330 - "id": "custom.width",
1331 - "value": 227
1332 - }
1333 - ]
1334 - },
1335 - {
1336 - "matcher": {
1337 - "id": "byName",
1338 - "options": "EVENT TIME"
1339 - },
1340 - "properties": [
1341 - {
1342 - "id": "custom.width",
1343 - "value": 195
1344 - }
1345 - ]
1346 - },
1347 - {
1348 - "matcher": {
1349 - "id": "byName",
1350 - "options": "CLIENT IP"
1351 - },
1352 - "properties": [
1353 - {
1354 - "id": "custom.width",
1355 - "value": 191
1356 - }
1357 - ]
1358 - },
1359 - {
1360 - "matcher": {
1361 - "id": "byName",
1362 - "options": "DESCRIPTION"
1363 - },
1364 - "properties": [
1365 - {
1366 - "id": "custom.width",
1367 - "value": 367
1368 - }
1369 - ]
1370 - },
1371 - {
1372 - "matcher": {
1373 - "id": "byName",
1374 - "options": "FILE"
1375 - },
1376 - "properties": [
1377 - {
1378 - "id": "custom.width",
1379 - "value": 282
1380 - }
1381 - ]
1382 - }
1383 - ]
1384 - },
1385 - "gridPos": {
1386 - "h": 16,
1387 - "w": 24,
1388 - "x": 0,
1389 - "y": 32
1390 - },
1391 - "id": 27,
1392 - "options": {
1393 - "cellHeight": "sm",
1394 - "footer": {
1395 - "countRows": false,
1396 - "enablePagination": true,
1397 - "fields": "",
1398 - "reducer": [
1399 - "sum"
1400 - ],
1401 - "show": false
1402 - },
1403 - "showHeader": true,
1404 - "sortBy": []
1405 - },
1406 - "pluginVersion": "10.0.3",
1407 - "targets": [
1408 - {
1409 - "bucketAggs": [],
1410 - "datasource": {
1411 - "type": "elasticsearch",
1412 - "uid": "replace_datasource_uid"
1413 - },
1414 - "metrics": [
1415 - {
1416 - "id": "1",
1417 - "settings": {
1418 - "size": "250"
1419 - },
1420 - "type": "raw_data"
1421 - }
1422 - ],
1423 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1424 - "refId": "A",
1425 - "timeField": "timestamp"
1426 - }
1427 - ],
1428 - "title": "EVENTS",
1429 - "transformations": [
1430 - {
1431 - "id": "organize",
1432 - "options": {
1433 - "excludeByName": {
1434 - "@metadata_beat": true,
1435 - "@metadata_type": true,
1436 - "@metadata_version": true,
1437 - "IMPHASH": true,
1438 - "MD5": true,
1439 - "SHA1": true,
1440 - "SHA256": true,
1441 - "_id": false,
1442 - "_index": true,
1443 - "_type": true,
1444 - "agent_ephemeral_id": true,
1445 - "agent_hostname": true,
1446 - "agent_id": true,
1447 - "agent_ip_city_name": true,
1448 - "agent_ip_country_code": true,
1449 - "agent_ip_geolocation": true,
1450 - "agent_name": true,
1451 - "agent_type": true,
1452 - "agent_version": true,
1453 - "beats_type": true,
1454 - "cluster_name": true,
1455 - "cluster_node": true,
1456 - "collector_node_id": true,
1457 - "data_alert_action": true,
1458 - "data_alert_category": true,
1459 - "data_alert_gid": true,
1460 - "data_alert_rev": true,
1461 - "data_alert_severity": true,
1462 - "data_alert_signature": true,
1463 - "data_alert_signature_id": true,
1464 - "data_app_proto": true,
1465 - "data_audit_auid": true,
1466 - "data_audit_command": true,
1467 - "data_audit_euid": true,
1468 - "data_audit_exe": true,
1469 - "data_audit_gid": true,
1470 - "data_audit_id": true,
1471 - "data_audit_pid": true,
1472 - "data_audit_res": true,
1473 - "data_audit_session": true,
1474 - "data_audit_type": true,
1475 - "data_audit_uid": true,
1476 - "data_dest_ip": true,
1477 - "data_dest_port": true,
1478 - "data_dstuser": true,
1479 - "data_event_type": true,
1480 - "data_extra_data": true,
1481 - "data_file": true,
1482 - "data_flow_bytes_toclient": true,
1483 - "data_flow_bytes_toserver": true,
1484 - "data_flow_id": true,
1485 - "data_flow_pkts_toclient": true,
1486 - "data_flow_pkts_toserver": true,
1487 - "data_flow_start": true,
1488 - "data_http_http_content_type": true,
1489 - "data_http_http_port": true,
1490 - "data_http_length": true,
1491 - "data_http_status": true,
1492 - "data_http_url": true,
1493 - "data_id": true,
1494 - "data_in_iface": true,
1495 - "data_integration": true,
1496 - "data_metadata_flowbits": true,
1497 - "data_metadata_flowints_http_anomaly_count": true,
1498 - "data_metadata_flowints_tcp_retransmission_count": true,
1499 - "data_office365_AADGroupId": true,
1500 - "data_office365_Actor": true,
1501 - "data_office365_ActorContextId": true,
1502 - "data_office365_ActorIpAddress": false,
1503 - "data_office365_ActorIpAddress_city_name": true,
1504 - "data_office365_ActorIpAddress_country_code": true,
1505 - "data_office365_ActorIpAddress_geolocation": true,
1506 - "data_office365_AppAccessContext_AADSessionId": true,
1507 - "data_office365_AppAccessContext_APIId": true,
1508 - "data_office365_AppAccessContext_ClientAppId": true,
1509 - "data_office365_AppAccessContext_ClientAppName": true,
1510 - "data_office365_AppAccessContext_CorrelationId": true,
1511 - "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1512 - "data_office365_AppAccessContext_UniqueTokenId": true,
1513 - "data_office365_AppId": true,
1514 - "data_office365_ApplicationDisplayName": true,
1515 - "data_office365_ApplicationId": true,
1516 - "data_office365_ArtifactsShared": true,
1517 - "data_office365_Attendees": true,
1518 - "data_office365_AuthenticationType": true,
1519 - "data_office365_AzureActiveDirectoryEventType": true,
1520 - "data_office365_BrowserVersion": true,
1521 - "data_office365_BrowserVersion_city_name": true,
1522 - "data_office365_BrowserVersion_country_code": true,
1523 - "data_office365_BrowserVersion_geolocation": true,
1524 - "data_office365_ChannelGuid": true,
1525 - "data_office365_ChannelName": true,
1526 - "data_office365_ChatName": true,
1527 - "data_office365_ChatThreadId": true,
1528 - "data_office365_ClientAppId": true,
1529 - "data_office365_ClientIP": false,
1530 - "data_office365_ClientIPAddress": true,
1531 - "data_office365_ClientIPAddress_city_name": true,
1532 - "data_office365_ClientIPAddress_country_code": true,
1533 - "data_office365_ClientIPAddress_geolocation": true,
1534 - "data_office365_ClientIP_city_name": true,
1535 - "data_office365_ClientIP_country_code": true,
1536 - "data_office365_ClientIP_geolocation": true,
1537 - "data_office365_ClientInfoString": true,
1538 - "data_office365_ClientProcessName": true,
1539 - "data_office365_ClientRequestId": true,
1540 - "data_office365_ClientVersion": true,
1541 - "data_office365_CommunicationSubType": true,
1542 - "data_office365_CommunicationType": true,
1543 - "data_office365_CorrelationId": true,
1544 - "data_office365_CreationTime": false,
1545 - "data_office365_CrossMailboxOperation": true,
1546 - "data_office365_CustomUniqueId": true,
1547 - "data_office365_DestFolder_Id": true,
1548 - "data_office365_DestFolder_Path": true,
1549 - "data_office365_DeviceDisplayName": true,
1550 - "data_office365_DeviceDisplayName_city_name": true,
1551 - "data_office365_DeviceDisplayName_country_code": true,
1552 - "data_office365_DeviceDisplayName_geolocation": true,
1553 - "data_office365_DeviceId": true,
1554 - "data_office365_DeviceInformation": true,
1555 - "data_office365_DeviceProperties": true,
1556 - "data_office365_DoNotDistributeEvent": true,
1557 - "data_office365_EndTime": true,
1558 - "data_office365_ErrorNumber": true,
1559 - "data_office365_EventData": true,
1560 - "data_office365_EventSource": true,
1561 - "data_office365_ExchangeId": true,
1562 - "data_office365_ExtendedProperties": true,
1563 - "data_office365_ExternalAccess": true,
1564 - "data_office365_ExtraProperties": true,
1565 - "data_office365_FileSizeBytes": true,
1566 - "data_office365_FileSyncBytesCommitted": true,
1567 - "data_office365_Folder_Id": true,
1568 - "data_office365_Folder_Path": true,
1569 - "data_office365_HighPriorityMediaProcessing": true,
1570 - "data_office365_HostedContents": true,
1571 - "data_office365_ICalUid": true,
1572 - "data_office365_Id": true,
1573 - "data_office365_ImplicitShare": true,
1574 - "data_office365_InterSystemsId": true,
1575 - "data_office365_InternalLogonType": true,
1576 - "data_office365_IntraSystemId": true,
1577 - "data_office365_IsManagedDevice": true,
1578 - "data_office365_ItemName": true,
1579 - "data_office365_ItemType": true,
1580 - "data_office365_Item_Id": true,
1581 - "data_office365_Item_InternetMessageId": true,
1582 - "data_office365_Item_IsRecord": true,
1583 - "data_office365_Item_ParentFolder_Id": true,
1584 - "data_office365_Item_SizeInBytes": true,
1585 - "data_office365_JoinTime": true,
1586 - "data_office365_LeaveTime": true,
1587 - "data_office365_ListBaseType": true,
1588 - "data_office365_ListId": true,
1589 - "data_office365_ListItemUniqueId": true,
1590 - "data_office365_ListServerTemplate": true,
1591 - "data_office365_LogonError": true,
1592 - "data_office365_LogonType": true,
1593 - "data_office365_LogonUserSid": true,
1594 - "data_office365_MachineId": true,
1595 - "data_office365_MailboxGuid": true,
1596 - "data_office365_MailboxOwnerSid": true,
1597 - "data_office365_MailboxOwnerUPN": true,
1598 - "data_office365_MeetingDetailId": true,
1599 - "data_office365_MeetingURL": true,
1600 - "data_office365_Members": true,
1601 - "data_office365_MessageId": true,
1602 - "data_office365_MessageSizeInBytes": true,
1603 - "data_office365_MessageURLs": true,
1604 - "data_office365_MessageVersion": true,
1605 - "data_office365_Modalities": true,
1606 - "data_office365_ModifiedProperties": true,
1607 - "data_office365_Name": true,
1608 - "data_office365_NewValue": true,
1609 - "data_office365_ObjectId": true,
1610 - "data_office365_Operation": true,
1611 - "data_office365_OperationScope": true,
1612 - "data_office365_OrganizationId": true,
1613 - "data_office365_OrganizationName": true,
1614 - "data_office365_Organizer_OrganizationId": true,
1615 - "data_office365_Organizer_RecipientType": true,
1616 - "data_office365_Organizer_Role": true,
1617 - "data_office365_Organizer_UserObjectId": true,
1618 - "data_office365_OriginatingServer": true,
1619 - "data_office365_Parameters": true,
1620 - "data_office365_ParentMessageId": true,
1621 - "data_office365_Platform": true,
1622 - "data_office365_ProviderTypes": true,
1623 - "data_office365_RecordType": true,
1624 - "data_office365_ResultStatus": true,
1625 - "data_office365_SessionId": true,
1626 - "data_office365_Site": true,
1627 - "data_office365_SiteUrl": true,
1628 - "data_office365_SourceFileExtension": true,
1629 - "data_office365_SourceRelativeUrl": true,
1630 - "data_office365_StartTime": true,
1631 - "data_office365_Subscription": true,
1632 - "data_office365_SubscriptionId": true,
1633 - "data_office365_Target": true,
1634 - "data_office365_TargetContextId": true,
1635 - "data_office365_TargetUserOrGroupName": true,
1636 - "data_office365_TargetUserOrGroupType": true,
1637 - "data_office365_TeamGuid": true,
1638 - "data_office365_TeamName": true,
1639 - "data_office365_UniqueSharingId": true,
1640 - "data_office365_UserAgent": true,
1641 - "data_office365_UserId": false,
1642 - "data_office365_UserKey": true,
1643 - "data_office365_UserType": true,
1644 - "data_office365_Version": true,
1645 - "data_office365_WebId": true,
1646 - "data_office365_Workload": true,
1647 - "data_osquery_action": true,
1648 - "data_osquery_calendarTime": true,
1649 - "data_osquery_columns_address": true,
1650 - "data_osquery_columns_address_city_name": true,
1651 - "data_osquery_columns_address_country_code": true,
1652 - "data_osquery_columns_address_geolocation": true,
1653 - "data_osquery_columns_cmdline": true,
1654 - "data_osquery_columns_cwd": true,
1655 - "data_osquery_columns_description": true,
1656 - "data_osquery_columns_directory": true,
1657 - "data_osquery_columns_disk_bytes_read": true,
1658 - "data_osquery_columns_disk_bytes_written": true,
1659 - "data_osquery_columns_egid": true,
1660 - "data_osquery_columns_euid": true,
1661 - "data_osquery_columns_family": true,
1662 - "data_osquery_columns_fd": true,
1663 - "data_osquery_columns_gid": true,
1664 - "data_osquery_columns_gid_signed": true,
1665 - "data_osquery_columns_host": true,
1666 - "data_osquery_columns_interface": true,
1667 - "data_osquery_columns_local_address": true,
1668 - "data_osquery_columns_local_address_city_name": true,
1669 - "data_osquery_columns_local_address_country_code": true,
1670 - "data_osquery_columns_local_address_geolocation": true,
1671 - "data_osquery_columns_local_port": true,
1672 - "data_osquery_columns_mac": true,
1673 - "data_osquery_columns_name": true,
1674 - "data_osquery_columns_net_namespace": true,
1675 - "data_osquery_columns_nice": true,
1676 - "data_osquery_columns_on_disk": true,
1677 - "data_osquery_columns_parent": true,
1678 - "data_osquery_columns_path": true,
1679 - "data_osquery_columns_pgroup": true,
1680 - "data_osquery_columns_pid": true,
1681 - "data_osquery_columns_port": true,
1682 - "data_osquery_columns_protocol": true,
1683 - "data_osquery_columns_remote_address": true,
1684 - "data_osquery_columns_remote_address_city_name": true,
1685 - "data_osquery_columns_remote_address_country_code": true,
1686 - "data_osquery_columns_remote_address_geolocation": true,
1687 - "data_osquery_columns_remote_port": true,
1688 - "data_osquery_columns_resident_size": true,
1689 - "data_osquery_columns_root": true,
1690 - "data_osquery_columns_sgid": true,
1691 - "data_osquery_columns_shell": true,
1692 - "data_osquery_columns_socket": true,
1693 - "data_osquery_columns_start_time": true,
1694 - "data_osquery_columns_state": true,
1695 - "data_osquery_columns_suid": true,
1696 - "data_osquery_columns_system_time": true,
1697 - "data_osquery_columns_threads": true,
1698 - "data_osquery_columns_time_utc": true,
1699 - "data_osquery_columns_total_size": true,
1700 - "data_osquery_columns_tty": true,
1701 - "data_osquery_columns_type": true,
1702 - "data_osquery_columns_uid": true,
1703 - "data_osquery_columns_uid_signed": true,
1704 - "data_osquery_columns_user": true,
1705 - "data_osquery_columns_user_time": true,
1706 - "data_osquery_columns_username": true,
1707 - "data_osquery_columns_wired_size": true,
1708 - "data_osquery_counter": true,
1709 - "data_osquery_decorations_host_uuid": true,
1710 - "data_osquery_decorations_hostname": true,
1711 - "data_osquery_epoch": true,
1712 - "data_osquery_hostIdentifier": true,
1713 - "data_osquery_name": true,
1714 - "data_osquery_numerics": true,
1715 - "data_osquery_unixTime": true,
1716 - "data_proto": true,
1717 - "data_sca_check_command": true,
1718 - "data_sca_check_compliance_cis": true,
1719 - "data_sca_check_compliance_cis_csc": true,
1720 - "data_sca_check_compliance_gdpr_IV": true,
1721 - "data_sca_check_compliance_gpg_13": true,
1722 - "data_sca_check_compliance_hipaa": true,
1723 - "data_sca_check_compliance_nist_800_53": true,
1724 - "data_sca_check_compliance_pci_dss": true,
1725 - "data_sca_check_compliance_tsc": true,
1726 - "data_sca_check_description": true,
1727 - "data_sca_check_id": true,
1728 - "data_sca_check_previous_result": true,
1729 - "data_sca_check_rationale": true,
1730 - "data_sca_check_remediation": true,
1731 - "data_sca_check_result": true,
1732 - "data_sca_check_title": true,
1733 - "data_sca_description": true,
1734 - "data_sca_failed": true,
1735 - "data_sca_file": true,
1736 - "data_sca_invalid": true,
1737 - "data_sca_passed": true,
1738 - "data_sca_policy": true,
1739 - "data_sca_policy_id": true,
1740 - "data_sca_scan_id": true,
1741 - "data_sca_score": true,
1742 - "data_sca_total_checks": true,
1743 - "data_sca_type": true,
1744 - "data_script": true,
1745 - "data_src_ip": true,
1746 - "data_src_ip_city_name": true,
1747 - "data_src_ip_country_code": true,
1748 - "data_src_ip_geolocation": true,
1749 - "data_src_port": true,
1750 - "data_srcip": true,
1751 - "data_srcip_city_name": true,
1752 - "data_srcip_country_code": true,
1753 - "data_srcip_geolocation": true,
1754 - "data_srcuser": true,
1755 - "data_timestamp": true,
1756 - "data_title": true,
1757 - "data_tls_session_resumed": true,
1758 - "data_tls_version": true,
1759 - "data_tx_id": true,
1760 - "data_type": true,
1761 - "data_win_eventXML_binaryData": true,
1762 - "data_win_eventXML_binaryDataSize": true,
1763 - "data_win_eventXML_param1": true,
1764 - "data_win_eventdata_authenticationPackageName": true,
1765 - "data_win_eventdata_callTrace": true,
1766 - "data_win_eventdata_commandLine": true,
1767 - "data_win_eventdata_company": true,
1768 - "data_win_eventdata_creationUtcTime": true,
1769 - "data_win_eventdata_currentDirectory": true,
1770 - "data_win_eventdata_description": true,
1771 - "data_win_eventdata_destinationHostname": true,
1772 - "data_win_eventdata_destinationIp": true,
1773 - "data_win_eventdata_destinationIp_city_name": true,
1774 - "data_win_eventdata_destinationIp_country_code": true,
1775 - "data_win_eventdata_destinationIp_geolocation": true,
1776 - "data_win_eventdata_destinationIsIpv6": true,
1777 - "data_win_eventdata_destinationPort": true,
1778 - "data_win_eventdata_destinationPortName": true,
1779 - "data_win_eventdata_details": true,
1780 - "data_win_eventdata_elevatedToken": true,
1781 - "data_win_eventdata_eventType": true,
1782 - "data_win_eventdata_fileVersion": true,
1783 - "data_win_eventdata_fileVersion_city_name": true,
1784 - "data_win_eventdata_fileVersion_country_code": true,
1785 - "data_win_eventdata_fileVersion_geolocation": true,
1786 - "data_win_eventdata_grantedAccess": true,
1787 - "data_win_eventdata_hashes": true,
1788 - "data_win_eventdata_image": true,
1789 - "data_win_eventdata_imageLoaded": true,
1790 - "data_win_eventdata_impersonationLevel": true,
1791 - "data_win_eventdata_initiated": true,
1792 - "data_win_eventdata_integrityLevel": true,
1793 - "data_win_eventdata_ipAddress": true,
1794 - "data_win_eventdata_ipPort": true,
1795 - "data_win_eventdata_keyLength": true,
1796 - "data_win_eventdata_logonGuid": true,
1797 - "data_win_eventdata_logonId": true,
1798 - "data_win_eventdata_logonProcessName": true,
1799 - "data_win_eventdata_logonType": true,
1800 - "data_win_eventdata_originalFileName": true,
1801 - "data_win_eventdata_param1": true,
1802 - "data_win_eventdata_param2": true,
1803 - "data_win_eventdata_param3": true,
1804 - "data_win_eventdata_param4": true,
1805 - "data_win_eventdata_parentCommandLine": true,
1806 - "data_win_eventdata_parentImage": true,
1807 - "data_win_eventdata_parentProcessGuid": true,
1808 - "data_win_eventdata_parentProcessId": true,
1809 - "data_win_eventdata_processGuid": true,
1810 - "data_win_eventdata_processId": true,
1811 - "data_win_eventdata_processName": true,
1812 - "data_win_eventdata_product": true,
1813 - "data_win_eventdata_protocol": true,
1814 - "data_win_eventdata_queryName": true,
1815 - "data_win_eventdata_queryResults": true,
1816 - "data_win_eventdata_queryStatus": true,
1817 - "data_win_eventdata_ruleName": true,
1818 - "data_win_eventdata_serviceName": true,
1819 - "data_win_eventdata_serviceSid": true,
1820 - "data_win_eventdata_signature": true,
1821 - "data_win_eventdata_signatureStatus": true,
1822 - "data_win_eventdata_signed": true,
1823 - "data_win_eventdata_sourceHostname": true,
1824 - "data_win_eventdata_sourceImage": true,
1825 - "data_win_eventdata_sourceIp": true,
1826 - "data_win_eventdata_sourceIp_city_name": true,
1827 - "data_win_eventdata_sourceIp_country_code": true,
1828 - "data_win_eventdata_sourceIp_geolocation": true,
1829 - "data_win_eventdata_sourceIsIpv6": true,
1830 - "data_win_eventdata_sourcePort": true,
1831 - "data_win_eventdata_sourceProcessGUID": true,
1832 - "data_win_eventdata_sourceProcessId": true,
1833 - "data_win_eventdata_sourceThreadId": true,
1834 - "data_win_eventdata_status": true,
1835 - "data_win_eventdata_subjectDomainName": true,
1836 - "data_win_eventdata_subjectLogonId": true,
1837 - "data_win_eventdata_subjectUserName": true,
1838 - "data_win_eventdata_subjectUserSid": true,
1839 - "data_win_eventdata_targetDomainName": true,
1840 - "data_win_eventdata_targetFilename": true,
1841 - "data_win_eventdata_targetImage": true,
1842 - "data_win_eventdata_targetLinkedLogonId": true,
1843 - "data_win_eventdata_targetLogonId": true,
1844 - "data_win_eventdata_targetObject": true,
1845 - "data_win_eventdata_targetProcessGUID": true,
1846 - "data_win_eventdata_targetProcessId": true,
1847 - "data_win_eventdata_targetUserName": true,
1848 - "data_win_eventdata_targetUserSid": true,
1849 - "data_win_eventdata_terminalSessionId": true,
1850 - "data_win_eventdata_ticketEncryptionType": true,
1851 - "data_win_eventdata_ticketOptions": true,
1852 - "data_win_eventdata_user": true,
1853 - "data_win_eventdata_utcTime": true,
1854 - "data_win_eventdata_virtualAccount": true,
1855 - "data_win_system_channel": true,
1856 - "data_win_system_computer": true,
1857 - "data_win_system_eventID": true,
1858 - "data_win_system_eventRecordID": true,
1859 - "data_win_system_eventSourceName": true,
1860 - "data_win_system_keywords": true,
1861 - "data_win_system_level": true,
1862 - "data_win_system_message": true,
1863 - "data_win_system_opcode": true,
1864 - "data_win_system_processID": true,
1865 - "data_win_system_providerGuid": true,
1866 - "data_win_system_providerName": true,
1867 - "data_win_system_severityValue": true,
1868 - "data_win_system_systemTime": true,
1869 - "data_win_system_task": true,
1870 - "data_win_system_threadID": true,
1871 - "data_win_system_version": true,
1872 - "decoder_name": true,
1873 - "decoder_parent": true,
1874 - "dns_query": true,
1875 - "dns_query_threat_indicated": true,
1876 - "dst_ip": true,
1877 - "dst_ip_city_name": true,
1878 - "dst_ip_country_code": true,
1879 - "dst_ip_geolocation": true,
1880 - "dst_ip_threat_indicated": true,
1881 - "dst_port": true,
1882 - "ecs_version": true,
1883 - "error": true,
1884 - "event_hash": true,
1885 - "file_path": true,
1886 - "firewall_rule_name": true,
1887 - "full_log": false,
1888 - "gl2_accounted_message_size": true,
1889 - "gl2_message_id": true,
1890 - "gl2_processing_error": true,
1891 - "gl2_remote_ip": true,
1892 - "gl2_remote_port": true,
1893 - "gl2_source_collector": true,
1894 - "gl2_source_input": true,
1895 - "gl2_source_node": true,
1896 - "hash_md5": true,
1897 - "hash_sha1": true,
1898 - "hash_sha256": true,
1899 - "highlight": true,
1900 - "host_architecture": true,
1901 - "host_containerized": true,
1902 - "host_hostname": true,
1903 - "host_id": true,
1904 - "host_ip": true,
1905 - "host_mac": true,
1906 - "host_name": true,
1907 - "host_os_codename": true,
1908 - "host_os_kernel": true,
1909 - "host_os_name": true,
1910 - "host_os_platform": true,
1911 - "host_os_version": true,
1912 - "hostname": true,
1913 - "id": true,
1914 - "input_type": true,
1915 - "level": true,
1916 - "location": true,
1917 - "log_file_path": true,
1918 - "log_offset": true,
1919 - "manager_name": true,
1920 - "message": true,
1921 - "module": true,
1922 - "msg_timestamp": true,
1923 - "parent_process_cmd_line": true,
1924 - "parent_process_id": true,
1925 - "parent_process_image": true,
1926 - "pid": true,
1927 - "predecoder_hostname": true,
1928 - "predecoder_program_name": true,
1929 - "predecoder_timestamp": true,
1930 - "previous_log": true,
1931 - "previous_output": true,
1932 - "process_cmd_line": true,
1933 - "process_id": true,
1934 - "process_image": true,
1935 - "process_name": true,
1936 - "protocol": true,
1937 - "rule_cis": true,
1938 - "rule_cis_csc": true,
1939 - "rule_firedtimes": true,
1940 - "rule_gdpr": true,
1941 - "rule_gdpr_IV": true,
1942 - "rule_gpg13": true,
1943 - "rule_gpg_13": true,
1944 - "rule_group1": true,
1945 - "rule_group2": true,
1946 - "rule_group3": true,
1947 - "rule_groups": true,
1948 - "rule_hipaa": true,
1949 - "rule_id": true,
1950 - "rule_info": true,
1951 - "rule_mail": true,
1952 - "rule_mitre_id": true,
1953 - "rule_mitre_tactic": false,
1954 - "rule_nist_800_53": true,
1955 - "rule_pci_dss": true,
1956 - "rule_tsc": true,
1957 - "scanid": true,
1958 - "service": true,
1959 - "software_package": true,
1960 - "software_vendor": true,
1961 - "sort": true,
1962 - "source": true,
1963 - "source_reserved_ip": true,
1964 - "src_ip": true,
1965 - "src_ip_city_name": true,
1966 - "src_ip_country_code": true,
1967 - "src_ip_geolocation": true,
1968 - "src_port": true,
1969 - "streams": true,
1970 - "syscheck_attrs_after": true,
1971 - "syscheck_audit_effective_user_id": true,
1972 - "syscheck_audit_effective_user_name": true,
1973 - "syscheck_audit_group_id": true,
1974 - "syscheck_audit_group_name": true,
1975 - "syscheck_audit_login_user_id": true,
1976 - "syscheck_audit_login_user_name": true,
1977 - "syscheck_audit_process_cwd": true,
1978 - "syscheck_audit_process_id": true,
1979 - "syscheck_audit_process_name": true,
1980 - "syscheck_audit_process_parent_cwd": true,
1981 - "syscheck_audit_process_parent_name": true,
1982 - "syscheck_audit_process_ppid": true,
1983 - "syscheck_audit_user_id": true,
1984 - "syscheck_audit_user_name": true,
1985 - "syscheck_changed_attributes": true,
1986 - "syscheck_event": true,
1987 - "syscheck_gid_after": true,
1988 - "syscheck_gname_after": true,
1989 - "syscheck_hard_links": true,
1990 - "syscheck_inode_after": true,
1991 - "syscheck_inode_before": true,
1992 - "syscheck_md5_after": true,
1993 - "syscheck_md5_before": true,
1994 - "syscheck_mode": true,
1995 - "syscheck_mtime_after": true,
1996 - "syscheck_mtime_before": true,
1997 - "syscheck_path": true,
1998 - "syscheck_perm_after": true,
1999 - "syscheck_perm_before": true,
2000 - "syscheck_sha1_after": true,
2001 - "syscheck_sha1_before": true,
2002 - "syscheck_sha256_after": true,
2003 - "syscheck_sha256_before": true,
2004 - "syscheck_size_after": true,
2005 - "syscheck_size_before": true,
2006 - "syscheck_uid_after": true,
2007 - "syscheck_uname_after": true,
2008 - "syscheck_win_perm_after": true,
2009 - "syscheck_win_perm_after_0_allowed": true,
2010 - "syscheck_win_perm_after_0_name": true,
2011 - "syscheck_win_perm_after_1_allowed": true,
2012 - "syscheck_win_perm_after_1_name": true,
2013 - "syscheck_win_perm_after_2_allowed": true,
2014 - "syscheck_win_perm_after_2_name": true,
2015 - "syscheck_win_perm_after_3_allowed": true,
2016 - "syscheck_win_perm_after_3_name": true,
2017 - "syslog_customer": true,
2018 - "syslog_level": true,
2019 - "syslog_tag": true,
2020 - "syslog_type": true,
2021 - "sysmon_event_description": true,
2022 - "threat_ids": true,
2023 - "threat_indicated": true,
2024 - "threat_names": true,
2025 - "time": true,
2026 - "timestamp": true,
2027 - "true": true,
2028 - "user_name": true,
2029 - "win_registry_key": true,
2030 - "win_system_eventID": true,
2031 - "windows_auth_package": true,
2032 - "windows_domain": true,
2033 - "windows_event_id": true,
2034 - "windows_event_severity": true,
2035 - "windows_logon_type": true
2036 - },
2037 - "indexByName": {
2038 - "_id": 2,
2039 - "_index": 9,
2040 - "_type": 10,
2041 - "agent_id": 11,
2042 - "agent_name": 5,
2043 - "cluster_name": 12,
2044 - "cluster_node": 13,
2045 - "data_office365_AppAccessContext_APIId": 49,
2046 - "data_office365_AppAccessContext_ClientAppId": 50,
2047 - "data_office365_AppAccessContext_ClientAppName": 51,
2048 - "data_office365_AppAccessContext_CorrelationId": 52,
2049 - "data_office365_ArtifactsShared": 53,
2050 - "data_office365_Attendees": 54,
2051 - "data_office365_ChatName": 55,
2052 - "data_office365_ChatThreadId": 56,
2053 - "data_office365_ClientIP": 4,
2054 - "data_office365_ClientIP_city_name": 14,
2055 - "data_office365_ClientIP_country_code": 15,
2056 - "data_office365_ClientIP_geolocation": 16,
2057 - "data_office365_CommunicationSubType": 57,
2058 - "data_office365_CommunicationType": 58,
2059 - "data_office365_CreationTime": 0,
2060 - "data_office365_DeviceId": 59,
2061 - "data_office365_DeviceInformation": 60,
2062 - "data_office365_EndTime": 61,
2063 - "data_office365_ExchangeId": 62,
2064 - "data_office365_ExtraProperties": 63,
2065 - "data_office365_ICalUid": 64,
2066 - "data_office365_Id": 17,
2067 - "data_office365_ItemName": 65,
2068 - "data_office365_JoinTime": 66,
2069 - "data_office365_LeaveTime": 67,
2070 - "data_office365_MeetingDetailId": 68,
2071 - "data_office365_MeetingURL": 69,
2072 - "data_office365_Members": 70,
2073 - "data_office365_MessageId": 71,
2074 - "data_office365_MessageSizeInBytes": 72,
2075 - "data_office365_MessageURLs": 73,
2076 - "data_office365_MessageVersion": 74,
2077 - "data_office365_Modalities": 75,
2078 - "data_office365_Name": 76,
2079 - "data_office365_NewValue": 77,
2080 - "data_office365_ObjectId": 18,
2081 - "data_office365_Operation": 24,
2082 - "data_office365_OperationScope": 78,
2083 - "data_office365_OrganizationId": 19,
2084 - "data_office365_Organizer_OrganizationId": 79,
2085 - "data_office365_Organizer_RecipientType": 80,
2086 - "data_office365_Organizer_Role": 81,
2087 - "data_office365_Organizer_UserObjectId": 82,
2088 - "data_office365_ProviderTypes": 83,
2089 - "data_office365_RecordType": 20,
2090 - "data_office365_StartTime": 84,
2091 - "data_office365_SubscriptionId": 85,
2092 - "data_office365_TeamGuid": 86,
2093 - "data_office365_UserId": 3,
2094 - "data_office365_UserKey": 21,
2095 - "data_office365_UserType": 22,
2096 - "data_office365_Version": 23,
2097 - "data_office365_Workload": 48,
2098 - "decoder_name": 25,
2099 - "gl2_accounted_message_size": 26,
2100 - "gl2_message_id": 27,
2101 - "gl2_processing_error": 28,
2102 - "gl2_remote_ip": 29,
2103 - "gl2_remote_port": 30,
2104 - "gl2_source_input": 31,
2105 - "gl2_source_node": 32,
2106 - "highlight": 33,
2107 - "id": 34,
2108 - "location": 35,
2109 - "manager_name": 36,
2110 - "message": 37,
2111 - "rule_description": 6,
2112 - "rule_firedtimes": 38,
2113 - "rule_group1": 39,
2114 - "rule_groups": 40,
2115 - "rule_id": 8,
2116 - "rule_level": 7,
2117 - "rule_mail": 41,
2118 - "sort": 42,
2119 - "source": 43,
2120 - "streams": 44,
2121 - "syslog_level": 45,
2122 - "syslog_type": 46,
2123 - "timestamp": 1,
2124 - "true": 47
2125 - },
2126 - "renameByName": {
2127 - "_id": "EVENT ID",
2128 - "agent_name": "",
2129 - "data_office365_ActorIpAddress": "SRC IP",
2130 - "data_office365_AffectedItems": "ITEMS",
2131 - "data_office365_BrowserName": "BROWSER",
2132 - "data_office365_ClientIP": "CLIENT IP",
2133 - "data_office365_ClientIP_city_name": "",
2134 - "data_office365_CreationTime": "EVENT TIME",
2135 - "data_office365_Item_Attachments": "ATTACHMENT",
2136 - "data_office365_Item_ParentFolder_Path": "FOLDER",
2137 - "data_office365_Item_Subject": "SUBJECT",
2138 - "data_office365_ResultStatus": "RESULT",
2139 - "data_office365_SourceFileName": "FILE",
2140 - "data_office365_UserId": "ACCOUNT",
2141 - "rule_description": "DESCRIPTION",
2142 - "rule_id": "RULE ID",
2143 - "rule_level": "",
2144 - "rule_mitre_tactic": "MITRE TACTIC",
2145 - "rule_mitre_technique": "MITRE TECHNIQUE",
2146 - "timestamp": "Date/Time"
2147 - }
2148 - }
2149 - }
2150 - ],
2151 - "transparent": true,
2152 - "type": "table"
2153 - }
2154 - ],
2155 - "refresh": "",
2156 - "schemaVersion": 38,
2157 - "style": "dark",
2158 - "tags": [
2159 - "O365"
2160 - ],
2161 - "templating": {
2162 - "list": [
2163 - {
2164 - "datasource": {
2165 - "type": "elasticsearch",
2166 - "uid": "replace_datasource_uid"
2167 - },
2168 - "filters": [],
2169 - "hide": 0,
2170 - "label": "",
2171 - "name": "Filters",
2172 - "skipUrlSync": false,
2173 - "type": "adhoc"
2174 - },
2175 - {
2176 - "current": {
2177 - "selected": false,
2178 - "text": "All",
2179 - "value": "$__all"
2180 - },
2181 - "datasource": {
2182 - "type": "elasticsearch",
2183 - "uid": "replace_datasource_uid"
2184 - },
2185 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:OneDrive\"}",
2186 - "hide": 0,
2187 - "includeAll": true,
2188 - "label": "Operation",
2189 - "multi": false,
2190 - "name": "operation",
2191 - "options": [],
2192 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:OneDrive\"}",
2193 - "refresh": 2,
2194 - "regex": "",
2195 - "skipUrlSync": false,
2196 - "sort": 1,
2197 - "tagValuesQuery": "",
2198 - "tagsQuery": "",
2199 - "type": "query",
2200 - "useTags": false
2201 - },
2202 - {
2203 - "current": {
2204 - "selected": false,
2205 - "text": "All",
2206 - "value": "$__all"
2207 - },
2208 - "datasource": {
2209 - "type": "elasticsearch",
2210 - "uid": "replace_datasource_uid"
2211 - },
2212 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2213 - "hide": 0,
2214 - "includeAll": true,
2215 - "label": "Rule Level",
2216 - "multi": false,
2217 - "name": "rule_level",
2218 - "options": [],
2219 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2220 - "refresh": 2,
2221 - "regex": "",
2222 - "skipUrlSync": false,
2223 - "sort": 0,
2224 - "type": "query"
2225 - }
2226 - ]
2227 - },
2228 - "time": {
2229 - "from": "now-12h",
2230 - "to": "now"
2231 - },
2232 - "timepicker": {
2233 - "refresh_intervals": [
2234 - "5s",
2235 - "10s",
2236 - "30s",
2237 - "1m",
2238 - "5m",
2239 - "15m",
2240 - "30m",
2241 - "1h",
2242 - "2h",
2243 - "1d"
2244 - ],
2245 - "time_options": [
2246 - "5m",
2247 - "15m",
2248 - "1h",
2249 - "6h",
2250 - "12h",
2251 - "24h",
2252 - "2d",
2253 - "7d",
2254 - "30d"
2255 - ]
2256 - },
2257 - "timezone": "",
2258 - "title": "O365 - ONEDRIVE",
2259 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "10.0.3",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "cellOptions": {
255 + "type": "auto"
256 + },
257 + "inspect": false
258 + },
259 + "mappings": [],
260 + "thresholds": {
261 + "mode": "absolute",
262 + "steps": [
263 + {
264 + "color": "red",
265 + "value": null
266 + }
267 + ]
268 + }
269 + },
270 + "overrides": [
271 + {
272 + "matcher": {
273 + "id": "byName",
274 + "options": "Count"
275 + },
276 + "properties": [
277 + {
278 + "id": "displayName",
279 + "value": "EVENTS"
280 + },
281 + {
282 + "id": "unit",
283 + "value": "short"
284 + },
285 + {
286 + "id": "decimals",
287 + "value": -1
288 + },
289 + {
290 + "id": "custom.align"
291 + },
292 + {
293 + "id": "thresholds",
294 + "value": {
295 + "mode": "absolute",
296 + "steps": [
297 + {
298 + "color": "red",
299 + "value": null
300 + }
301 + ]
302 + }
303 + }
304 + ]
305 + }
306 + ]
307 + },
308 + "gridPos": {
309 + "h": 7,
310 + "w": 6,
311 + "x": 8,
312 + "y": 0
313 + },
314 + "id": 54,
315 + "options": {
316 + "cellHeight": "sm",
317 + "footer": {
318 + "countRows": false,
319 + "fields": "",
320 + "reducer": ["sum"],
321 + "show": false
322 + },
323 + "showHeader": true
324 + },
325 + "pluginVersion": "10.0.3",
326 + "targets": [
327 + {
328 + "bucketAggs": [
329 + {
330 + "fake": true,
331 + "field": "data_office365_Operation",
332 + "id": "4",
333 + "settings": {
334 + "min_doc_count": 1,
335 + "order": "desc",
336 + "orderBy": "_count",
337 + "size": "0"
338 + },
339 + "type": "terms"
340 + }
341 + ],
342 + "datasource": {
343 + "type": "elasticsearch",
344 + "uid": "replace_datasource_uid"
345 + },
346 + "metrics": [
347 + {
348 + "field": "select field",
349 + "id": "1",
350 + "type": "count"
351 + }
352 + ],
353 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
354 + "refId": "A",
355 + "timeField": "timestamp"
356 + }
357 + ],
358 + "title": "EVENTS BY OPERATION",
359 + "transformations": [
360 + {
361 + "id": "merge",
362 + "options": {
363 + "reducers": []
364 + }
365 + },
366 + {
367 + "id": "organize",
368 + "options": {
369 + "excludeByName": {},
370 + "indexByName": {},
371 + "renameByName": {
372 + "Count": "EVENTS",
373 + "data_office365_Operation": "OPERATION"
374 + }
375 + }
376 + }
377 + ],
378 + "type": "table"
379 + },
380 + {
381 + "datasource": {
382 + "type": "elasticsearch",
383 + "uid": "replace_datasource_uid"
384 + },
385 + "fieldConfig": {
386 + "defaults": {
387 + "color": {
388 + "mode": "thresholds"
389 + },
390 + "mappings": [
391 + {
392 + "options": {
393 + "match": "null",
394 + "result": {
395 + "text": "N/A"
396 + }
397 + },
398 + "type": "special"
399 + }
400 + ],
401 + "max": 15,
402 + "min": 0,
403 + "thresholds": {
404 + "mode": "absolute",
405 + "steps": [
406 + {
407 + "color": "#299c46",
408 + "value": null
409 + },
410 + {
411 + "color": "rgba(237, 129, 40, 0.89)",
412 + "value": 8
413 + },
414 + {
415 + "color": "#d44a3a",
416 + "value": 12
417 + }
418 + ]
419 + },
420 + "unit": "none"
421 + },
422 + "overrides": []
423 + },
424 + "gridPos": {
425 + "h": 7,
426 + "w": 4,
427 + "x": 0,
428 + "y": 7
429 + },
430 + "id": 16,
431 + "links": [],
432 + "options": {
433 + "orientation": "horizontal",
434 + "reduceOptions": {
435 + "calcs": ["max"],
436 + "fields": "",
437 + "values": false
438 + },
439 + "showThresholdLabels": false,
440 + "showThresholdMarkers": true,
441 + "text": {}
442 + },
443 + "pluginVersion": "10.0.3",
444 + "targets": [
445 + {
446 + "bucketAggs": [
447 + {
448 + "field": "timestamp",
449 + "id": "2",
450 + "settings": {
451 + "interval": "auto",
452 + "min_doc_count": 0,
453 + "trimEdges": 0
454 + },
455 + "type": "date_histogram"
456 + }
457 + ],
458 + "datasource": {
459 + "type": "elasticsearch",
460 + "uid": "replace_datasource_uid"
461 + },
462 + "metrics": [
463 + {
464 + "field": "rule_level",
465 + "id": "1",
466 + "meta": {},
467 + "settings": {},
468 + "type": "max"
469 + }
470 + ],
471 + "query": "data_office365_Operation:$operation",
472 + "refId": "A",
473 + "timeField": "timestamp"
474 + }
475 + ],
476 + "title": "MAX SEVERITY (0 - 15)",
477 + "type": "gauge"
478 + },
479 + {
480 + "datasource": {
481 + "type": "elasticsearch",
482 + "uid": "replace_datasource_uid"
483 + },
484 + "fieldConfig": {
485 + "defaults": {
486 + "color": {
487 + "mode": "palette-classic"
488 + },
489 + "custom": {
490 + "axisCenteredZero": false,
491 + "axisColorMode": "text",
492 + "axisLabel": "",
493 + "axisPlacement": "auto",
494 + "barAlignment": 0,
495 + "drawStyle": "bars",
496 + "fillOpacity": 0,
497 + "gradientMode": "none",
498 + "hideFrom": {
499 + "legend": false,
500 + "tooltip": false,
501 + "viz": false
502 + },
503 + "lineInterpolation": "linear",
504 + "lineWidth": 1,
505 + "pointSize": 5,
506 + "scaleDistribution": {
507 + "type": "linear"
508 + },
509 + "showPoints": "auto",
510 + "spanNulls": false,
511 + "stacking": {
512 + "group": "A",
513 + "mode": "normal"
514 + },
515 + "thresholdsStyle": {
516 + "mode": "off"
517 + }
518 + },
519 + "mappings": [],
520 + "thresholds": {
521 + "mode": "absolute",
522 + "steps": [
523 + {
524 + "color": "green",
525 + "value": null
526 + },
527 + {
528 + "color": "red",
529 + "value": 80
530 + }
531 + ]
532 + }
533 + },
534 + "overrides": []
535 + },
536 + "gridPos": {
537 + "h": 13,
538 + "w": 20,
539 + "x": 4,
540 + "y": 7
541 + },
542 + "id": 60,
543 + "options": {
544 + "legend": {
545 + "calcs": [],
546 + "displayMode": "table",
547 + "placement": "right",
548 + "showLegend": true
549 + },
550 + "tooltip": {
551 + "mode": "single",
552 + "sort": "none"
553 + }
554 + },
555 + "targets": [
556 + {
557 + "alias": "",
558 + "bucketAggs": [
559 + {
560 + "field": "data_office365_Operation",
561 + "id": "3",
562 + "settings": {
563 + "min_doc_count": "1",
564 + "order": "desc",
565 + "orderBy": "_count",
566 + "size": "10"
567 + },
568 + "type": "terms"
569 + },
570 + {
571 + "field": "timestamp",
572 + "id": "2",
573 + "settings": {
574 + "interval": "auto"
575 + },
576 + "type": "date_histogram"
577 + }
578 + ],
579 + "datasource": {
580 + "type": "elasticsearch",
581 + "uid": "replace_datasource_uid"
582 + },
583 + "metrics": [
584 + {
585 + "id": "1",
586 + "type": "count"
587 + }
588 + ],
589 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
590 + "refId": "A",
591 + "timeField": "timestamp"
592 + }
593 + ],
594 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
595 + "transparent": true,
596 + "type": "timeseries"
597 + },
598 + {
599 + "datasource": {
600 + "type": "elasticsearch",
601 + "uid": "replace_datasource_uid"
602 + },
603 + "fieldConfig": {
604 + "defaults": {
605 + "mappings": [
606 + {
607 + "options": {
608 + "match": "null",
609 + "result": {
610 + "text": "N/A"
611 + }
612 + },
613 + "type": "special"
614 + }
615 + ],
616 + "thresholds": {
617 + "mode": "absolute",
618 + "steps": [
619 + {
620 + "color": "blue",
621 + "value": null
622 + }
623 + ]
624 + },
625 + "unit": "locale"
626 + },
627 + "overrides": []
628 + },
629 + "gridPos": {
630 + "h": 6,
631 + "w": 4,
632 + "x": 0,
633 + "y": 14
634 + },
635 + "id": 51,
636 + "links": [],
637 + "options": {
638 + "colorMode": "value",
639 + "graphMode": "area",
640 + "justifyMode": "auto",
641 + "orientation": "horizontal",
642 + "reduceOptions": {
643 + "calcs": ["sum"],
644 + "fields": "",
645 + "values": false
646 + },
647 + "text": {},
648 + "textMode": "auto"
649 + },
650 + "pluginVersion": "10.0.3",
651 + "targets": [
652 + {
653 + "bucketAggs": [
654 + {
655 + "$$hashKey": "object:331",
656 + "field": "timestamp",
657 + "id": "2",
658 + "settings": {
659 + "interval": "auto",
660 + "min_doc_count": 0,
661 + "trimEdges": 0
662 + },
663 + "type": "date_histogram"
664 + }
665 + ],
666 + "datasource": {
667 + "type": "elasticsearch",
668 + "uid": "replace_datasource_uid"
669 + },
670 + "metrics": [
671 + {
672 + "$$hashKey": "object:329",
673 + "field": "select field",
674 + "id": "1",
675 + "type": "count"
676 + }
677 + ],
678 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
679 + "refId": "A",
680 + "timeField": "timestamp"
681 + }
682 + ],
683 + "title": "EVENTS (Total)",
684 + "type": "stat"
685 + },
686 + {
687 + "datasource": {
688 + "type": "elasticsearch",
689 + "uid": "replace_datasource_uid"
690 + },
691 + "fieldConfig": {
692 + "defaults": {
693 + "mappings": [
694 + {
695 + "options": {
696 + "match": "null",
697 + "result": {
698 + "text": "N/A"
699 + }
700 + },
701 + "type": "special"
702 + }
703 + ],
704 + "thresholds": {
705 + "mode": "absolute",
706 + "steps": [
707 + {
708 + "color": "orange",
709 + "value": null
710 + }
711 + ]
712 + },
713 + "unit": "locale"
714 + },
715 + "overrides": []
716 + },
717 + "gridPos": {
718 + "h": 6,
719 + "w": 4,
720 + "x": 0,
721 + "y": 20
722 + },
723 + "id": 52,
724 + "links": [],
725 + "options": {
726 + "colorMode": "value",
727 + "graphMode": "area",
728 + "justifyMode": "auto",
729 + "orientation": "horizontal",
730 + "reduceOptions": {
731 + "calcs": ["sum"],
732 + "fields": "",
733 + "values": false
734 + },
735 + "text": {},
736 + "textMode": "auto"
737 + },
738 + "pluginVersion": "10.0.3",
739 + "targets": [
740 + {
741 + "bucketAggs": [
742 + {
743 + "$$hashKey": "object:331",
744 + "field": "timestamp",
745 + "id": "2",
746 + "settings": {
747 + "interval": "auto",
748 + "min_doc_count": 0,
749 + "trimEdges": 0
750 + },
751 + "type": "date_histogram"
752 + }
753 + ],
754 + "datasource": {
755 + "type": "elasticsearch",
756 + "uid": "replace_datasource_uid"
757 + },
758 + "metrics": [
759 + {
760 + "$$hashKey": "object:329",
761 + "field": "select field",
762 + "id": "1",
763 + "type": "count"
764 + }
765 + ],
766 + "query": "data_office365_Operation:MessageCreatedHasLink AND rule_level:$rule_level",
767 + "refId": "A",
768 + "timeField": "timestamp"
769 + }
770 + ],
771 + "title": "ONEDRIVE - MESSAGES CONTAINING LINK",
772 + "type": "stat"
773 + },
774 + {
775 + "circleMaxSize": 30,
776 + "circleMinSize": 2,
777 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
778 + "datasource": {
779 + "type": "elasticsearch",
780 + "uid": "replace_datasource_uid"
781 + },
782 + "decimals": 0,
783 + "esMetric": "Count",
784 + "gridPos": {
785 + "h": 12,
786 + "w": 10,
787 + "x": 4,
788 + "y": 20
789 + },
790 + "hideEmpty": false,
791 + "hideZero": false,
792 + "id": 50,
793 + "initialZoom": 1,
794 + "locationData": "countries",
795 + "mapCenter": "(0°, 0°)",
796 + "mapCenterLatitude": 0,
797 + "mapCenterLongitude": 0,
798 + "maxDataPoints": 1,
799 + "mouseWheelZoom": false,
800 + "showLegend": true,
801 + "stickyLabels": false,
802 + "tableQueryOptions": {
803 + "geohashField": "geohash",
804 + "latitudeField": "latitude",
805 + "longitudeField": "longitude",
806 + "metricField": "metric",
807 + "queryType": "geohash"
808 + },
809 + "targets": [
810 + {
811 + "bucketAggs": [
812 + {
813 + "fake": true,
814 + "field": "data_office365_ClientIP_country_code",
815 + "id": "3",
816 + "settings": {
817 + "min_doc_count": 1,
818 + "order": "desc",
819 + "orderBy": "_term",
820 + "size": "0"
821 + },
822 + "type": "terms"
823 + },
824 + {
825 + "field": "timestamp",
826 + "id": "2",
827 + "settings": {
828 + "interval": "auto",
829 + "min_doc_count": 0,
830 + "trimEdges": 0
831 + },
832 + "type": "date_histogram"
833 + }
834 + ],
835 + "datasource": {
836 + "type": "elasticsearch",
837 + "uid": "replace_datasource_uid"
838 + },
839 + "metrics": [
840 + {
841 + "field": "select field",
842 + "id": "1",
843 + "type": "count"
844 + }
845 + ],
846 + "query": "data_office365_Workload:OneDrive AND rule_level:$rule_level",
847 + "refId": "A",
848 + "timeField": "timestamp"
849 + }
850 + ],
851 + "thresholds": "0,10",
852 + "title": "ONEDRIVE - ALL EVENTS BY SRC COUNTRY",
853 + "type": "grafana-worldmap-panel",
854 + "unitPlural": "",
855 + "unitSingle": "",
856 + "valueName": "total"
857 + },
858 + {
859 + "datasource": {
860 + "type": "elasticsearch",
861 + "uid": "replace_datasource_uid"
862 + },
863 + "fieldConfig": {
864 + "defaults": {
865 + "color": {
866 + "mode": "thresholds"
867 + },
868 + "custom": {
869 + "align": "auto",
870 + "cellOptions": {
871 + "type": "auto"
872 + },
873 + "inspect": false
874 + },
875 + "mappings": [],
876 + "thresholds": {
877 + "mode": "absolute",
878 + "steps": [
879 + {
880 + "color": "orange",
881 + "value": null
882 + }
883 + ]
884 + }
885 + },
886 + "overrides": [
887 + {
888 + "matcher": {
889 + "id": "byName",
890 + "options": "Count"
891 + },
892 + "properties": [
893 + {
894 + "id": "displayName",
895 + "value": "EVENTS"
896 + },
897 + {
898 + "id": "unit",
899 + "value": "short"
900 + },
901 + {
902 + "id": "decimals",
903 + "value": -1
904 + },
905 + {
906 + "id": "custom.align"
907 + }
908 + ]
909 + },
910 + {
911 + "matcher": {
912 + "id": "byName",
913 + "options": "AD ACCOUNT"
914 + },
915 + "properties": [
916 + {
917 + "id": "custom.width",
918 + "value": 377
919 + }
920 + ]
921 + }
922 + ]
923 + },
924 + "gridPos": {
925 + "h": 12,
926 + "w": 10,
927 + "x": 14,
928 + "y": 20
929 + },
930 + "id": 58,
931 + "options": {
932 + "cellHeight": "sm",
933 + "footer": {
934 + "countRows": false,
935 + "fields": "",
936 + "reducer": ["sum"],
937 + "show": false
938 + },
939 + "showHeader": true,
940 + "sortBy": []
941 + },
942 + "pluginVersion": "10.0.3",
943 + "targets": [
944 + {
945 + "bucketAggs": [
946 + {
947 + "fake": true,
948 + "field": "data_office365_UserId",
949 + "id": "4",
950 + "settings": {
951 + "min_doc_count": 1,
952 + "order": "desc",
953 + "orderBy": "_count",
954 + "size": "0"
955 + },
956 + "type": "terms"
957 + },
958 + {
959 + "field": "data_office365_ClientIP_country_code",
960 + "id": "5",
961 + "settings": {
962 + "min_doc_count": "1",
963 + "order": "desc",
964 + "orderBy": "_term",
965 + "size": "10"
966 + },
967 + "type": "terms"
968 + }
969 + ],
970 + "datasource": {
971 + "type": "elasticsearch",
972 + "uid": "replace_datasource_uid"
973 + },
974 + "metrics": [
975 + {
976 + "field": "select field",
977 + "id": "1",
978 + "type": "count"
979 + }
980 + ],
981 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
982 + "refId": "A",
983 + "timeField": "timestamp"
984 + }
985 + ],
986 + "title": "ONEDRIVE EVENTS BY ACCOUNT",
987 + "transformations": [
988 + {
989 + "id": "merge",
990 + "options": {
991 + "reducers": []
992 + }
993 + },
994 + {
995 + "id": "organize",
996 + "options": {
997 + "excludeByName": {},
998 + "indexByName": {},
999 + "renameByName": {
1000 + "Count": "EVENTS",
1001 + "data_office365_ClientIP_country_code": "COUNTRY",
1002 + "data_office365_LogonError": "ERROR",
1003 + "data_office365_Operation": "WORKLOAD",
1004 + "data_office365_UserId": "AD ACCOUNT"
1005 + }
1006 + }
1007 + }
1008 + ],
1009 + "type": "table"
1010 + },
1011 + {
1012 + "datasource": {
1013 + "type": "elasticsearch",
1014 + "uid": "replace_datasource_uid"
1015 + },
1016 + "fieldConfig": {
1017 + "defaults": {
1018 + "mappings": [
1019 + {
1020 + "options": {
1021 + "match": "null",
1022 + "result": {
1023 + "text": "N/A"
1024 + }
1025 + },
1026 + "type": "special"
1027 + }
1028 + ],
1029 + "thresholds": {
1030 + "mode": "absolute",
1031 + "steps": [
1032 + {
1033 + "color": "blue",
1034 + "value": null
1035 + }
1036 + ]
1037 + },
1038 + "unit": "locale"
1039 + },
1040 + "overrides": []
1041 + },
1042 + "gridPos": {
1043 + "h": 6,
1044 + "w": 4,
1045 + "x": 0,
1046 + "y": 26
1047 + },
1048 + "id": 18,
1049 + "links": [],
1050 + "options": {
1051 + "colorMode": "value",
1052 + "graphMode": "area",
1053 + "justifyMode": "auto",
1054 + "orientation": "horizontal",
1055 + "reduceOptions": {
1056 + "calcs": ["sum"],
1057 + "fields": "",
1058 + "values": false
1059 + },
1060 + "text": {},
1061 + "textMode": "auto"
1062 + },
1063 + "pluginVersion": "10.0.3",
1064 + "targets": [
1065 + {
1066 + "bucketAggs": [
1067 + {
1068 + "$$hashKey": "object:331",
1069 + "field": "timestamp",
1070 + "id": "2",
1071 + "settings": {
1072 + "interval": "auto",
1073 + "min_doc_count": 0,
1074 + "trimEdges": 0
1075 + },
1076 + "type": "date_histogram"
1077 + }
1078 + ],
1079 + "datasource": {
1080 + "type": "elasticsearch",
1081 + "uid": "replace_datasource_uid"
1082 + },
1083 + "metrics": [
1084 + {
1085 + "$$hashKey": "object:329",
1086 + "field": "select field",
1087 + "id": "1",
1088 + "type": "count"
1089 + }
1090 + ],
1091 + "query": "data_office365_Operation:TeamsSessionStarted AND rule_level:$rule_level",
1092 + "refId": "A",
1093 + "timeField": "timestamp"
1094 + }
1095 + ],
1096 + "title": "ONEDRIVE - SESSIONS STARTED",
1097 + "type": "stat"
1098 + },
1099 + {
1100 + "datasource": {
1101 + "type": "elasticsearch",
1102 + "uid": "replace_datasource_uid"
1103 + },
1104 + "fieldConfig": {
1105 + "defaults": {
1106 + "color": {
1107 + "mode": "thresholds"
1108 + },
1109 + "custom": {
1110 + "align": "auto",
1111 + "cellOptions": {
1112 + "type": "auto"
1113 + },
1114 + "filterable": true,
1115 + "inspect": false
1116 + },
1117 + "mappings": [],
1118 + "thresholds": {
1119 + "mode": "absolute",
1120 + "steps": [
1121 + {
1122 + "color": "green",
1123 + "value": null
1124 + },
1125 + {
1126 + "color": "red",
1127 + "value": 80
1128 + }
1129 + ]
1130 + }
1131 + },
1132 + "overrides": [
1133 + {
1134 + "matcher": {
1135 + "id": "byName",
1136 + "options": "rule_level"
1137 + },
1138 + "properties": [
1139 + {
1140 + "id": "displayName",
1141 + "value": "RULE LEVEL"
1142 + },
1143 + {
1144 + "id": "unit",
1145 + "value": "short"
1146 + },
1147 + {
1148 + "id": "decimals",
1149 + "value": -1
1150 + },
1151 + {
1152 + "id": "custom.cellOptions",
1153 + "value": {
1154 + "mode": "gradient",
1155 + "type": "color-background"
1156 + }
1157 + },
1158 + {
1159 + "id": "custom.align"
1160 + },
1161 + {
1162 + "id": "thresholds",
1163 + "value": {
1164 + "mode": "absolute",
1165 + "steps": [
1166 + {
1167 + "color": "#37872D",
1168 + "value": null
1169 + },
1170 + {
1171 + "color": "rgba(237, 129, 40, 0.89)",
1172 + "value": 7
1173 + },
1174 + {
1175 + "color": "rgba(245, 54, 54, 0.9)",
1176 + "value": 12
1177 + }
1178 + ]
1179 + }
1180 + }
1181 + ]
1182 + },
1183 + {
1184 + "matcher": {
1185 + "id": "byName",
1186 + "options": "Date/Time"
1187 + },
1188 + "properties": [
1189 + {
1190 + "id": "custom.width",
1191 + "value": 242
1192 + }
1193 + ]
1194 + },
1195 + {
1196 + "matcher": {
1197 + "id": "byName",
1198 + "options": "MITRE TACTIC"
1199 + },
1200 + "properties": [
1201 + {
1202 + "id": "custom.width",
1203 + "value": 332
1204 + }
1205 + ]
1206 + },
1207 + {
1208 + "matcher": {
1209 + "id": "byName",
1210 + "options": "IP ADDRESS"
1211 + },
1212 + "properties": [
1213 + {
1214 + "id": "custom.width",
1215 + "value": 163
1216 + }
1217 + ]
1218 + },
1219 + {
1220 + "matcher": {
1221 + "id": "byName",
1222 + "options": "MITRE TECHNIQUE"
1223 + },
1224 + "properties": [
1225 + {
1226 + "id": "custom.width",
1227 + "value": 312
1228 + }
1229 + ]
1230 + },
1231 + {
1232 + "matcher": {
1233 + "id": "byName",
1234 + "options": "EVENT ID"
1235 + },
1236 + "properties": [
1237 + {
1238 + "id": "links",
1239 + "value": [
1240 + {
1241 + "targetBlank": true,
1242 + "title": "VIEW EVENT DETAILS",
1243 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1244 + }
1245 + ]
1246 + },
1247 + {
1248 + "id": "custom.width",
1249 + "value": 265
1250 + }
1251 + ]
1252 + },
1253 + {
1254 + "matcher": {
1255 + "id": "byName",
1256 + "options": "RESULT"
1257 + },
1258 + "properties": [
1259 + {
1260 + "id": "custom.width",
1261 + "value": 118
1262 + },
1263 + {
1264 + "id": "mappings",
1265 + "value": [
1266 + {
1267 + "options": {
1268 + "Failed": {
1269 + "color": "orange",
1270 + "index": 1
1271 + },
1272 + "Success": {
1273 + "color": "green",
1274 + "index": 0
1275 + }
1276 + },
1277 + "type": "value"
1278 + }
1279 + ]
1280 + },
1281 + {
1282 + "id": "custom.cellOptions",
1283 + "value": {
1284 + "type": "color-text"
1285 + }
1286 + }
1287 + ]
1288 + },
1289 + {
1290 + "matcher": {
1291 + "id": "byName",
1292 + "options": "SRC IP"
1293 + },
1294 + "properties": [
1295 + {
1296 + "id": "custom.width",
1297 + "value": 265
1298 + }
1299 + ]
1300 + },
1301 + {
1302 + "matcher": {
1303 + "id": "byName",
1304 + "options": "ACCOUNT"
1305 + },
1306 + "properties": [
1307 + {
1308 + "id": "custom.width",
1309 + "value": 227
1310 + }
1311 + ]
1312 + },
1313 + {
1314 + "matcher": {
1315 + "id": "byName",
1316 + "options": "EVENT TIME"
1317 + },
1318 + "properties": [
1319 + {
1320 + "id": "custom.width",
1321 + "value": 195
1322 + }
1323 + ]
1324 + },
1325 + {
1326 + "matcher": {
1327 + "id": "byName",
1328 + "options": "CLIENT IP"
1329 + },
1330 + "properties": [
1331 + {
1332 + "id": "custom.width",
1333 + "value": 191
1334 + }
1335 + ]
1336 + },
1337 + {
1338 + "matcher": {
1339 + "id": "byName",
1340 + "options": "DESCRIPTION"
1341 + },
1342 + "properties": [
1343 + {
1344 + "id": "custom.width",
1345 + "value": 367
1346 + }
1347 + ]
1348 + },
1349 + {
1350 + "matcher": {
1351 + "id": "byName",
1352 + "options": "FILE"
1353 + },
1354 + "properties": [
1355 + {
1356 + "id": "custom.width",
1357 + "value": 282
1358 + }
1359 + ]
1360 + }
1361 + ]
1362 + },
1363 + "gridPos": {
1364 + "h": 16,
1365 + "w": 24,
1366 + "x": 0,
1367 + "y": 32
1368 + },
1369 + "id": 27,
1370 + "options": {
1371 + "cellHeight": "sm",
1372 + "footer": {
1373 + "countRows": false,
1374 + "enablePagination": true,
1375 + "fields": "",
1376 + "reducer": ["sum"],
1377 + "show": false
1378 + },
1379 + "showHeader": true,
1380 + "sortBy": []
1381 + },
1382 + "pluginVersion": "10.0.3",
1383 + "targets": [
1384 + {
1385 + "bucketAggs": [],
1386 + "datasource": {
1387 + "type": "elasticsearch",
1388 + "uid": "replace_datasource_uid"
1389 + },
1390 + "metrics": [
1391 + {
1392 + "id": "1",
1393 + "settings": {
1394 + "size": "250"
1395 + },
1396 + "type": "raw_data"
1397 + }
1398 + ],
1399 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1400 + "refId": "A",
1401 + "timeField": "timestamp"
1402 + }
1403 + ],
1404 + "title": "EVENTS",
1405 + "transformations": [
1406 + {
1407 + "id": "organize",
1408 + "options": {
1409 + "excludeByName": {
1410 + "@metadata_beat": true,
1411 + "@metadata_type": true,
1412 + "@metadata_version": true,
1413 + "IMPHASH": true,
1414 + "MD5": true,
1415 + "SHA1": true,
1416 + "SHA256": true,
1417 + "_id": false,
1418 + "_index": true,
1419 + "_type": true,
1420 + "agent_ephemeral_id": true,
1421 + "agent_hostname": true,
1422 + "agent_id": true,
1423 + "agent_ip_city_name": true,
1424 + "agent_ip_country_code": true,
1425 + "agent_ip_geolocation": true,
1426 + "agent_name": true,
1427 + "agent_type": true,
1428 + "agent_version": true,
1429 + "beats_type": true,
1430 + "cluster_name": true,
1431 + "cluster_node": true,
1432 + "collector_node_id": true,
1433 + "data_alert_action": true,
1434 + "data_alert_category": true,
1435 + "data_alert_gid": true,
1436 + "data_alert_rev": true,
1437 + "data_alert_severity": true,
1438 + "data_alert_signature": true,
1439 + "data_alert_signature_id": true,
1440 + "data_app_proto": true,
1441 + "data_audit_auid": true,
1442 + "data_audit_command": true,
1443 + "data_audit_euid": true,
1444 + "data_audit_exe": true,
1445 + "data_audit_gid": true,
1446 + "data_audit_id": true,
1447 + "data_audit_pid": true,
1448 + "data_audit_res": true,
1449 + "data_audit_session": true,
1450 + "data_audit_type": true,
1451 + "data_audit_uid": true,
1452 + "data_dest_ip": true,
1453 + "data_dest_port": true,
1454 + "data_dstuser": true,
1455 + "data_event_type": true,
1456 + "data_extra_data": true,
1457 + "data_file": true,
1458 + "data_flow_bytes_toclient": true,
1459 + "data_flow_bytes_toserver": true,
1460 + "data_flow_id": true,
1461 + "data_flow_pkts_toclient": true,
1462 + "data_flow_pkts_toserver": true,
1463 + "data_flow_start": true,
1464 + "data_http_http_content_type": true,
1465 + "data_http_http_port": true,
1466 + "data_http_length": true,
1467 + "data_http_status": true,
1468 + "data_http_url": true,
1469 + "data_id": true,
1470 + "data_in_iface": true,
1471 + "data_integration": true,
1472 + "data_metadata_flowbits": true,
1473 + "data_metadata_flowints_http_anomaly_count": true,
1474 + "data_metadata_flowints_tcp_retransmission_count": true,
1475 + "data_office365_AADGroupId": true,
1476 + "data_office365_Actor": true,
1477 + "data_office365_ActorContextId": true,
1478 + "data_office365_ActorIpAddress": false,
1479 + "data_office365_ActorIpAddress_city_name": true,
1480 + "data_office365_ActorIpAddress_country_code": true,
1481 + "data_office365_ActorIpAddress_geolocation": true,
1482 + "data_office365_AppAccessContext_AADSessionId": true,
1483 + "data_office365_AppAccessContext_APIId": true,
1484 + "data_office365_AppAccessContext_ClientAppId": true,
1485 + "data_office365_AppAccessContext_ClientAppName": true,
1486 + "data_office365_AppAccessContext_CorrelationId": true,
1487 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1488 + "data_office365_AppAccessContext_UniqueTokenId": true,
1489 + "data_office365_AppId": true,
1490 + "data_office365_ApplicationDisplayName": true,
1491 + "data_office365_ApplicationId": true,
1492 + "data_office365_ArtifactsShared": true,
1493 + "data_office365_Attendees": true,
1494 + "data_office365_AuthenticationType": true,
1495 + "data_office365_AzureActiveDirectoryEventType": true,
1496 + "data_office365_BrowserVersion": true,
1497 + "data_office365_BrowserVersion_city_name": true,
1498 + "data_office365_BrowserVersion_country_code": true,
1499 + "data_office365_BrowserVersion_geolocation": true,
1500 + "data_office365_ChannelGuid": true,
1501 + "data_office365_ChannelName": true,
1502 + "data_office365_ChatName": true,
1503 + "data_office365_ChatThreadId": true,
1504 + "data_office365_ClientAppId": true,
1505 + "data_office365_ClientIP": false,
1506 + "data_office365_ClientIPAddress": true,
1507 + "data_office365_ClientIPAddress_city_name": true,
1508 + "data_office365_ClientIPAddress_country_code": true,
1509 + "data_office365_ClientIPAddress_geolocation": true,
1510 + "data_office365_ClientIP_city_name": true,
1511 + "data_office365_ClientIP_country_code": true,
1512 + "data_office365_ClientIP_geolocation": true,
1513 + "data_office365_ClientInfoString": true,
1514 + "data_office365_ClientProcessName": true,
1515 + "data_office365_ClientRequestId": true,
1516 + "data_office365_ClientVersion": true,
1517 + "data_office365_CommunicationSubType": true,
1518 + "data_office365_CommunicationType": true,
1519 + "data_office365_CorrelationId": true,
1520 + "data_office365_CreationTime": false,
1521 + "data_office365_CrossMailboxOperation": true,
1522 + "data_office365_CustomUniqueId": true,
1523 + "data_office365_DestFolder_Id": true,
1524 + "data_office365_DestFolder_Path": true,
1525 + "data_office365_DeviceDisplayName": true,
1526 + "data_office365_DeviceDisplayName_city_name": true,
1527 + "data_office365_DeviceDisplayName_country_code": true,
1528 + "data_office365_DeviceDisplayName_geolocation": true,
1529 + "data_office365_DeviceId": true,
1530 + "data_office365_DeviceInformation": true,
1531 + "data_office365_DeviceProperties": true,
1532 + "data_office365_DoNotDistributeEvent": true,
1533 + "data_office365_EndTime": true,
1534 + "data_office365_ErrorNumber": true,
1535 + "data_office365_EventData": true,
1536 + "data_office365_EventSource": true,
1537 + "data_office365_ExchangeId": true,
1538 + "data_office365_ExtendedProperties": true,
1539 + "data_office365_ExternalAccess": true,
1540 + "data_office365_ExtraProperties": true,
1541 + "data_office365_FileSizeBytes": true,
1542 + "data_office365_FileSyncBytesCommitted": true,
1543 + "data_office365_Folder_Id": true,
1544 + "data_office365_Folder_Path": true,
1545 + "data_office365_HighPriorityMediaProcessing": true,
1546 + "data_office365_HostedContents": true,
1547 + "data_office365_ICalUid": true,
1548 + "data_office365_Id": true,
1549 + "data_office365_ImplicitShare": true,
1550 + "data_office365_InterSystemsId": true,
1551 + "data_office365_InternalLogonType": true,
1552 + "data_office365_IntraSystemId": true,
1553 + "data_office365_IsManagedDevice": true,
1554 + "data_office365_ItemName": true,
1555 + "data_office365_ItemType": true,
1556 + "data_office365_Item_Id": true,
1557 + "data_office365_Item_InternetMessageId": true,
1558 + "data_office365_Item_IsRecord": true,
1559 + "data_office365_Item_ParentFolder_Id": true,
1560 + "data_office365_Item_SizeInBytes": true,
1561 + "data_office365_JoinTime": true,
1562 + "data_office365_LeaveTime": true,
1563 + "data_office365_ListBaseType": true,
1564 + "data_office365_ListId": true,
1565 + "data_office365_ListItemUniqueId": true,
1566 + "data_office365_ListServerTemplate": true,
1567 + "data_office365_LogonError": true,
1568 + "data_office365_LogonType": true,
1569 + "data_office365_LogonUserSid": true,
1570 + "data_office365_MachineId": true,
1571 + "data_office365_MailboxGuid": true,
1572 + "data_office365_MailboxOwnerSid": true,
1573 + "data_office365_MailboxOwnerUPN": true,
1574 + "data_office365_MeetingDetailId": true,
1575 + "data_office365_MeetingURL": true,
1576 + "data_office365_Members": true,
1577 + "data_office365_MessageId": true,
1578 + "data_office365_MessageSizeInBytes": true,
1579 + "data_office365_MessageURLs": true,
1580 + "data_office365_MessageVersion": true,
1581 + "data_office365_Modalities": true,
1582 + "data_office365_ModifiedProperties": true,
1583 + "data_office365_Name": true,
1584 + "data_office365_NewValue": true,
1585 + "data_office365_ObjectId": true,
1586 + "data_office365_Operation": true,
1587 + "data_office365_OperationScope": true,
1588 + "data_office365_OrganizationId": true,
1589 + "data_office365_OrganizationName": true,
1590 + "data_office365_Organizer_OrganizationId": true,
1591 + "data_office365_Organizer_RecipientType": true,
1592 + "data_office365_Organizer_Role": true,
1593 + "data_office365_Organizer_UserObjectId": true,
1594 + "data_office365_OriginatingServer": true,
1595 + "data_office365_Parameters": true,
1596 + "data_office365_ParentMessageId": true,
1597 + "data_office365_Platform": true,
1598 + "data_office365_ProviderTypes": true,
1599 + "data_office365_RecordType": true,
1600 + "data_office365_ResultStatus": true,
1601 + "data_office365_SessionId": true,
1602 + "data_office365_Site": true,
1603 + "data_office365_SiteUrl": true,
1604 + "data_office365_SourceFileExtension": true,
1605 + "data_office365_SourceRelativeUrl": true,
1606 + "data_office365_StartTime": true,
1607 + "data_office365_Subscription": true,
1608 + "data_office365_SubscriptionId": true,
1609 + "data_office365_Target": true,
1610 + "data_office365_TargetContextId": true,
1611 + "data_office365_TargetUserOrGroupName": true,
1612 + "data_office365_TargetUserOrGroupType": true,
1613 + "data_office365_TeamGuid": true,
1614 + "data_office365_TeamName": true,
1615 + "data_office365_UniqueSharingId": true,
1616 + "data_office365_UserAgent": true,
1617 + "data_office365_UserId": false,
1618 + "data_office365_UserKey": true,
1619 + "data_office365_UserType": true,
1620 + "data_office365_Version": true,
1621 + "data_office365_WebId": true,
1622 + "data_office365_Workload": true,
1623 + "data_osquery_action": true,
1624 + "data_osquery_calendarTime": true,
1625 + "data_osquery_columns_address": true,
1626 + "data_osquery_columns_address_city_name": true,
1627 + "data_osquery_columns_address_country_code": true,
1628 + "data_osquery_columns_address_geolocation": true,
1629 + "data_osquery_columns_cmdline": true,
1630 + "data_osquery_columns_cwd": true,
1631 + "data_osquery_columns_description": true,
1632 + "data_osquery_columns_directory": true,
1633 + "data_osquery_columns_disk_bytes_read": true,
1634 + "data_osquery_columns_disk_bytes_written": true,
1635 + "data_osquery_columns_egid": true,
1636 + "data_osquery_columns_euid": true,
1637 + "data_osquery_columns_family": true,
1638 + "data_osquery_columns_fd": true,
1639 + "data_osquery_columns_gid": true,
1640 + "data_osquery_columns_gid_signed": true,
1641 + "data_osquery_columns_host": true,
1642 + "data_osquery_columns_interface": true,
1643 + "data_osquery_columns_local_address": true,
1644 + "data_osquery_columns_local_address_city_name": true,
1645 + "data_osquery_columns_local_address_country_code": true,
1646 + "data_osquery_columns_local_address_geolocation": true,
1647 + "data_osquery_columns_local_port": true,
1648 + "data_osquery_columns_mac": true,
1649 + "data_osquery_columns_name": true,
1650 + "data_osquery_columns_net_namespace": true,
1651 + "data_osquery_columns_nice": true,
1652 + "data_osquery_columns_on_disk": true,
1653 + "data_osquery_columns_parent": true,
1654 + "data_osquery_columns_path": true,
1655 + "data_osquery_columns_pgroup": true,
1656 + "data_osquery_columns_pid": true,
1657 + "data_osquery_columns_port": true,
1658 + "data_osquery_columns_protocol": true,
1659 + "data_osquery_columns_remote_address": true,
1660 + "data_osquery_columns_remote_address_city_name": true,
1661 + "data_osquery_columns_remote_address_country_code": true,
1662 + "data_osquery_columns_remote_address_geolocation": true,
1663 + "data_osquery_columns_remote_port": true,
1664 + "data_osquery_columns_resident_size": true,
1665 + "data_osquery_columns_root": true,
1666 + "data_osquery_columns_sgid": true,
1667 + "data_osquery_columns_shell": true,
1668 + "data_osquery_columns_socket": true,
1669 + "data_osquery_columns_start_time": true,
1670 + "data_osquery_columns_state": true,
1671 + "data_osquery_columns_suid": true,
1672 + "data_osquery_columns_system_time": true,
1673 + "data_osquery_columns_threads": true,
1674 + "data_osquery_columns_time_utc": true,
1675 + "data_osquery_columns_total_size": true,
1676 + "data_osquery_columns_tty": true,
1677 + "data_osquery_columns_type": true,
1678 + "data_osquery_columns_uid": true,
1679 + "data_osquery_columns_uid_signed": true,
1680 + "data_osquery_columns_user": true,
1681 + "data_osquery_columns_user_time": true,
1682 + "data_osquery_columns_username": true,
1683 + "data_osquery_columns_wired_size": true,
1684 + "data_osquery_counter": true,
1685 + "data_osquery_decorations_host_uuid": true,
1686 + "data_osquery_decorations_hostname": true,
1687 + "data_osquery_epoch": true,
1688 + "data_osquery_hostIdentifier": true,
1689 + "data_osquery_name": true,
1690 + "data_osquery_numerics": true,
1691 + "data_osquery_unixTime": true,
1692 + "data_proto": true,
1693 + "data_sca_check_command": true,
1694 + "data_sca_check_compliance_cis": true,
1695 + "data_sca_check_compliance_cis_csc": true,
1696 + "data_sca_check_compliance_gdpr_IV": true,
1697 + "data_sca_check_compliance_gpg_13": true,
1698 + "data_sca_check_compliance_hipaa": true,
1699 + "data_sca_check_compliance_nist_800_53": true,
1700 + "data_sca_check_compliance_pci_dss": true,
1701 + "data_sca_check_compliance_tsc": true,
1702 + "data_sca_check_description": true,
1703 + "data_sca_check_id": true,
1704 + "data_sca_check_previous_result": true,
1705 + "data_sca_check_rationale": true,
1706 + "data_sca_check_remediation": true,
1707 + "data_sca_check_result": true,
1708 + "data_sca_check_title": true,
1709 + "data_sca_description": true,
1710 + "data_sca_failed": true,
1711 + "data_sca_file": true,
1712 + "data_sca_invalid": true,
1713 + "data_sca_passed": true,
1714 + "data_sca_policy": true,
1715 + "data_sca_policy_id": true,
1716 + "data_sca_scan_id": true,
1717 + "data_sca_score": true,
1718 + "data_sca_total_checks": true,
1719 + "data_sca_type": true,
1720 + "data_script": true,
1721 + "data_src_ip": true,
1722 + "data_src_ip_city_name": true,
1723 + "data_src_ip_country_code": true,
1724 + "data_src_ip_geolocation": true,
1725 + "data_src_port": true,
1726 + "data_srcip": true,
1727 + "data_srcip_city_name": true,
1728 + "data_srcip_country_code": true,
1729 + "data_srcip_geolocation": true,
1730 + "data_srcuser": true,
1731 + "data_timestamp": true,
1732 + "data_title": true,
1733 + "data_tls_session_resumed": true,
1734 + "data_tls_version": true,
1735 + "data_tx_id": true,
1736 + "data_type": true,
1737 + "data_win_eventXML_binaryData": true,
1738 + "data_win_eventXML_binaryDataSize": true,
1739 + "data_win_eventXML_param1": true,
1740 + "data_win_eventdata_authenticationPackageName": true,
1741 + "data_win_eventdata_callTrace": true,
1742 + "data_win_eventdata_commandLine": true,
1743 + "data_win_eventdata_company": true,
1744 + "data_win_eventdata_creationUtcTime": true,
1745 + "data_win_eventdata_currentDirectory": true,
1746 + "data_win_eventdata_description": true,
1747 + "data_win_eventdata_destinationHostname": true,
1748 + "data_win_eventdata_destinationIp": true,
1749 + "data_win_eventdata_destinationIp_city_name": true,
1750 + "data_win_eventdata_destinationIp_country_code": true,
1751 + "data_win_eventdata_destinationIp_geolocation": true,
1752 + "data_win_eventdata_destinationIsIpv6": true,
1753 + "data_win_eventdata_destinationPort": true,
1754 + "data_win_eventdata_destinationPortName": true,
1755 + "data_win_eventdata_details": true,
1756 + "data_win_eventdata_elevatedToken": true,
1757 + "data_win_eventdata_eventType": true,
1758 + "data_win_eventdata_fileVersion": true,
1759 + "data_win_eventdata_fileVersion_city_name": true,
1760 + "data_win_eventdata_fileVersion_country_code": true,
1761 + "data_win_eventdata_fileVersion_geolocation": true,
1762 + "data_win_eventdata_grantedAccess": true,
1763 + "data_win_eventdata_hashes": true,
1764 + "data_win_eventdata_image": true,
1765 + "data_win_eventdata_imageLoaded": true,
1766 + "data_win_eventdata_impersonationLevel": true,
1767 + "data_win_eventdata_initiated": true,
1768 + "data_win_eventdata_integrityLevel": true,
1769 + "data_win_eventdata_ipAddress": true,
1770 + "data_win_eventdata_ipPort": true,
1771 + "data_win_eventdata_keyLength": true,
1772 + "data_win_eventdata_logonGuid": true,
1773 + "data_win_eventdata_logonId": true,
1774 + "data_win_eventdata_logonProcessName": true,
1775 + "data_win_eventdata_logonType": true,
1776 + "data_win_eventdata_originalFileName": true,
1777 + "data_win_eventdata_param1": true,
1778 + "data_win_eventdata_param2": true,
1779 + "data_win_eventdata_param3": true,
1780 + "data_win_eventdata_param4": true,
1781 + "data_win_eventdata_parentCommandLine": true,
1782 + "data_win_eventdata_parentImage": true,
1783 + "data_win_eventdata_parentProcessGuid": true,
1784 + "data_win_eventdata_parentProcessId": true,
1785 + "data_win_eventdata_processGuid": true,
1786 + "data_win_eventdata_processId": true,
1787 + "data_win_eventdata_processName": true,
1788 + "data_win_eventdata_product": true,
1789 + "data_win_eventdata_protocol": true,
1790 + "data_win_eventdata_queryName": true,
1791 + "data_win_eventdata_queryResults": true,
1792 + "data_win_eventdata_queryStatus": true,
1793 + "data_win_eventdata_ruleName": true,
1794 + "data_win_eventdata_serviceName": true,
1795 + "data_win_eventdata_serviceSid": true,
1796 + "data_win_eventdata_signature": true,
1797 + "data_win_eventdata_signatureStatus": true,
1798 + "data_win_eventdata_signed": true,
1799 + "data_win_eventdata_sourceHostname": true,
1800 + "data_win_eventdata_sourceImage": true,
1801 + "data_win_eventdata_sourceIp": true,
1802 + "data_win_eventdata_sourceIp_city_name": true,
1803 + "data_win_eventdata_sourceIp_country_code": true,
1804 + "data_win_eventdata_sourceIp_geolocation": true,
1805 + "data_win_eventdata_sourceIsIpv6": true,
1806 + "data_win_eventdata_sourcePort": true,
1807 + "data_win_eventdata_sourceProcessGUID": true,
1808 + "data_win_eventdata_sourceProcessId": true,
1809 + "data_win_eventdata_sourceThreadId": true,
1810 + "data_win_eventdata_status": true,
1811 + "data_win_eventdata_subjectDomainName": true,
1812 + "data_win_eventdata_subjectLogonId": true,
1813 + "data_win_eventdata_subjectUserName": true,
1814 + "data_win_eventdata_subjectUserSid": true,
1815 + "data_win_eventdata_targetDomainName": true,
1816 + "data_win_eventdata_targetFilename": true,
1817 + "data_win_eventdata_targetImage": true,
1818 + "data_win_eventdata_targetLinkedLogonId": true,
1819 + "data_win_eventdata_targetLogonId": true,
1820 + "data_win_eventdata_targetObject": true,
1821 + "data_win_eventdata_targetProcessGUID": true,
1822 + "data_win_eventdata_targetProcessId": true,
1823 + "data_win_eventdata_targetUserName": true,
1824 + "data_win_eventdata_targetUserSid": true,
1825 + "data_win_eventdata_terminalSessionId": true,
1826 + "data_win_eventdata_ticketEncryptionType": true,
1827 + "data_win_eventdata_ticketOptions": true,
1828 + "data_win_eventdata_user": true,
1829 + "data_win_eventdata_utcTime": true,
1830 + "data_win_eventdata_virtualAccount": true,
1831 + "data_win_system_channel": true,
1832 + "data_win_system_computer": true,
1833 + "data_win_system_eventID": true,
1834 + "data_win_system_eventRecordID": true,
1835 + "data_win_system_eventSourceName": true,
1836 + "data_win_system_keywords": true,
1837 + "data_win_system_level": true,
1838 + "data_win_system_message": true,
1839 + "data_win_system_opcode": true,
1840 + "data_win_system_processID": true,
1841 + "data_win_system_providerGuid": true,
1842 + "data_win_system_providerName": true,
1843 + "data_win_system_severityValue": true,
1844 + "data_win_system_systemTime": true,
1845 + "data_win_system_task": true,
1846 + "data_win_system_threadID": true,
1847 + "data_win_system_version": true,
1848 + "decoder_name": true,
1849 + "decoder_parent": true,
1850 + "dns_query": true,
1851 + "dns_query_threat_indicated": true,
1852 + "dst_ip": true,
1853 + "dst_ip_city_name": true,
1854 + "dst_ip_country_code": true,
1855 + "dst_ip_geolocation": true,
1856 + "dst_ip_threat_indicated": true,
1857 + "dst_port": true,
1858 + "ecs_version": true,
1859 + "error": true,
1860 + "event_hash": true,
1861 + "file_path": true,
1862 + "firewall_rule_name": true,
1863 + "full_log": false,
1864 + "gl2_accounted_message_size": true,
1865 + "gl2_message_id": true,
1866 + "gl2_processing_error": true,
1867 + "gl2_remote_ip": true,
1868 + "gl2_remote_port": true,
1869 + "gl2_source_collector": true,
1870 + "gl2_source_input": true,
1871 + "gl2_source_node": true,
1872 + "hash_md5": true,
1873 + "hash_sha1": true,
1874 + "hash_sha256": true,
1875 + "highlight": true,
1876 + "host_architecture": true,
1877 + "host_containerized": true,
1878 + "host_hostname": true,
1879 + "host_id": true,
1880 + "host_ip": true,
1881 + "host_mac": true,
1882 + "host_name": true,
1883 + "host_os_codename": true,
1884 + "host_os_kernel": true,
1885 + "host_os_name": true,
1886 + "host_os_platform": true,
1887 + "host_os_version": true,
1888 + "hostname": true,
1889 + "id": true,
1890 + "input_type": true,
1891 + "level": true,
1892 + "location": true,
1893 + "log_file_path": true,
1894 + "log_offset": true,
1895 + "manager_name": true,
1896 + "message": true,
1897 + "module": true,
1898 + "msg_timestamp": true,
1899 + "parent_process_cmd_line": true,
1900 + "parent_process_id": true,
1901 + "parent_process_image": true,
1902 + "pid": true,
1903 + "predecoder_hostname": true,
1904 + "predecoder_program_name": true,
1905 + "predecoder_timestamp": true,
1906 + "previous_log": true,
1907 + "previous_output": true,
1908 + "process_cmd_line": true,
1909 + "process_id": true,
1910 + "process_image": true,
1911 + "process_name": true,
1912 + "protocol": true,
1913 + "rule_cis": true,
1914 + "rule_cis_csc": true,
1915 + "rule_firedtimes": true,
1916 + "rule_gdpr": true,
1917 + "rule_gdpr_IV": true,
1918 + "rule_gpg13": true,
1919 + "rule_gpg_13": true,
1920 + "rule_group1": true,
1921 + "rule_group2": true,
1922 + "rule_group3": true,
1923 + "rule_groups": true,
1924 + "rule_hipaa": true,
1925 + "rule_id": true,
1926 + "rule_info": true,
1927 + "rule_mail": true,
1928 + "rule_mitre_id": true,
1929 + "rule_mitre_tactic": false,
1930 + "rule_nist_800_53": true,
1931 + "rule_pci_dss": true,
1932 + "rule_tsc": true,
1933 + "scanid": true,
1934 + "service": true,
1935 + "software_package": true,
1936 + "software_vendor": true,
1937 + "sort": true,
1938 + "source": true,
1939 + "source_reserved_ip": true,
1940 + "src_ip": true,
1941 + "src_ip_city_name": true,
1942 + "src_ip_country_code": true,
1943 + "src_ip_geolocation": true,
1944 + "src_port": true,
1945 + "streams": true,
1946 + "syscheck_attrs_after": true,
1947 + "syscheck_audit_effective_user_id": true,
1948 + "syscheck_audit_effective_user_name": true,
1949 + "syscheck_audit_group_id": true,
1950 + "syscheck_audit_group_name": true,
1951 + "syscheck_audit_login_user_id": true,
1952 + "syscheck_audit_login_user_name": true,
1953 + "syscheck_audit_process_cwd": true,
1954 + "syscheck_audit_process_id": true,
1955 + "syscheck_audit_process_name": true,
1956 + "syscheck_audit_process_parent_cwd": true,
1957 + "syscheck_audit_process_parent_name": true,
1958 + "syscheck_audit_process_ppid": true,
1959 + "syscheck_audit_user_id": true,
1960 + "syscheck_audit_user_name": true,
1961 + "syscheck_changed_attributes": true,
1962 + "syscheck_event": true,
1963 + "syscheck_gid_after": true,
1964 + "syscheck_gname_after": true,
1965 + "syscheck_hard_links": true,
1966 + "syscheck_inode_after": true,
1967 + "syscheck_inode_before": true,
1968 + "syscheck_md5_after": true,
1969 + "syscheck_md5_before": true,
1970 + "syscheck_mode": true,
1971 + "syscheck_mtime_after": true,
1972 + "syscheck_mtime_before": true,
1973 + "syscheck_path": true,
1974 + "syscheck_perm_after": true,
1975 + "syscheck_perm_before": true,
1976 + "syscheck_sha1_after": true,
1977 + "syscheck_sha1_before": true,
1978 + "syscheck_sha256_after": true,
1979 + "syscheck_sha256_before": true,
1980 + "syscheck_size_after": true,
1981 + "syscheck_size_before": true,
1982 + "syscheck_uid_after": true,
1983 + "syscheck_uname_after": true,
1984 + "syscheck_win_perm_after": true,
1985 + "syscheck_win_perm_after_0_allowed": true,
1986 + "syscheck_win_perm_after_0_name": true,
1987 + "syscheck_win_perm_after_1_allowed": true,
1988 + "syscheck_win_perm_after_1_name": true,
1989 + "syscheck_win_perm_after_2_allowed": true,
1990 + "syscheck_win_perm_after_2_name": true,
1991 + "syscheck_win_perm_after_3_allowed": true,
1992 + "syscheck_win_perm_after_3_name": true,
1993 + "syslog_customer": true,
1994 + "syslog_level": true,
1995 + "syslog_tag": true,
1996 + "syslog_type": true,
1997 + "sysmon_event_description": true,
1998 + "threat_ids": true,
1999 + "threat_indicated": true,
2000 + "threat_names": true,
2001 + "time": true,
2002 + "timestamp": true,
2003 + "true": true,
2004 + "user_name": true,
2005 + "win_registry_key": true,
2006 + "win_system_eventID": true,
2007 + "windows_auth_package": true,
2008 + "windows_domain": true,
2009 + "windows_event_id": true,
2010 + "windows_event_severity": true,
2011 + "windows_logon_type": true
2012 + },
2013 + "indexByName": {
2014 + "_id": 2,
2015 + "_index": 9,
2016 + "_type": 10,
2017 + "agent_id": 11,
2018 + "agent_name": 5,
2019 + "cluster_name": 12,
2020 + "cluster_node": 13,
2021 + "data_office365_AppAccessContext_APIId": 49,
2022 + "data_office365_AppAccessContext_ClientAppId": 50,
2023 + "data_office365_AppAccessContext_ClientAppName": 51,
2024 + "data_office365_AppAccessContext_CorrelationId": 52,
2025 + "data_office365_ArtifactsShared": 53,
2026 + "data_office365_Attendees": 54,
2027 + "data_office365_ChatName": 55,
2028 + "data_office365_ChatThreadId": 56,
2029 + "data_office365_ClientIP": 4,
2030 + "data_office365_ClientIP_city_name": 14,
2031 + "data_office365_ClientIP_country_code": 15,
2032 + "data_office365_ClientIP_geolocation": 16,
2033 + "data_office365_CommunicationSubType": 57,
2034 + "data_office365_CommunicationType": 58,
2035 + "data_office365_CreationTime": 0,
2036 + "data_office365_DeviceId": 59,
2037 + "data_office365_DeviceInformation": 60,
2038 + "data_office365_EndTime": 61,
2039 + "data_office365_ExchangeId": 62,
2040 + "data_office365_ExtraProperties": 63,
2041 + "data_office365_ICalUid": 64,
2042 + "data_office365_Id": 17,
2043 + "data_office365_ItemName": 65,
2044 + "data_office365_JoinTime": 66,
2045 + "data_office365_LeaveTime": 67,
2046 + "data_office365_MeetingDetailId": 68,
2047 + "data_office365_MeetingURL": 69,
2048 + "data_office365_Members": 70,
2049 + "data_office365_MessageId": 71,
2050 + "data_office365_MessageSizeInBytes": 72,
2051 + "data_office365_MessageURLs": 73,
2052 + "data_office365_MessageVersion": 74,
2053 + "data_office365_Modalities": 75,
2054 + "data_office365_Name": 76,
2055 + "data_office365_NewValue": 77,
2056 + "data_office365_ObjectId": 18,
2057 + "data_office365_Operation": 24,
2058 + "data_office365_OperationScope": 78,
2059 + "data_office365_OrganizationId": 19,
2060 + "data_office365_Organizer_OrganizationId": 79,
2061 + "data_office365_Organizer_RecipientType": 80,
2062 + "data_office365_Organizer_Role": 81,
2063 + "data_office365_Organizer_UserObjectId": 82,
2064 + "data_office365_ProviderTypes": 83,
2065 + "data_office365_RecordType": 20,
2066 + "data_office365_StartTime": 84,
2067 + "data_office365_SubscriptionId": 85,
2068 + "data_office365_TeamGuid": 86,
2069 + "data_office365_UserId": 3,
2070 + "data_office365_UserKey": 21,
2071 + "data_office365_UserType": 22,
2072 + "data_office365_Version": 23,
2073 + "data_office365_Workload": 48,
2074 + "decoder_name": 25,
2075 + "gl2_accounted_message_size": 26,
2076 + "gl2_message_id": 27,
2077 + "gl2_processing_error": 28,
2078 + "gl2_remote_ip": 29,
2079 + "gl2_remote_port": 30,
2080 + "gl2_source_input": 31,
2081 + "gl2_source_node": 32,
2082 + "highlight": 33,
2083 + "id": 34,
2084 + "location": 35,
2085 + "manager_name": 36,
2086 + "message": 37,
2087 + "rule_description": 6,
2088 + "rule_firedtimes": 38,
2089 + "rule_group1": 39,
2090 + "rule_groups": 40,
2091 + "rule_id": 8,
2092 + "rule_level": 7,
2093 + "rule_mail": 41,
2094 + "sort": 42,
2095 + "source": 43,
2096 + "streams": 44,
2097 + "syslog_level": 45,
2098 + "syslog_type": 46,
2099 + "timestamp": 1,
2100 + "true": 47
2101 + },
2102 + "renameByName": {
2103 + "_id": "EVENT ID",
2104 + "agent_name": "",
2105 + "data_office365_ActorIpAddress": "SRC IP",
2106 + "data_office365_AffectedItems": "ITEMS",
2107 + "data_office365_BrowserName": "BROWSER",
2108 + "data_office365_ClientIP": "CLIENT IP",
2109 + "data_office365_ClientIP_city_name": "",
2110 + "data_office365_CreationTime": "EVENT TIME",
2111 + "data_office365_Item_Attachments": "ATTACHMENT",
2112 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2113 + "data_office365_Item_Subject": "SUBJECT",
2114 + "data_office365_ResultStatus": "RESULT",
2115 + "data_office365_SourceFileName": "FILE",
2116 + "data_office365_UserId": "ACCOUNT",
2117 + "rule_description": "DESCRIPTION",
2118 + "rule_id": "RULE ID",
2119 + "rule_level": "",
2120 + "rule_mitre_tactic": "MITRE TACTIC",
2121 + "rule_mitre_technique": "MITRE TECHNIQUE",
2122 + "timestamp": "Date/Time"
2123 + }
2124 + }
2125 + }
2126 + ],
2127 + "transparent": true,
2128 + "type": "table"
2129 + }
2130 + ],
2131 + "refresh": "",
2132 + "schemaVersion": 38,
2133 + "style": "dark",
2134 + "tags": ["O365"],
2135 + "templating": {
2136 + "list": [
2137 + {
2138 + "datasource": {
2139 + "type": "elasticsearch",
2140 + "uid": "replace_datasource_uid"
2141 + },
2142 + "filters": [],
2143 + "hide": 0,
2144 + "label": "",
2145 + "name": "Filters",
2146 + "skipUrlSync": false,
2147 + "type": "adhoc"
2148 + },
2149 + {
2150 + "current": {
2151 + "selected": false,
2152 + "text": "All",
2153 + "value": "$__all"
2154 + },
2155 + "datasource": {
2156 + "type": "elasticsearch",
2157 + "uid": "replace_datasource_uid"
2158 + },
2159 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:OneDrive\"}",
2160 + "hide": 0,
2161 + "includeAll": true,
2162 + "label": "Operation",
2163 + "multi": false,
2164 + "name": "operation",
2165 + "options": [],
2166 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:OneDrive\"}",
2167 + "refresh": 2,
2168 + "regex": "",
2169 + "skipUrlSync": false,
2170 + "sort": 1,
2171 + "tagValuesQuery": "",
2172 + "tagsQuery": "",
2173 + "type": "query",
2174 + "useTags": false
2175 + },
2176 + {
2177 + "current": {
2178 + "selected": false,
2179 + "text": "All",
2180 + "value": "$__all"
2181 + },
2182 + "datasource": {
2183 + "type": "elasticsearch",
2184 + "uid": "replace_datasource_uid"
2185 + },
2186 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2187 + "hide": 0,
2188 + "includeAll": true,
2189 + "label": "Rule Level",
2190 + "multi": false,
2191 + "name": "rule_level",
2192 + "options": [],
2193 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2194 + "refresh": 2,
2195 + "regex": "",
2196 + "skipUrlSync": false,
2197 + "sort": 0,
2198 + "type": "query"
2199 + }
2200 + ]
2201 + },
2202 + "time": {
2203 + "from": "now-12h",
2204 + "to": "now"
2205 + },
2206 + "timepicker": {
2207 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2208 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2209 + },
2210 + "timezone": "",
2211 + "title": "O365 - ONEDRIVE",
2212 + "weekStart": ""
2213 }
backend/app/connectors/grafana/dashboards/Office365/powerbi.json
+2377 -2424
@@ -1,2426 +1,2379 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "10.0.3",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:PowerBI",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "cellOptions": {
261 - "type": "auto"
262 - },
263 - "inspect": false
264 - },
265 - "mappings": [],
266 - "thresholds": {
267 - "mode": "absolute",
268 - "steps": [
269 - {
270 - "color": "red",
271 - "value": null
272 - }
273 - ]
274 - }
275 - },
276 - "overrides": [
277 - {
278 - "matcher": {
279 - "id": "byName",
280 - "options": "Count"
281 - },
282 - "properties": [
283 - {
284 - "id": "displayName",
285 - "value": "EVENTS"
286 - },
287 - {
288 - "id": "unit",
289 - "value": "short"
290 - },
291 - {
292 - "id": "decimals",
293 - "value": -1
294 - },
295 - {
296 - "id": "custom.align"
297 - },
298 - {
299 - "id": "thresholds",
300 - "value": {
301 - "mode": "absolute",
302 - "steps": [
303 - {
304 - "color": "red",
305 - "value": null
306 - }
307 - ]
308 - }
309 - }
310 - ]
311 - }
312 - ]
313 - },
314 - "gridPos": {
315 - "h": 7,
316 - "w": 6,
317 - "x": 8,
318 - "y": 0
319 - },
320 - "id": 54,
321 - "options": {
322 - "cellHeight": "sm",
323 - "footer": {
324 - "countRows": false,
325 - "fields": "",
326 - "reducer": [
327 - "sum"
328 - ],
329 - "show": false
330 - },
331 - "showHeader": true
332 - },
333 - "pluginVersion": "10.0.3",
334 - "targets": [
335 - {
336 - "bucketAggs": [
337 - {
338 - "fake": true,
339 - "field": "data_office365_Operation",
340 - "id": "4",
341 - "settings": {
342 - "min_doc_count": 1,
343 - "order": "desc",
344 - "orderBy": "_count",
345 - "size": "0"
346 - },
347 - "type": "terms"
348 - }
349 - ],
350 - "datasource": {
351 - "type": "elasticsearch",
352 - "uid": "replace_datasource_uid"
353 - },
354 - "metrics": [
355 - {
356 - "field": "select field",
357 - "id": "1",
358 - "type": "count"
359 - }
360 - ],
361 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
362 - "refId": "A",
363 - "timeField": "timestamp"
364 - }
365 - ],
366 - "title": "EVENTS BY OPERATION",
367 - "transformations": [
368 - {
369 - "id": "merge",
370 - "options": {
371 - "reducers": []
372 - }
373 - },
374 - {
375 - "id": "organize",
376 - "options": {
377 - "excludeByName": {},
378 - "indexByName": {},
379 - "renameByName": {
380 - "Count": "EVENTS",
381 - "data_office365_Operation": "OPERATION"
382 - }
383 - }
384 - }
385 - ],
386 - "type": "table"
387 - },
388 - {
389 - "datasource": {
390 - "type": "elasticsearch",
391 - "uid": "replace_datasource_uid"
392 - },
393 - "fieldConfig": {
394 - "defaults": {
395 - "color": {
396 - "mode": "thresholds"
397 - },
398 - "custom": {
399 - "align": "auto",
400 - "cellOptions": {
401 - "type": "auto"
402 - },
403 - "inspect": false
404 - },
405 - "mappings": [],
406 - "thresholds": {
407 - "mode": "absolute",
408 - "steps": [
409 - {
410 - "color": "red",
411 - "value": null
412 - }
413 - ]
414 - }
415 - },
416 - "overrides": [
417 - {
418 - "matcher": {
419 - "id": "byName",
420 - "options": "Count"
421 - },
422 - "properties": [
423 - {
424 - "id": "displayName",
425 - "value": "EVENTS"
426 - },
427 - {
428 - "id": "unit",
429 - "value": "short"
430 - },
431 - {
432 - "id": "decimals",
433 - "value": -1
434 - },
435 - {
436 - "id": "custom.align"
437 - },
438 - {
439 - "id": "thresholds",
440 - "value": {
441 - "mode": "absolute",
442 - "steps": [
443 - {
444 - "color": "red",
445 - "value": null
446 - }
447 - ]
448 - }
449 - }
450 - ]
451 - }
452 - ]
453 - },
454 - "gridPos": {
455 - "h": 7,
456 - "w": 6,
457 - "x": 14,
458 - "y": 0
459 - },
460 - "id": 62,
461 - "options": {
462 - "cellHeight": "sm",
463 - "footer": {
464 - "countRows": false,
465 - "fields": "",
466 - "reducer": [
467 - "sum"
468 - ],
469 - "show": false
470 - },
471 - "showHeader": true
472 - },
473 - "pluginVersion": "10.0.3",
474 - "targets": [
475 - {
476 - "bucketAggs": [
477 - {
478 - "fake": true,
479 - "field": "data_office365_Activity",
480 - "id": "4",
481 - "settings": {
482 - "min_doc_count": 1,
483 - "order": "desc",
484 - "orderBy": "_count",
485 - "size": "0"
486 - },
487 - "type": "terms"
488 - }
489 - ],
490 - "datasource": {
491 - "type": "elasticsearch",
492 - "uid": "replace_datasource_uid"
493 - },
494 - "metrics": [
495 - {
496 - "field": "select field",
497 - "id": "1",
498 - "type": "count"
499 - }
500 - ],
501 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
502 - "refId": "A",
503 - "timeField": "timestamp"
504 - }
505 - ],
506 - "title": "EVENTS BY ACTIVITY",
507 - "transformations": [
508 - {
509 - "id": "merge",
510 - "options": {
511 - "reducers": []
512 - }
513 - },
514 - {
515 - "id": "organize",
516 - "options": {
517 - "excludeByName": {},
518 - "indexByName": {},
519 - "renameByName": {
520 - "Count": "EVENTS",
521 - "data_office365_Activity": "ACTIVITY",
522 - "data_office365_Operation": "OPERATION",
523 - "data_office365_SourceApp": "SOURCE APP",
524 - "data_office365_UserAgent": "USER AGENT"
525 - }
526 - }
527 - }
528 - ],
529 - "type": "table"
530 - },
531 - {
532 - "datasource": {
533 - "type": "elasticsearch",
534 - "uid": "replace_datasource_uid"
535 - },
536 - "fieldConfig": {
537 - "defaults": {
538 - "color": {
539 - "mode": "thresholds"
540 - },
541 - "mappings": [
542 - {
543 - "options": {
544 - "match": "null",
545 - "result": {
546 - "text": "N/A"
547 - }
548 - },
549 - "type": "special"
550 - }
551 - ],
552 - "max": 15,
553 - "min": 0,
554 - "thresholds": {
555 - "mode": "absolute",
556 - "steps": [
557 - {
558 - "color": "#299c46",
559 - "value": null
560 - },
561 - {
562 - "color": "rgba(237, 129, 40, 0.89)",
563 - "value": 8
564 - },
565 - {
566 - "color": "#d44a3a",
567 - "value": 12
568 - }
569 - ]
570 - },
571 - "unit": "none"
572 - },
573 - "overrides": []
574 - },
575 - "gridPos": {
576 - "h": 7,
577 - "w": 4,
578 - "x": 0,
579 - "y": 7
580 - },
581 - "id": 16,
582 - "links": [],
583 - "options": {
584 - "orientation": "horizontal",
585 - "reduceOptions": {
586 - "calcs": [
587 - "max"
588 - ],
589 - "fields": "",
590 - "values": false
591 - },
592 - "showThresholdLabels": false,
593 - "showThresholdMarkers": true,
594 - "text": {}
595 - },
596 - "pluginVersion": "10.0.3",
597 - "targets": [
598 - {
599 - "bucketAggs": [
600 - {
601 - "field": "timestamp",
602 - "id": "2",
603 - "settings": {
604 - "interval": "auto",
605 - "min_doc_count": 0,
606 - "trimEdges": 0
607 - },
608 - "type": "date_histogram"
609 - }
610 - ],
611 - "datasource": {
612 - "type": "elasticsearch",
613 - "uid": "replace_datasource_uid"
614 - },
615 - "metrics": [
616 - {
617 - "field": "rule_level",
618 - "id": "1",
619 - "meta": {},
620 - "settings": {},
621 - "type": "max"
622 - }
623 - ],
624 - "query": "data_office365_Operation:$operation AND data_office365_Workload:PowerBI",
625 - "refId": "A",
626 - "timeField": "timestamp"
627 - }
628 - ],
629 - "title": "MAX SEVERITY (0 - 15)",
630 - "type": "gauge"
631 - },
632 - {
633 - "datasource": {
634 - "type": "elasticsearch",
635 - "uid": "replace_datasource_uid"
636 - },
637 - "fieldConfig": {
638 - "defaults": {
639 - "color": {
640 - "mode": "palette-classic"
641 - },
642 - "custom": {
643 - "axisCenteredZero": false,
644 - "axisColorMode": "text",
645 - "axisLabel": "",
646 - "axisPlacement": "auto",
647 - "barAlignment": 0,
648 - "drawStyle": "bars",
649 - "fillOpacity": 0,
650 - "gradientMode": "none",
651 - "hideFrom": {
652 - "legend": false,
653 - "tooltip": false,
654 - "viz": false
655 - },
656 - "lineInterpolation": "linear",
657 - "lineWidth": 1,
658 - "pointSize": 5,
659 - "scaleDistribution": {
660 - "type": "linear"
661 - },
662 - "showPoints": "auto",
663 - "spanNulls": false,
664 - "stacking": {
665 - "group": "A",
666 - "mode": "normal"
667 - },
668 - "thresholdsStyle": {
669 - "mode": "off"
670 - }
671 - },
672 - "mappings": [],
673 - "thresholds": {
674 - "mode": "absolute",
675 - "steps": [
676 - {
677 - "color": "green",
678 - "value": null
679 - },
680 - {
681 - "color": "red",
682 - "value": 80
683 - }
684 - ]
685 - }
686 - },
687 - "overrides": []
688 - },
689 - "gridPos": {
690 - "h": 13,
691 - "w": 20,
692 - "x": 4,
693 - "y": 7
694 - },
695 - "id": 60,
696 - "options": {
697 - "legend": {
698 - "calcs": [],
699 - "displayMode": "table",
700 - "placement": "right",
701 - "showLegend": true
702 - },
703 - "tooltip": {
704 - "mode": "single",
705 - "sort": "none"
706 - }
707 - },
708 - "targets": [
709 - {
710 - "alias": "",
711 - "bucketAggs": [
712 - {
713 - "field": "data_office365_Operation",
714 - "id": "3",
715 - "settings": {
716 - "min_doc_count": "1",
717 - "order": "desc",
718 - "orderBy": "_count",
719 - "size": "10"
720 - },
721 - "type": "terms"
722 - },
723 - {
724 - "field": "timestamp",
725 - "id": "2",
726 - "settings": {
727 - "interval": "auto"
728 - },
729 - "type": "date_histogram"
730 - }
731 - ],
732 - "datasource": {
733 - "type": "elasticsearch",
734 - "uid": "replace_datasource_uid"
735 - },
736 - "metrics": [
737 - {
738 - "id": "1",
739 - "type": "count"
740 - }
741 - ],
742 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
743 - "refId": "A",
744 - "timeField": "timestamp"
745 - }
746 - ],
747 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
748 - "transparent": true,
749 - "type": "timeseries"
750 - },
751 - {
752 - "datasource": {
753 - "type": "elasticsearch",
754 - "uid": "replace_datasource_uid"
755 - },
756 - "fieldConfig": {
757 - "defaults": {
758 - "mappings": [
759 - {
760 - "options": {
761 - "match": "null",
762 - "result": {
763 - "text": "N/A"
764 - }
765 - },
766 - "type": "special"
767 - }
768 - ],
769 - "thresholds": {
770 - "mode": "absolute",
771 - "steps": [
772 - {
773 - "color": "blue",
774 - "value": null
775 - }
776 - ]
777 - },
778 - "unit": "locale"
779 - },
780 - "overrides": []
781 - },
782 - "gridPos": {
783 - "h": 6,
784 - "w": 4,
785 - "x": 0,
786 - "y": 14
787 - },
788 - "id": 51,
789 - "links": [],
790 - "options": {
791 - "colorMode": "value",
792 - "graphMode": "area",
793 - "justifyMode": "auto",
794 - "orientation": "horizontal",
795 - "reduceOptions": {
796 - "calcs": [
797 - "sum"
798 - ],
799 - "fields": "",
800 - "values": false
801 - },
802 - "text": {},
803 - "textMode": "auto"
804 - },
805 - "pluginVersion": "10.0.3",
806 - "targets": [
807 - {
808 - "bucketAggs": [
809 - {
810 - "$$hashKey": "object:331",
811 - "field": "timestamp",
812 - "id": "2",
813 - "settings": {
814 - "interval": "auto",
815 - "min_doc_count": 0,
816 - "trimEdges": 0
817 - },
818 - "type": "date_histogram"
819 - }
820 - ],
821 - "datasource": {
822 - "type": "elasticsearch",
823 - "uid": "replace_datasource_uid"
824 - },
825 - "metrics": [
826 - {
827 - "$$hashKey": "object:329",
828 - "field": "select field",
829 - "id": "1",
830 - "type": "count"
831 - }
832 - ],
833 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
834 - "refId": "A",
835 - "timeField": "timestamp"
836 - }
837 - ],
838 - "title": "EVENTS (Total)",
839 - "type": "stat"
840 - },
841 - {
842 - "datasource": {
843 - "type": "elasticsearch",
844 - "uid": "replace_datasource_uid"
845 - },
846 - "fieldConfig": {
847 - "defaults": {
848 - "color": {
849 - "mode": "thresholds"
850 - },
851 - "custom": {
852 - "align": "auto",
853 - "cellOptions": {
854 - "type": "auto"
855 - },
856 - "inspect": false
857 - },
858 - "mappings": [],
859 - "thresholds": {
860 - "mode": "absolute",
861 - "steps": [
862 - {
863 - "color": "orange",
864 - "value": null
865 - }
866 - ]
867 - }
868 - },
869 - "overrides": [
870 - {
871 - "matcher": {
872 - "id": "byName",
873 - "options": "Count"
874 - },
875 - "properties": [
876 - {
877 - "id": "displayName",
878 - "value": "EVENTS"
879 - },
880 - {
881 - "id": "unit",
882 - "value": "short"
883 - },
884 - {
885 - "id": "decimals",
886 - "value": -1
887 - },
888 - {
889 - "id": "custom.align"
890 - }
891 - ]
892 - },
893 - {
894 - "matcher": {
895 - "id": "byName",
896 - "options": "AD ACCOUNT"
897 - },
898 - "properties": [
899 - {
900 - "id": "custom.width",
901 - "value": 377
902 - }
903 - ]
904 - }
905 - ]
906 - },
907 - "gridPos": {
908 - "h": 12,
909 - "w": 8,
910 - "x": 0,
911 - "y": 20
912 - },
913 - "id": 61,
914 - "options": {
915 - "cellHeight": "sm",
916 - "footer": {
917 - "countRows": false,
918 - "fields": "",
919 - "reducer": [
920 - "sum"
921 - ],
922 - "show": false
923 - },
924 - "showHeader": true,
925 - "sortBy": []
926 - },
927 - "pluginVersion": "10.0.3",
928 - "targets": [
929 - {
930 - "bucketAggs": [
931 - {
932 - "fake": true,
933 - "field": "data_office365_ArtifactName",
934 - "id": "4",
935 - "settings": {
936 - "min_doc_count": 1,
937 - "order": "desc",
938 - "orderBy": "_count",
939 - "size": "0"
940 - },
941 - "type": "terms"
942 - }
943 - ],
944 - "datasource": {
945 - "type": "elasticsearch",
946 - "uid": "replace_datasource_uid"
947 - },
948 - "metrics": [
949 - {
950 - "field": "select field",
951 - "id": "1",
952 - "type": "count"
953 - }
954 - ],
955 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
956 - "refId": "A",
957 - "timeField": "timestamp"
958 - }
959 - ],
960 - "title": "MS-PowerBI EVENTS BY ARTIFACT",
961 - "transformations": [
962 - {
963 - "id": "merge",
964 - "options": {
965 - "reducers": []
966 - }
967 - },
968 - {
969 - "id": "organize",
970 - "options": {
971 - "excludeByName": {},
972 - "indexByName": {},
973 - "renameByName": {
974 - "Count": "EVENTS",
975 - "data_office365_ArtifactName": "ARTIFACT",
976 - "data_office365_AuthenticationType": "AUTH TYPE",
977 - "data_office365_ClientIP_country_code": "COUNTRY",
978 - "data_office365_FormName": "FORM NAME",
979 - "data_office365_LogonError": "ERROR",
980 - "data_office365_Operation": "WORKLOAD",
981 - "data_office365_UserId": "AD ACCOUNT"
982 - }
983 - }
984 - }
985 - ],
986 - "type": "table"
987 - },
988 - {
989 - "circleMaxSize": 30,
990 - "circleMinSize": 2,
991 - "colors": [
992 - "rgba(245, 54, 54, 0.9)",
993 - "rgba(237, 129, 40, 0.89)",
994 - "rgba(50, 172, 45, 0.97)"
995 - ],
996 - "datasource": {
997 - "type": "elasticsearch",
998 - "uid": "replace_datasource_uid"
999 - },
1000 - "decimals": 0,
1001 - "esMetric": "Count",
1002 - "gridPos": {
1003 - "h": 12,
1004 - "w": 8,
1005 - "x": 8,
1006 - "y": 20
1007 - },
1008 - "hideEmpty": false,
1009 - "hideZero": false,
1010 - "id": 50,
1011 - "initialZoom": 1,
1012 - "locationData": "countries",
1013 - "mapCenter": "(0°, 0°)",
1014 - "mapCenterLatitude": 0,
1015 - "mapCenterLongitude": 0,
1016 - "maxDataPoints": 1,
1017 - "mouseWheelZoom": false,
1018 - "showLegend": true,
1019 - "stickyLabels": false,
1020 - "tableQueryOptions": {
1021 - "geohashField": "geohash",
1022 - "latitudeField": "latitude",
1023 - "longitudeField": "longitude",
1024 - "metricField": "metric",
1025 - "queryType": "geohash"
1026 - },
1027 - "targets": [
1028 - {
1029 - "bucketAggs": [
1030 - {
1031 - "fake": true,
1032 - "field": "data_office365_ClientIP_country_code",
1033 - "id": "3",
1034 - "settings": {
1035 - "min_doc_count": 1,
1036 - "order": "desc",
1037 - "orderBy": "_term",
1038 - "size": "0"
1039 - },
1040 - "type": "terms"
1041 - },
1042 - {
1043 - "field": "timestamp",
1044 - "id": "2",
1045 - "settings": {
1046 - "interval": "auto",
1047 - "min_doc_count": 0,
1048 - "trimEdges": 0
1049 - },
1050 - "type": "date_histogram"
1051 - }
1052 - ],
1053 - "datasource": {
1054 - "type": "elasticsearch",
1055 - "uid": "replace_datasource_uid"
1056 - },
1057 - "metrics": [
1058 - {
1059 - "field": "select field",
1060 - "id": "1",
1061 - "type": "count"
1062 - }
1063 - ],
1064 - "query": "data_office365_Workload:PowerBI AND rule_level:$rule_level",
1065 - "refId": "A",
1066 - "timeField": "timestamp"
1067 - }
1068 - ],
1069 - "thresholds": "0,10",
1070 - "title": "MS-PowerBI - ALL EVENTS BY SRC COUNTRY",
1071 - "type": "grafana-worldmap-panel",
1072 - "unitPlural": "",
1073 - "unitSingle": "",
1074 - "valueName": "total"
1075 - },
1076 - {
1077 - "datasource": {
1078 - "type": "elasticsearch",
1079 - "uid": "replace_datasource_uid"
1080 - },
1081 - "fieldConfig": {
1082 - "defaults": {
1083 - "color": {
1084 - "mode": "thresholds"
1085 - },
1086 - "custom": {
1087 - "align": "auto",
1088 - "cellOptions": {
1089 - "type": "auto"
1090 - },
1091 - "inspect": false
1092 - },
1093 - "mappings": [],
1094 - "thresholds": {
1095 - "mode": "absolute",
1096 - "steps": [
1097 - {
1098 - "color": "orange",
1099 - "value": null
1100 - }
1101 - ]
1102 - }
1103 - },
1104 - "overrides": [
1105 - {
1106 - "matcher": {
1107 - "id": "byName",
1108 - "options": "Count"
1109 - },
1110 - "properties": [
1111 - {
1112 - "id": "displayName",
1113 - "value": "EVENTS"
1114 - },
1115 - {
1116 - "id": "unit",
1117 - "value": "short"
1118 - },
1119 - {
1120 - "id": "decimals",
1121 - "value": -1
1122 - },
1123 - {
1124 - "id": "custom.align"
1125 - }
1126 - ]
1127 - },
1128 - {
1129 - "matcher": {
1130 - "id": "byName",
1131 - "options": "AD ACCOUNT"
1132 - },
1133 - "properties": [
1134 - {
1135 - "id": "custom.width",
1136 - "value": 377
1137 - }
1138 - ]
1139 - }
1140 - ]
1141 - },
1142 - "gridPos": {
1143 - "h": 12,
1144 - "w": 8,
1145 - "x": 16,
1146 - "y": 20
1147 - },
1148 - "id": 58,
1149 - "options": {
1150 - "cellHeight": "sm",
1151 - "footer": {
1152 - "countRows": false,
1153 - "fields": "",
1154 - "reducer": [
1155 - "sum"
1156 - ],
1157 - "show": false
1158 - },
1159 - "showHeader": true,
1160 - "sortBy": []
1161 - },
1162 - "pluginVersion": "10.0.3",
1163 - "targets": [
1164 - {
1165 - "bucketAggs": [
1166 - {
1167 - "fake": true,
1168 - "field": "data_office365_UserId",
1169 - "id": "4",
1170 - "settings": {
1171 - "min_doc_count": 1,
1172 - "order": "desc",
1173 - "orderBy": "_count",
1174 - "size": "0"
1175 - },
1176 - "type": "terms"
1177 - },
1178 - {
1179 - "field": "data_office365_ClientIP_country_code",
1180 - "id": "5",
1181 - "settings": {
1182 - "min_doc_count": "1",
1183 - "order": "desc",
1184 - "orderBy": "_term",
1185 - "size": "10"
1186 - },
1187 - "type": "terms"
1188 - }
1189 - ],
1190 - "datasource": {
1191 - "type": "elasticsearch",
1192 - "uid": "replace_datasource_uid"
1193 - },
1194 - "metrics": [
1195 - {
1196 - "field": "select field",
1197 - "id": "1",
1198 - "type": "count"
1199 - }
1200 - ],
1201 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
1202 - "refId": "A",
1203 - "timeField": "timestamp"
1204 - }
1205 - ],
1206 - "title": "MS-PowerBI EVENTS BY ACCOUNT",
1207 - "transformations": [
1208 - {
1209 - "id": "merge",
1210 - "options": {
1211 - "reducers": []
1212 - }
1213 - },
1214 - {
1215 - "id": "organize",
1216 - "options": {
1217 - "excludeByName": {},
1218 - "indexByName": {},
1219 - "renameByName": {
1220 - "Count": "EVENTS",
1221 - "data_office365_ClientIP_country_code": "COUNTRY",
1222 - "data_office365_LogonError": "ERROR",
1223 - "data_office365_Operation": "WORKLOAD",
1224 - "data_office365_UserId": "AD ACCOUNT"
1225 - }
1226 - }
1227 - }
1228 - ],
1229 - "type": "table"
1230 - },
1231 - {
1232 - "datasource": {
1233 - "type": "elasticsearch",
1234 - "uid": "replace_datasource_uid"
1235 - },
1236 - "fieldConfig": {
1237 - "defaults": {
1238 - "color": {
1239 - "mode": "thresholds"
1240 - },
1241 - "custom": {
1242 - "align": "auto",
1243 - "cellOptions": {
1244 - "type": "auto"
1245 - },
1246 - "filterable": true,
1247 - "inspect": false
1248 - },
1249 - "mappings": [],
1250 - "thresholds": {
1251 - "mode": "absolute",
1252 - "steps": [
1253 - {
1254 - "color": "green",
1255 - "value": null
1256 - },
1257 - {
1258 - "color": "red",
1259 - "value": 80
1260 - }
1261 - ]
1262 - }
1263 - },
1264 - "overrides": [
1265 - {
1266 - "matcher": {
1267 - "id": "byName",
1268 - "options": "rule_level"
1269 - },
1270 - "properties": [
1271 - {
1272 - "id": "displayName",
1273 - "value": "RULE LEVEL"
1274 - },
1275 - {
1276 - "id": "unit",
1277 - "value": "short"
1278 - },
1279 - {
1280 - "id": "decimals",
1281 - "value": -1
1282 - },
1283 - {
1284 - "id": "custom.cellOptions",
1285 - "value": {
1286 - "mode": "gradient",
1287 - "type": "color-background"
1288 - }
1289 - },
1290 - {
1291 - "id": "custom.align"
1292 - },
1293 - {
1294 - "id": "thresholds",
1295 - "value": {
1296 - "mode": "absolute",
1297 - "steps": [
1298 - {
1299 - "color": "#37872D",
1300 - "value": null
1301 - },
1302 - {
1303 - "color": "rgba(237, 129, 40, 0.89)",
1304 - "value": 7
1305 - },
1306 - {
1307 - "color": "rgba(245, 54, 54, 0.9)",
1308 - "value": 12
1309 - }
1310 - ]
1311 - }
1312 - }
1313 - ]
1314 - },
1315 - {
1316 - "matcher": {
1317 - "id": "byName",
1318 - "options": "Date/Time"
1319 - },
1320 - "properties": [
1321 - {
1322 - "id": "custom.width",
1323 - "value": 242
1324 - }
1325 - ]
1326 - },
1327 - {
1328 - "matcher": {
1329 - "id": "byName",
1330 - "options": "MITRE TACTIC"
1331 - },
1332 - "properties": [
1333 - {
1334 - "id": "custom.width",
1335 - "value": 332
1336 - }
1337 - ]
1338 - },
1339 - {
1340 - "matcher": {
1341 - "id": "byName",
1342 - "options": "IP ADDRESS"
1343 - },
1344 - "properties": [
1345 - {
1346 - "id": "custom.width",
1347 - "value": 163
1348 - }
1349 - ]
1350 - },
1351 - {
1352 - "matcher": {
1353 - "id": "byName",
1354 - "options": "MITRE TECHNIQUE"
1355 - },
1356 - "properties": [
1357 - {
1358 - "id": "custom.width",
1359 - "value": 312
1360 - }
1361 - ]
1362 - },
1363 - {
1364 - "matcher": {
1365 - "id": "byName",
1366 - "options": "EVENT ID"
1367 - },
1368 - "properties": [
1369 - {
1370 - "id": "links",
1371 - "value": [
1372 - {
1373 - "targetBlank": true,
1374 - "title": "VIEW EVENT DETAILS",
1375 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1376 - }
1377 - ]
1378 - },
1379 - {
1380 - "id": "custom.width",
1381 - "value": 265
1382 - }
1383 - ]
1384 - },
1385 - {
1386 - "matcher": {
1387 - "id": "byName",
1388 - "options": "RESULT"
1389 - },
1390 - "properties": [
1391 - {
1392 - "id": "custom.width",
1393 - "value": 118
1394 - },
1395 - {
1396 - "id": "mappings",
1397 - "value": [
1398 - {
1399 - "options": {
1400 - "Failed": {
1401 - "color": "orange",
1402 - "index": 1
1403 - },
1404 - "Success": {
1405 - "color": "green",
1406 - "index": 0
1407 - }
1408 - },
1409 - "type": "value"
1410 - }
1411 - ]
1412 - },
1413 - {
1414 - "id": "custom.cellOptions",
1415 - "value": {
1416 - "type": "color-text"
1417 - }
1418 - }
1419 - ]
1420 - },
1421 - {
1422 - "matcher": {
1423 - "id": "byName",
1424 - "options": "SRC IP"
1425 - },
1426 - "properties": [
1427 - {
1428 - "id": "custom.width",
1429 - "value": 265
1430 - }
1431 - ]
1432 - },
1433 - {
1434 - "matcher": {
1435 - "id": "byName",
1436 - "options": "ACCOUNT"
1437 - },
1438 - "properties": [
1439 - {
1440 - "id": "custom.width",
1441 - "value": 227
1442 - }
1443 - ]
1444 - },
1445 - {
1446 - "matcher": {
1447 - "id": "byName",
1448 - "options": "EVENT TIME"
1449 - },
1450 - "properties": [
1451 - {
1452 - "id": "custom.width",
1453 - "value": 195
1454 - }
1455 - ]
1456 - },
1457 - {
1458 - "matcher": {
1459 - "id": "byName",
1460 - "options": "CLIENT IP"
1461 - },
1462 - "properties": [
1463 - {
1464 - "id": "custom.width",
1465 - "value": 191
1466 - }
1467 - ]
1468 - },
1469 - {
1470 - "matcher": {
1471 - "id": "byName",
1472 - "options": "DESCRIPTION"
1473 - },
1474 - "properties": [
1475 - {
1476 - "id": "custom.width",
1477 - "value": 367
1478 - }
1479 - ]
1480 - },
1481 - {
1482 - "matcher": {
1483 - "id": "byName",
1484 - "options": "FILE"
1485 - },
1486 - "properties": [
1487 - {
1488 - "id": "custom.width",
1489 - "value": 855
1490 - }
1491 - ]
1492 - },
1493 - {
1494 - "matcher": {
1495 - "id": "byName",
1496 - "options": "BROWSER"
1497 - },
1498 - "properties": [
1499 - {
1500 - "id": "custom.width",
1501 - "value": 205
1502 - }
1503 - ]
1504 - },
1505 - {
1506 - "matcher": {
1507 - "id": "byName",
1508 - "options": "RULE LEVEL"
1509 - },
1510 - "properties": [
1511 - {
1512 - "id": "custom.width",
1513 - "value": 197
1514 - }
1515 - ]
1516 - }
1517 - ]
1518 - },
1519 - "gridPos": {
1520 - "h": 16,
1521 - "w": 24,
1522 - "x": 0,
1523 - "y": 32
1524 - },
1525 - "id": 27,
1526 - "options": {
1527 - "cellHeight": "sm",
1528 - "footer": {
1529 - "countRows": false,
1530 - "enablePagination": true,
1531 - "fields": "",
1532 - "reducer": [
1533 - "sum"
1534 - ],
1535 - "show": false
1536 - },
1537 - "showHeader": true,
1538 - "sortBy": []
1539 - },
1540 - "pluginVersion": "10.0.3",
1541 - "targets": [
1542 - {
1543 - "bucketAggs": [],
1544 - "datasource": {
1545 - "type": "elasticsearch",
1546 - "uid": "replace_datasource_uid"
1547 - },
1548 - "metrics": [
1549 - {
1550 - "id": "1",
1551 - "settings": {
1552 - "size": "250"
1553 - },
1554 - "type": "raw_data"
1555 - }
1556 - ],
1557 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
1558 - "refId": "A",
1559 - "timeField": "timestamp"
1560 - }
1561 - ],
1562 - "title": "EVENTS",
1563 - "transformations": [
1564 - {
1565 - "id": "organize",
1566 - "options": {
1567 - "excludeByName": {
1568 - "@metadata_beat": true,
1569 - "@metadata_type": true,
1570 - "@metadata_version": true,
1571 - "IMPHASH": true,
1572 - "MD5": true,
1573 - "SHA1": true,
1574 - "SHA256": true,
1575 - "_id": false,
1576 - "_index": true,
1577 - "_type": true,
1578 - "agent_ephemeral_id": true,
1579 - "agent_hostname": true,
1580 - "agent_id": true,
1581 - "agent_ip_city_name": true,
1582 - "agent_ip_country_code": true,
1583 - "agent_ip_geolocation": true,
1584 - "agent_name": true,
1585 - "agent_type": true,
1586 - "agent_version": true,
1587 - "beats_type": true,
1588 - "cluster_name": true,
1589 - "cluster_node": true,
1590 - "collector_node_id": true,
1591 - "data_alert_action": true,
1592 - "data_alert_category": true,
1593 - "data_alert_gid": true,
1594 - "data_alert_rev": true,
1595 - "data_alert_severity": true,
1596 - "data_alert_signature": true,
1597 - "data_alert_signature_id": true,
1598 - "data_app_proto": true,
1599 - "data_audit_auid": true,
1600 - "data_audit_command": true,
1601 - "data_audit_euid": true,
1602 - "data_audit_exe": true,
1603 - "data_audit_gid": true,
1604 - "data_audit_id": true,
1605 - "data_audit_pid": true,
1606 - "data_audit_res": true,
1607 - "data_audit_session": true,
1608 - "data_audit_type": true,
1609 - "data_audit_uid": true,
1610 - "data_dest_ip": true,
1611 - "data_dest_port": true,
1612 - "data_dstuser": true,
1613 - "data_event_type": true,
1614 - "data_extra_data": true,
1615 - "data_file": true,
1616 - "data_flow_bytes_toclient": true,
1617 - "data_flow_bytes_toserver": true,
1618 - "data_flow_id": true,
1619 - "data_flow_pkts_toclient": true,
1620 - "data_flow_pkts_toserver": true,
1621 - "data_flow_start": true,
1622 - "data_http_http_content_type": true,
1623 - "data_http_http_port": true,
1624 - "data_http_length": true,
1625 - "data_http_status": true,
1626 - "data_http_url": true,
1627 - "data_id": true,
1628 - "data_in_iface": true,
1629 - "data_integration": true,
1630 - "data_metadata_flowbits": true,
1631 - "data_metadata_flowints_http_anomaly_count": true,
1632 - "data_metadata_flowints_tcp_retransmission_count": true,
1633 - "data_office365_AADGroupId": true,
1634 - "data_office365_ActivityId": true,
1635 - "data_office365_ActivityParameters": true,
1636 - "data_office365_Actor": true,
1637 - "data_office365_ActorContextId": true,
1638 - "data_office365_ActorIpAddress": false,
1639 - "data_office365_ActorIpAddress_city_name": true,
1640 - "data_office365_ActorIpAddress_country_code": true,
1641 - "data_office365_ActorIpAddress_geolocation": true,
1642 - "data_office365_AppAccessContext_AADSessionId": true,
1643 - "data_office365_AppAccessContext_APIId": true,
1644 - "data_office365_AppAccessContext_ClientAppId": true,
1645 - "data_office365_AppAccessContext_ClientAppName": true,
1646 - "data_office365_AppAccessContext_CorrelationId": true,
1647 - "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1648 - "data_office365_AppAccessContext_UniqueTokenId": true,
1649 - "data_office365_AppId": true,
1650 - "data_office365_ApplicationDisplayName": true,
1651 - "data_office365_ApplicationId": true,
1652 - "data_office365_ArtifactId": true,
1653 - "data_office365_ArtifactKind": true,
1654 - "data_office365_ArtifactsShared": true,
1655 - "data_office365_AssertingApplicationId": true,
1656 - "data_office365_Attendees": true,
1657 - "data_office365_AuthenticationType": true,
1658 - "data_office365_AzureActiveDirectoryEventType": true,
1659 - "data_office365_BrowserVersion": true,
1660 - "data_office365_BrowserVersion_city_name": true,
1661 - "data_office365_BrowserVersion_country_code": true,
1662 - "data_office365_BrowserVersion_geolocation": true,
1663 - "data_office365_CapacityId": true,
1664 - "data_office365_CapacityName": true,
1665 - "data_office365_ChannelGuid": true,
1666 - "data_office365_ChannelName": true,
1667 - "data_office365_ChatName": true,
1668 - "data_office365_ChatThreadId": true,
1669 - "data_office365_ClientAppId": true,
1670 - "data_office365_ClientIP": false,
1671 - "data_office365_ClientIPAddress": true,
1672 - "data_office365_ClientIPAddress_city_name": true,
1673 - "data_office365_ClientIPAddress_country_code": true,
1674 - "data_office365_ClientIPAddress_geolocation": true,
1675 - "data_office365_ClientIP_city_name": true,
1676 - "data_office365_ClientIP_country_code": true,
1677 - "data_office365_ClientIP_geolocation": true,
1678 - "data_office365_ClientIP_reserved_ip": true,
1679 - "data_office365_ClientInfoString": true,
1680 - "data_office365_ClientProcessName": true,
1681 - "data_office365_ClientRequestId": true,
1682 - "data_office365_ClientVersion": true,
1683 - "data_office365_CommunicationSubType": true,
1684 - "data_office365_CommunicationType": true,
1685 - "data_office365_ConsumptionMethod": true,
1686 - "data_office365_CorrelationId": true,
1687 - "data_office365_CreationTime": false,
1688 - "data_office365_CrossMailboxOperation": true,
1689 - "data_office365_CustomUniqueId": true,
1690 - "data_office365_CustomizedDoclib": true,
1691 - "data_office365_DashboardId": true,
1692 - "data_office365_DashboardName": true,
1693 - "data_office365_DatasetId": true,
1694 - "data_office365_DatasetName": true,
1695 - "data_office365_Datasets": true,
1696 - "data_office365_DestFolder_Id": true,
1697 - "data_office365_DestFolder_Path": true,
1698 - "data_office365_DestinationFileExtension": true,
1699 - "data_office365_DestinationFileName": true,
1700 - "data_office365_DestinationRelativeUrl": true,
1701 - "data_office365_DeviceDisplayName": true,
1702 - "data_office365_DeviceDisplayName_city_name": true,
1703 - "data_office365_DeviceDisplayName_country_code": true,
1704 - "data_office365_DeviceDisplayName_geolocation": true,
1705 - "data_office365_DeviceId": true,
1706 - "data_office365_DeviceInformation": true,
1707 - "data_office365_DeviceProperties": true,
1708 - "data_office365_DistributionMethod": true,
1709 - "data_office365_DoNotDistributeEvent": true,
1710 - "data_office365_EndTime": true,
1711 - "data_office365_ErrorNumber": true,
1712 - "data_office365_EventData": true,
1713 - "data_office365_EventSource": true,
1714 - "data_office365_ExchangeId": true,
1715 - "data_office365_ExtendedProperties": true,
1716 - "data_office365_ExternalAccess": true,
1717 - "data_office365_ExtraProperties": true,
1718 - "data_office365_FileSizeBytes": true,
1719 - "data_office365_FileSyncBytesCommitted": true,
1720 - "data_office365_Folder_Id": true,
1721 - "data_office365_Folder_Path": true,
1722 - "data_office365_FormId": true,
1723 - "data_office365_FormsUserType": true,
1724 - "data_office365_FromApp": true,
1725 - "data_office365_HighPriorityMediaProcessing": true,
1726 - "data_office365_HostedContents": true,
1727 - "data_office365_ICalUid": true,
1728 - "data_office365_Id": true,
1729 - "data_office365_ImplicitShare": true,
1730 - "data_office365_InterSystemsId": true,
1731 - "data_office365_InternalLogonType": true,
1732 - "data_office365_IntraSystemId": true,
1733 - "data_office365_IsManagedDevice": true,
1734 - "data_office365_IsSuccess": true,
1735 - "data_office365_ItemCount": true,
1736 - "data_office365_ItemName": true,
1737 - "data_office365_ItemType": true,
1738 - "data_office365_Item_Id": true,
1739 - "data_office365_Item_InternetMessageId": true,
1740 - "data_office365_Item_IsRecord": true,
1741 - "data_office365_Item_ParentFolder_Id": true,
1742 - "data_office365_Item_SizeInBytes": true,
1743 - "data_office365_JoinTime": true,
1744 - "data_office365_LeaveTime": true,
1745 - "data_office365_ListBaseTemplateType": true,
1746 - "data_office365_ListBaseType": true,
1747 - "data_office365_ListId": true,
1748 - "data_office365_ListItemUniqueId": true,
1749 - "data_office365_ListServerTemplate": true,
1750 - "data_office365_ListTitle": true,
1751 - "data_office365_LogonError": true,
1752 - "data_office365_LogonType": true,
1753 - "data_office365_LogonUserSid": true,
1754 - "data_office365_MachineId": true,
1755 - "data_office365_MailboxGuid": true,
1756 - "data_office365_MailboxOwnerSid": true,
1757 - "data_office365_MailboxOwnerUPN": true,
1758 - "data_office365_MeetingDetailId": true,
1759 - "data_office365_MeetingURL": true,
1760 - "data_office365_Members": true,
1761 - "data_office365_MessageId": true,
1762 - "data_office365_MessageSizeInBytes": true,
1763 - "data_office365_MessageURLs": true,
1764 - "data_office365_MessageVersion": true,
1765 - "data_office365_Modalities": true,
1766 - "data_office365_ModifiedProperties": true,
1767 - "data_office365_Name": true,
1768 - "data_office365_NewValue": true,
1769 - "data_office365_ObjectId": true,
1770 - "data_office365_Operation": true,
1771 - "data_office365_OperationScope": true,
1772 - "data_office365_OrganizationId": true,
1773 - "data_office365_OrganizationName": true,
1774 - "data_office365_Organizer_OrganizationId": true,
1775 - "data_office365_Organizer_RecipientType": true,
1776 - "data_office365_Organizer_Role": true,
1777 - "data_office365_Organizer_UserObjectId": true,
1778 - "data_office365_OriginatingServer": true,
1779 - "data_office365_Parameters": true,
1780 - "data_office365_ParentMessageId": true,
1781 - "data_office365_Platform": true,
1782 - "data_office365_ProviderTypes": true,
1783 - "data_office365_RecordType": true,
1784 - "data_office365_RefreshEnforcementPolicy": true,
1785 - "data_office365_ReportId": true,
1786 - "data_office365_ReportName": true,
1787 - "data_office365_ReportType": true,
1788 - "data_office365_RequestId": true,
1789 - "data_office365_ResultStatus": false,
1790 - "data_office365_SearchQueryText": true,
1791 - "data_office365_SessionId": true,
1792 - "data_office365_Site": true,
1793 - "data_office365_SiteUrl": true,
1794 - "data_office365_SkipForServiceWorker": true,
1795 - "data_office365_Source": true,
1796 - "data_office365_SourceFileExtension": true,
1797 - "data_office365_SourceRelativeUrl": true,
1798 - "data_office365_StartTime": true,
1799 - "data_office365_Subscription": true,
1800 - "data_office365_SubscriptionId": true,
1801 - "data_office365_Target": true,
1802 - "data_office365_TargetContextId": true,
1803 - "data_office365_TargetUserOrGroupName": true,
1804 - "data_office365_TargetUserOrGroupType": true,
1805 - "data_office365_TeamGuid": true,
1806 - "data_office365_TeamName": true,
1807 - "data_office365_UniqueSharingId": true,
1808 - "data_office365_UserAgent": false,
1809 - "data_office365_UserId": false,
1810 - "data_office365_UserKey": true,
1811 - "data_office365_UserType": true,
1812 - "data_office365_Version": true,
1813 - "data_office365_WebId": true,
1814 - "data_office365_WorkSpaceName": true,
1815 - "data_office365_Workload": true,
1816 - "data_office365_WorkspaceId": true,
1817 - "data_osquery_action": true,
1818 - "data_osquery_calendarTime": true,
1819 - "data_osquery_columns_address": true,
1820 - "data_osquery_columns_address_city_name": true,
1821 - "data_osquery_columns_address_country_code": true,
1822 - "data_osquery_columns_address_geolocation": true,
1823 - "data_osquery_columns_cmdline": true,
1824 - "data_osquery_columns_cwd": true,
1825 - "data_osquery_columns_description": true,
1826 - "data_osquery_columns_directory": true,
1827 - "data_osquery_columns_disk_bytes_read": true,
1828 - "data_osquery_columns_disk_bytes_written": true,
1829 - "data_osquery_columns_egid": true,
1830 - "data_osquery_columns_euid": true,
1831 - "data_osquery_columns_family": true,
1832 - "data_osquery_columns_fd": true,
1833 - "data_osquery_columns_gid": true,
1834 - "data_osquery_columns_gid_signed": true,
1835 - "data_osquery_columns_host": true,
1836 - "data_osquery_columns_interface": true,
1837 - "data_osquery_columns_local_address": true,
1838 - "data_osquery_columns_local_address_city_name": true,
1839 - "data_osquery_columns_local_address_country_code": true,
1840 - "data_osquery_columns_local_address_geolocation": true,
1841 - "data_osquery_columns_local_port": true,
1842 - "data_osquery_columns_mac": true,
1843 - "data_osquery_columns_name": true,
1844 - "data_osquery_columns_net_namespace": true,
1845 - "data_osquery_columns_nice": true,
1846 - "data_osquery_columns_on_disk": true,
1847 - "data_osquery_columns_parent": true,
1848 - "data_osquery_columns_path": true,
1849 - "data_osquery_columns_pgroup": true,
1850 - "data_osquery_columns_pid": true,
1851 - "data_osquery_columns_port": true,
1852 - "data_osquery_columns_protocol": true,
1853 - "data_osquery_columns_remote_address": true,
1854 - "data_osquery_columns_remote_address_city_name": true,
1855 - "data_osquery_columns_remote_address_country_code": true,
1856 - "data_osquery_columns_remote_address_geolocation": true,
1857 - "data_osquery_columns_remote_port": true,
1858 - "data_osquery_columns_resident_size": true,
1859 - "data_osquery_columns_root": true,
1860 - "data_osquery_columns_sgid": true,
1861 - "data_osquery_columns_shell": true,
1862 - "data_osquery_columns_socket": true,
1863 - "data_osquery_columns_start_time": true,
1864 - "data_osquery_columns_state": true,
1865 - "data_osquery_columns_suid": true,
1866 - "data_osquery_columns_system_time": true,
1867 - "data_osquery_columns_threads": true,
1868 - "data_osquery_columns_time_utc": true,
1869 - "data_osquery_columns_total_size": true,
1870 - "data_osquery_columns_tty": true,
1871 - "data_osquery_columns_type": true,
1872 - "data_osquery_columns_uid": true,
1873 - "data_osquery_columns_uid_signed": true,
1874 - "data_osquery_columns_user": true,
1875 - "data_osquery_columns_user_time": true,
1876 - "data_osquery_columns_username": true,
1877 - "data_osquery_columns_wired_size": true,
1878 - "data_osquery_counter": true,
1879 - "data_osquery_decorations_host_uuid": true,
1880 - "data_osquery_decorations_hostname": true,
1881 - "data_osquery_epoch": true,
1882 - "data_osquery_hostIdentifier": true,
1883 - "data_osquery_name": true,
1884 - "data_osquery_numerics": true,
1885 - "data_osquery_unixTime": true,
1886 - "data_proto": true,
1887 - "data_sca_check_command": true,
1888 - "data_sca_check_compliance_cis": true,
1889 - "data_sca_check_compliance_cis_csc": true,
1890 - "data_sca_check_compliance_gdpr_IV": true,
1891 - "data_sca_check_compliance_gpg_13": true,
1892 - "data_sca_check_compliance_hipaa": true,
1893 - "data_sca_check_compliance_nist_800_53": true,
1894 - "data_sca_check_compliance_pci_dss": true,
1895 - "data_sca_check_compliance_tsc": true,
1896 - "data_sca_check_description": true,
1897 - "data_sca_check_id": true,
1898 - "data_sca_check_previous_result": true,
1899 - "data_sca_check_rationale": true,
1900 - "data_sca_check_remediation": true,
1901 - "data_sca_check_result": true,
1902 - "data_sca_check_title": true,
1903 - "data_sca_description": true,
1904 - "data_sca_failed": true,
1905 - "data_sca_file": true,
1906 - "data_sca_invalid": true,
1907 - "data_sca_passed": true,
1908 - "data_sca_policy": true,
1909 - "data_sca_policy_id": true,
1910 - "data_sca_scan_id": true,
1911 - "data_sca_score": true,
1912 - "data_sca_total_checks": true,
1913 - "data_sca_type": true,
1914 - "data_script": true,
1915 - "data_src_ip": true,
1916 - "data_src_ip_city_name": true,
1917 - "data_src_ip_country_code": true,
1918 - "data_src_ip_geolocation": true,
1919 - "data_src_port": true,
1920 - "data_srcip": true,
1921 - "data_srcip_city_name": true,
1922 - "data_srcip_country_code": true,
1923 - "data_srcip_geolocation": true,
1924 - "data_srcuser": true,
1925 - "data_timestamp": true,
1926 - "data_title": true,
1927 - "data_tls_session_resumed": true,
1928 - "data_tls_version": true,
1929 - "data_tx_id": true,
1930 - "data_type": true,
1931 - "data_win_eventXML_binaryData": true,
1932 - "data_win_eventXML_binaryDataSize": true,
1933 - "data_win_eventXML_param1": true,
1934 - "data_win_eventdata_authenticationPackageName": true,
1935 - "data_win_eventdata_callTrace": true,
1936 - "data_win_eventdata_commandLine": true,
1937 - "data_win_eventdata_company": true,
1938 - "data_win_eventdata_creationUtcTime": true,
1939 - "data_win_eventdata_currentDirectory": true,
1940 - "data_win_eventdata_description": true,
1941 - "data_win_eventdata_destinationHostname": true,
1942 - "data_win_eventdata_destinationIp": true,
1943 - "data_win_eventdata_destinationIp_city_name": true,
1944 - "data_win_eventdata_destinationIp_country_code": true,
1945 - "data_win_eventdata_destinationIp_geolocation": true,
1946 - "data_win_eventdata_destinationIsIpv6": true,
1947 - "data_win_eventdata_destinationPort": true,
1948 - "data_win_eventdata_destinationPortName": true,
1949 - "data_win_eventdata_details": true,
1950 - "data_win_eventdata_elevatedToken": true,
1951 - "data_win_eventdata_eventType": true,
1952 - "data_win_eventdata_fileVersion": true,
1953 - "data_win_eventdata_fileVersion_city_name": true,
1954 - "data_win_eventdata_fileVersion_country_code": true,
1955 - "data_win_eventdata_fileVersion_geolocation": true,
1956 - "data_win_eventdata_grantedAccess": true,
1957 - "data_win_eventdata_hashes": true,
1958 - "data_win_eventdata_image": true,
1959 - "data_win_eventdata_imageLoaded": true,
1960 - "data_win_eventdata_impersonationLevel": true,
1961 - "data_win_eventdata_initiated": true,
1962 - "data_win_eventdata_integrityLevel": true,
1963 - "data_win_eventdata_ipAddress": true,
1964 - "data_win_eventdata_ipPort": true,
1965 - "data_win_eventdata_keyLength": true,
1966 - "data_win_eventdata_logonGuid": true,
1967 - "data_win_eventdata_logonId": true,
1968 - "data_win_eventdata_logonProcessName": true,
1969 - "data_win_eventdata_logonType": true,
1970 - "data_win_eventdata_originalFileName": true,
1971 - "data_win_eventdata_param1": true,
1972 - "data_win_eventdata_param2": true,
1973 - "data_win_eventdata_param3": true,
1974 - "data_win_eventdata_param4": true,
1975 - "data_win_eventdata_parentCommandLine": true,
1976 - "data_win_eventdata_parentImage": true,
1977 - "data_win_eventdata_parentProcessGuid": true,
1978 - "data_win_eventdata_parentProcessId": true,
1979 - "data_win_eventdata_processGuid": true,
1980 - "data_win_eventdata_processId": true,
1981 - "data_win_eventdata_processName": true,
1982 - "data_win_eventdata_product": true,
1983 - "data_win_eventdata_protocol": true,
1984 - "data_win_eventdata_queryName": true,
1985 - "data_win_eventdata_queryResults": true,
1986 - "data_win_eventdata_queryStatus": true,
1987 - "data_win_eventdata_ruleName": true,
1988 - "data_win_eventdata_serviceName": true,
1989 - "data_win_eventdata_serviceSid": true,
1990 - "data_win_eventdata_signature": true,
1991 - "data_win_eventdata_signatureStatus": true,
1992 - "data_win_eventdata_signed": true,
1993 - "data_win_eventdata_sourceHostname": true,
1994 - "data_win_eventdata_sourceImage": true,
1995 - "data_win_eventdata_sourceIp": true,
1996 - "data_win_eventdata_sourceIp_city_name": true,
1997 - "data_win_eventdata_sourceIp_country_code": true,
1998 - "data_win_eventdata_sourceIp_geolocation": true,
1999 - "data_win_eventdata_sourceIsIpv6": true,
2000 - "data_win_eventdata_sourcePort": true,
2001 - "data_win_eventdata_sourceProcessGUID": true,
2002 - "data_win_eventdata_sourceProcessId": true,
2003 - "data_win_eventdata_sourceThreadId": true,
2004 - "data_win_eventdata_status": true,
2005 - "data_win_eventdata_subjectDomainName": true,
2006 - "data_win_eventdata_subjectLogonId": true,
2007 - "data_win_eventdata_subjectUserName": true,
2008 - "data_win_eventdata_subjectUserSid": true,
2009 - "data_win_eventdata_targetDomainName": true,
2010 - "data_win_eventdata_targetFilename": true,
2011 - "data_win_eventdata_targetImage": true,
2012 - "data_win_eventdata_targetLinkedLogonId": true,
2013 - "data_win_eventdata_targetLogonId": true,
2014 - "data_win_eventdata_targetObject": true,
2015 - "data_win_eventdata_targetProcessGUID": true,
2016 - "data_win_eventdata_targetProcessId": true,
2017 - "data_win_eventdata_targetUserName": true,
2018 - "data_win_eventdata_targetUserSid": true,
2019 - "data_win_eventdata_terminalSessionId": true,
2020 - "data_win_eventdata_ticketEncryptionType": true,
2021 - "data_win_eventdata_ticketOptions": true,
2022 - "data_win_eventdata_user": true,
2023 - "data_win_eventdata_utcTime": true,
2024 - "data_win_eventdata_virtualAccount": true,
2025 - "data_win_system_channel": true,
2026 - "data_win_system_computer": true,
2027 - "data_win_system_eventID": true,
2028 - "data_win_system_eventRecordID": true,
2029 - "data_win_system_eventSourceName": true,
2030 - "data_win_system_keywords": true,
2031 - "data_win_system_level": true,
2032 - "data_win_system_message": true,
2033 - "data_win_system_opcode": true,
2034 - "data_win_system_processID": true,
2035 - "data_win_system_providerGuid": true,
2036 - "data_win_system_providerName": true,
2037 - "data_win_system_severityValue": true,
2038 - "data_win_system_systemTime": true,
2039 - "data_win_system_task": true,
2040 - "data_win_system_threadID": true,
2041 - "data_win_system_version": true,
2042 - "decoder_name": true,
2043 - "decoder_parent": true,
2044 - "dns_query": true,
2045 - "dns_query_threat_indicated": true,
2046 - "dst_ip": true,
2047 - "dst_ip_city_name": true,
2048 - "dst_ip_country_code": true,
2049 - "dst_ip_geolocation": true,
2050 - "dst_ip_threat_indicated": true,
2051 - "dst_port": true,
2052 - "ecs_version": true,
2053 - "error": true,
2054 - "event_hash": true,
2055 - "file_path": true,
2056 - "firewall_rule_name": true,
2057 - "full_log": false,
2058 - "gl2_accounted_message_size": true,
2059 - "gl2_message_id": true,
2060 - "gl2_processing_error": true,
2061 - "gl2_remote_ip": true,
2062 - "gl2_remote_port": true,
2063 - "gl2_source_collector": true,
2064 - "gl2_source_input": true,
2065 - "gl2_source_node": true,
2066 - "hash_md5": true,
2067 - "hash_sha1": true,
2068 - "hash_sha256": true,
2069 - "highlight": true,
2070 - "host_architecture": true,
2071 - "host_containerized": true,
2072 - "host_hostname": true,
2073 - "host_id": true,
2074 - "host_ip": true,
2075 - "host_mac": true,
2076 - "host_name": true,
2077 - "host_os_codename": true,
2078 - "host_os_kernel": true,
2079 - "host_os_name": true,
2080 - "host_os_platform": true,
2081 - "host_os_version": true,
2082 - "hostname": true,
2083 - "id": true,
2084 - "input_type": true,
2085 - "level": true,
2086 - "location": true,
2087 - "log_file_path": true,
2088 - "log_offset": true,
2089 - "manager_name": true,
2090 - "message": true,
2091 - "module": true,
2092 - "msg_timestamp": true,
2093 - "parent_process_cmd_line": true,
2094 - "parent_process_id": true,
2095 - "parent_process_image": true,
2096 - "pid": true,
2097 - "predecoder_hostname": true,
2098 - "predecoder_program_name": true,
2099 - "predecoder_timestamp": true,
2100 - "previous_log": true,
2101 - "previous_output": true,
2102 - "process_cmd_line": true,
2103 - "process_id": true,
2104 - "process_image": true,
2105 - "process_name": true,
2106 - "protocol": true,
2107 - "rule_cis": true,
2108 - "rule_cis_csc": true,
2109 - "rule_firedtimes": true,
2110 - "rule_gdpr": true,
2111 - "rule_gdpr_IV": true,
2112 - "rule_gpg13": true,
2113 - "rule_gpg_13": true,
2114 - "rule_group1": true,
2115 - "rule_group2": true,
2116 - "rule_group3": true,
2117 - "rule_groups": true,
2118 - "rule_hipaa": true,
2119 - "rule_id": true,
2120 - "rule_info": true,
2121 - "rule_mail": true,
2122 - "rule_mitre_id": true,
2123 - "rule_mitre_tactic": false,
2124 - "rule_nist_800_53": true,
2125 - "rule_pci_dss": true,
2126 - "rule_tsc": true,
2127 - "scanid": true,
2128 - "service": true,
2129 - "software_package": true,
2130 - "software_vendor": true,
2131 - "sort": true,
2132 - "source": true,
2133 - "source_reserved_ip": true,
2134 - "src_ip": true,
2135 - "src_ip_city_name": true,
2136 - "src_ip_country_code": true,
2137 - "src_ip_geolocation": true,
2138 - "src_port": true,
2139 - "streams": true,
2140 - "syscheck_attrs_after": true,
2141 - "syscheck_audit_effective_user_id": true,
2142 - "syscheck_audit_effective_user_name": true,
2143 - "syscheck_audit_group_id": true,
2144 - "syscheck_audit_group_name": true,
2145 - "syscheck_audit_login_user_id": true,
2146 - "syscheck_audit_login_user_name": true,
2147 - "syscheck_audit_process_cwd": true,
2148 - "syscheck_audit_process_id": true,
2149 - "syscheck_audit_process_name": true,
2150 - "syscheck_audit_process_parent_cwd": true,
2151 - "syscheck_audit_process_parent_name": true,
2152 - "syscheck_audit_process_ppid": true,
2153 - "syscheck_audit_user_id": true,
2154 - "syscheck_audit_user_name": true,
2155 - "syscheck_changed_attributes": true,
2156 - "syscheck_event": true,
2157 - "syscheck_gid_after": true,
2158 - "syscheck_gname_after": true,
2159 - "syscheck_hard_links": true,
2160 - "syscheck_inode_after": true,
2161 - "syscheck_inode_before": true,
2162 - "syscheck_md5_after": true,
2163 - "syscheck_md5_before": true,
2164 - "syscheck_mode": true,
2165 - "syscheck_mtime_after": true,
2166 - "syscheck_mtime_before": true,
2167 - "syscheck_path": true,
2168 - "syscheck_perm_after": true,
2169 - "syscheck_perm_before": true,
2170 - "syscheck_sha1_after": true,
2171 - "syscheck_sha1_before": true,
2172 - "syscheck_sha256_after": true,
2173 - "syscheck_sha256_before": true,
2174 - "syscheck_size_after": true,
2175 - "syscheck_size_before": true,
2176 - "syscheck_uid_after": true,
2177 - "syscheck_uname_after": true,
2178 - "syscheck_win_perm_after": true,
2179 - "syscheck_win_perm_after_0_allowed": true,
2180 - "syscheck_win_perm_after_0_name": true,
2181 - "syscheck_win_perm_after_1_allowed": true,
2182 - "syscheck_win_perm_after_1_name": true,
2183 - "syscheck_win_perm_after_2_allowed": true,
2184 - "syscheck_win_perm_after_2_name": true,
2185 - "syscheck_win_perm_after_3_allowed": true,
2186 - "syscheck_win_perm_after_3_name": true,
2187 - "syslog_customer": true,
2188 - "syslog_level": true,
2189 - "syslog_tag": true,
2190 - "syslog_type": true,
2191 - "sysmon_event_description": true,
2192 - "threat_ids": true,
2193 - "threat_indicated": true,
2194 - "threat_names": true,
2195 - "time": true,
2196 - "timestamp": true,
2197 - "true": true,
2198 - "user_name": true,
2199 - "win_registry_key": true,
2200 - "win_system_eventID": true,
2201 - "windows_auth_package": true,
2202 - "windows_domain": true,
2203 - "windows_event_id": true,
2204 - "windows_event_severity": true,
2205 - "windows_logon_type": true
2206 - },
2207 - "indexByName": {
2208 - "_id": 2,
2209 - "_index": 10,
2210 - "_type": 11,
2211 - "agent_id": 12,
2212 - "agent_name": 6,
2213 - "cluster_name": 13,
2214 - "cluster_node": 14,
2215 - "data_integration": 49,
2216 - "data_office365_Activity": 50,
2217 - "data_office365_ActivityId": 51,
2218 - "data_office365_ArtifactId": 52,
2219 - "data_office365_ArtifactKind": 53,
2220 - "data_office365_ArtifactName": 54,
2221 - "data_office365_CapacityId": 55,
2222 - "data_office365_CapacityName": 56,
2223 - "data_office365_ClientIP": 5,
2224 - "data_office365_ClientIP_city_name": 15,
2225 - "data_office365_ClientIP_country_code": 16,
2226 - "data_office365_ClientIP_geolocation": 17,
2227 - "data_office365_ConsumptionMethod": 57,
2228 - "data_office365_CreationTime": 0,
2229 - "data_office365_DashboardId": 58,
2230 - "data_office365_DashboardName": 59,
2231 - "data_office365_DatasetId": 60,
2232 - "data_office365_DatasetName": 61,
2233 - "data_office365_Datasets": 62,
2234 - "data_office365_DistributionMethod": 63,
2235 - "data_office365_Id": 18,
2236 - "data_office365_IsSuccess": 64,
2237 - "data_office365_ItemName": 48,
2238 - "data_office365_ObjectId": 19,
2239 - "data_office365_Operation": 24,
2240 - "data_office365_OrganizationId": 20,
2241 - "data_office365_RecordType": 21,
2242 - "data_office365_RefreshEnforcementPolicy": 65,
2243 - "data_office365_ReportId": 66,
2244 - "data_office365_ReportName": 67,
2245 - "data_office365_ReportType": 68,
2246 - "data_office365_RequestId": 69,
2247 - "data_office365_Subscription": 70,
2248 - "data_office365_UserAgent": 4,
2249 - "data_office365_UserId": 3,
2250 - "data_office365_UserKey": 22,
2251 - "data_office365_UserType": 23,
2252 - "data_office365_WorkSpaceName": 71,
2253 - "data_office365_Workload": 47,
2254 - "data_office365_WorkspaceId": 72,
2255 - "decoder_name": 25,
2256 - "gl2_accounted_message_size": 26,
2257 - "gl2_message_id": 27,
2258 - "gl2_processing_error": 28,
2259 - "gl2_remote_ip": 29,
2260 - "gl2_remote_port": 30,
2261 - "gl2_source_input": 31,
2262 - "gl2_source_node": 32,
2263 - "highlight": 33,
2264 - "id": 34,
2265 - "location": 35,
2266 - "manager_name": 36,
2267 - "message": 37,
2268 - "msg_timestamp": 73,
2269 - "rule_description": 7,
2270 - "rule_firedtimes": 38,
2271 - "rule_group1": 39,
2272 - "rule_group2": 74,
2273 - "rule_groups": 40,
2274 - "rule_hipaa": 75,
2275 - "rule_id": 9,
2276 - "rule_level": 8,
2277 - "rule_mail": 41,
2278 - "rule_pci_dss": 76,
2279 - "sort": 42,
2280 - "source": 43,
2281 - "source_reserved_ip": 77,
2282 - "streams": 44,
2283 - "syslog_type": 45,
2284 - "timestamp": 1,
2285 - "true": 46
2286 - },
2287 - "renameByName": {
2288 - "_id": "EVENT ID",
2289 - "agent_name": "",
2290 - "data_office365_Activity": "ACTIVITY",
2291 - "data_office365_ActorIpAddress": "SRC IP",
2292 - "data_office365_AffectedItems": "ITEMS",
2293 - "data_office365_ArtifactName": "ARTIFACT",
2294 - "data_office365_BrowserName": "BROWSER",
2295 - "data_office365_ClientIP": "CLIENT IP",
2296 - "data_office365_ClientIP_city_name": "",
2297 - "data_office365_CreationTime": "EVENT TIME",
2298 - "data_office365_FormName": "FORM",
2299 - "data_office365_Item_Attachments": "ATTACHMENT",
2300 - "data_office365_Item_ParentFolder_Path": "FOLDER",
2301 - "data_office365_Item_Subject": "SUBJECT",
2302 - "data_office365_ResultStatus": "RESULT",
2303 - "data_office365_SourceApp": "SRC APP",
2304 - "data_office365_SourceFileName": "FILE",
2305 - "data_office365_UserAgent": "USER AGENT",
2306 - "data_office365_UserId": "ACCOUNT",
2307 - "rule_description": "DESCRIPTION",
2308 - "rule_id": "RULE ID",
2309 - "rule_level": "",
2310 - "rule_mitre_tactic": "MITRE TACTIC",
2311 - "rule_mitre_technique": "MITRE TECHNIQUE",
2312 - "timestamp": "Date/Time"
2313 - }
2314 - }
2315 - }
2316 - ],
2317 - "transparent": true,
2318 - "type": "table"
2319 - }
2320 - ],
2321 - "refresh": "",
2322 - "schemaVersion": 38,
2323 - "style": "dark",
2324 - "tags": [
2325 - "O365"
2326 - ],
2327 - "templating": {
2328 - "list": [
2329 - {
2330 - "datasource": {
2331 - "type": "elasticsearch",
2332 - "uid": "replace_datasource_uid"
2333 - },
2334 - "filters": [],
2335 - "hide": 0,
2336 - "label": "",
2337 - "name": "Filters",
2338 - "skipUrlSync": false,
2339 - "type": "adhoc"
2340 - },
2341 - {
2342 - "current": {
2343 - "selected": false,
2344 - "text": "All",
2345 - "value": "$__all"
2346 - },
2347 - "datasource": {
2348 - "type": "elasticsearch",
2349 - "uid": "replace_datasource_uid"
2350 - },
2351 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:PowerBI\"}",
2352 - "hide": 0,
2353 - "includeAll": true,
2354 - "label": "Operation",
2355 - "multi": false,
2356 - "name": "operation",
2357 - "options": [],
2358 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:PowerBI\"}",
2359 - "refresh": 2,
2360 - "regex": "",
2361 - "skipUrlSync": false,
2362 - "sort": 1,
2363 - "tagValuesQuery": "",
2364 - "tagsQuery": "",
2365 - "type": "query",
2366 - "useTags": false
2367 - },
2368 - {
2369 - "current": {
2370 - "selected": false,
2371 - "text": "All",
2372 - "value": "$__all"
2373 - },
2374 - "datasource": {
2375 - "type": "elasticsearch",
2376 - "uid": "replace_datasource_uid"
2377 - },
2378 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:PowerBI\"}",
2379 - "hide": 0,
2380 - "includeAll": true,
2381 - "label": "Rule Level",
2382 - "multi": false,
2383 - "name": "rule_level",
2384 - "options": [],
2385 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:PowerBI\"}",
2386 - "refresh": 2,
2387 - "regex": "",
2388 - "skipUrlSync": false,
2389 - "sort": 0,
2390 - "type": "query"
2391 - }
2392 - ]
2393 - },
2394 - "time": {
2395 - "from": "now-6h",
2396 - "to": "now"
2397 - },
2398 - "timepicker": {
2399 - "refresh_intervals": [
2400 - "5s",
2401 - "10s",
2402 - "30s",
2403 - "1m",
2404 - "5m",
2405 - "15m",
2406 - "30m",
2407 - "1h",
2408 - "2h",
2409 - "1d"
2410 - ],
2411 - "time_options": [
2412 - "5m",
2413 - "15m",
2414 - "1h",
2415 - "6h",
2416 - "12h",
2417 - "24h",
2418 - "2d",
2419 - "7d",
2420 - "30d"
2421 - ]
2422 - },
2423 - "timezone": "",
2424 - "title": "O365 - MICROSOFT PowerBI",
2425 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "10.0.3",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:PowerBI",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "cellOptions": {
255 + "type": "auto"
256 + },
257 + "inspect": false
258 + },
259 + "mappings": [],
260 + "thresholds": {
261 + "mode": "absolute",
262 + "steps": [
263 + {
264 + "color": "red",
265 + "value": null
266 + }
267 + ]
268 + }
269 + },
270 + "overrides": [
271 + {
272 + "matcher": {
273 + "id": "byName",
274 + "options": "Count"
275 + },
276 + "properties": [
277 + {
278 + "id": "displayName",
279 + "value": "EVENTS"
280 + },
281 + {
282 + "id": "unit",
283 + "value": "short"
284 + },
285 + {
286 + "id": "decimals",
287 + "value": -1
288 + },
289 + {
290 + "id": "custom.align"
291 + },
292 + {
293 + "id": "thresholds",
294 + "value": {
295 + "mode": "absolute",
296 + "steps": [
297 + {
298 + "color": "red",
299 + "value": null
300 + }
301 + ]
302 + }
303 + }
304 + ]
305 + }
306 + ]
307 + },
308 + "gridPos": {
309 + "h": 7,
310 + "w": 6,
311 + "x": 8,
312 + "y": 0
313 + },
314 + "id": 54,
315 + "options": {
316 + "cellHeight": "sm",
317 + "footer": {
318 + "countRows": false,
319 + "fields": "",
320 + "reducer": ["sum"],
321 + "show": false
322 + },
323 + "showHeader": true
324 + },
325 + "pluginVersion": "10.0.3",
326 + "targets": [
327 + {
328 + "bucketAggs": [
329 + {
330 + "fake": true,
331 + "field": "data_office365_Operation",
332 + "id": "4",
333 + "settings": {
334 + "min_doc_count": 1,
335 + "order": "desc",
336 + "orderBy": "_count",
337 + "size": "0"
338 + },
339 + "type": "terms"
340 + }
341 + ],
342 + "datasource": {
343 + "type": "elasticsearch",
344 + "uid": "replace_datasource_uid"
345 + },
346 + "metrics": [
347 + {
348 + "field": "select field",
349 + "id": "1",
350 + "type": "count"
351 + }
352 + ],
353 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
354 + "refId": "A",
355 + "timeField": "timestamp"
356 + }
357 + ],
358 + "title": "EVENTS BY OPERATION",
359 + "transformations": [
360 + {
361 + "id": "merge",
362 + "options": {
363 + "reducers": []
364 + }
365 + },
366 + {
367 + "id": "organize",
368 + "options": {
369 + "excludeByName": {},
370 + "indexByName": {},
371 + "renameByName": {
372 + "Count": "EVENTS",
373 + "data_office365_Operation": "OPERATION"
374 + }
375 + }
376 + }
377 + ],
378 + "type": "table"
379 + },
380 + {
381 + "datasource": {
382 + "type": "elasticsearch",
383 + "uid": "replace_datasource_uid"
384 + },
385 + "fieldConfig": {
386 + "defaults": {
387 + "color": {
388 + "mode": "thresholds"
389 + },
390 + "custom": {
391 + "align": "auto",
392 + "cellOptions": {
393 + "type": "auto"
394 + },
395 + "inspect": false
396 + },
397 + "mappings": [],
398 + "thresholds": {
399 + "mode": "absolute",
400 + "steps": [
401 + {
402 + "color": "red",
403 + "value": null
404 + }
405 + ]
406 + }
407 + },
408 + "overrides": [
409 + {
410 + "matcher": {
411 + "id": "byName",
412 + "options": "Count"
413 + },
414 + "properties": [
415 + {
416 + "id": "displayName",
417 + "value": "EVENTS"
418 + },
419 + {
420 + "id": "unit",
421 + "value": "short"
422 + },
423 + {
424 + "id": "decimals",
425 + "value": -1
426 + },
427 + {
428 + "id": "custom.align"
429 + },
430 + {
431 + "id": "thresholds",
432 + "value": {
433 + "mode": "absolute",
434 + "steps": [
435 + {
436 + "color": "red",
437 + "value": null
438 + }
439 + ]
440 + }
441 + }
442 + ]
443 + }
444 + ]
445 + },
446 + "gridPos": {
447 + "h": 7,
448 + "w": 6,
449 + "x": 14,
450 + "y": 0
451 + },
452 + "id": 62,
453 + "options": {
454 + "cellHeight": "sm",
455 + "footer": {
456 + "countRows": false,
457 + "fields": "",
458 + "reducer": ["sum"],
459 + "show": false
460 + },
461 + "showHeader": true
462 + },
463 + "pluginVersion": "10.0.3",
464 + "targets": [
465 + {
466 + "bucketAggs": [
467 + {
468 + "fake": true,
469 + "field": "data_office365_Activity",
470 + "id": "4",
471 + "settings": {
472 + "min_doc_count": 1,
473 + "order": "desc",
474 + "orderBy": "_count",
475 + "size": "0"
476 + },
477 + "type": "terms"
478 + }
479 + ],
480 + "datasource": {
481 + "type": "elasticsearch",
482 + "uid": "replace_datasource_uid"
483 + },
484 + "metrics": [
485 + {
486 + "field": "select field",
487 + "id": "1",
488 + "type": "count"
489 + }
490 + ],
491 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
492 + "refId": "A",
493 + "timeField": "timestamp"
494 + }
495 + ],
496 + "title": "EVENTS BY ACTIVITY",
497 + "transformations": [
498 + {
499 + "id": "merge",
500 + "options": {
501 + "reducers": []
502 + }
503 + },
504 + {
505 + "id": "organize",
506 + "options": {
507 + "excludeByName": {},
508 + "indexByName": {},
509 + "renameByName": {
510 + "Count": "EVENTS",
511 + "data_office365_Activity": "ACTIVITY",
512 + "data_office365_Operation": "OPERATION",
513 + "data_office365_SourceApp": "SOURCE APP",
514 + "data_office365_UserAgent": "USER AGENT"
515 + }
516 + }
517 + }
518 + ],
519 + "type": "table"
520 + },
521 + {
522 + "datasource": {
523 + "type": "elasticsearch",
524 + "uid": "replace_datasource_uid"
525 + },
526 + "fieldConfig": {
527 + "defaults": {
528 + "color": {
529 + "mode": "thresholds"
530 + },
531 + "mappings": [
532 + {
533 + "options": {
534 + "match": "null",
535 + "result": {
536 + "text": "N/A"
537 + }
538 + },
539 + "type": "special"
540 + }
541 + ],
542 + "max": 15,
543 + "min": 0,
544 + "thresholds": {
545 + "mode": "absolute",
546 + "steps": [
547 + {
548 + "color": "#299c46",
549 + "value": null
550 + },
551 + {
552 + "color": "rgba(237, 129, 40, 0.89)",
553 + "value": 8
554 + },
555 + {
556 + "color": "#d44a3a",
557 + "value": 12
558 + }
559 + ]
560 + },
561 + "unit": "none"
562 + },
563 + "overrides": []
564 + },
565 + "gridPos": {
566 + "h": 7,
567 + "w": 4,
568 + "x": 0,
569 + "y": 7
570 + },
571 + "id": 16,
572 + "links": [],
573 + "options": {
574 + "orientation": "horizontal",
575 + "reduceOptions": {
576 + "calcs": ["max"],
577 + "fields": "",
578 + "values": false
579 + },
580 + "showThresholdLabels": false,
581 + "showThresholdMarkers": true,
582 + "text": {}
583 + },
584 + "pluginVersion": "10.0.3",
585 + "targets": [
586 + {
587 + "bucketAggs": [
588 + {
589 + "field": "timestamp",
590 + "id": "2",
591 + "settings": {
592 + "interval": "auto",
593 + "min_doc_count": 0,
594 + "trimEdges": 0
595 + },
596 + "type": "date_histogram"
597 + }
598 + ],
599 + "datasource": {
600 + "type": "elasticsearch",
601 + "uid": "replace_datasource_uid"
602 + },
603 + "metrics": [
604 + {
605 + "field": "rule_level",
606 + "id": "1",
607 + "meta": {},
608 + "settings": {},
609 + "type": "max"
610 + }
611 + ],
612 + "query": "data_office365_Operation:$operation AND data_office365_Workload:PowerBI",
613 + "refId": "A",
614 + "timeField": "timestamp"
615 + }
616 + ],
617 + "title": "MAX SEVERITY (0 - 15)",
618 + "type": "gauge"
619 + },
620 + {
621 + "datasource": {
622 + "type": "elasticsearch",
623 + "uid": "replace_datasource_uid"
624 + },
625 + "fieldConfig": {
626 + "defaults": {
627 + "color": {
628 + "mode": "palette-classic"
629 + },
630 + "custom": {
631 + "axisCenteredZero": false,
632 + "axisColorMode": "text",
633 + "axisLabel": "",
634 + "axisPlacement": "auto",
635 + "barAlignment": 0,
636 + "drawStyle": "bars",
637 + "fillOpacity": 0,
638 + "gradientMode": "none",
639 + "hideFrom": {
640 + "legend": false,
641 + "tooltip": false,
642 + "viz": false
643 + },
644 + "lineInterpolation": "linear",
645 + "lineWidth": 1,
646 + "pointSize": 5,
647 + "scaleDistribution": {
648 + "type": "linear"
649 + },
650 + "showPoints": "auto",
651 + "spanNulls": false,
652 + "stacking": {
653 + "group": "A",
654 + "mode": "normal"
655 + },
656 + "thresholdsStyle": {
657 + "mode": "off"
658 + }
659 + },
660 + "mappings": [],
661 + "thresholds": {
662 + "mode": "absolute",
663 + "steps": [
664 + {
665 + "color": "green",
666 + "value": null
667 + },
668 + {
669 + "color": "red",
670 + "value": 80
671 + }
672 + ]
673 + }
674 + },
675 + "overrides": []
676 + },
677 + "gridPos": {
678 + "h": 13,
679 + "w": 20,
680 + "x": 4,
681 + "y": 7
682 + },
683 + "id": 60,
684 + "options": {
685 + "legend": {
686 + "calcs": [],
687 + "displayMode": "table",
688 + "placement": "right",
689 + "showLegend": true
690 + },
691 + "tooltip": {
692 + "mode": "single",
693 + "sort": "none"
694 + }
695 + },
696 + "targets": [
697 + {
698 + "alias": "",
699 + "bucketAggs": [
700 + {
701 + "field": "data_office365_Operation",
702 + "id": "3",
703 + "settings": {
704 + "min_doc_count": "1",
705 + "order": "desc",
706 + "orderBy": "_count",
707 + "size": "10"
708 + },
709 + "type": "terms"
710 + },
711 + {
712 + "field": "timestamp",
713 + "id": "2",
714 + "settings": {
715 + "interval": "auto"
716 + },
717 + "type": "date_histogram"
718 + }
719 + ],
720 + "datasource": {
721 + "type": "elasticsearch",
722 + "uid": "replace_datasource_uid"
723 + },
724 + "metrics": [
725 + {
726 + "id": "1",
727 + "type": "count"
728 + }
729 + ],
730 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
731 + "refId": "A",
732 + "timeField": "timestamp"
733 + }
734 + ],
735 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
736 + "transparent": true,
737 + "type": "timeseries"
738 + },
739 + {
740 + "datasource": {
741 + "type": "elasticsearch",
742 + "uid": "replace_datasource_uid"
743 + },
744 + "fieldConfig": {
745 + "defaults": {
746 + "mappings": [
747 + {
748 + "options": {
749 + "match": "null",
750 + "result": {
751 + "text": "N/A"
752 + }
753 + },
754 + "type": "special"
755 + }
756 + ],
757 + "thresholds": {
758 + "mode": "absolute",
759 + "steps": [
760 + {
761 + "color": "blue",
762 + "value": null
763 + }
764 + ]
765 + },
766 + "unit": "locale"
767 + },
768 + "overrides": []
769 + },
770 + "gridPos": {
771 + "h": 6,
772 + "w": 4,
773 + "x": 0,
774 + "y": 14
775 + },
776 + "id": 51,
777 + "links": [],
778 + "options": {
779 + "colorMode": "value",
780 + "graphMode": "area",
781 + "justifyMode": "auto",
782 + "orientation": "horizontal",
783 + "reduceOptions": {
784 + "calcs": ["sum"],
785 + "fields": "",
786 + "values": false
787 + },
788 + "text": {},
789 + "textMode": "auto"
790 + },
791 + "pluginVersion": "10.0.3",
792 + "targets": [
793 + {
794 + "bucketAggs": [
795 + {
796 + "$$hashKey": "object:331",
797 + "field": "timestamp",
798 + "id": "2",
799 + "settings": {
800 + "interval": "auto",
801 + "min_doc_count": 0,
802 + "trimEdges": 0
803 + },
804 + "type": "date_histogram"
805 + }
806 + ],
807 + "datasource": {
808 + "type": "elasticsearch",
809 + "uid": "replace_datasource_uid"
810 + },
811 + "metrics": [
812 + {
813 + "$$hashKey": "object:329",
814 + "field": "select field",
815 + "id": "1",
816 + "type": "count"
817 + }
818 + ],
819 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
820 + "refId": "A",
821 + "timeField": "timestamp"
822 + }
823 + ],
824 + "title": "EVENTS (Total)",
825 + "type": "stat"
826 + },
827 + {
828 + "datasource": {
829 + "type": "elasticsearch",
830 + "uid": "replace_datasource_uid"
831 + },
832 + "fieldConfig": {
833 + "defaults": {
834 + "color": {
835 + "mode": "thresholds"
836 + },
837 + "custom": {
838 + "align": "auto",
839 + "cellOptions": {
840 + "type": "auto"
841 + },
842 + "inspect": false
843 + },
844 + "mappings": [],
845 + "thresholds": {
846 + "mode": "absolute",
847 + "steps": [
848 + {
849 + "color": "orange",
850 + "value": null
851 + }
852 + ]
853 + }
854 + },
855 + "overrides": [
856 + {
857 + "matcher": {
858 + "id": "byName",
859 + "options": "Count"
860 + },
861 + "properties": [
862 + {
863 + "id": "displayName",
864 + "value": "EVENTS"
865 + },
866 + {
867 + "id": "unit",
868 + "value": "short"
869 + },
870 + {
871 + "id": "decimals",
872 + "value": -1
873 + },
874 + {
875 + "id": "custom.align"
876 + }
877 + ]
878 + },
879 + {
880 + "matcher": {
881 + "id": "byName",
882 + "options": "AD ACCOUNT"
883 + },
884 + "properties": [
885 + {
886 + "id": "custom.width",
887 + "value": 377
888 + }
889 + ]
890 + }
891 + ]
892 + },
893 + "gridPos": {
894 + "h": 12,
895 + "w": 8,
896 + "x": 0,
897 + "y": 20
898 + },
899 + "id": 61,
900 + "options": {
901 + "cellHeight": "sm",
902 + "footer": {
903 + "countRows": false,
904 + "fields": "",
905 + "reducer": ["sum"],
906 + "show": false
907 + },
908 + "showHeader": true,
909 + "sortBy": []
910 + },
911 + "pluginVersion": "10.0.3",
912 + "targets": [
913 + {
914 + "bucketAggs": [
915 + {
916 + "fake": true,
917 + "field": "data_office365_ArtifactName",
918 + "id": "4",
919 + "settings": {
920 + "min_doc_count": 1,
921 + "order": "desc",
922 + "orderBy": "_count",
923 + "size": "0"
924 + },
925 + "type": "terms"
926 + }
927 + ],
928 + "datasource": {
929 + "type": "elasticsearch",
930 + "uid": "replace_datasource_uid"
931 + },
932 + "metrics": [
933 + {
934 + "field": "select field",
935 + "id": "1",
936 + "type": "count"
937 + }
938 + ],
939 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
940 + "refId": "A",
941 + "timeField": "timestamp"
942 + }
943 + ],
944 + "title": "MS-PowerBI EVENTS BY ARTIFACT",
945 + "transformations": [
946 + {
947 + "id": "merge",
948 + "options": {
949 + "reducers": []
950 + }
951 + },
952 + {
953 + "id": "organize",
954 + "options": {
955 + "excludeByName": {},
956 + "indexByName": {},
957 + "renameByName": {
958 + "Count": "EVENTS",
959 + "data_office365_ArtifactName": "ARTIFACT",
960 + "data_office365_AuthenticationType": "AUTH TYPE",
961 + "data_office365_ClientIP_country_code": "COUNTRY",
962 + "data_office365_FormName": "FORM NAME",
963 + "data_office365_LogonError": "ERROR",
964 + "data_office365_Operation": "WORKLOAD",
965 + "data_office365_UserId": "AD ACCOUNT"
966 + }
967 + }
968 + }
969 + ],
970 + "type": "table"
971 + },
972 + {
973 + "circleMaxSize": 30,
974 + "circleMinSize": 2,
975 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
976 + "datasource": {
977 + "type": "elasticsearch",
978 + "uid": "replace_datasource_uid"
979 + },
980 + "decimals": 0,
981 + "esMetric": "Count",
982 + "gridPos": {
983 + "h": 12,
984 + "w": 8,
985 + "x": 8,
986 + "y": 20
987 + },
988 + "hideEmpty": false,
989 + "hideZero": false,
990 + "id": 50,
991 + "initialZoom": 1,
992 + "locationData": "countries",
993 + "mapCenter": "(0°, 0°)",
994 + "mapCenterLatitude": 0,
995 + "mapCenterLongitude": 0,
996 + "maxDataPoints": 1,
997 + "mouseWheelZoom": false,
998 + "showLegend": true,
999 + "stickyLabels": false,
1000 + "tableQueryOptions": {
1001 + "geohashField": "geohash",
1002 + "latitudeField": "latitude",
1003 + "longitudeField": "longitude",
1004 + "metricField": "metric",
1005 + "queryType": "geohash"
1006 + },
1007 + "targets": [
1008 + {
1009 + "bucketAggs": [
1010 + {
1011 + "fake": true,
1012 + "field": "data_office365_ClientIP_country_code",
1013 + "id": "3",
1014 + "settings": {
1015 + "min_doc_count": 1,
1016 + "order": "desc",
1017 + "orderBy": "_term",
1018 + "size": "0"
1019 + },
1020 + "type": "terms"
1021 + },
1022 + {
1023 + "field": "timestamp",
1024 + "id": "2",
1025 + "settings": {
1026 + "interval": "auto",
1027 + "min_doc_count": 0,
1028 + "trimEdges": 0
1029 + },
1030 + "type": "date_histogram"
1031 + }
1032 + ],
1033 + "datasource": {
1034 + "type": "elasticsearch",
1035 + "uid": "replace_datasource_uid"
1036 + },
1037 + "metrics": [
1038 + {
1039 + "field": "select field",
1040 + "id": "1",
1041 + "type": "count"
1042 + }
1043 + ],
1044 + "query": "data_office365_Workload:PowerBI AND rule_level:$rule_level",
1045 + "refId": "A",
1046 + "timeField": "timestamp"
1047 + }
1048 + ],
1049 + "thresholds": "0,10",
1050 + "title": "MS-PowerBI - ALL EVENTS BY SRC COUNTRY",
1051 + "type": "grafana-worldmap-panel",
1052 + "unitPlural": "",
1053 + "unitSingle": "",
1054 + "valueName": "total"
1055 + },
1056 + {
1057 + "datasource": {
1058 + "type": "elasticsearch",
1059 + "uid": "replace_datasource_uid"
1060 + },
1061 + "fieldConfig": {
1062 + "defaults": {
1063 + "color": {
1064 + "mode": "thresholds"
1065 + },
1066 + "custom": {
1067 + "align": "auto",
1068 + "cellOptions": {
1069 + "type": "auto"
1070 + },
1071 + "inspect": false
1072 + },
1073 + "mappings": [],
1074 + "thresholds": {
1075 + "mode": "absolute",
1076 + "steps": [
1077 + {
1078 + "color": "orange",
1079 + "value": null
1080 + }
1081 + ]
1082 + }
1083 + },
1084 + "overrides": [
1085 + {
1086 + "matcher": {
1087 + "id": "byName",
1088 + "options": "Count"
1089 + },
1090 + "properties": [
1091 + {
1092 + "id": "displayName",
1093 + "value": "EVENTS"
1094 + },
1095 + {
1096 + "id": "unit",
1097 + "value": "short"
1098 + },
1099 + {
1100 + "id": "decimals",
1101 + "value": -1
1102 + },
1103 + {
1104 + "id": "custom.align"
1105 + }
1106 + ]
1107 + },
1108 + {
1109 + "matcher": {
1110 + "id": "byName",
1111 + "options": "AD ACCOUNT"
1112 + },
1113 + "properties": [
1114 + {
1115 + "id": "custom.width",
1116 + "value": 377
1117 + }
1118 + ]
1119 + }
1120 + ]
1121 + },
1122 + "gridPos": {
1123 + "h": 12,
1124 + "w": 8,
1125 + "x": 16,
1126 + "y": 20
1127 + },
1128 + "id": 58,
1129 + "options": {
1130 + "cellHeight": "sm",
1131 + "footer": {
1132 + "countRows": false,
1133 + "fields": "",
1134 + "reducer": ["sum"],
1135 + "show": false
1136 + },
1137 + "showHeader": true,
1138 + "sortBy": []
1139 + },
1140 + "pluginVersion": "10.0.3",
1141 + "targets": [
1142 + {
1143 + "bucketAggs": [
1144 + {
1145 + "fake": true,
1146 + "field": "data_office365_UserId",
1147 + "id": "4",
1148 + "settings": {
1149 + "min_doc_count": 1,
1150 + "order": "desc",
1151 + "orderBy": "_count",
1152 + "size": "0"
1153 + },
1154 + "type": "terms"
1155 + },
1156 + {
1157 + "field": "data_office365_ClientIP_country_code",
1158 + "id": "5",
1159 + "settings": {
1160 + "min_doc_count": "1",
1161 + "order": "desc",
1162 + "orderBy": "_term",
1163 + "size": "10"
1164 + },
1165 + "type": "terms"
1166 + }
1167 + ],
1168 + "datasource": {
1169 + "type": "elasticsearch",
1170 + "uid": "replace_datasource_uid"
1171 + },
1172 + "metrics": [
1173 + {
1174 + "field": "select field",
1175 + "id": "1",
1176 + "type": "count"
1177 + }
1178 + ],
1179 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
1180 + "refId": "A",
1181 + "timeField": "timestamp"
1182 + }
1183 + ],
1184 + "title": "MS-PowerBI EVENTS BY ACCOUNT",
1185 + "transformations": [
1186 + {
1187 + "id": "merge",
1188 + "options": {
1189 + "reducers": []
1190 + }
1191 + },
1192 + {
1193 + "id": "organize",
1194 + "options": {
1195 + "excludeByName": {},
1196 + "indexByName": {},
1197 + "renameByName": {
1198 + "Count": "EVENTS",
1199 + "data_office365_ClientIP_country_code": "COUNTRY",
1200 + "data_office365_LogonError": "ERROR",
1201 + "data_office365_Operation": "WORKLOAD",
1202 + "data_office365_UserId": "AD ACCOUNT"
1203 + }
1204 + }
1205 + }
1206 + ],
1207 + "type": "table"
1208 + },
1209 + {
1210 + "datasource": {
1211 + "type": "elasticsearch",
1212 + "uid": "replace_datasource_uid"
1213 + },
1214 + "fieldConfig": {
1215 + "defaults": {
1216 + "color": {
1217 + "mode": "thresholds"
1218 + },
1219 + "custom": {
1220 + "align": "auto",
1221 + "cellOptions": {
1222 + "type": "auto"
1223 + },
1224 + "filterable": true,
1225 + "inspect": false
1226 + },
1227 + "mappings": [],
1228 + "thresholds": {
1229 + "mode": "absolute",
1230 + "steps": [
1231 + {
1232 + "color": "green",
1233 + "value": null
1234 + },
1235 + {
1236 + "color": "red",
1237 + "value": 80
1238 + }
1239 + ]
1240 + }
1241 + },
1242 + "overrides": [
1243 + {
1244 + "matcher": {
1245 + "id": "byName",
1246 + "options": "rule_level"
1247 + },
1248 + "properties": [
1249 + {
1250 + "id": "displayName",
1251 + "value": "RULE LEVEL"
1252 + },
1253 + {
1254 + "id": "unit",
1255 + "value": "short"
1256 + },
1257 + {
1258 + "id": "decimals",
1259 + "value": -1
1260 + },
1261 + {
1262 + "id": "custom.cellOptions",
1263 + "value": {
1264 + "mode": "gradient",
1265 + "type": "color-background"
1266 + }
1267 + },
1268 + {
1269 + "id": "custom.align"
1270 + },
1271 + {
1272 + "id": "thresholds",
1273 + "value": {
1274 + "mode": "absolute",
1275 + "steps": [
1276 + {
1277 + "color": "#37872D",
1278 + "value": null
1279 + },
1280 + {
1281 + "color": "rgba(237, 129, 40, 0.89)",
1282 + "value": 7
1283 + },
1284 + {
1285 + "color": "rgba(245, 54, 54, 0.9)",
1286 + "value": 12
1287 + }
1288 + ]
1289 + }
1290 + }
1291 + ]
1292 + },
1293 + {
1294 + "matcher": {
1295 + "id": "byName",
1296 + "options": "Date/Time"
1297 + },
1298 + "properties": [
1299 + {
1300 + "id": "custom.width",
1301 + "value": 242
1302 + }
1303 + ]
1304 + },
1305 + {
1306 + "matcher": {
1307 + "id": "byName",
1308 + "options": "MITRE TACTIC"
1309 + },
1310 + "properties": [
1311 + {
1312 + "id": "custom.width",
1313 + "value": 332
1314 + }
1315 + ]
1316 + },
1317 + {
1318 + "matcher": {
1319 + "id": "byName",
1320 + "options": "IP ADDRESS"
1321 + },
1322 + "properties": [
1323 + {
1324 + "id": "custom.width",
1325 + "value": 163
1326 + }
1327 + ]
1328 + },
1329 + {
1330 + "matcher": {
1331 + "id": "byName",
1332 + "options": "MITRE TECHNIQUE"
1333 + },
1334 + "properties": [
1335 + {
1336 + "id": "custom.width",
1337 + "value": 312
1338 + }
1339 + ]
1340 + },
1341 + {
1342 + "matcher": {
1343 + "id": "byName",
1344 + "options": "EVENT ID"
1345 + },
1346 + "properties": [
1347 + {
1348 + "id": "links",
1349 + "value": [
1350 + {
1351 + "targetBlank": true,
1352 + "title": "VIEW EVENT DETAILS",
1353 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1354 + }
1355 + ]
1356 + },
1357 + {
1358 + "id": "custom.width",
1359 + "value": 265
1360 + }
1361 + ]
1362 + },
1363 + {
1364 + "matcher": {
1365 + "id": "byName",
1366 + "options": "RESULT"
1367 + },
1368 + "properties": [
1369 + {
1370 + "id": "custom.width",
1371 + "value": 118
1372 + },
1373 + {
1374 + "id": "mappings",
1375 + "value": [
1376 + {
1377 + "options": {
1378 + "Failed": {
1379 + "color": "orange",
1380 + "index": 1
1381 + },
1382 + "Success": {
1383 + "color": "green",
1384 + "index": 0
1385 + }
1386 + },
1387 + "type": "value"
1388 + }
1389 + ]
1390 + },
1391 + {
1392 + "id": "custom.cellOptions",
1393 + "value": {
1394 + "type": "color-text"
1395 + }
1396 + }
1397 + ]
1398 + },
1399 + {
1400 + "matcher": {
1401 + "id": "byName",
1402 + "options": "SRC IP"
1403 + },
1404 + "properties": [
1405 + {
1406 + "id": "custom.width",
1407 + "value": 265
1408 + }
1409 + ]
1410 + },
1411 + {
1412 + "matcher": {
1413 + "id": "byName",
1414 + "options": "ACCOUNT"
1415 + },
1416 + "properties": [
1417 + {
1418 + "id": "custom.width",
1419 + "value": 227
1420 + }
1421 + ]
1422 + },
1423 + {
1424 + "matcher": {
1425 + "id": "byName",
1426 + "options": "EVENT TIME"
1427 + },
1428 + "properties": [
1429 + {
1430 + "id": "custom.width",
1431 + "value": 195
1432 + }
1433 + ]
1434 + },
1435 + {
1436 + "matcher": {
1437 + "id": "byName",
1438 + "options": "CLIENT IP"
1439 + },
1440 + "properties": [
1441 + {
1442 + "id": "custom.width",
1443 + "value": 191
1444 + }
1445 + ]
1446 + },
1447 + {
1448 + "matcher": {
1449 + "id": "byName",
1450 + "options": "DESCRIPTION"
1451 + },
1452 + "properties": [
1453 + {
1454 + "id": "custom.width",
1455 + "value": 367
1456 + }
1457 + ]
1458 + },
1459 + {
1460 + "matcher": {
1461 + "id": "byName",
1462 + "options": "FILE"
1463 + },
1464 + "properties": [
1465 + {
1466 + "id": "custom.width",
1467 + "value": 855
1468 + }
1469 + ]
1470 + },
1471 + {
1472 + "matcher": {
1473 + "id": "byName",
1474 + "options": "BROWSER"
1475 + },
1476 + "properties": [
1477 + {
1478 + "id": "custom.width",
1479 + "value": 205
1480 + }
1481 + ]
1482 + },
1483 + {
1484 + "matcher": {
1485 + "id": "byName",
1486 + "options": "RULE LEVEL"
1487 + },
1488 + "properties": [
1489 + {
1490 + "id": "custom.width",
1491 + "value": 197
1492 + }
1493 + ]
1494 + }
1495 + ]
1496 + },
1497 + "gridPos": {
1498 + "h": 16,
1499 + "w": 24,
1500 + "x": 0,
1501 + "y": 32
1502 + },
1503 + "id": 27,
1504 + "options": {
1505 + "cellHeight": "sm",
1506 + "footer": {
1507 + "countRows": false,
1508 + "enablePagination": true,
1509 + "fields": "",
1510 + "reducer": ["sum"],
1511 + "show": false
1512 + },
1513 + "showHeader": true,
1514 + "sortBy": []
1515 + },
1516 + "pluginVersion": "10.0.3",
1517 + "targets": [
1518 + {
1519 + "bucketAggs": [],
1520 + "datasource": {
1521 + "type": "elasticsearch",
1522 + "uid": "replace_datasource_uid"
1523 + },
1524 + "metrics": [
1525 + {
1526 + "id": "1",
1527 + "settings": {
1528 + "size": "250"
1529 + },
1530 + "type": "raw_data"
1531 + }
1532 + ],
1533 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:PowerBI",
1534 + "refId": "A",
1535 + "timeField": "timestamp"
1536 + }
1537 + ],
1538 + "title": "EVENTS",
1539 + "transformations": [
1540 + {
1541 + "id": "organize",
1542 + "options": {
1543 + "excludeByName": {
1544 + "@metadata_beat": true,
1545 + "@metadata_type": true,
1546 + "@metadata_version": true,
1547 + "IMPHASH": true,
1548 + "MD5": true,
1549 + "SHA1": true,
1550 + "SHA256": true,
1551 + "_id": false,
1552 + "_index": true,
1553 + "_type": true,
1554 + "agent_ephemeral_id": true,
1555 + "agent_hostname": true,
1556 + "agent_id": true,
1557 + "agent_ip_city_name": true,
1558 + "agent_ip_country_code": true,
1559 + "agent_ip_geolocation": true,
1560 + "agent_name": true,
1561 + "agent_type": true,
1562 + "agent_version": true,
1563 + "beats_type": true,
1564 + "cluster_name": true,
1565 + "cluster_node": true,
1566 + "collector_node_id": true,
1567 + "data_alert_action": true,
1568 + "data_alert_category": true,
1569 + "data_alert_gid": true,
1570 + "data_alert_rev": true,
1571 + "data_alert_severity": true,
1572 + "data_alert_signature": true,
1573 + "data_alert_signature_id": true,
1574 + "data_app_proto": true,
1575 + "data_audit_auid": true,
1576 + "data_audit_command": true,
1577 + "data_audit_euid": true,
1578 + "data_audit_exe": true,
1579 + "data_audit_gid": true,
1580 + "data_audit_id": true,
1581 + "data_audit_pid": true,
1582 + "data_audit_res": true,
1583 + "data_audit_session": true,
1584 + "data_audit_type": true,
1585 + "data_audit_uid": true,
1586 + "data_dest_ip": true,
1587 + "data_dest_port": true,
1588 + "data_dstuser": true,
1589 + "data_event_type": true,
1590 + "data_extra_data": true,
1591 + "data_file": true,
1592 + "data_flow_bytes_toclient": true,
1593 + "data_flow_bytes_toserver": true,
1594 + "data_flow_id": true,
1595 + "data_flow_pkts_toclient": true,
1596 + "data_flow_pkts_toserver": true,
1597 + "data_flow_start": true,
1598 + "data_http_http_content_type": true,
1599 + "data_http_http_port": true,
1600 + "data_http_length": true,
1601 + "data_http_status": true,
1602 + "data_http_url": true,
1603 + "data_id": true,
1604 + "data_in_iface": true,
1605 + "data_integration": true,
1606 + "data_metadata_flowbits": true,
1607 + "data_metadata_flowints_http_anomaly_count": true,
1608 + "data_metadata_flowints_tcp_retransmission_count": true,
1609 + "data_office365_AADGroupId": true,
1610 + "data_office365_ActivityId": true,
1611 + "data_office365_ActivityParameters": true,
1612 + "data_office365_Actor": true,
1613 + "data_office365_ActorContextId": true,
1614 + "data_office365_ActorIpAddress": false,
1615 + "data_office365_ActorIpAddress_city_name": true,
1616 + "data_office365_ActorIpAddress_country_code": true,
1617 + "data_office365_ActorIpAddress_geolocation": true,
1618 + "data_office365_AppAccessContext_AADSessionId": true,
1619 + "data_office365_AppAccessContext_APIId": true,
1620 + "data_office365_AppAccessContext_ClientAppId": true,
1621 + "data_office365_AppAccessContext_ClientAppName": true,
1622 + "data_office365_AppAccessContext_CorrelationId": true,
1623 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1624 + "data_office365_AppAccessContext_UniqueTokenId": true,
1625 + "data_office365_AppId": true,
1626 + "data_office365_ApplicationDisplayName": true,
1627 + "data_office365_ApplicationId": true,
1628 + "data_office365_ArtifactId": true,
1629 + "data_office365_ArtifactKind": true,
1630 + "data_office365_ArtifactsShared": true,
1631 + "data_office365_AssertingApplicationId": true,
1632 + "data_office365_Attendees": true,
1633 + "data_office365_AuthenticationType": true,
1634 + "data_office365_AzureActiveDirectoryEventType": true,
1635 + "data_office365_BrowserVersion": true,
1636 + "data_office365_BrowserVersion_city_name": true,
1637 + "data_office365_BrowserVersion_country_code": true,
1638 + "data_office365_BrowserVersion_geolocation": true,
1639 + "data_office365_CapacityId": true,
1640 + "data_office365_CapacityName": true,
1641 + "data_office365_ChannelGuid": true,
1642 + "data_office365_ChannelName": true,
1643 + "data_office365_ChatName": true,
1644 + "data_office365_ChatThreadId": true,
1645 + "data_office365_ClientAppId": true,
1646 + "data_office365_ClientIP": false,
1647 + "data_office365_ClientIPAddress": true,
1648 + "data_office365_ClientIPAddress_city_name": true,
1649 + "data_office365_ClientIPAddress_country_code": true,
1650 + "data_office365_ClientIPAddress_geolocation": true,
1651 + "data_office365_ClientIP_city_name": true,
1652 + "data_office365_ClientIP_country_code": true,
1653 + "data_office365_ClientIP_geolocation": true,
1654 + "data_office365_ClientIP_reserved_ip": true,
1655 + "data_office365_ClientInfoString": true,
1656 + "data_office365_ClientProcessName": true,
1657 + "data_office365_ClientRequestId": true,
1658 + "data_office365_ClientVersion": true,
1659 + "data_office365_CommunicationSubType": true,
1660 + "data_office365_CommunicationType": true,
1661 + "data_office365_ConsumptionMethod": true,
1662 + "data_office365_CorrelationId": true,
1663 + "data_office365_CreationTime": false,
1664 + "data_office365_CrossMailboxOperation": true,
1665 + "data_office365_CustomUniqueId": true,
1666 + "data_office365_CustomizedDoclib": true,
1667 + "data_office365_DashboardId": true,
1668 + "data_office365_DashboardName": true,
1669 + "data_office365_DatasetId": true,
1670 + "data_office365_DatasetName": true,
1671 + "data_office365_Datasets": true,
1672 + "data_office365_DestFolder_Id": true,
1673 + "data_office365_DestFolder_Path": true,
1674 + "data_office365_DestinationFileExtension": true,
1675 + "data_office365_DestinationFileName": true,
1676 + "data_office365_DestinationRelativeUrl": true,
1677 + "data_office365_DeviceDisplayName": true,
1678 + "data_office365_DeviceDisplayName_city_name": true,
1679 + "data_office365_DeviceDisplayName_country_code": true,
1680 + "data_office365_DeviceDisplayName_geolocation": true,
1681 + "data_office365_DeviceId": true,
1682 + "data_office365_DeviceInformation": true,
1683 + "data_office365_DeviceProperties": true,
1684 + "data_office365_DistributionMethod": true,
1685 + "data_office365_DoNotDistributeEvent": true,
1686 + "data_office365_EndTime": true,
1687 + "data_office365_ErrorNumber": true,
1688 + "data_office365_EventData": true,
1689 + "data_office365_EventSource": true,
1690 + "data_office365_ExchangeId": true,
1691 + "data_office365_ExtendedProperties": true,
1692 + "data_office365_ExternalAccess": true,
1693 + "data_office365_ExtraProperties": true,
1694 + "data_office365_FileSizeBytes": true,
1695 + "data_office365_FileSyncBytesCommitted": true,
1696 + "data_office365_Folder_Id": true,
1697 + "data_office365_Folder_Path": true,
1698 + "data_office365_FormId": true,
1699 + "data_office365_FormsUserType": true,
1700 + "data_office365_FromApp": true,
1701 + "data_office365_HighPriorityMediaProcessing": true,
1702 + "data_office365_HostedContents": true,
1703 + "data_office365_ICalUid": true,
1704 + "data_office365_Id": true,
1705 + "data_office365_ImplicitShare": true,
1706 + "data_office365_InterSystemsId": true,
1707 + "data_office365_InternalLogonType": true,
1708 + "data_office365_IntraSystemId": true,
1709 + "data_office365_IsManagedDevice": true,
1710 + "data_office365_IsSuccess": true,
1711 + "data_office365_ItemCount": true,
1712 + "data_office365_ItemName": true,
1713 + "data_office365_ItemType": true,
1714 + "data_office365_Item_Id": true,
1715 + "data_office365_Item_InternetMessageId": true,
1716 + "data_office365_Item_IsRecord": true,
1717 + "data_office365_Item_ParentFolder_Id": true,
1718 + "data_office365_Item_SizeInBytes": true,
1719 + "data_office365_JoinTime": true,
1720 + "data_office365_LeaveTime": true,
1721 + "data_office365_ListBaseTemplateType": true,
1722 + "data_office365_ListBaseType": true,
1723 + "data_office365_ListId": true,
1724 + "data_office365_ListItemUniqueId": true,
1725 + "data_office365_ListServerTemplate": true,
1726 + "data_office365_ListTitle": true,
1727 + "data_office365_LogonError": true,
1728 + "data_office365_LogonType": true,
1729 + "data_office365_LogonUserSid": true,
1730 + "data_office365_MachineId": true,
1731 + "data_office365_MailboxGuid": true,
1732 + "data_office365_MailboxOwnerSid": true,
1733 + "data_office365_MailboxOwnerUPN": true,
1734 + "data_office365_MeetingDetailId": true,
1735 + "data_office365_MeetingURL": true,
1736 + "data_office365_Members": true,
1737 + "data_office365_MessageId": true,
1738 + "data_office365_MessageSizeInBytes": true,
1739 + "data_office365_MessageURLs": true,
1740 + "data_office365_MessageVersion": true,
1741 + "data_office365_Modalities": true,
1742 + "data_office365_ModifiedProperties": true,
1743 + "data_office365_Name": true,
1744 + "data_office365_NewValue": true,
1745 + "data_office365_ObjectId": true,
1746 + "data_office365_Operation": true,
1747 + "data_office365_OperationScope": true,
1748 + "data_office365_OrganizationId": true,
1749 + "data_office365_OrganizationName": true,
1750 + "data_office365_Organizer_OrganizationId": true,
1751 + "data_office365_Organizer_RecipientType": true,
1752 + "data_office365_Organizer_Role": true,
1753 + "data_office365_Organizer_UserObjectId": true,
1754 + "data_office365_OriginatingServer": true,
1755 + "data_office365_Parameters": true,
1756 + "data_office365_ParentMessageId": true,
1757 + "data_office365_Platform": true,
1758 + "data_office365_ProviderTypes": true,
1759 + "data_office365_RecordType": true,
1760 + "data_office365_RefreshEnforcementPolicy": true,
1761 + "data_office365_ReportId": true,
1762 + "data_office365_ReportName": true,
1763 + "data_office365_ReportType": true,
1764 + "data_office365_RequestId": true,
1765 + "data_office365_ResultStatus": false,
1766 + "data_office365_SearchQueryText": true,
1767 + "data_office365_SessionId": true,
1768 + "data_office365_Site": true,
1769 + "data_office365_SiteUrl": true,
1770 + "data_office365_SkipForServiceWorker": true,
1771 + "data_office365_Source": true,
1772 + "data_office365_SourceFileExtension": true,
1773 + "data_office365_SourceRelativeUrl": true,
1774 + "data_office365_StartTime": true,
1775 + "data_office365_Subscription": true,
1776 + "data_office365_SubscriptionId": true,
1777 + "data_office365_Target": true,
1778 + "data_office365_TargetContextId": true,
1779 + "data_office365_TargetUserOrGroupName": true,
1780 + "data_office365_TargetUserOrGroupType": true,
1781 + "data_office365_TeamGuid": true,
1782 + "data_office365_TeamName": true,
1783 + "data_office365_UniqueSharingId": true,
1784 + "data_office365_UserAgent": false,
1785 + "data_office365_UserId": false,
1786 + "data_office365_UserKey": true,
1787 + "data_office365_UserType": true,
1788 + "data_office365_Version": true,
1789 + "data_office365_WebId": true,
1790 + "data_office365_WorkSpaceName": true,
1791 + "data_office365_Workload": true,
1792 + "data_office365_WorkspaceId": true,
1793 + "data_osquery_action": true,
1794 + "data_osquery_calendarTime": true,
1795 + "data_osquery_columns_address": true,
1796 + "data_osquery_columns_address_city_name": true,
1797 + "data_osquery_columns_address_country_code": true,
1798 + "data_osquery_columns_address_geolocation": true,
1799 + "data_osquery_columns_cmdline": true,
1800 + "data_osquery_columns_cwd": true,
1801 + "data_osquery_columns_description": true,
1802 + "data_osquery_columns_directory": true,
1803 + "data_osquery_columns_disk_bytes_read": true,
1804 + "data_osquery_columns_disk_bytes_written": true,
1805 + "data_osquery_columns_egid": true,
1806 + "data_osquery_columns_euid": true,
1807 + "data_osquery_columns_family": true,
1808 + "data_osquery_columns_fd": true,
1809 + "data_osquery_columns_gid": true,
1810 + "data_osquery_columns_gid_signed": true,
1811 + "data_osquery_columns_host": true,
1812 + "data_osquery_columns_interface": true,
1813 + "data_osquery_columns_local_address": true,
1814 + "data_osquery_columns_local_address_city_name": true,
1815 + "data_osquery_columns_local_address_country_code": true,
1816 + "data_osquery_columns_local_address_geolocation": true,
1817 + "data_osquery_columns_local_port": true,
1818 + "data_osquery_columns_mac": true,
1819 + "data_osquery_columns_name": true,
1820 + "data_osquery_columns_net_namespace": true,
1821 + "data_osquery_columns_nice": true,
1822 + "data_osquery_columns_on_disk": true,
1823 + "data_osquery_columns_parent": true,
1824 + "data_osquery_columns_path": true,
1825 + "data_osquery_columns_pgroup": true,
1826 + "data_osquery_columns_pid": true,
1827 + "data_osquery_columns_port": true,
1828 + "data_osquery_columns_protocol": true,
1829 + "data_osquery_columns_remote_address": true,
1830 + "data_osquery_columns_remote_address_city_name": true,
1831 + "data_osquery_columns_remote_address_country_code": true,
1832 + "data_osquery_columns_remote_address_geolocation": true,
1833 + "data_osquery_columns_remote_port": true,
1834 + "data_osquery_columns_resident_size": true,
1835 + "data_osquery_columns_root": true,
1836 + "data_osquery_columns_sgid": true,
1837 + "data_osquery_columns_shell": true,
1838 + "data_osquery_columns_socket": true,
1839 + "data_osquery_columns_start_time": true,
1840 + "data_osquery_columns_state": true,
1841 + "data_osquery_columns_suid": true,
1842 + "data_osquery_columns_system_time": true,
1843 + "data_osquery_columns_threads": true,
1844 + "data_osquery_columns_time_utc": true,
1845 + "data_osquery_columns_total_size": true,
1846 + "data_osquery_columns_tty": true,
1847 + "data_osquery_columns_type": true,
1848 + "data_osquery_columns_uid": true,
1849 + "data_osquery_columns_uid_signed": true,
1850 + "data_osquery_columns_user": true,
1851 + "data_osquery_columns_user_time": true,
1852 + "data_osquery_columns_username": true,
1853 + "data_osquery_columns_wired_size": true,
1854 + "data_osquery_counter": true,
1855 + "data_osquery_decorations_host_uuid": true,
1856 + "data_osquery_decorations_hostname": true,
1857 + "data_osquery_epoch": true,
1858 + "data_osquery_hostIdentifier": true,
1859 + "data_osquery_name": true,
1860 + "data_osquery_numerics": true,
1861 + "data_osquery_unixTime": true,
1862 + "data_proto": true,
1863 + "data_sca_check_command": true,
1864 + "data_sca_check_compliance_cis": true,
1865 + "data_sca_check_compliance_cis_csc": true,
1866 + "data_sca_check_compliance_gdpr_IV": true,
1867 + "data_sca_check_compliance_gpg_13": true,
1868 + "data_sca_check_compliance_hipaa": true,
1869 + "data_sca_check_compliance_nist_800_53": true,
1870 + "data_sca_check_compliance_pci_dss": true,
1871 + "data_sca_check_compliance_tsc": true,
1872 + "data_sca_check_description": true,
1873 + "data_sca_check_id": true,
1874 + "data_sca_check_previous_result": true,
1875 + "data_sca_check_rationale": true,
1876 + "data_sca_check_remediation": true,
1877 + "data_sca_check_result": true,
1878 + "data_sca_check_title": true,
1879 + "data_sca_description": true,
1880 + "data_sca_failed": true,
1881 + "data_sca_file": true,
1882 + "data_sca_invalid": true,
1883 + "data_sca_passed": true,
1884 + "data_sca_policy": true,
1885 + "data_sca_policy_id": true,
1886 + "data_sca_scan_id": true,
1887 + "data_sca_score": true,
1888 + "data_sca_total_checks": true,
1889 + "data_sca_type": true,
1890 + "data_script": true,
1891 + "data_src_ip": true,
1892 + "data_src_ip_city_name": true,
1893 + "data_src_ip_country_code": true,
1894 + "data_src_ip_geolocation": true,
1895 + "data_src_port": true,
1896 + "data_srcip": true,
1897 + "data_srcip_city_name": true,
1898 + "data_srcip_country_code": true,
1899 + "data_srcip_geolocation": true,
1900 + "data_srcuser": true,
1901 + "data_timestamp": true,
1902 + "data_title": true,
1903 + "data_tls_session_resumed": true,
1904 + "data_tls_version": true,
1905 + "data_tx_id": true,
1906 + "data_type": true,
1907 + "data_win_eventXML_binaryData": true,
1908 + "data_win_eventXML_binaryDataSize": true,
1909 + "data_win_eventXML_param1": true,
1910 + "data_win_eventdata_authenticationPackageName": true,
1911 + "data_win_eventdata_callTrace": true,
1912 + "data_win_eventdata_commandLine": true,
1913 + "data_win_eventdata_company": true,
1914 + "data_win_eventdata_creationUtcTime": true,
1915 + "data_win_eventdata_currentDirectory": true,
1916 + "data_win_eventdata_description": true,
1917 + "data_win_eventdata_destinationHostname": true,
1918 + "data_win_eventdata_destinationIp": true,
1919 + "data_win_eventdata_destinationIp_city_name": true,
1920 + "data_win_eventdata_destinationIp_country_code": true,
1921 + "data_win_eventdata_destinationIp_geolocation": true,
1922 + "data_win_eventdata_destinationIsIpv6": true,
1923 + "data_win_eventdata_destinationPort": true,
1924 + "data_win_eventdata_destinationPortName": true,
1925 + "data_win_eventdata_details": true,
1926 + "data_win_eventdata_elevatedToken": true,
1927 + "data_win_eventdata_eventType": true,
1928 + "data_win_eventdata_fileVersion": true,
1929 + "data_win_eventdata_fileVersion_city_name": true,
1930 + "data_win_eventdata_fileVersion_country_code": true,
1931 + "data_win_eventdata_fileVersion_geolocation": true,
1932 + "data_win_eventdata_grantedAccess": true,
1933 + "data_win_eventdata_hashes": true,
1934 + "data_win_eventdata_image": true,
1935 + "data_win_eventdata_imageLoaded": true,
1936 + "data_win_eventdata_impersonationLevel": true,
1937 + "data_win_eventdata_initiated": true,
1938 + "data_win_eventdata_integrityLevel": true,
1939 + "data_win_eventdata_ipAddress": true,
1940 + "data_win_eventdata_ipPort": true,
1941 + "data_win_eventdata_keyLength": true,
1942 + "data_win_eventdata_logonGuid": true,
1943 + "data_win_eventdata_logonId": true,
1944 + "data_win_eventdata_logonProcessName": true,
1945 + "data_win_eventdata_logonType": true,
1946 + "data_win_eventdata_originalFileName": true,
1947 + "data_win_eventdata_param1": true,
1948 + "data_win_eventdata_param2": true,
1949 + "data_win_eventdata_param3": true,
1950 + "data_win_eventdata_param4": true,
1951 + "data_win_eventdata_parentCommandLine": true,
1952 + "data_win_eventdata_parentImage": true,
1953 + "data_win_eventdata_parentProcessGuid": true,
1954 + "data_win_eventdata_parentProcessId": true,
1955 + "data_win_eventdata_processGuid": true,
1956 + "data_win_eventdata_processId": true,
1957 + "data_win_eventdata_processName": true,
1958 + "data_win_eventdata_product": true,
1959 + "data_win_eventdata_protocol": true,
1960 + "data_win_eventdata_queryName": true,
1961 + "data_win_eventdata_queryResults": true,
1962 + "data_win_eventdata_queryStatus": true,
1963 + "data_win_eventdata_ruleName": true,
1964 + "data_win_eventdata_serviceName": true,
1965 + "data_win_eventdata_serviceSid": true,
1966 + "data_win_eventdata_signature": true,
1967 + "data_win_eventdata_signatureStatus": true,
1968 + "data_win_eventdata_signed": true,
1969 + "data_win_eventdata_sourceHostname": true,
1970 + "data_win_eventdata_sourceImage": true,
1971 + "data_win_eventdata_sourceIp": true,
1972 + "data_win_eventdata_sourceIp_city_name": true,
1973 + "data_win_eventdata_sourceIp_country_code": true,
1974 + "data_win_eventdata_sourceIp_geolocation": true,
1975 + "data_win_eventdata_sourceIsIpv6": true,
1976 + "data_win_eventdata_sourcePort": true,
1977 + "data_win_eventdata_sourceProcessGUID": true,
1978 + "data_win_eventdata_sourceProcessId": true,
1979 + "data_win_eventdata_sourceThreadId": true,
1980 + "data_win_eventdata_status": true,
1981 + "data_win_eventdata_subjectDomainName": true,
1982 + "data_win_eventdata_subjectLogonId": true,
1983 + "data_win_eventdata_subjectUserName": true,
1984 + "data_win_eventdata_subjectUserSid": true,
1985 + "data_win_eventdata_targetDomainName": true,
1986 + "data_win_eventdata_targetFilename": true,
1987 + "data_win_eventdata_targetImage": true,
1988 + "data_win_eventdata_targetLinkedLogonId": true,
1989 + "data_win_eventdata_targetLogonId": true,
1990 + "data_win_eventdata_targetObject": true,
1991 + "data_win_eventdata_targetProcessGUID": true,
1992 + "data_win_eventdata_targetProcessId": true,
1993 + "data_win_eventdata_targetUserName": true,
1994 + "data_win_eventdata_targetUserSid": true,
1995 + "data_win_eventdata_terminalSessionId": true,
1996 + "data_win_eventdata_ticketEncryptionType": true,
1997 + "data_win_eventdata_ticketOptions": true,
1998 + "data_win_eventdata_user": true,
1999 + "data_win_eventdata_utcTime": true,
2000 + "data_win_eventdata_virtualAccount": true,
2001 + "data_win_system_channel": true,
2002 + "data_win_system_computer": true,
2003 + "data_win_system_eventID": true,
2004 + "data_win_system_eventRecordID": true,
2005 + "data_win_system_eventSourceName": true,
2006 + "data_win_system_keywords": true,
2007 + "data_win_system_level": true,
2008 + "data_win_system_message": true,
2009 + "data_win_system_opcode": true,
2010 + "data_win_system_processID": true,
2011 + "data_win_system_providerGuid": true,
2012 + "data_win_system_providerName": true,
2013 + "data_win_system_severityValue": true,
2014 + "data_win_system_systemTime": true,
2015 + "data_win_system_task": true,
2016 + "data_win_system_threadID": true,
2017 + "data_win_system_version": true,
2018 + "decoder_name": true,
2019 + "decoder_parent": true,
2020 + "dns_query": true,
2021 + "dns_query_threat_indicated": true,
2022 + "dst_ip": true,
2023 + "dst_ip_city_name": true,
2024 + "dst_ip_country_code": true,
2025 + "dst_ip_geolocation": true,
2026 + "dst_ip_threat_indicated": true,
2027 + "dst_port": true,
2028 + "ecs_version": true,
2029 + "error": true,
2030 + "event_hash": true,
2031 + "file_path": true,
2032 + "firewall_rule_name": true,
2033 + "full_log": false,
2034 + "gl2_accounted_message_size": true,
2035 + "gl2_message_id": true,
2036 + "gl2_processing_error": true,
2037 + "gl2_remote_ip": true,
2038 + "gl2_remote_port": true,
2039 + "gl2_source_collector": true,
2040 + "gl2_source_input": true,
2041 + "gl2_source_node": true,
2042 + "hash_md5": true,
2043 + "hash_sha1": true,
2044 + "hash_sha256": true,
2045 + "highlight": true,
2046 + "host_architecture": true,
2047 + "host_containerized": true,
2048 + "host_hostname": true,
2049 + "host_id": true,
2050 + "host_ip": true,
2051 + "host_mac": true,
2052 + "host_name": true,
2053 + "host_os_codename": true,
2054 + "host_os_kernel": true,
2055 + "host_os_name": true,
2056 + "host_os_platform": true,
2057 + "host_os_version": true,
2058 + "hostname": true,
2059 + "id": true,
2060 + "input_type": true,
2061 + "level": true,
2062 + "location": true,
2063 + "log_file_path": true,
2064 + "log_offset": true,
2065 + "manager_name": true,
2066 + "message": true,
2067 + "module": true,
2068 + "msg_timestamp": true,
2069 + "parent_process_cmd_line": true,
2070 + "parent_process_id": true,
2071 + "parent_process_image": true,
2072 + "pid": true,
2073 + "predecoder_hostname": true,
2074 + "predecoder_program_name": true,
2075 + "predecoder_timestamp": true,
2076 + "previous_log": true,
2077 + "previous_output": true,
2078 + "process_cmd_line": true,
2079 + "process_id": true,
2080 + "process_image": true,
2081 + "process_name": true,
2082 + "protocol": true,
2083 + "rule_cis": true,
2084 + "rule_cis_csc": true,
2085 + "rule_firedtimes": true,
2086 + "rule_gdpr": true,
2087 + "rule_gdpr_IV": true,
2088 + "rule_gpg13": true,
2089 + "rule_gpg_13": true,
2090 + "rule_group1": true,
2091 + "rule_group2": true,
2092 + "rule_group3": true,
2093 + "rule_groups": true,
2094 + "rule_hipaa": true,
2095 + "rule_id": true,
2096 + "rule_info": true,
2097 + "rule_mail": true,
2098 + "rule_mitre_id": true,
2099 + "rule_mitre_tactic": false,
2100 + "rule_nist_800_53": true,
2101 + "rule_pci_dss": true,
2102 + "rule_tsc": true,
2103 + "scanid": true,
2104 + "service": true,
2105 + "software_package": true,
2106 + "software_vendor": true,
2107 + "sort": true,
2108 + "source": true,
2109 + "source_reserved_ip": true,
2110 + "src_ip": true,
2111 + "src_ip_city_name": true,
2112 + "src_ip_country_code": true,
2113 + "src_ip_geolocation": true,
2114 + "src_port": true,
2115 + "streams": true,
2116 + "syscheck_attrs_after": true,
2117 + "syscheck_audit_effective_user_id": true,
2118 + "syscheck_audit_effective_user_name": true,
2119 + "syscheck_audit_group_id": true,
2120 + "syscheck_audit_group_name": true,
2121 + "syscheck_audit_login_user_id": true,
2122 + "syscheck_audit_login_user_name": true,
2123 + "syscheck_audit_process_cwd": true,
2124 + "syscheck_audit_process_id": true,
2125 + "syscheck_audit_process_name": true,
2126 + "syscheck_audit_process_parent_cwd": true,
2127 + "syscheck_audit_process_parent_name": true,
2128 + "syscheck_audit_process_ppid": true,
2129 + "syscheck_audit_user_id": true,
2130 + "syscheck_audit_user_name": true,
2131 + "syscheck_changed_attributes": true,
2132 + "syscheck_event": true,
2133 + "syscheck_gid_after": true,
2134 + "syscheck_gname_after": true,
2135 + "syscheck_hard_links": true,
2136 + "syscheck_inode_after": true,
2137 + "syscheck_inode_before": true,
2138 + "syscheck_md5_after": true,
2139 + "syscheck_md5_before": true,
2140 + "syscheck_mode": true,
2141 + "syscheck_mtime_after": true,
2142 + "syscheck_mtime_before": true,
2143 + "syscheck_path": true,
2144 + "syscheck_perm_after": true,
2145 + "syscheck_perm_before": true,
2146 + "syscheck_sha1_after": true,
2147 + "syscheck_sha1_before": true,
2148 + "syscheck_sha256_after": true,
2149 + "syscheck_sha256_before": true,
2150 + "syscheck_size_after": true,
2151 + "syscheck_size_before": true,
2152 + "syscheck_uid_after": true,
2153 + "syscheck_uname_after": true,
2154 + "syscheck_win_perm_after": true,
2155 + "syscheck_win_perm_after_0_allowed": true,
2156 + "syscheck_win_perm_after_0_name": true,
2157 + "syscheck_win_perm_after_1_allowed": true,
2158 + "syscheck_win_perm_after_1_name": true,
2159 + "syscheck_win_perm_after_2_allowed": true,
2160 + "syscheck_win_perm_after_2_name": true,
2161 + "syscheck_win_perm_after_3_allowed": true,
2162 + "syscheck_win_perm_after_3_name": true,
2163 + "syslog_customer": true,
2164 + "syslog_level": true,
2165 + "syslog_tag": true,
2166 + "syslog_type": true,
2167 + "sysmon_event_description": true,
2168 + "threat_ids": true,
2169 + "threat_indicated": true,
2170 + "threat_names": true,
2171 + "time": true,
2172 + "timestamp": true,
2173 + "true": true,
2174 + "user_name": true,
2175 + "win_registry_key": true,
2176 + "win_system_eventID": true,
2177 + "windows_auth_package": true,
2178 + "windows_domain": true,
2179 + "windows_event_id": true,
2180 + "windows_event_severity": true,
2181 + "windows_logon_type": true
2182 + },
2183 + "indexByName": {
2184 + "_id": 2,
2185 + "_index": 10,
2186 + "_type": 11,
2187 + "agent_id": 12,
2188 + "agent_name": 6,
2189 + "cluster_name": 13,
2190 + "cluster_node": 14,
2191 + "data_integration": 49,
2192 + "data_office365_Activity": 50,
2193 + "data_office365_ActivityId": 51,
2194 + "data_office365_ArtifactId": 52,
2195 + "data_office365_ArtifactKind": 53,
2196 + "data_office365_ArtifactName": 54,
2197 + "data_office365_CapacityId": 55,
2198 + "data_office365_CapacityName": 56,
2199 + "data_office365_ClientIP": 5,
2200 + "data_office365_ClientIP_city_name": 15,
2201 + "data_office365_ClientIP_country_code": 16,
2202 + "data_office365_ClientIP_geolocation": 17,
2203 + "data_office365_ConsumptionMethod": 57,
2204 + "data_office365_CreationTime": 0,
2205 + "data_office365_DashboardId": 58,
2206 + "data_office365_DashboardName": 59,
2207 + "data_office365_DatasetId": 60,
2208 + "data_office365_DatasetName": 61,
2209 + "data_office365_Datasets": 62,
2210 + "data_office365_DistributionMethod": 63,
2211 + "data_office365_Id": 18,
2212 + "data_office365_IsSuccess": 64,
2213 + "data_office365_ItemName": 48,
2214 + "data_office365_ObjectId": 19,
2215 + "data_office365_Operation": 24,
2216 + "data_office365_OrganizationId": 20,
2217 + "data_office365_RecordType": 21,
2218 + "data_office365_RefreshEnforcementPolicy": 65,
2219 + "data_office365_ReportId": 66,
2220 + "data_office365_ReportName": 67,
2221 + "data_office365_ReportType": 68,
2222 + "data_office365_RequestId": 69,
2223 + "data_office365_Subscription": 70,
2224 + "data_office365_UserAgent": 4,
2225 + "data_office365_UserId": 3,
2226 + "data_office365_UserKey": 22,
2227 + "data_office365_UserType": 23,
2228 + "data_office365_WorkSpaceName": 71,
2229 + "data_office365_Workload": 47,
2230 + "data_office365_WorkspaceId": 72,
2231 + "decoder_name": 25,
2232 + "gl2_accounted_message_size": 26,
2233 + "gl2_message_id": 27,
2234 + "gl2_processing_error": 28,
2235 + "gl2_remote_ip": 29,
2236 + "gl2_remote_port": 30,
2237 + "gl2_source_input": 31,
2238 + "gl2_source_node": 32,
2239 + "highlight": 33,
2240 + "id": 34,
2241 + "location": 35,
2242 + "manager_name": 36,
2243 + "message": 37,
2244 + "msg_timestamp": 73,
2245 + "rule_description": 7,
2246 + "rule_firedtimes": 38,
2247 + "rule_group1": 39,
2248 + "rule_group2": 74,
2249 + "rule_groups": 40,
2250 + "rule_hipaa": 75,
2251 + "rule_id": 9,
2252 + "rule_level": 8,
2253 + "rule_mail": 41,
2254 + "rule_pci_dss": 76,
2255 + "sort": 42,
2256 + "source": 43,
2257 + "source_reserved_ip": 77,
2258 + "streams": 44,
2259 + "syslog_type": 45,
2260 + "timestamp": 1,
2261 + "true": 46
2262 + },
2263 + "renameByName": {
2264 + "_id": "EVENT ID",
2265 + "agent_name": "",
2266 + "data_office365_Activity": "ACTIVITY",
2267 + "data_office365_ActorIpAddress": "SRC IP",
2268 + "data_office365_AffectedItems": "ITEMS",
2269 + "data_office365_ArtifactName": "ARTIFACT",
2270 + "data_office365_BrowserName": "BROWSER",
2271 + "data_office365_ClientIP": "CLIENT IP",
2272 + "data_office365_ClientIP_city_name": "",
2273 + "data_office365_CreationTime": "EVENT TIME",
2274 + "data_office365_FormName": "FORM",
2275 + "data_office365_Item_Attachments": "ATTACHMENT",
2276 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2277 + "data_office365_Item_Subject": "SUBJECT",
2278 + "data_office365_ResultStatus": "RESULT",
2279 + "data_office365_SourceApp": "SRC APP",
2280 + "data_office365_SourceFileName": "FILE",
2281 + "data_office365_UserAgent": "USER AGENT",
2282 + "data_office365_UserId": "ACCOUNT",
2283 + "rule_description": "DESCRIPTION",
2284 + "rule_id": "RULE ID",
2285 + "rule_level": "",
2286 + "rule_mitre_tactic": "MITRE TACTIC",
2287 + "rule_mitre_technique": "MITRE TECHNIQUE",
2288 + "timestamp": "Date/Time"
2289 + }
2290 + }
2291 + }
2292 + ],
2293 + "transparent": true,
2294 + "type": "table"
2295 + }
2296 + ],
2297 + "refresh": "",
2298 + "schemaVersion": 38,
2299 + "style": "dark",
2300 + "tags": ["O365"],
2301 + "templating": {
2302 + "list": [
2303 + {
2304 + "datasource": {
2305 + "type": "elasticsearch",
2306 + "uid": "replace_datasource_uid"
2307 + },
2308 + "filters": [],
2309 + "hide": 0,
2310 + "label": "",
2311 + "name": "Filters",
2312 + "skipUrlSync": false,
2313 + "type": "adhoc"
2314 + },
2315 + {
2316 + "current": {
2317 + "selected": false,
2318 + "text": "All",
2319 + "value": "$__all"
2320 + },
2321 + "datasource": {
2322 + "type": "elasticsearch",
2323 + "uid": "replace_datasource_uid"
2324 + },
2325 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:PowerBI\"}",
2326 + "hide": 0,
2327 + "includeAll": true,
2328 + "label": "Operation",
2329 + "multi": false,
2330 + "name": "operation",
2331 + "options": [],
2332 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:PowerBI\"}",
2333 + "refresh": 2,
2334 + "regex": "",
2335 + "skipUrlSync": false,
2336 + "sort": 1,
2337 + "tagValuesQuery": "",
2338 + "tagsQuery": "",
2339 + "type": "query",
2340 + "useTags": false
2341 + },
2342 + {
2343 + "current": {
2344 + "selected": false,
2345 + "text": "All",
2346 + "value": "$__all"
2347 + },
2348 + "datasource": {
2349 + "type": "elasticsearch",
2350 + "uid": "replace_datasource_uid"
2351 + },
2352 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:PowerBI\"}",
2353 + "hide": 0,
2354 + "includeAll": true,
2355 + "label": "Rule Level",
2356 + "multi": false,
2357 + "name": "rule_level",
2358 + "options": [],
2359 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:PowerBI\"}",
2360 + "refresh": 2,
2361 + "regex": "",
2362 + "skipUrlSync": false,
2363 + "sort": 0,
2364 + "type": "query"
2365 + }
2366 + ]
2367 + },
2368 + "time": {
2369 + "from": "now-6h",
2370 + "to": "now"
2371 + },
2372 + "timepicker": {
2373 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2374 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2375 + },
2376 + "timezone": "",
2377 + "title": "O365 - MICROSOFT PowerBI",
2378 + "weekStart": ""
2379 }
backend/app/connectors/grafana/dashboards/Office365/sharepoint.json
+2364 -2411
@@ -1,2413 +1,2366 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "10.0.3",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:SharePoint",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "cellOptions": {
261 - "type": "auto"
262 - },
263 - "inspect": false
264 - },
265 - "mappings": [],
266 - "thresholds": {
267 - "mode": "absolute",
268 - "steps": [
269 - {
270 - "color": "red",
271 - "value": null
272 - }
273 - ]
274 - }
275 - },
276 - "overrides": [
277 - {
278 - "matcher": {
279 - "id": "byName",
280 - "options": "Count"
281 - },
282 - "properties": [
283 - {
284 - "id": "displayName",
285 - "value": "EVENTS"
286 - },
287 - {
288 - "id": "unit",
289 - "value": "short"
290 - },
291 - {
292 - "id": "decimals",
293 - "value": -1
294 - },
295 - {
296 - "id": "custom.align"
297 - },
298 - {
299 - "id": "thresholds",
300 - "value": {
301 - "mode": "absolute",
302 - "steps": [
303 - {
304 - "color": "red",
305 - "value": null
306 - }
307 - ]
308 - }
309 - }
310 - ]
311 - }
312 - ]
313 - },
314 - "gridPos": {
315 - "h": 7,
316 - "w": 6,
317 - "x": 8,
318 - "y": 0
319 - },
320 - "id": 54,
321 - "options": {
322 - "cellHeight": "sm",
323 - "footer": {
324 - "countRows": false,
325 - "fields": "",
326 - "reducer": [
327 - "sum"
328 - ],
329 - "show": false
330 - },
331 - "showHeader": true
332 - },
333 - "pluginVersion": "10.0.3",
334 - "targets": [
335 - {
336 - "bucketAggs": [
337 - {
338 - "fake": true,
339 - "field": "data_office365_Operation",
340 - "id": "4",
341 - "settings": {
342 - "min_doc_count": 1,
343 - "order": "desc",
344 - "orderBy": "_count",
345 - "size": "0"
346 - },
347 - "type": "terms"
348 - }
349 - ],
350 - "datasource": {
351 - "type": "elasticsearch",
352 - "uid": "replace_datasource_uid"
353 - },
354 - "metrics": [
355 - {
356 - "field": "select field",
357 - "id": "1",
358 - "type": "count"
359 - }
360 - ],
361 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
362 - "refId": "A",
363 - "timeField": "timestamp"
364 - }
365 - ],
366 - "title": "EVENTS BY OPERATION",
367 - "transformations": [
368 - {
369 - "id": "merge",
370 - "options": {
371 - "reducers": []
372 - }
373 - },
374 - {
375 - "id": "organize",
376 - "options": {
377 - "excludeByName": {},
378 - "indexByName": {},
379 - "renameByName": {
380 - "Count": "EVENTS",
381 - "data_office365_Operation": "OPERATION"
382 - }
383 - }
384 - }
385 - ],
386 - "type": "table"
387 - },
388 - {
389 - "datasource": {
390 - "type": "elasticsearch",
391 - "uid": "replace_datasource_uid"
392 - },
393 - "fieldConfig": {
394 - "defaults": {
395 - "color": {
396 - "mode": "thresholds"
397 - },
398 - "custom": {
399 - "align": "auto",
400 - "cellOptions": {
401 - "type": "auto"
402 - },
403 - "inspect": false
404 - },
405 - "mappings": [],
406 - "thresholds": {
407 - "mode": "absolute",
408 - "steps": [
409 - {
410 - "color": "red",
411 - "value": null
412 - }
413 - ]
414 - }
415 - },
416 - "overrides": [
417 - {
418 - "matcher": {
419 - "id": "byName",
420 - "options": "Count"
421 - },
422 - "properties": [
423 - {
424 - "id": "displayName",
425 - "value": "EVENTS"
426 - },
427 - {
428 - "id": "unit",
429 - "value": "short"
430 - },
431 - {
432 - "id": "decimals",
433 - "value": -1
434 - },
435 - {
436 - "id": "custom.align"
437 - },
438 - {
439 - "id": "thresholds",
440 - "value": {
441 - "mode": "absolute",
442 - "steps": [
443 - {
444 - "color": "red",
445 - "value": null
446 - }
447 - ]
448 - }
449 - }
450 - ]
451 - }
452 - ]
453 - },
454 - "gridPos": {
455 - "h": 7,
456 - "w": 6,
457 - "x": 14,
458 - "y": 0
459 - },
460 - "id": 62,
461 - "options": {
462 - "cellHeight": "sm",
463 - "footer": {
464 - "countRows": false,
465 - "fields": "",
466 - "reducer": [
467 - "sum"
468 - ],
469 - "show": false
470 - },
471 - "showHeader": true
472 - },
473 - "pluginVersion": "10.0.3",
474 - "targets": [
475 - {
476 - "bucketAggs": [
477 - {
478 - "fake": true,
479 - "field": "data_office365_UserAgent",
480 - "id": "4",
481 - "settings": {
482 - "min_doc_count": 1,
483 - "order": "desc",
484 - "orderBy": "_count",
485 - "size": "0"
486 - },
487 - "type": "terms"
488 - }
489 - ],
490 - "datasource": {
491 - "type": "elasticsearch",
492 - "uid": "replace_datasource_uid"
493 - },
494 - "metrics": [
495 - {
496 - "field": "select field",
497 - "id": "1",
498 - "type": "count"
499 - }
500 - ],
501 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
502 - "refId": "A",
503 - "timeField": "timestamp"
504 - }
505 - ],
506 - "title": "EVENTS BY USER AGENT",
507 - "transformations": [
508 - {
509 - "id": "merge",
510 - "options": {
511 - "reducers": []
512 - }
513 - },
514 - {
515 - "id": "organize",
516 - "options": {
517 - "excludeByName": {},
518 - "indexByName": {},
519 - "renameByName": {
520 - "Count": "EVENTS",
521 - "data_office365_Operation": "OPERATION",
522 - "data_office365_UserAgent": "USER AGENT"
523 - }
524 - }
525 - }
526 - ],
527 - "type": "table"
528 - },
529 - {
530 - "datasource": {
531 - "type": "elasticsearch",
532 - "uid": "replace_datasource_uid"
533 - },
534 - "fieldConfig": {
535 - "defaults": {
536 - "color": {
537 - "mode": "thresholds"
538 - },
539 - "mappings": [
540 - {
541 - "options": {
542 - "match": "null",
543 - "result": {
544 - "text": "N/A"
545 - }
546 - },
547 - "type": "special"
548 - }
549 - ],
550 - "max": 15,
551 - "min": 0,
552 - "thresholds": {
553 - "mode": "absolute",
554 - "steps": [
555 - {
556 - "color": "#299c46",
557 - "value": null
558 - },
559 - {
560 - "color": "rgba(237, 129, 40, 0.89)",
561 - "value": 8
562 - },
563 - {
564 - "color": "#d44a3a",
565 - "value": 12
566 - }
567 - ]
568 - },
569 - "unit": "none"
570 - },
571 - "overrides": []
572 - },
573 - "gridPos": {
574 - "h": 7,
575 - "w": 4,
576 - "x": 0,
577 - "y": 7
578 - },
579 - "id": 16,
580 - "links": [],
581 - "options": {
582 - "orientation": "horizontal",
583 - "reduceOptions": {
584 - "calcs": [
585 - "max"
586 - ],
587 - "fields": "",
588 - "values": false
589 - },
590 - "showThresholdLabels": false,
591 - "showThresholdMarkers": true,
592 - "text": {}
593 - },
594 - "pluginVersion": "10.0.3",
595 - "targets": [
596 - {
597 - "bucketAggs": [
598 - {
599 - "field": "timestamp",
600 - "id": "2",
601 - "settings": {
602 - "interval": "auto",
603 - "min_doc_count": 0,
604 - "trimEdges": 0
605 - },
606 - "type": "date_histogram"
607 - }
608 - ],
609 - "datasource": {
610 - "type": "elasticsearch",
611 - "uid": "replace_datasource_uid"
612 - },
613 - "metrics": [
614 - {
615 - "field": "rule_level",
616 - "id": "1",
617 - "meta": {},
618 - "settings": {},
619 - "type": "max"
620 - }
621 - ],
622 - "query": "data_office365_Operation:$operation AND data_office365_Workload:SharePoint",
623 - "refId": "A",
624 - "timeField": "timestamp"
625 - }
626 - ],
627 - "title": "MAX SEVERITY (0 - 15)",
628 - "type": "gauge"
629 - },
630 - {
631 - "datasource": {
632 - "type": "elasticsearch",
633 - "uid": "replace_datasource_uid"
634 - },
635 - "fieldConfig": {
636 - "defaults": {
637 - "color": {
638 - "mode": "palette-classic"
639 - },
640 - "custom": {
641 - "axisCenteredZero": false,
642 - "axisColorMode": "text",
643 - "axisLabel": "",
644 - "axisPlacement": "auto",
645 - "barAlignment": 0,
646 - "drawStyle": "bars",
647 - "fillOpacity": 0,
648 - "gradientMode": "none",
649 - "hideFrom": {
650 - "legend": false,
651 - "tooltip": false,
652 - "viz": false
653 - },
654 - "lineInterpolation": "linear",
655 - "lineWidth": 1,
656 - "pointSize": 5,
657 - "scaleDistribution": {
658 - "type": "linear"
659 - },
660 - "showPoints": "auto",
661 - "spanNulls": false,
662 - "stacking": {
663 - "group": "A",
664 - "mode": "normal"
665 - },
666 - "thresholdsStyle": {
667 - "mode": "off"
668 - }
669 - },
670 - "mappings": [],
671 - "thresholds": {
672 - "mode": "absolute",
673 - "steps": [
674 - {
675 - "color": "green",
676 - "value": null
677 - },
678 - {
679 - "color": "red",
680 - "value": 80
681 - }
682 - ]
683 - }
684 - },
685 - "overrides": []
686 - },
687 - "gridPos": {
688 - "h": 13,
689 - "w": 20,
690 - "x": 4,
691 - "y": 7
692 - },
693 - "id": 60,
694 - "options": {
695 - "legend": {
696 - "calcs": [],
697 - "displayMode": "table",
698 - "placement": "right",
699 - "showLegend": true
700 - },
701 - "tooltip": {
702 - "mode": "single",
703 - "sort": "none"
704 - }
705 - },
706 - "targets": [
707 - {
708 - "alias": "",
709 - "bucketAggs": [
710 - {
711 - "field": "data_office365_Operation",
712 - "id": "3",
713 - "settings": {
714 - "min_doc_count": "1",
715 - "order": "desc",
716 - "orderBy": "_count",
717 - "size": "10"
718 - },
719 - "type": "terms"
720 - },
721 - {
722 - "field": "timestamp",
723 - "id": "2",
724 - "settings": {
725 - "interval": "auto"
726 - },
727 - "type": "date_histogram"
728 - }
729 - ],
730 - "datasource": {
731 - "type": "elasticsearch",
732 - "uid": "replace_datasource_uid"
733 - },
734 - "metrics": [
735 - {
736 - "id": "1",
737 - "type": "count"
738 - }
739 - ],
740 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
741 - "refId": "A",
742 - "timeField": "timestamp"
743 - }
744 - ],
745 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
746 - "transparent": true,
747 - "type": "timeseries"
748 - },
749 - {
750 - "datasource": {
751 - "type": "elasticsearch",
752 - "uid": "replace_datasource_uid"
753 - },
754 - "fieldConfig": {
755 - "defaults": {
756 - "mappings": [
757 - {
758 - "options": {
759 - "match": "null",
760 - "result": {
761 - "text": "N/A"
762 - }
763 - },
764 - "type": "special"
765 - }
766 - ],
767 - "thresholds": {
768 - "mode": "absolute",
769 - "steps": [
770 - {
771 - "color": "blue",
772 - "value": null
773 - }
774 - ]
775 - },
776 - "unit": "locale"
777 - },
778 - "overrides": []
779 - },
780 - "gridPos": {
781 - "h": 6,
782 - "w": 4,
783 - "x": 0,
784 - "y": 14
785 - },
786 - "id": 51,
787 - "links": [],
788 - "options": {
789 - "colorMode": "value",
790 - "graphMode": "area",
791 - "justifyMode": "auto",
792 - "orientation": "horizontal",
793 - "reduceOptions": {
794 - "calcs": [
795 - "sum"
796 - ],
797 - "fields": "",
798 - "values": false
799 - },
800 - "text": {},
801 - "textMode": "auto"
802 - },
803 - "pluginVersion": "10.0.3",
804 - "targets": [
805 - {
806 - "bucketAggs": [
807 - {
808 - "$$hashKey": "object:331",
809 - "field": "timestamp",
810 - "id": "2",
811 - "settings": {
812 - "interval": "auto",
813 - "min_doc_count": 0,
814 - "trimEdges": 0
815 - },
816 - "type": "date_histogram"
817 - }
818 - ],
819 - "datasource": {
820 - "type": "elasticsearch",
821 - "uid": "replace_datasource_uid"
822 - },
823 - "metrics": [
824 - {
825 - "$$hashKey": "object:329",
826 - "field": "select field",
827 - "id": "1",
828 - "type": "count"
829 - }
830 - ],
831 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
832 - "refId": "A",
833 - "timeField": "timestamp"
834 - }
835 - ],
836 - "title": "EVENTS (Total)",
837 - "type": "stat"
838 - },
839 - {
840 - "datasource": {
841 - "type": "elasticsearch",
842 - "uid": "replace_datasource_uid"
843 - },
844 - "fieldConfig": {
845 - "defaults": {
846 - "color": {
847 - "mode": "thresholds"
848 - },
849 - "custom": {
850 - "align": "auto",
851 - "cellOptions": {
852 - "type": "auto"
853 - },
854 - "inspect": false
855 - },
856 - "mappings": [],
857 - "thresholds": {
858 - "mode": "absolute",
859 - "steps": [
860 - {
861 - "color": "orange",
862 - "value": null
863 - }
864 - ]
865 - }
866 - },
867 - "overrides": [
868 - {
869 - "matcher": {
870 - "id": "byName",
871 - "options": "Count"
872 - },
873 - "properties": [
874 - {
875 - "id": "displayName",
876 - "value": "EVENTS"
877 - },
878 - {
879 - "id": "unit",
880 - "value": "short"
881 - },
882 - {
883 - "id": "decimals",
884 - "value": -1
885 - },
886 - {
887 - "id": "custom.align"
888 - }
889 - ]
890 - },
891 - {
892 - "matcher": {
893 - "id": "byName",
894 - "options": "AD ACCOUNT"
895 - },
896 - "properties": [
897 - {
898 - "id": "custom.width",
899 - "value": 377
900 - }
901 - ]
902 - }
903 - ]
904 - },
905 - "gridPos": {
906 - "h": 12,
907 - "w": 8,
908 - "x": 0,
909 - "y": 20
910 - },
911 - "id": 61,
912 - "options": {
913 - "cellHeight": "sm",
914 - "footer": {
915 - "countRows": false,
916 - "fields": "",
917 - "reducer": [
918 - "sum"
919 - ],
920 - "show": false
921 - },
922 - "showHeader": true,
923 - "sortBy": []
924 - },
925 - "pluginVersion": "10.0.3",
926 - "targets": [
927 - {
928 - "bucketAggs": [
929 - {
930 - "fake": true,
931 - "field": "data_office365_AuthenticationType",
932 - "id": "4",
933 - "settings": {
934 - "min_doc_count": 1,
935 - "order": "desc",
936 - "orderBy": "_count",
937 - "size": "0"
938 - },
939 - "type": "terms"
940 - },
941 - {
942 - "field": "data_office365_ClientIP_country_code",
943 - "id": "5",
944 - "settings": {
945 - "min_doc_count": "1",
946 - "order": "desc",
947 - "orderBy": "_term",
948 - "size": "10"
949 - },
950 - "type": "terms"
951 - }
952 - ],
953 - "datasource": {
954 - "type": "elasticsearch",
955 - "uid": "replace_datasource_uid"
956 - },
957 - "metrics": [
958 - {
959 - "field": "select field",
960 - "id": "1",
961 - "type": "count"
962 - }
963 - ],
964 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
965 - "refId": "A",
966 - "timeField": "timestamp"
967 - }
968 - ],
969 - "title": "SHAREPOINT EVENTS BY AUTH TYPE",
970 - "transformations": [
971 - {
972 - "id": "merge",
973 - "options": {
974 - "reducers": []
975 - }
976 - },
977 - {
978 - "id": "organize",
979 - "options": {
980 - "excludeByName": {},
981 - "indexByName": {},
982 - "renameByName": {
983 - "Count": "EVENTS",
984 - "data_office365_AuthenticationType": "AUTH TYPE",
985 - "data_office365_ClientIP_country_code": "COUNTRY",
986 - "data_office365_LogonError": "ERROR",
987 - "data_office365_Operation": "WORKLOAD",
988 - "data_office365_UserId": "AD ACCOUNT"
989 - }
990 - }
991 - }
992 - ],
993 - "type": "table"
994 - },
995 - {
996 - "circleMaxSize": 30,
997 - "circleMinSize": 2,
998 - "colors": [
999 - "rgba(245, 54, 54, 0.9)",
1000 - "rgba(237, 129, 40, 0.89)",
1001 - "rgba(50, 172, 45, 0.97)"
1002 - ],
1003 - "datasource": {
1004 - "type": "elasticsearch",
1005 - "uid": "replace_datasource_uid"
1006 - },
1007 - "decimals": 0,
1008 - "esMetric": "Count",
1009 - "gridPos": {
1010 - "h": 12,
1011 - "w": 8,
1012 - "x": 8,
1013 - "y": 20
1014 - },
1015 - "hideEmpty": false,
1016 - "hideZero": false,
1017 - "id": 50,
1018 - "initialZoom": 1,
1019 - "locationData": "countries",
1020 - "mapCenter": "(0°, 0°)",
1021 - "mapCenterLatitude": 0,
1022 - "mapCenterLongitude": 0,
1023 - "maxDataPoints": 1,
1024 - "mouseWheelZoom": false,
1025 - "showLegend": true,
1026 - "stickyLabels": false,
1027 - "tableQueryOptions": {
1028 - "geohashField": "geohash",
1029 - "latitudeField": "latitude",
1030 - "longitudeField": "longitude",
1031 - "metricField": "metric",
1032 - "queryType": "geohash"
1033 - },
1034 - "targets": [
1035 - {
1036 - "bucketAggs": [
1037 - {
1038 - "fake": true,
1039 - "field": "data_office365_ClientIP_country_code",
1040 - "id": "3",
1041 - "settings": {
1042 - "min_doc_count": 1,
1043 - "order": "desc",
1044 - "orderBy": "_term",
1045 - "size": "0"
1046 - },
1047 - "type": "terms"
1048 - },
1049 - {
1050 - "field": "timestamp",
1051 - "id": "2",
1052 - "settings": {
1053 - "interval": "auto",
1054 - "min_doc_count": 0,
1055 - "trimEdges": 0
1056 - },
1057 - "type": "date_histogram"
1058 - }
1059 - ],
1060 - "datasource": {
1061 - "type": "elasticsearch",
1062 - "uid": "replace_datasource_uid"
1063 - },
1064 - "metrics": [
1065 - {
1066 - "field": "select field",
1067 - "id": "1",
1068 - "type": "count"
1069 - }
1070 - ],
1071 - "query": "data_office365_Workload:SharePoint AND rule_level:$rule_level",
1072 - "refId": "A",
1073 - "timeField": "timestamp"
1074 - }
1075 - ],
1076 - "thresholds": "0,10",
1077 - "title": "SHAREPOINT - ALL EVENTS BY SRC COUNTRY",
1078 - "type": "grafana-worldmap-panel",
1079 - "unitPlural": "",
1080 - "unitSingle": "",
1081 - "valueName": "total"
1082 - },
1083 - {
1084 - "datasource": {
1085 - "type": "elasticsearch",
1086 - "uid": "replace_datasource_uid"
1087 - },
1088 - "fieldConfig": {
1089 - "defaults": {
1090 - "color": {
1091 - "mode": "thresholds"
1092 - },
1093 - "custom": {
1094 - "align": "auto",
1095 - "cellOptions": {
1096 - "type": "auto"
1097 - },
1098 - "inspect": false
1099 - },
1100 - "mappings": [],
1101 - "thresholds": {
1102 - "mode": "absolute",
1103 - "steps": [
1104 - {
1105 - "color": "orange",
1106 - "value": null
1107 - }
1108 - ]
1109 - }
1110 - },
1111 - "overrides": [
1112 - {
1113 - "matcher": {
1114 - "id": "byName",
1115 - "options": "Count"
1116 - },
1117 - "properties": [
1118 - {
1119 - "id": "displayName",
1120 - "value": "EVENTS"
1121 - },
1122 - {
1123 - "id": "unit",
1124 - "value": "short"
1125 - },
1126 - {
1127 - "id": "decimals",
1128 - "value": -1
1129 - },
1130 - {
1131 - "id": "custom.align"
1132 - }
1133 - ]
1134 - },
1135 - {
1136 - "matcher": {
1137 - "id": "byName",
1138 - "options": "AD ACCOUNT"
1139 - },
1140 - "properties": [
1141 - {
1142 - "id": "custom.width",
1143 - "value": 377
1144 - }
1145 - ]
1146 - }
1147 - ]
1148 - },
1149 - "gridPos": {
1150 - "h": 12,
1151 - "w": 8,
1152 - "x": 16,
1153 - "y": 20
1154 - },
1155 - "id": 58,
1156 - "options": {
1157 - "cellHeight": "sm",
1158 - "footer": {
1159 - "countRows": false,
1160 - "fields": "",
1161 - "reducer": [
1162 - "sum"
1163 - ],
1164 - "show": false
1165 - },
1166 - "showHeader": true,
1167 - "sortBy": []
1168 - },
1169 - "pluginVersion": "10.0.3",
1170 - "targets": [
1171 - {
1172 - "bucketAggs": [
1173 - {
1174 - "fake": true,
1175 - "field": "data_office365_UserId",
1176 - "id": "4",
1177 - "settings": {
1178 - "min_doc_count": 1,
1179 - "order": "desc",
1180 - "orderBy": "_count",
1181 - "size": "0"
1182 - },
1183 - "type": "terms"
1184 - },
1185 - {
1186 - "field": "data_office365_ClientIP_country_code",
1187 - "id": "5",
1188 - "settings": {
1189 - "min_doc_count": "1",
1190 - "order": "desc",
1191 - "orderBy": "_term",
1192 - "size": "10"
1193 - },
1194 - "type": "terms"
1195 - }
1196 - ],
1197 - "datasource": {
1198 - "type": "elasticsearch",
1199 - "uid": "replace_datasource_uid"
1200 - },
1201 - "metrics": [
1202 - {
1203 - "field": "select field",
1204 - "id": "1",
1205 - "type": "count"
1206 - }
1207 - ],
1208 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
1209 - "refId": "A",
1210 - "timeField": "timestamp"
1211 - }
1212 - ],
1213 - "title": "SHAREPOINT EVENTS BY ACCOUNT",
1214 - "transformations": [
1215 - {
1216 - "id": "merge",
1217 - "options": {
1218 - "reducers": []
1219 - }
1220 - },
1221 - {
1222 - "id": "organize",
1223 - "options": {
1224 - "excludeByName": {},
1225 - "indexByName": {},
1226 - "renameByName": {
1227 - "Count": "EVENTS",
1228 - "data_office365_ClientIP_country_code": "COUNTRY",
1229 - "data_office365_LogonError": "ERROR",
1230 - "data_office365_Operation": "WORKLOAD",
1231 - "data_office365_UserId": "AD ACCOUNT"
1232 - }
1233 - }
1234 - }
1235 - ],
1236 - "type": "table"
1237 - },
1238 - {
1239 - "datasource": {
1240 - "type": "elasticsearch",
1241 - "uid": "replace_datasource_uid"
1242 - },
1243 - "fieldConfig": {
1244 - "defaults": {
1245 - "color": {
1246 - "mode": "thresholds"
1247 - },
1248 - "custom": {
1249 - "align": "auto",
1250 - "cellOptions": {
1251 - "type": "auto"
1252 - },
1253 - "filterable": true,
1254 - "inspect": false
1255 - },
1256 - "mappings": [],
1257 - "thresholds": {
1258 - "mode": "absolute",
1259 - "steps": [
1260 - {
1261 - "color": "green",
1262 - "value": null
1263 - },
1264 - {
1265 - "color": "red",
1266 - "value": 80
1267 - }
1268 - ]
1269 - }
1270 - },
1271 - "overrides": [
1272 - {
1273 - "matcher": {
1274 - "id": "byName",
1275 - "options": "rule_level"
1276 - },
1277 - "properties": [
1278 - {
1279 - "id": "displayName",
1280 - "value": "RULE LEVEL"
1281 - },
1282 - {
1283 - "id": "unit",
1284 - "value": "short"
1285 - },
1286 - {
1287 - "id": "decimals",
1288 - "value": -1
1289 - },
1290 - {
1291 - "id": "custom.cellOptions",
1292 - "value": {
1293 - "mode": "gradient",
1294 - "type": "color-background"
1295 - }
1296 - },
1297 - {
1298 - "id": "custom.align"
1299 - },
1300 - {
1301 - "id": "thresholds",
1302 - "value": {
1303 - "mode": "absolute",
1304 - "steps": [
1305 - {
1306 - "color": "#37872D",
1307 - "value": null
1308 - },
1309 - {
1310 - "color": "rgba(237, 129, 40, 0.89)",
1311 - "value": 7
1312 - },
1313 - {
1314 - "color": "rgba(245, 54, 54, 0.9)",
1315 - "value": 12
1316 - }
1317 - ]
1318 - }
1319 - }
1320 - ]
1321 - },
1322 - {
1323 - "matcher": {
1324 - "id": "byName",
1325 - "options": "Date/Time"
1326 - },
1327 - "properties": [
1328 - {
1329 - "id": "custom.width",
1330 - "value": 242
1331 - }
1332 - ]
1333 - },
1334 - {
1335 - "matcher": {
1336 - "id": "byName",
1337 - "options": "MITRE TACTIC"
1338 - },
1339 - "properties": [
1340 - {
1341 - "id": "custom.width",
1342 - "value": 332
1343 - }
1344 - ]
1345 - },
1346 - {
1347 - "matcher": {
1348 - "id": "byName",
1349 - "options": "IP ADDRESS"
1350 - },
1351 - "properties": [
1352 - {
1353 - "id": "custom.width",
1354 - "value": 163
1355 - }
1356 - ]
1357 - },
1358 - {
1359 - "matcher": {
1360 - "id": "byName",
1361 - "options": "MITRE TECHNIQUE"
1362 - },
1363 - "properties": [
1364 - {
1365 - "id": "custom.width",
1366 - "value": 312
1367 - }
1368 - ]
1369 - },
1370 - {
1371 - "matcher": {
1372 - "id": "byName",
1373 - "options": "EVENT ID"
1374 - },
1375 - "properties": [
1376 - {
1377 - "id": "links",
1378 - "value": [
1379 - {
1380 - "targetBlank": true,
1381 - "title": "VIEW EVENT DETAILS",
1382 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1383 - }
1384 - ]
1385 - },
1386 - {
1387 - "id": "custom.width",
1388 - "value": 265
1389 - }
1390 - ]
1391 - },
1392 - {
1393 - "matcher": {
1394 - "id": "byName",
1395 - "options": "RESULT"
1396 - },
1397 - "properties": [
1398 - {
1399 - "id": "custom.width",
1400 - "value": 118
1401 - },
1402 - {
1403 - "id": "mappings",
1404 - "value": [
1405 - {
1406 - "options": {
1407 - "Failed": {
1408 - "color": "orange",
1409 - "index": 1
1410 - },
1411 - "Success": {
1412 - "color": "green",
1413 - "index": 0
1414 - }
1415 - },
1416 - "type": "value"
1417 - }
1418 - ]
1419 - },
1420 - {
1421 - "id": "custom.cellOptions",
1422 - "value": {
1423 - "type": "color-text"
1424 - }
1425 - }
1426 - ]
1427 - },
1428 - {
1429 - "matcher": {
1430 - "id": "byName",
1431 - "options": "SRC IP"
1432 - },
1433 - "properties": [
1434 - {
1435 - "id": "custom.width",
1436 - "value": 265
1437 - }
1438 - ]
1439 - },
1440 - {
1441 - "matcher": {
1442 - "id": "byName",
1443 - "options": "ACCOUNT"
1444 - },
1445 - "properties": [
1446 - {
1447 - "id": "custom.width",
1448 - "value": 227
1449 - }
1450 - ]
1451 - },
1452 - {
1453 - "matcher": {
1454 - "id": "byName",
1455 - "options": "EVENT TIME"
1456 - },
1457 - "properties": [
1458 - {
1459 - "id": "custom.width",
1460 - "value": 195
1461 - }
1462 - ]
1463 - },
1464 - {
1465 - "matcher": {
1466 - "id": "byName",
1467 - "options": "CLIENT IP"
1468 - },
1469 - "properties": [
1470 - {
1471 - "id": "custom.width",
1472 - "value": 191
1473 - }
1474 - ]
1475 - },
1476 - {
1477 - "matcher": {
1478 - "id": "byName",
1479 - "options": "DESCRIPTION"
1480 - },
1481 - "properties": [
1482 - {
1483 - "id": "custom.width",
1484 - "value": 367
1485 - }
1486 - ]
1487 - },
1488 - {
1489 - "matcher": {
1490 - "id": "byName",
1491 - "options": "FILE"
1492 - },
1493 - "properties": [
1494 - {
1495 - "id": "custom.width",
1496 - "value": 855
1497 - }
1498 - ]
1499 - },
1500 - {
1501 - "matcher": {
1502 - "id": "byName",
1503 - "options": "BROWSER"
1504 - },
1505 - "properties": [
1506 - {
1507 - "id": "custom.width",
1508 - "value": 205
1509 - }
1510 - ]
1511 - },
1512 - {
1513 - "matcher": {
1514 - "id": "byName",
1515 - "options": "RULE LEVEL"
1516 - },
1517 - "properties": [
1518 - {
1519 - "id": "custom.width",
1520 - "value": 197
1521 - }
1522 - ]
1523 - }
1524 - ]
1525 - },
1526 - "gridPos": {
1527 - "h": 16,
1528 - "w": 24,
1529 - "x": 0,
1530 - "y": 32
1531 - },
1532 - "id": 27,
1533 - "options": {
1534 - "cellHeight": "sm",
1535 - "footer": {
1536 - "countRows": false,
1537 - "enablePagination": true,
1538 - "fields": "",
1539 - "reducer": [
1540 - "sum"
1541 - ],
1542 - "show": false
1543 - },
1544 - "showHeader": true,
1545 - "sortBy": []
1546 - },
1547 - "pluginVersion": "10.0.3",
1548 - "targets": [
1549 - {
1550 - "bucketAggs": [],
1551 - "datasource": {
1552 - "type": "elasticsearch",
1553 - "uid": "replace_datasource_uid"
1554 - },
1555 - "metrics": [
1556 - {
1557 - "id": "1",
1558 - "settings": {
1559 - "size": "250"
1560 - },
1561 - "type": "raw_data"
1562 - }
1563 - ],
1564 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
1565 - "refId": "A",
1566 - "timeField": "timestamp"
1567 - }
1568 - ],
1569 - "title": "EVENTS",
1570 - "transformations": [
1571 - {
1572 - "id": "organize",
1573 - "options": {
1574 - "excludeByName": {
1575 - "@metadata_beat": true,
1576 - "@metadata_type": true,
1577 - "@metadata_version": true,
1578 - "IMPHASH": true,
1579 - "MD5": true,
1580 - "SHA1": true,
1581 - "SHA256": true,
1582 - "_id": false,
1583 - "_index": true,
1584 - "_type": true,
1585 - "agent_ephemeral_id": true,
1586 - "agent_hostname": true,
1587 - "agent_id": true,
1588 - "agent_ip_city_name": true,
1589 - "agent_ip_country_code": true,
1590 - "agent_ip_geolocation": true,
1591 - "agent_name": true,
1592 - "agent_type": true,
1593 - "agent_version": true,
1594 - "beats_type": true,
1595 - "cluster_name": true,
1596 - "cluster_node": true,
1597 - "collector_node_id": true,
1598 - "data_alert_action": true,
1599 - "data_alert_category": true,
1600 - "data_alert_gid": true,
1601 - "data_alert_rev": true,
1602 - "data_alert_severity": true,
1603 - "data_alert_signature": true,
1604 - "data_alert_signature_id": true,
1605 - "data_app_proto": true,
1606 - "data_audit_auid": true,
1607 - "data_audit_command": true,
1608 - "data_audit_euid": true,
1609 - "data_audit_exe": true,
1610 - "data_audit_gid": true,
1611 - "data_audit_id": true,
1612 - "data_audit_pid": true,
1613 - "data_audit_res": true,
1614 - "data_audit_session": true,
1615 - "data_audit_type": true,
1616 - "data_audit_uid": true,
1617 - "data_dest_ip": true,
1618 - "data_dest_port": true,
1619 - "data_dstuser": true,
1620 - "data_event_type": true,
1621 - "data_extra_data": true,
1622 - "data_file": true,
1623 - "data_flow_bytes_toclient": true,
1624 - "data_flow_bytes_toserver": true,
1625 - "data_flow_id": true,
1626 - "data_flow_pkts_toclient": true,
1627 - "data_flow_pkts_toserver": true,
1628 - "data_flow_start": true,
1629 - "data_http_http_content_type": true,
1630 - "data_http_http_port": true,
1631 - "data_http_length": true,
1632 - "data_http_status": true,
1633 - "data_http_url": true,
1634 - "data_id": true,
1635 - "data_in_iface": true,
1636 - "data_integration": true,
1637 - "data_metadata_flowbits": true,
1638 - "data_metadata_flowints_http_anomaly_count": true,
1639 - "data_metadata_flowints_tcp_retransmission_count": true,
1640 - "data_office365_AADGroupId": true,
1641 - "data_office365_Actor": true,
1642 - "data_office365_ActorContextId": true,
1643 - "data_office365_ActorIpAddress": false,
1644 - "data_office365_ActorIpAddress_city_name": true,
1645 - "data_office365_ActorIpAddress_country_code": true,
1646 - "data_office365_ActorIpAddress_geolocation": true,
1647 - "data_office365_AppAccessContext_AADSessionId": true,
1648 - "data_office365_AppAccessContext_APIId": true,
1649 - "data_office365_AppAccessContext_ClientAppId": true,
1650 - "data_office365_AppAccessContext_ClientAppName": true,
1651 - "data_office365_AppAccessContext_CorrelationId": true,
1652 - "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1653 - "data_office365_AppAccessContext_UniqueTokenId": true,
1654 - "data_office365_AppId": true,
1655 - "data_office365_ApplicationDisplayName": true,
1656 - "data_office365_ApplicationId": true,
1657 - "data_office365_ArtifactsShared": true,
1658 - "data_office365_AssertingApplicationId": true,
1659 - "data_office365_Attendees": true,
1660 - "data_office365_AuthenticationType": true,
1661 - "data_office365_AzureActiveDirectoryEventType": true,
1662 - "data_office365_BrowserVersion": true,
1663 - "data_office365_BrowserVersion_city_name": true,
1664 - "data_office365_BrowserVersion_country_code": true,
1665 - "data_office365_BrowserVersion_geolocation": true,
1666 - "data_office365_ChannelGuid": true,
1667 - "data_office365_ChannelName": true,
1668 - "data_office365_ChatName": true,
1669 - "data_office365_ChatThreadId": true,
1670 - "data_office365_ClientAppId": true,
1671 - "data_office365_ClientIP": false,
1672 - "data_office365_ClientIPAddress": true,
1673 - "data_office365_ClientIPAddress_city_name": true,
1674 - "data_office365_ClientIPAddress_country_code": true,
1675 - "data_office365_ClientIPAddress_geolocation": true,
1676 - "data_office365_ClientIP_city_name": true,
1677 - "data_office365_ClientIP_country_code": true,
1678 - "data_office365_ClientIP_geolocation": true,
1679 - "data_office365_ClientInfoString": true,
1680 - "data_office365_ClientProcessName": true,
1681 - "data_office365_ClientRequestId": true,
1682 - "data_office365_ClientVersion": true,
1683 - "data_office365_CommunicationSubType": true,
1684 - "data_office365_CommunicationType": true,
1685 - "data_office365_CorrelationId": true,
1686 - "data_office365_CreationTime": false,
1687 - "data_office365_CrossMailboxOperation": true,
1688 - "data_office365_CustomUniqueId": true,
1689 - "data_office365_CustomizedDoclib": true,
1690 - "data_office365_DestFolder_Id": true,
1691 - "data_office365_DestFolder_Path": true,
1692 - "data_office365_DestinationFileExtension": true,
1693 - "data_office365_DestinationFileName": true,
1694 - "data_office365_DestinationRelativeUrl": true,
1695 - "data_office365_DeviceDisplayName": true,
1696 - "data_office365_DeviceDisplayName_city_name": true,
1697 - "data_office365_DeviceDisplayName_country_code": true,
1698 - "data_office365_DeviceDisplayName_geolocation": true,
1699 - "data_office365_DeviceId": true,
1700 - "data_office365_DeviceInformation": true,
1701 - "data_office365_DeviceProperties": true,
1702 - "data_office365_DoNotDistributeEvent": true,
1703 - "data_office365_EndTime": true,
1704 - "data_office365_ErrorNumber": true,
1705 - "data_office365_EventData": true,
1706 - "data_office365_EventSource": true,
1707 - "data_office365_ExchangeId": true,
1708 - "data_office365_ExtendedProperties": true,
1709 - "data_office365_ExternalAccess": true,
1710 - "data_office365_ExtraProperties": true,
1711 - "data_office365_FileSizeBytes": true,
1712 - "data_office365_FileSyncBytesCommitted": true,
1713 - "data_office365_Folder_Id": true,
1714 - "data_office365_Folder_Path": true,
1715 - "data_office365_FromApp": true,
1716 - "data_office365_HighPriorityMediaProcessing": true,
1717 - "data_office365_HostedContents": true,
1718 - "data_office365_ICalUid": true,
1719 - "data_office365_Id": true,
1720 - "data_office365_ImplicitShare": true,
1721 - "data_office365_InterSystemsId": true,
1722 - "data_office365_InternalLogonType": true,
1723 - "data_office365_IntraSystemId": true,
1724 - "data_office365_IsManagedDevice": true,
1725 - "data_office365_ItemCount": true,
1726 - "data_office365_ItemName": true,
1727 - "data_office365_ItemType": true,
1728 - "data_office365_Item_Id": true,
1729 - "data_office365_Item_InternetMessageId": true,
1730 - "data_office365_Item_IsRecord": true,
1731 - "data_office365_Item_ParentFolder_Id": true,
1732 - "data_office365_Item_SizeInBytes": true,
1733 - "data_office365_JoinTime": true,
1734 - "data_office365_LeaveTime": true,
1735 - "data_office365_ListBaseTemplateType": true,
1736 - "data_office365_ListBaseType": true,
1737 - "data_office365_ListId": true,
1738 - "data_office365_ListItemUniqueId": true,
1739 - "data_office365_ListServerTemplate": true,
1740 - "data_office365_ListTitle": true,
1741 - "data_office365_LogonError": true,
1742 - "data_office365_LogonType": true,
1743 - "data_office365_LogonUserSid": true,
1744 - "data_office365_MachineId": true,
1745 - "data_office365_MailboxGuid": true,
1746 - "data_office365_MailboxOwnerSid": true,
1747 - "data_office365_MailboxOwnerUPN": true,
1748 - "data_office365_MeetingDetailId": true,
1749 - "data_office365_MeetingURL": true,
1750 - "data_office365_Members": true,
1751 - "data_office365_MessageId": true,
1752 - "data_office365_MessageSizeInBytes": true,
1753 - "data_office365_MessageURLs": true,
1754 - "data_office365_MessageVersion": true,
1755 - "data_office365_Modalities": true,
1756 - "data_office365_ModifiedProperties": true,
1757 - "data_office365_Name": true,
1758 - "data_office365_NewValue": true,
1759 - "data_office365_ObjectId": true,
1760 - "data_office365_Operation": true,
1761 - "data_office365_OperationScope": true,
1762 - "data_office365_OrganizationId": true,
1763 - "data_office365_OrganizationName": true,
1764 - "data_office365_Organizer_OrganizationId": true,
1765 - "data_office365_Organizer_RecipientType": true,
1766 - "data_office365_Organizer_Role": true,
1767 - "data_office365_Organizer_UserObjectId": true,
1768 - "data_office365_OriginatingServer": true,
1769 - "data_office365_Parameters": true,
1770 - "data_office365_ParentMessageId": true,
1771 - "data_office365_Platform": true,
1772 - "data_office365_ProviderTypes": true,
1773 - "data_office365_RecordType": true,
1774 - "data_office365_ResultStatus": true,
1775 - "data_office365_SearchQueryText": true,
1776 - "data_office365_SessionId": true,
1777 - "data_office365_Site": true,
1778 - "data_office365_SiteUrl": true,
1779 - "data_office365_SkipForServiceWorker": true,
1780 - "data_office365_Source": true,
1781 - "data_office365_SourceFileExtension": true,
1782 - "data_office365_SourceRelativeUrl": true,
1783 - "data_office365_StartTime": true,
1784 - "data_office365_Subscription": true,
1785 - "data_office365_SubscriptionId": true,
1786 - "data_office365_Target": true,
1787 - "data_office365_TargetContextId": true,
1788 - "data_office365_TargetUserOrGroupName": true,
1789 - "data_office365_TargetUserOrGroupType": true,
1790 - "data_office365_TeamGuid": true,
1791 - "data_office365_TeamName": true,
1792 - "data_office365_UniqueSharingId": true,
1793 - "data_office365_UserAgent": true,
1794 - "data_office365_UserId": false,
1795 - "data_office365_UserKey": true,
1796 - "data_office365_UserType": true,
1797 - "data_office365_Version": true,
1798 - "data_office365_WebId": true,
1799 - "data_office365_Workload": true,
1800 - "data_osquery_action": true,
1801 - "data_osquery_calendarTime": true,
1802 - "data_osquery_columns_address": true,
1803 - "data_osquery_columns_address_city_name": true,
1804 - "data_osquery_columns_address_country_code": true,
1805 - "data_osquery_columns_address_geolocation": true,
1806 - "data_osquery_columns_cmdline": true,
1807 - "data_osquery_columns_cwd": true,
1808 - "data_osquery_columns_description": true,
1809 - "data_osquery_columns_directory": true,
1810 - "data_osquery_columns_disk_bytes_read": true,
1811 - "data_osquery_columns_disk_bytes_written": true,
1812 - "data_osquery_columns_egid": true,
1813 - "data_osquery_columns_euid": true,
1814 - "data_osquery_columns_family": true,
1815 - "data_osquery_columns_fd": true,
1816 - "data_osquery_columns_gid": true,
1817 - "data_osquery_columns_gid_signed": true,
1818 - "data_osquery_columns_host": true,
1819 - "data_osquery_columns_interface": true,
1820 - "data_osquery_columns_local_address": true,
1821 - "data_osquery_columns_local_address_city_name": true,
1822 - "data_osquery_columns_local_address_country_code": true,
1823 - "data_osquery_columns_local_address_geolocation": true,
1824 - "data_osquery_columns_local_port": true,
1825 - "data_osquery_columns_mac": true,
1826 - "data_osquery_columns_name": true,
1827 - "data_osquery_columns_net_namespace": true,
1828 - "data_osquery_columns_nice": true,
1829 - "data_osquery_columns_on_disk": true,
1830 - "data_osquery_columns_parent": true,
1831 - "data_osquery_columns_path": true,
1832 - "data_osquery_columns_pgroup": true,
1833 - "data_osquery_columns_pid": true,
1834 - "data_osquery_columns_port": true,
1835 - "data_osquery_columns_protocol": true,
1836 - "data_osquery_columns_remote_address": true,
1837 - "data_osquery_columns_remote_address_city_name": true,
1838 - "data_osquery_columns_remote_address_country_code": true,
1839 - "data_osquery_columns_remote_address_geolocation": true,
1840 - "data_osquery_columns_remote_port": true,
1841 - "data_osquery_columns_resident_size": true,
1842 - "data_osquery_columns_root": true,
1843 - "data_osquery_columns_sgid": true,
1844 - "data_osquery_columns_shell": true,
1845 - "data_osquery_columns_socket": true,
1846 - "data_osquery_columns_start_time": true,
1847 - "data_osquery_columns_state": true,
1848 - "data_osquery_columns_suid": true,
1849 - "data_osquery_columns_system_time": true,
1850 - "data_osquery_columns_threads": true,
1851 - "data_osquery_columns_time_utc": true,
1852 - "data_osquery_columns_total_size": true,
1853 - "data_osquery_columns_tty": true,
1854 - "data_osquery_columns_type": true,
1855 - "data_osquery_columns_uid": true,
1856 - "data_osquery_columns_uid_signed": true,
1857 - "data_osquery_columns_user": true,
1858 - "data_osquery_columns_user_time": true,
1859 - "data_osquery_columns_username": true,
1860 - "data_osquery_columns_wired_size": true,
1861 - "data_osquery_counter": true,
1862 - "data_osquery_decorations_host_uuid": true,
1863 - "data_osquery_decorations_hostname": true,
1864 - "data_osquery_epoch": true,
1865 - "data_osquery_hostIdentifier": true,
1866 - "data_osquery_name": true,
1867 - "data_osquery_numerics": true,
1868 - "data_osquery_unixTime": true,
1869 - "data_proto": true,
1870 - "data_sca_check_command": true,
1871 - "data_sca_check_compliance_cis": true,
1872 - "data_sca_check_compliance_cis_csc": true,
1873 - "data_sca_check_compliance_gdpr_IV": true,
1874 - "data_sca_check_compliance_gpg_13": true,
1875 - "data_sca_check_compliance_hipaa": true,
1876 - "data_sca_check_compliance_nist_800_53": true,
1877 - "data_sca_check_compliance_pci_dss": true,
1878 - "data_sca_check_compliance_tsc": true,
1879 - "data_sca_check_description": true,
1880 - "data_sca_check_id": true,
1881 - "data_sca_check_previous_result": true,
1882 - "data_sca_check_rationale": true,
1883 - "data_sca_check_remediation": true,
1884 - "data_sca_check_result": true,
1885 - "data_sca_check_title": true,
1886 - "data_sca_description": true,
1887 - "data_sca_failed": true,
1888 - "data_sca_file": true,
1889 - "data_sca_invalid": true,
1890 - "data_sca_passed": true,
1891 - "data_sca_policy": true,
1892 - "data_sca_policy_id": true,
1893 - "data_sca_scan_id": true,
1894 - "data_sca_score": true,
1895 - "data_sca_total_checks": true,
1896 - "data_sca_type": true,
1897 - "data_script": true,
1898 - "data_src_ip": true,
1899 - "data_src_ip_city_name": true,
1900 - "data_src_ip_country_code": true,
1901 - "data_src_ip_geolocation": true,
1902 - "data_src_port": true,
1903 - "data_srcip": true,
1904 - "data_srcip_city_name": true,
1905 - "data_srcip_country_code": true,
1906 - "data_srcip_geolocation": true,
1907 - "data_srcuser": true,
1908 - "data_timestamp": true,
1909 - "data_title": true,
1910 - "data_tls_session_resumed": true,
1911 - "data_tls_version": true,
1912 - "data_tx_id": true,
1913 - "data_type": true,
1914 - "data_win_eventXML_binaryData": true,
1915 - "data_win_eventXML_binaryDataSize": true,
1916 - "data_win_eventXML_param1": true,
1917 - "data_win_eventdata_authenticationPackageName": true,
1918 - "data_win_eventdata_callTrace": true,
1919 - "data_win_eventdata_commandLine": true,
1920 - "data_win_eventdata_company": true,
1921 - "data_win_eventdata_creationUtcTime": true,
1922 - "data_win_eventdata_currentDirectory": true,
1923 - "data_win_eventdata_description": true,
1924 - "data_win_eventdata_destinationHostname": true,
1925 - "data_win_eventdata_destinationIp": true,
1926 - "data_win_eventdata_destinationIp_city_name": true,
1927 - "data_win_eventdata_destinationIp_country_code": true,
1928 - "data_win_eventdata_destinationIp_geolocation": true,
1929 - "data_win_eventdata_destinationIsIpv6": true,
1930 - "data_win_eventdata_destinationPort": true,
1931 - "data_win_eventdata_destinationPortName": true,
1932 - "data_win_eventdata_details": true,
1933 - "data_win_eventdata_elevatedToken": true,
1934 - "data_win_eventdata_eventType": true,
1935 - "data_win_eventdata_fileVersion": true,
1936 - "data_win_eventdata_fileVersion_city_name": true,
1937 - "data_win_eventdata_fileVersion_country_code": true,
1938 - "data_win_eventdata_fileVersion_geolocation": true,
1939 - "data_win_eventdata_grantedAccess": true,
1940 - "data_win_eventdata_hashes": true,
1941 - "data_win_eventdata_image": true,
1942 - "data_win_eventdata_imageLoaded": true,
1943 - "data_win_eventdata_impersonationLevel": true,
1944 - "data_win_eventdata_initiated": true,
1945 - "data_win_eventdata_integrityLevel": true,
1946 - "data_win_eventdata_ipAddress": true,
1947 - "data_win_eventdata_ipPort": true,
1948 - "data_win_eventdata_keyLength": true,
1949 - "data_win_eventdata_logonGuid": true,
1950 - "data_win_eventdata_logonId": true,
1951 - "data_win_eventdata_logonProcessName": true,
1952 - "data_win_eventdata_logonType": true,
1953 - "data_win_eventdata_originalFileName": true,
1954 - "data_win_eventdata_param1": true,
1955 - "data_win_eventdata_param2": true,
1956 - "data_win_eventdata_param3": true,
1957 - "data_win_eventdata_param4": true,
1958 - "data_win_eventdata_parentCommandLine": true,
1959 - "data_win_eventdata_parentImage": true,
1960 - "data_win_eventdata_parentProcessGuid": true,
1961 - "data_win_eventdata_parentProcessId": true,
1962 - "data_win_eventdata_processGuid": true,
1963 - "data_win_eventdata_processId": true,
1964 - "data_win_eventdata_processName": true,
1965 - "data_win_eventdata_product": true,
1966 - "data_win_eventdata_protocol": true,
1967 - "data_win_eventdata_queryName": true,
1968 - "data_win_eventdata_queryResults": true,
1969 - "data_win_eventdata_queryStatus": true,
1970 - "data_win_eventdata_ruleName": true,
1971 - "data_win_eventdata_serviceName": true,
1972 - "data_win_eventdata_serviceSid": true,
1973 - "data_win_eventdata_signature": true,
1974 - "data_win_eventdata_signatureStatus": true,
1975 - "data_win_eventdata_signed": true,
1976 - "data_win_eventdata_sourceHostname": true,
1977 - "data_win_eventdata_sourceImage": true,
1978 - "data_win_eventdata_sourceIp": true,
1979 - "data_win_eventdata_sourceIp_city_name": true,
1980 - "data_win_eventdata_sourceIp_country_code": true,
1981 - "data_win_eventdata_sourceIp_geolocation": true,
1982 - "data_win_eventdata_sourceIsIpv6": true,
1983 - "data_win_eventdata_sourcePort": true,
1984 - "data_win_eventdata_sourceProcessGUID": true,
1985 - "data_win_eventdata_sourceProcessId": true,
1986 - "data_win_eventdata_sourceThreadId": true,
1987 - "data_win_eventdata_status": true,
1988 - "data_win_eventdata_subjectDomainName": true,
1989 - "data_win_eventdata_subjectLogonId": true,
1990 - "data_win_eventdata_subjectUserName": true,
1991 - "data_win_eventdata_subjectUserSid": true,
1992 - "data_win_eventdata_targetDomainName": true,
1993 - "data_win_eventdata_targetFilename": true,
1994 - "data_win_eventdata_targetImage": true,
1995 - "data_win_eventdata_targetLinkedLogonId": true,
1996 - "data_win_eventdata_targetLogonId": true,
1997 - "data_win_eventdata_targetObject": true,
1998 - "data_win_eventdata_targetProcessGUID": true,
1999 - "data_win_eventdata_targetProcessId": true,
2000 - "data_win_eventdata_targetUserName": true,
2001 - "data_win_eventdata_targetUserSid": true,
2002 - "data_win_eventdata_terminalSessionId": true,
2003 - "data_win_eventdata_ticketEncryptionType": true,
2004 - "data_win_eventdata_ticketOptions": true,
2005 - "data_win_eventdata_user": true,
2006 - "data_win_eventdata_utcTime": true,
2007 - "data_win_eventdata_virtualAccount": true,
2008 - "data_win_system_channel": true,
2009 - "data_win_system_computer": true,
2010 - "data_win_system_eventID": true,
2011 - "data_win_system_eventRecordID": true,
2012 - "data_win_system_eventSourceName": true,
2013 - "data_win_system_keywords": true,
2014 - "data_win_system_level": true,
2015 - "data_win_system_message": true,
2016 - "data_win_system_opcode": true,
2017 - "data_win_system_processID": true,
2018 - "data_win_system_providerGuid": true,
2019 - "data_win_system_providerName": true,
2020 - "data_win_system_severityValue": true,
2021 - "data_win_system_systemTime": true,
2022 - "data_win_system_task": true,
2023 - "data_win_system_threadID": true,
2024 - "data_win_system_version": true,
2025 - "decoder_name": true,
2026 - "decoder_parent": true,
2027 - "dns_query": true,
2028 - "dns_query_threat_indicated": true,
2029 - "dst_ip": true,
2030 - "dst_ip_city_name": true,
2031 - "dst_ip_country_code": true,
2032 - "dst_ip_geolocation": true,
2033 - "dst_ip_threat_indicated": true,
2034 - "dst_port": true,
2035 - "ecs_version": true,
2036 - "error": true,
2037 - "event_hash": true,
2038 - "file_path": true,
2039 - "firewall_rule_name": true,
2040 - "full_log": false,
2041 - "gl2_accounted_message_size": true,
2042 - "gl2_message_id": true,
2043 - "gl2_processing_error": true,
2044 - "gl2_remote_ip": true,
2045 - "gl2_remote_port": true,
2046 - "gl2_source_collector": true,
2047 - "gl2_source_input": true,
2048 - "gl2_source_node": true,
2049 - "hash_md5": true,
2050 - "hash_sha1": true,
2051 - "hash_sha256": true,
2052 - "highlight": true,
2053 - "host_architecture": true,
2054 - "host_containerized": true,
2055 - "host_hostname": true,
2056 - "host_id": true,
2057 - "host_ip": true,
2058 - "host_mac": true,
2059 - "host_name": true,
2060 - "host_os_codename": true,
2061 - "host_os_kernel": true,
2062 - "host_os_name": true,
2063 - "host_os_platform": true,
2064 - "host_os_version": true,
2065 - "hostname": true,
2066 - "id": true,
2067 - "input_type": true,
2068 - "level": true,
2069 - "location": true,
2070 - "log_file_path": true,
2071 - "log_offset": true,
2072 - "manager_name": true,
2073 - "message": true,
2074 - "module": true,
2075 - "msg_timestamp": true,
2076 - "parent_process_cmd_line": true,
2077 - "parent_process_id": true,
2078 - "parent_process_image": true,
2079 - "pid": true,
2080 - "predecoder_hostname": true,
2081 - "predecoder_program_name": true,
2082 - "predecoder_timestamp": true,
2083 - "previous_log": true,
2084 - "previous_output": true,
2085 - "process_cmd_line": true,
2086 - "process_id": true,
2087 - "process_image": true,
2088 - "process_name": true,
2089 - "protocol": true,
2090 - "rule_cis": true,
2091 - "rule_cis_csc": true,
2092 - "rule_firedtimes": true,
2093 - "rule_gdpr": true,
2094 - "rule_gdpr_IV": true,
2095 - "rule_gpg13": true,
2096 - "rule_gpg_13": true,
2097 - "rule_group1": true,
2098 - "rule_group2": true,
2099 - "rule_group3": true,
2100 - "rule_groups": true,
2101 - "rule_hipaa": true,
2102 - "rule_id": true,
2103 - "rule_info": true,
2104 - "rule_mail": true,
2105 - "rule_mitre_id": true,
2106 - "rule_mitre_tactic": false,
2107 - "rule_nist_800_53": true,
2108 - "rule_pci_dss": true,
2109 - "rule_tsc": true,
2110 - "scanid": true,
2111 - "service": true,
2112 - "software_package": true,
2113 - "software_vendor": true,
2114 - "sort": true,
2115 - "source": true,
2116 - "source_reserved_ip": true,
2117 - "src_ip": true,
2118 - "src_ip_city_name": true,
2119 - "src_ip_country_code": true,
2120 - "src_ip_geolocation": true,
2121 - "src_port": true,
2122 - "streams": true,
2123 - "syscheck_attrs_after": true,
2124 - "syscheck_audit_effective_user_id": true,
2125 - "syscheck_audit_effective_user_name": true,
2126 - "syscheck_audit_group_id": true,
2127 - "syscheck_audit_group_name": true,
2128 - "syscheck_audit_login_user_id": true,
2129 - "syscheck_audit_login_user_name": true,
2130 - "syscheck_audit_process_cwd": true,
2131 - "syscheck_audit_process_id": true,
2132 - "syscheck_audit_process_name": true,
2133 - "syscheck_audit_process_parent_cwd": true,
2134 - "syscheck_audit_process_parent_name": true,
2135 - "syscheck_audit_process_ppid": true,
2136 - "syscheck_audit_user_id": true,
2137 - "syscheck_audit_user_name": true,
2138 - "syscheck_changed_attributes": true,
2139 - "syscheck_event": true,
2140 - "syscheck_gid_after": true,
2141 - "syscheck_gname_after": true,
2142 - "syscheck_hard_links": true,
2143 - "syscheck_inode_after": true,
2144 - "syscheck_inode_before": true,
2145 - "syscheck_md5_after": true,
2146 - "syscheck_md5_before": true,
2147 - "syscheck_mode": true,
2148 - "syscheck_mtime_after": true,
2149 - "syscheck_mtime_before": true,
2150 - "syscheck_path": true,
2151 - "syscheck_perm_after": true,
2152 - "syscheck_perm_before": true,
2153 - "syscheck_sha1_after": true,
2154 - "syscheck_sha1_before": true,
2155 - "syscheck_sha256_after": true,
2156 - "syscheck_sha256_before": true,
2157 - "syscheck_size_after": true,
2158 - "syscheck_size_before": true,
2159 - "syscheck_uid_after": true,
2160 - "syscheck_uname_after": true,
2161 - "syscheck_win_perm_after": true,
2162 - "syscheck_win_perm_after_0_allowed": true,
2163 - "syscheck_win_perm_after_0_name": true,
2164 - "syscheck_win_perm_after_1_allowed": true,
2165 - "syscheck_win_perm_after_1_name": true,
2166 - "syscheck_win_perm_after_2_allowed": true,
2167 - "syscheck_win_perm_after_2_name": true,
2168 - "syscheck_win_perm_after_3_allowed": true,
2169 - "syscheck_win_perm_after_3_name": true,
2170 - "syslog_customer": true,
2171 - "syslog_level": true,
2172 - "syslog_tag": true,
2173 - "syslog_type": true,
2174 - "sysmon_event_description": true,
2175 - "threat_ids": true,
2176 - "threat_indicated": true,
2177 - "threat_names": true,
2178 - "time": true,
2179 - "timestamp": true,
2180 - "true": true,
2181 - "user_name": true,
2182 - "win_registry_key": true,
2183 - "win_system_eventID": true,
2184 - "windows_auth_package": true,
2185 - "windows_domain": true,
2186 - "windows_event_id": true,
2187 - "windows_event_severity": true,
2188 - "windows_logon_type": true
2189 - },
2190 - "indexByName": {
2191 - "_id": 2,
2192 - "_index": 9,
2193 - "_type": 10,
2194 - "agent_id": 11,
2195 - "agent_name": 5,
2196 - "cluster_name": 12,
2197 - "cluster_node": 13,
2198 - "data_office365_AppAccessContext_APIId": 49,
2199 - "data_office365_AppAccessContext_ClientAppId": 50,
2200 - "data_office365_AppAccessContext_ClientAppName": 51,
2201 - "data_office365_AppAccessContext_CorrelationId": 52,
2202 - "data_office365_ArtifactsShared": 53,
2203 - "data_office365_Attendees": 54,
2204 - "data_office365_ChatName": 55,
2205 - "data_office365_ChatThreadId": 56,
2206 - "data_office365_ClientIP": 4,
2207 - "data_office365_ClientIP_city_name": 14,
2208 - "data_office365_ClientIP_country_code": 15,
2209 - "data_office365_ClientIP_geolocation": 16,
2210 - "data_office365_CommunicationSubType": 57,
2211 - "data_office365_CommunicationType": 58,
2212 - "data_office365_CreationTime": 0,
2213 - "data_office365_DeviceId": 59,
2214 - "data_office365_DeviceInformation": 60,
2215 - "data_office365_EndTime": 61,
2216 - "data_office365_ExchangeId": 62,
2217 - "data_office365_ExtraProperties": 63,
2218 - "data_office365_ICalUid": 64,
2219 - "data_office365_Id": 17,
2220 - "data_office365_ItemName": 65,
2221 - "data_office365_JoinTime": 66,
2222 - "data_office365_LeaveTime": 67,
2223 - "data_office365_MeetingDetailId": 68,
2224 - "data_office365_MeetingURL": 69,
2225 - "data_office365_Members": 70,
2226 - "data_office365_MessageId": 71,
2227 - "data_office365_MessageSizeInBytes": 72,
2228 - "data_office365_MessageURLs": 73,
2229 - "data_office365_MessageVersion": 74,
2230 - "data_office365_Modalities": 75,
2231 - "data_office365_Name": 76,
2232 - "data_office365_NewValue": 77,
2233 - "data_office365_ObjectId": 18,
2234 - "data_office365_Operation": 24,
2235 - "data_office365_OperationScope": 78,
2236 - "data_office365_OrganizationId": 19,
2237 - "data_office365_Organizer_OrganizationId": 79,
2238 - "data_office365_Organizer_RecipientType": 80,
2239 - "data_office365_Organizer_Role": 81,
2240 - "data_office365_Organizer_UserObjectId": 82,
2241 - "data_office365_ProviderTypes": 83,
2242 - "data_office365_RecordType": 20,
2243 - "data_office365_StartTime": 84,
2244 - "data_office365_SubscriptionId": 85,
2245 - "data_office365_TeamGuid": 86,
2246 - "data_office365_UserId": 3,
2247 - "data_office365_UserKey": 21,
2248 - "data_office365_UserType": 22,
2249 - "data_office365_Version": 23,
2250 - "data_office365_Workload": 48,
2251 - "decoder_name": 25,
2252 - "gl2_accounted_message_size": 26,
2253 - "gl2_message_id": 27,
2254 - "gl2_processing_error": 28,
2255 - "gl2_remote_ip": 29,
2256 - "gl2_remote_port": 30,
2257 - "gl2_source_input": 31,
2258 - "gl2_source_node": 32,
2259 - "highlight": 33,
2260 - "id": 34,
2261 - "location": 35,
2262 - "manager_name": 36,
2263 - "message": 37,
2264 - "rule_description": 6,
2265 - "rule_firedtimes": 38,
2266 - "rule_group1": 39,
2267 - "rule_groups": 40,
2268 - "rule_id": 8,
2269 - "rule_level": 7,
2270 - "rule_mail": 41,
2271 - "sort": 42,
2272 - "source": 43,
2273 - "streams": 44,
2274 - "syslog_level": 45,
2275 - "syslog_type": 46,
2276 - "timestamp": 1,
2277 - "true": 47
2278 - },
2279 - "renameByName": {
2280 - "_id": "EVENT ID",
2281 - "agent_name": "",
2282 - "data_office365_ActorIpAddress": "SRC IP",
2283 - "data_office365_AffectedItems": "ITEMS",
2284 - "data_office365_BrowserName": "BROWSER",
2285 - "data_office365_ClientIP": "CLIENT IP",
2286 - "data_office365_ClientIP_city_name": "",
2287 - "data_office365_CreationTime": "EVENT TIME",
2288 - "data_office365_Item_Attachments": "ATTACHMENT",
2289 - "data_office365_Item_ParentFolder_Path": "FOLDER",
2290 - "data_office365_Item_Subject": "SUBJECT",
2291 - "data_office365_ResultStatus": "RESULT",
2292 - "data_office365_SourceFileName": "FILE",
2293 - "data_office365_UserId": "ACCOUNT",
2294 - "rule_description": "DESCRIPTION",
2295 - "rule_id": "RULE ID",
2296 - "rule_level": "",
2297 - "rule_mitre_tactic": "MITRE TACTIC",
2298 - "rule_mitre_technique": "MITRE TECHNIQUE",
2299 - "timestamp": "Date/Time"
2300 - }
2301 - }
2302 - }
2303 - ],
2304 - "transparent": true,
2305 - "type": "table"
2306 - }
2307 - ],
2308 - "refresh": "",
2309 - "schemaVersion": 38,
2310 - "style": "dark",
2311 - "tags": [
2312 - "O365"
2313 - ],
2314 - "templating": {
2315 - "list": [
2316 - {
2317 - "datasource": {
2318 - "type": "elasticsearch",
2319 - "uid": "replace_datasource_uid"
2320 - },
2321 - "filters": [],
2322 - "hide": 0,
2323 - "label": "",
2324 - "name": "Filters",
2325 - "skipUrlSync": false,
2326 - "type": "adhoc"
2327 - },
2328 - {
2329 - "current": {
2330 - "selected": false,
2331 - "text": "All",
2332 - "value": "$__all"
2333 - },
2334 - "datasource": {
2335 - "type": "elasticsearch",
2336 - "uid": "replace_datasource_uid"
2337 - },
2338 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SharePoint\"}",
2339 - "hide": 0,
2340 - "includeAll": true,
2341 - "label": "Operation",
2342 - "multi": false,
2343 - "name": "operation",
2344 - "options": [],
2345 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SharePoint\"}",
2346 - "refresh": 2,
2347 - "regex": "",
2348 - "skipUrlSync": false,
2349 - "sort": 1,
2350 - "tagValuesQuery": "",
2351 - "tagsQuery": "",
2352 - "type": "query",
2353 - "useTags": false
2354 - },
2355 - {
2356 - "current": {
2357 - "selected": false,
2358 - "text": "All",
2359 - "value": "$__all"
2360 - },
2361 - "datasource": {
2362 - "type": "elasticsearch",
2363 - "uid": "replace_datasource_uid"
2364 - },
2365 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:SharePoint\"}",
2366 - "hide": 0,
2367 - "includeAll": true,
2368 - "label": "Rule Level",
2369 - "multi": false,
2370 - "name": "rule_level",
2371 - "options": [],
2372 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:SharePoint\"}",
2373 - "refresh": 2,
2374 - "regex": "",
2375 - "skipUrlSync": false,
2376 - "sort": 0,
2377 - "type": "query"
2378 - }
2379 - ]
2380 - },
2381 - "time": {
2382 - "from": "now-6h",
2383 - "to": "now"
2384 - },
2385 - "timepicker": {
2386 - "refresh_intervals": [
2387 - "5s",
2388 - "10s",
2389 - "30s",
2390 - "1m",
2391 - "5m",
2392 - "15m",
2393 - "30m",
2394 - "1h",
2395 - "2h",
2396 - "1d"
2397 - ],
2398 - "time_options": [
2399 - "5m",
2400 - "15m",
2401 - "1h",
2402 - "6h",
2403 - "12h",
2404 - "24h",
2405 - "2d",
2406 - "7d",
2407 - "30d"
2408 - ]
2409 - },
2410 - "timezone": "",
2411 - "title": "O365 - SHAREPOINT",
2412 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "10.0.3",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation AND data_office365_Workload:SharePoint",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "cellOptions": {
255 + "type": "auto"
256 + },
257 + "inspect": false
258 + },
259 + "mappings": [],
260 + "thresholds": {
261 + "mode": "absolute",
262 + "steps": [
263 + {
264 + "color": "red",
265 + "value": null
266 + }
267 + ]
268 + }
269 + },
270 + "overrides": [
271 + {
272 + "matcher": {
273 + "id": "byName",
274 + "options": "Count"
275 + },
276 + "properties": [
277 + {
278 + "id": "displayName",
279 + "value": "EVENTS"
280 + },
281 + {
282 + "id": "unit",
283 + "value": "short"
284 + },
285 + {
286 + "id": "decimals",
287 + "value": -1
288 + },
289 + {
290 + "id": "custom.align"
291 + },
292 + {
293 + "id": "thresholds",
294 + "value": {
295 + "mode": "absolute",
296 + "steps": [
297 + {
298 + "color": "red",
299 + "value": null
300 + }
301 + ]
302 + }
303 + }
304 + ]
305 + }
306 + ]
307 + },
308 + "gridPos": {
309 + "h": 7,
310 + "w": 6,
311 + "x": 8,
312 + "y": 0
313 + },
314 + "id": 54,
315 + "options": {
316 + "cellHeight": "sm",
317 + "footer": {
318 + "countRows": false,
319 + "fields": "",
320 + "reducer": ["sum"],
321 + "show": false
322 + },
323 + "showHeader": true
324 + },
325 + "pluginVersion": "10.0.3",
326 + "targets": [
327 + {
328 + "bucketAggs": [
329 + {
330 + "fake": true,
331 + "field": "data_office365_Operation",
332 + "id": "4",
333 + "settings": {
334 + "min_doc_count": 1,
335 + "order": "desc",
336 + "orderBy": "_count",
337 + "size": "0"
338 + },
339 + "type": "terms"
340 + }
341 + ],
342 + "datasource": {
343 + "type": "elasticsearch",
344 + "uid": "replace_datasource_uid"
345 + },
346 + "metrics": [
347 + {
348 + "field": "select field",
349 + "id": "1",
350 + "type": "count"
351 + }
352 + ],
353 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
354 + "refId": "A",
355 + "timeField": "timestamp"
356 + }
357 + ],
358 + "title": "EVENTS BY OPERATION",
359 + "transformations": [
360 + {
361 + "id": "merge",
362 + "options": {
363 + "reducers": []
364 + }
365 + },
366 + {
367 + "id": "organize",
368 + "options": {
369 + "excludeByName": {},
370 + "indexByName": {},
371 + "renameByName": {
372 + "Count": "EVENTS",
373 + "data_office365_Operation": "OPERATION"
374 + }
375 + }
376 + }
377 + ],
378 + "type": "table"
379 + },
380 + {
381 + "datasource": {
382 + "type": "elasticsearch",
383 + "uid": "replace_datasource_uid"
384 + },
385 + "fieldConfig": {
386 + "defaults": {
387 + "color": {
388 + "mode": "thresholds"
389 + },
390 + "custom": {
391 + "align": "auto",
392 + "cellOptions": {
393 + "type": "auto"
394 + },
395 + "inspect": false
396 + },
397 + "mappings": [],
398 + "thresholds": {
399 + "mode": "absolute",
400 + "steps": [
401 + {
402 + "color": "red",
403 + "value": null
404 + }
405 + ]
406 + }
407 + },
408 + "overrides": [
409 + {
410 + "matcher": {
411 + "id": "byName",
412 + "options": "Count"
413 + },
414 + "properties": [
415 + {
416 + "id": "displayName",
417 + "value": "EVENTS"
418 + },
419 + {
420 + "id": "unit",
421 + "value": "short"
422 + },
423 + {
424 + "id": "decimals",
425 + "value": -1
426 + },
427 + {
428 + "id": "custom.align"
429 + },
430 + {
431 + "id": "thresholds",
432 + "value": {
433 + "mode": "absolute",
434 + "steps": [
435 + {
436 + "color": "red",
437 + "value": null
438 + }
439 + ]
440 + }
441 + }
442 + ]
443 + }
444 + ]
445 + },
446 + "gridPos": {
447 + "h": 7,
448 + "w": 6,
449 + "x": 14,
450 + "y": 0
451 + },
452 + "id": 62,
453 + "options": {
454 + "cellHeight": "sm",
455 + "footer": {
456 + "countRows": false,
457 + "fields": "",
458 + "reducer": ["sum"],
459 + "show": false
460 + },
461 + "showHeader": true
462 + },
463 + "pluginVersion": "10.0.3",
464 + "targets": [
465 + {
466 + "bucketAggs": [
467 + {
468 + "fake": true,
469 + "field": "data_office365_UserAgent",
470 + "id": "4",
471 + "settings": {
472 + "min_doc_count": 1,
473 + "order": "desc",
474 + "orderBy": "_count",
475 + "size": "0"
476 + },
477 + "type": "terms"
478 + }
479 + ],
480 + "datasource": {
481 + "type": "elasticsearch",
482 + "uid": "replace_datasource_uid"
483 + },
484 + "metrics": [
485 + {
486 + "field": "select field",
487 + "id": "1",
488 + "type": "count"
489 + }
490 + ],
491 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
492 + "refId": "A",
493 + "timeField": "timestamp"
494 + }
495 + ],
496 + "title": "EVENTS BY USER AGENT",
497 + "transformations": [
498 + {
499 + "id": "merge",
500 + "options": {
501 + "reducers": []
502 + }
503 + },
504 + {
505 + "id": "organize",
506 + "options": {
507 + "excludeByName": {},
508 + "indexByName": {},
509 + "renameByName": {
510 + "Count": "EVENTS",
511 + "data_office365_Operation": "OPERATION",
512 + "data_office365_UserAgent": "USER AGENT"
513 + }
514 + }
515 + }
516 + ],
517 + "type": "table"
518 + },
519 + {
520 + "datasource": {
521 + "type": "elasticsearch",
522 + "uid": "replace_datasource_uid"
523 + },
524 + "fieldConfig": {
525 + "defaults": {
526 + "color": {
527 + "mode": "thresholds"
528 + },
529 + "mappings": [
530 + {
531 + "options": {
532 + "match": "null",
533 + "result": {
534 + "text": "N/A"
535 + }
536 + },
537 + "type": "special"
538 + }
539 + ],
540 + "max": 15,
541 + "min": 0,
542 + "thresholds": {
543 + "mode": "absolute",
544 + "steps": [
545 + {
546 + "color": "#299c46",
547 + "value": null
548 + },
549 + {
550 + "color": "rgba(237, 129, 40, 0.89)",
551 + "value": 8
552 + },
553 + {
554 + "color": "#d44a3a",
555 + "value": 12
556 + }
557 + ]
558 + },
559 + "unit": "none"
560 + },
561 + "overrides": []
562 + },
563 + "gridPos": {
564 + "h": 7,
565 + "w": 4,
566 + "x": 0,
567 + "y": 7
568 + },
569 + "id": 16,
570 + "links": [],
571 + "options": {
572 + "orientation": "horizontal",
573 + "reduceOptions": {
574 + "calcs": ["max"],
575 + "fields": "",
576 + "values": false
577 + },
578 + "showThresholdLabels": false,
579 + "showThresholdMarkers": true,
580 + "text": {}
581 + },
582 + "pluginVersion": "10.0.3",
583 + "targets": [
584 + {
585 + "bucketAggs": [
586 + {
587 + "field": "timestamp",
588 + "id": "2",
589 + "settings": {
590 + "interval": "auto",
591 + "min_doc_count": 0,
592 + "trimEdges": 0
593 + },
594 + "type": "date_histogram"
595 + }
596 + ],
597 + "datasource": {
598 + "type": "elasticsearch",
599 + "uid": "replace_datasource_uid"
600 + },
601 + "metrics": [
602 + {
603 + "field": "rule_level",
604 + "id": "1",
605 + "meta": {},
606 + "settings": {},
607 + "type": "max"
608 + }
609 + ],
610 + "query": "data_office365_Operation:$operation AND data_office365_Workload:SharePoint",
611 + "refId": "A",
612 + "timeField": "timestamp"
613 + }
614 + ],
615 + "title": "MAX SEVERITY (0 - 15)",
616 + "type": "gauge"
617 + },
618 + {
619 + "datasource": {
620 + "type": "elasticsearch",
621 + "uid": "replace_datasource_uid"
622 + },
623 + "fieldConfig": {
624 + "defaults": {
625 + "color": {
626 + "mode": "palette-classic"
627 + },
628 + "custom": {
629 + "axisCenteredZero": false,
630 + "axisColorMode": "text",
631 + "axisLabel": "",
632 + "axisPlacement": "auto",
633 + "barAlignment": 0,
634 + "drawStyle": "bars",
635 + "fillOpacity": 0,
636 + "gradientMode": "none",
637 + "hideFrom": {
638 + "legend": false,
639 + "tooltip": false,
640 + "viz": false
641 + },
642 + "lineInterpolation": "linear",
643 + "lineWidth": 1,
644 + "pointSize": 5,
645 + "scaleDistribution": {
646 + "type": "linear"
647 + },
648 + "showPoints": "auto",
649 + "spanNulls": false,
650 + "stacking": {
651 + "group": "A",
652 + "mode": "normal"
653 + },
654 + "thresholdsStyle": {
655 + "mode": "off"
656 + }
657 + },
658 + "mappings": [],
659 + "thresholds": {
660 + "mode": "absolute",
661 + "steps": [
662 + {
663 + "color": "green",
664 + "value": null
665 + },
666 + {
667 + "color": "red",
668 + "value": 80
669 + }
670 + ]
671 + }
672 + },
673 + "overrides": []
674 + },
675 + "gridPos": {
676 + "h": 13,
677 + "w": 20,
678 + "x": 4,
679 + "y": 7
680 + },
681 + "id": 60,
682 + "options": {
683 + "legend": {
684 + "calcs": [],
685 + "displayMode": "table",
686 + "placement": "right",
687 + "showLegend": true
688 + },
689 + "tooltip": {
690 + "mode": "single",
691 + "sort": "none"
692 + }
693 + },
694 + "targets": [
695 + {
696 + "alias": "",
697 + "bucketAggs": [
698 + {
699 + "field": "data_office365_Operation",
700 + "id": "3",
701 + "settings": {
702 + "min_doc_count": "1",
703 + "order": "desc",
704 + "orderBy": "_count",
705 + "size": "10"
706 + },
707 + "type": "terms"
708 + },
709 + {
710 + "field": "timestamp",
711 + "id": "2",
712 + "settings": {
713 + "interval": "auto"
714 + },
715 + "type": "date_histogram"
716 + }
717 + ],
718 + "datasource": {
719 + "type": "elasticsearch",
720 + "uid": "replace_datasource_uid"
721 + },
722 + "metrics": [
723 + {
724 + "id": "1",
725 + "type": "count"
726 + }
727 + ],
728 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
729 + "refId": "A",
730 + "timeField": "timestamp"
731 + }
732 + ],
733 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
734 + "transparent": true,
735 + "type": "timeseries"
736 + },
737 + {
738 + "datasource": {
739 + "type": "elasticsearch",
740 + "uid": "replace_datasource_uid"
741 + },
742 + "fieldConfig": {
743 + "defaults": {
744 + "mappings": [
745 + {
746 + "options": {
747 + "match": "null",
748 + "result": {
749 + "text": "N/A"
750 + }
751 + },
752 + "type": "special"
753 + }
754 + ],
755 + "thresholds": {
756 + "mode": "absolute",
757 + "steps": [
758 + {
759 + "color": "blue",
760 + "value": null
761 + }
762 + ]
763 + },
764 + "unit": "locale"
765 + },
766 + "overrides": []
767 + },
768 + "gridPos": {
769 + "h": 6,
770 + "w": 4,
771 + "x": 0,
772 + "y": 14
773 + },
774 + "id": 51,
775 + "links": [],
776 + "options": {
777 + "colorMode": "value",
778 + "graphMode": "area",
779 + "justifyMode": "auto",
780 + "orientation": "horizontal",
781 + "reduceOptions": {
782 + "calcs": ["sum"],
783 + "fields": "",
784 + "values": false
785 + },
786 + "text": {},
787 + "textMode": "auto"
788 + },
789 + "pluginVersion": "10.0.3",
790 + "targets": [
791 + {
792 + "bucketAggs": [
793 + {
794 + "$$hashKey": "object:331",
795 + "field": "timestamp",
796 + "id": "2",
797 + "settings": {
798 + "interval": "auto",
799 + "min_doc_count": 0,
800 + "trimEdges": 0
801 + },
802 + "type": "date_histogram"
803 + }
804 + ],
805 + "datasource": {
806 + "type": "elasticsearch",
807 + "uid": "replace_datasource_uid"
808 + },
809 + "metrics": [
810 + {
811 + "$$hashKey": "object:329",
812 + "field": "select field",
813 + "id": "1",
814 + "type": "count"
815 + }
816 + ],
817 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
818 + "refId": "A",
819 + "timeField": "timestamp"
820 + }
821 + ],
822 + "title": "EVENTS (Total)",
823 + "type": "stat"
824 + },
825 + {
826 + "datasource": {
827 + "type": "elasticsearch",
828 + "uid": "replace_datasource_uid"
829 + },
830 + "fieldConfig": {
831 + "defaults": {
832 + "color": {
833 + "mode": "thresholds"
834 + },
835 + "custom": {
836 + "align": "auto",
837 + "cellOptions": {
838 + "type": "auto"
839 + },
840 + "inspect": false
841 + },
842 + "mappings": [],
843 + "thresholds": {
844 + "mode": "absolute",
845 + "steps": [
846 + {
847 + "color": "orange",
848 + "value": null
849 + }
850 + ]
851 + }
852 + },
853 + "overrides": [
854 + {
855 + "matcher": {
856 + "id": "byName",
857 + "options": "Count"
858 + },
859 + "properties": [
860 + {
861 + "id": "displayName",
862 + "value": "EVENTS"
863 + },
864 + {
865 + "id": "unit",
866 + "value": "short"
867 + },
868 + {
869 + "id": "decimals",
870 + "value": -1
871 + },
872 + {
873 + "id": "custom.align"
874 + }
875 + ]
876 + },
877 + {
878 + "matcher": {
879 + "id": "byName",
880 + "options": "AD ACCOUNT"
881 + },
882 + "properties": [
883 + {
884 + "id": "custom.width",
885 + "value": 377
886 + }
887 + ]
888 + }
889 + ]
890 + },
891 + "gridPos": {
892 + "h": 12,
893 + "w": 8,
894 + "x": 0,
895 + "y": 20
896 + },
897 + "id": 61,
898 + "options": {
899 + "cellHeight": "sm",
900 + "footer": {
901 + "countRows": false,
902 + "fields": "",
903 + "reducer": ["sum"],
904 + "show": false
905 + },
906 + "showHeader": true,
907 + "sortBy": []
908 + },
909 + "pluginVersion": "10.0.3",
910 + "targets": [
911 + {
912 + "bucketAggs": [
913 + {
914 + "fake": true,
915 + "field": "data_office365_AuthenticationType",
916 + "id": "4",
917 + "settings": {
918 + "min_doc_count": 1,
919 + "order": "desc",
920 + "orderBy": "_count",
921 + "size": "0"
922 + },
923 + "type": "terms"
924 + },
925 + {
926 + "field": "data_office365_ClientIP_country_code",
927 + "id": "5",
928 + "settings": {
929 + "min_doc_count": "1",
930 + "order": "desc",
931 + "orderBy": "_term",
932 + "size": "10"
933 + },
934 + "type": "terms"
935 + }
936 + ],
937 + "datasource": {
938 + "type": "elasticsearch",
939 + "uid": "replace_datasource_uid"
940 + },
941 + "metrics": [
942 + {
943 + "field": "select field",
944 + "id": "1",
945 + "type": "count"
946 + }
947 + ],
948 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
949 + "refId": "A",
950 + "timeField": "timestamp"
951 + }
952 + ],
953 + "title": "SHAREPOINT EVENTS BY AUTH TYPE",
954 + "transformations": [
955 + {
956 + "id": "merge",
957 + "options": {
958 + "reducers": []
959 + }
960 + },
961 + {
962 + "id": "organize",
963 + "options": {
964 + "excludeByName": {},
965 + "indexByName": {},
966 + "renameByName": {
967 + "Count": "EVENTS",
968 + "data_office365_AuthenticationType": "AUTH TYPE",
969 + "data_office365_ClientIP_country_code": "COUNTRY",
970 + "data_office365_LogonError": "ERROR",
971 + "data_office365_Operation": "WORKLOAD",
972 + "data_office365_UserId": "AD ACCOUNT"
973 + }
974 + }
975 + }
976 + ],
977 + "type": "table"
978 + },
979 + {
980 + "circleMaxSize": 30,
981 + "circleMinSize": 2,
982 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
983 + "datasource": {
984 + "type": "elasticsearch",
985 + "uid": "replace_datasource_uid"
986 + },
987 + "decimals": 0,
988 + "esMetric": "Count",
989 + "gridPos": {
990 + "h": 12,
991 + "w": 8,
992 + "x": 8,
993 + "y": 20
994 + },
995 + "hideEmpty": false,
996 + "hideZero": false,
997 + "id": 50,
998 + "initialZoom": 1,
999 + "locationData": "countries",
1000 + "mapCenter": "(0°, 0°)",
1001 + "mapCenterLatitude": 0,
1002 + "mapCenterLongitude": 0,
1003 + "maxDataPoints": 1,
1004 + "mouseWheelZoom": false,
1005 + "showLegend": true,
1006 + "stickyLabels": false,
1007 + "tableQueryOptions": {
1008 + "geohashField": "geohash",
1009 + "latitudeField": "latitude",
1010 + "longitudeField": "longitude",
1011 + "metricField": "metric",
1012 + "queryType": "geohash"
1013 + },
1014 + "targets": [
1015 + {
1016 + "bucketAggs": [
1017 + {
1018 + "fake": true,
1019 + "field": "data_office365_ClientIP_country_code",
1020 + "id": "3",
1021 + "settings": {
1022 + "min_doc_count": 1,
1023 + "order": "desc",
1024 + "orderBy": "_term",
1025 + "size": "0"
1026 + },
1027 + "type": "terms"
1028 + },
1029 + {
1030 + "field": "timestamp",
1031 + "id": "2",
1032 + "settings": {
1033 + "interval": "auto",
1034 + "min_doc_count": 0,
1035 + "trimEdges": 0
1036 + },
1037 + "type": "date_histogram"
1038 + }
1039 + ],
1040 + "datasource": {
1041 + "type": "elasticsearch",
1042 + "uid": "replace_datasource_uid"
1043 + },
1044 + "metrics": [
1045 + {
1046 + "field": "select field",
1047 + "id": "1",
1048 + "type": "count"
1049 + }
1050 + ],
1051 + "query": "data_office365_Workload:SharePoint AND rule_level:$rule_level",
1052 + "refId": "A",
1053 + "timeField": "timestamp"
1054 + }
1055 + ],
1056 + "thresholds": "0,10",
1057 + "title": "SHAREPOINT - ALL EVENTS BY SRC COUNTRY",
1058 + "type": "grafana-worldmap-panel",
1059 + "unitPlural": "",
1060 + "unitSingle": "",
1061 + "valueName": "total"
1062 + },
1063 + {
1064 + "datasource": {
1065 + "type": "elasticsearch",
1066 + "uid": "replace_datasource_uid"
1067 + },
1068 + "fieldConfig": {
1069 + "defaults": {
1070 + "color": {
1071 + "mode": "thresholds"
1072 + },
1073 + "custom": {
1074 + "align": "auto",
1075 + "cellOptions": {
1076 + "type": "auto"
1077 + },
1078 + "inspect": false
1079 + },
1080 + "mappings": [],
1081 + "thresholds": {
1082 + "mode": "absolute",
1083 + "steps": [
1084 + {
1085 + "color": "orange",
1086 + "value": null
1087 + }
1088 + ]
1089 + }
1090 + },
1091 + "overrides": [
1092 + {
1093 + "matcher": {
1094 + "id": "byName",
1095 + "options": "Count"
1096 + },
1097 + "properties": [
1098 + {
1099 + "id": "displayName",
1100 + "value": "EVENTS"
1101 + },
1102 + {
1103 + "id": "unit",
1104 + "value": "short"
1105 + },
1106 + {
1107 + "id": "decimals",
1108 + "value": -1
1109 + },
1110 + {
1111 + "id": "custom.align"
1112 + }
1113 + ]
1114 + },
1115 + {
1116 + "matcher": {
1117 + "id": "byName",
1118 + "options": "AD ACCOUNT"
1119 + },
1120 + "properties": [
1121 + {
1122 + "id": "custom.width",
1123 + "value": 377
1124 + }
1125 + ]
1126 + }
1127 + ]
1128 + },
1129 + "gridPos": {
1130 + "h": 12,
1131 + "w": 8,
1132 + "x": 16,
1133 + "y": 20
1134 + },
1135 + "id": 58,
1136 + "options": {
1137 + "cellHeight": "sm",
1138 + "footer": {
1139 + "countRows": false,
1140 + "fields": "",
1141 + "reducer": ["sum"],
1142 + "show": false
1143 + },
1144 + "showHeader": true,
1145 + "sortBy": []
1146 + },
1147 + "pluginVersion": "10.0.3",
1148 + "targets": [
1149 + {
1150 + "bucketAggs": [
1151 + {
1152 + "fake": true,
1153 + "field": "data_office365_UserId",
1154 + "id": "4",
1155 + "settings": {
1156 + "min_doc_count": 1,
1157 + "order": "desc",
1158 + "orderBy": "_count",
1159 + "size": "0"
1160 + },
1161 + "type": "terms"
1162 + },
1163 + {
1164 + "field": "data_office365_ClientIP_country_code",
1165 + "id": "5",
1166 + "settings": {
1167 + "min_doc_count": "1",
1168 + "order": "desc",
1169 + "orderBy": "_term",
1170 + "size": "10"
1171 + },
1172 + "type": "terms"
1173 + }
1174 + ],
1175 + "datasource": {
1176 + "type": "elasticsearch",
1177 + "uid": "replace_datasource_uid"
1178 + },
1179 + "metrics": [
1180 + {
1181 + "field": "select field",
1182 + "id": "1",
1183 + "type": "count"
1184 + }
1185 + ],
1186 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
1187 + "refId": "A",
1188 + "timeField": "timestamp"
1189 + }
1190 + ],
1191 + "title": "SHAREPOINT EVENTS BY ACCOUNT",
1192 + "transformations": [
1193 + {
1194 + "id": "merge",
1195 + "options": {
1196 + "reducers": []
1197 + }
1198 + },
1199 + {
1200 + "id": "organize",
1201 + "options": {
1202 + "excludeByName": {},
1203 + "indexByName": {},
1204 + "renameByName": {
1205 + "Count": "EVENTS",
1206 + "data_office365_ClientIP_country_code": "COUNTRY",
1207 + "data_office365_LogonError": "ERROR",
1208 + "data_office365_Operation": "WORKLOAD",
1209 + "data_office365_UserId": "AD ACCOUNT"
1210 + }
1211 + }
1212 + }
1213 + ],
1214 + "type": "table"
1215 + },
1216 + {
1217 + "datasource": {
1218 + "type": "elasticsearch",
1219 + "uid": "replace_datasource_uid"
1220 + },
1221 + "fieldConfig": {
1222 + "defaults": {
1223 + "color": {
1224 + "mode": "thresholds"
1225 + },
1226 + "custom": {
1227 + "align": "auto",
1228 + "cellOptions": {
1229 + "type": "auto"
1230 + },
1231 + "filterable": true,
1232 + "inspect": false
1233 + },
1234 + "mappings": [],
1235 + "thresholds": {
1236 + "mode": "absolute",
1237 + "steps": [
1238 + {
1239 + "color": "green",
1240 + "value": null
1241 + },
1242 + {
1243 + "color": "red",
1244 + "value": 80
1245 + }
1246 + ]
1247 + }
1248 + },
1249 + "overrides": [
1250 + {
1251 + "matcher": {
1252 + "id": "byName",
1253 + "options": "rule_level"
1254 + },
1255 + "properties": [
1256 + {
1257 + "id": "displayName",
1258 + "value": "RULE LEVEL"
1259 + },
1260 + {
1261 + "id": "unit",
1262 + "value": "short"
1263 + },
1264 + {
1265 + "id": "decimals",
1266 + "value": -1
1267 + },
1268 + {
1269 + "id": "custom.cellOptions",
1270 + "value": {
1271 + "mode": "gradient",
1272 + "type": "color-background"
1273 + }
1274 + },
1275 + {
1276 + "id": "custom.align"
1277 + },
1278 + {
1279 + "id": "thresholds",
1280 + "value": {
1281 + "mode": "absolute",
1282 + "steps": [
1283 + {
1284 + "color": "#37872D",
1285 + "value": null
1286 + },
1287 + {
1288 + "color": "rgba(237, 129, 40, 0.89)",
1289 + "value": 7
1290 + },
1291 + {
1292 + "color": "rgba(245, 54, 54, 0.9)",
1293 + "value": 12
1294 + }
1295 + ]
1296 + }
1297 + }
1298 + ]
1299 + },
1300 + {
1301 + "matcher": {
1302 + "id": "byName",
1303 + "options": "Date/Time"
1304 + },
1305 + "properties": [
1306 + {
1307 + "id": "custom.width",
1308 + "value": 242
1309 + }
1310 + ]
1311 + },
1312 + {
1313 + "matcher": {
1314 + "id": "byName",
1315 + "options": "MITRE TACTIC"
1316 + },
1317 + "properties": [
1318 + {
1319 + "id": "custom.width",
1320 + "value": 332
1321 + }
1322 + ]
1323 + },
1324 + {
1325 + "matcher": {
1326 + "id": "byName",
1327 + "options": "IP ADDRESS"
1328 + },
1329 + "properties": [
1330 + {
1331 + "id": "custom.width",
1332 + "value": 163
1333 + }
1334 + ]
1335 + },
1336 + {
1337 + "matcher": {
1338 + "id": "byName",
1339 + "options": "MITRE TECHNIQUE"
1340 + },
1341 + "properties": [
1342 + {
1343 + "id": "custom.width",
1344 + "value": 312
1345 + }
1346 + ]
1347 + },
1348 + {
1349 + "matcher": {
1350 + "id": "byName",
1351 + "options": "EVENT ID"
1352 + },
1353 + "properties": [
1354 + {
1355 + "id": "links",
1356 + "value": [
1357 + {
1358 + "targetBlank": true,
1359 + "title": "VIEW EVENT DETAILS",
1360 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1361 + }
1362 + ]
1363 + },
1364 + {
1365 + "id": "custom.width",
1366 + "value": 265
1367 + }
1368 + ]
1369 + },
1370 + {
1371 + "matcher": {
1372 + "id": "byName",
1373 + "options": "RESULT"
1374 + },
1375 + "properties": [
1376 + {
1377 + "id": "custom.width",
1378 + "value": 118
1379 + },
1380 + {
1381 + "id": "mappings",
1382 + "value": [
1383 + {
1384 + "options": {
1385 + "Failed": {
1386 + "color": "orange",
1387 + "index": 1
1388 + },
1389 + "Success": {
1390 + "color": "green",
1391 + "index": 0
1392 + }
1393 + },
1394 + "type": "value"
1395 + }
1396 + ]
1397 + },
1398 + {
1399 + "id": "custom.cellOptions",
1400 + "value": {
1401 + "type": "color-text"
1402 + }
1403 + }
1404 + ]
1405 + },
1406 + {
1407 + "matcher": {
1408 + "id": "byName",
1409 + "options": "SRC IP"
1410 + },
1411 + "properties": [
1412 + {
1413 + "id": "custom.width",
1414 + "value": 265
1415 + }
1416 + ]
1417 + },
1418 + {
1419 + "matcher": {
1420 + "id": "byName",
1421 + "options": "ACCOUNT"
1422 + },
1423 + "properties": [
1424 + {
1425 + "id": "custom.width",
1426 + "value": 227
1427 + }
1428 + ]
1429 + },
1430 + {
1431 + "matcher": {
1432 + "id": "byName",
1433 + "options": "EVENT TIME"
1434 + },
1435 + "properties": [
1436 + {
1437 + "id": "custom.width",
1438 + "value": 195
1439 + }
1440 + ]
1441 + },
1442 + {
1443 + "matcher": {
1444 + "id": "byName",
1445 + "options": "CLIENT IP"
1446 + },
1447 + "properties": [
1448 + {
1449 + "id": "custom.width",
1450 + "value": 191
1451 + }
1452 + ]
1453 + },
1454 + {
1455 + "matcher": {
1456 + "id": "byName",
1457 + "options": "DESCRIPTION"
1458 + },
1459 + "properties": [
1460 + {
1461 + "id": "custom.width",
1462 + "value": 367
1463 + }
1464 + ]
1465 + },
1466 + {
1467 + "matcher": {
1468 + "id": "byName",
1469 + "options": "FILE"
1470 + },
1471 + "properties": [
1472 + {
1473 + "id": "custom.width",
1474 + "value": 855
1475 + }
1476 + ]
1477 + },
1478 + {
1479 + "matcher": {
1480 + "id": "byName",
1481 + "options": "BROWSER"
1482 + },
1483 + "properties": [
1484 + {
1485 + "id": "custom.width",
1486 + "value": 205
1487 + }
1488 + ]
1489 + },
1490 + {
1491 + "matcher": {
1492 + "id": "byName",
1493 + "options": "RULE LEVEL"
1494 + },
1495 + "properties": [
1496 + {
1497 + "id": "custom.width",
1498 + "value": 197
1499 + }
1500 + ]
1501 + }
1502 + ]
1503 + },
1504 + "gridPos": {
1505 + "h": 16,
1506 + "w": 24,
1507 + "x": 0,
1508 + "y": 32
1509 + },
1510 + "id": 27,
1511 + "options": {
1512 + "cellHeight": "sm",
1513 + "footer": {
1514 + "countRows": false,
1515 + "enablePagination": true,
1516 + "fields": "",
1517 + "reducer": ["sum"],
1518 + "show": false
1519 + },
1520 + "showHeader": true,
1521 + "sortBy": []
1522 + },
1523 + "pluginVersion": "10.0.3",
1524 + "targets": [
1525 + {
1526 + "bucketAggs": [],
1527 + "datasource": {
1528 + "type": "elasticsearch",
1529 + "uid": "replace_datasource_uid"
1530 + },
1531 + "metrics": [
1532 + {
1533 + "id": "1",
1534 + "settings": {
1535 + "size": "250"
1536 + },
1537 + "type": "raw_data"
1538 + }
1539 + ],
1540 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level AND data_office365_Workload:SharePoint",
1541 + "refId": "A",
1542 + "timeField": "timestamp"
1543 + }
1544 + ],
1545 + "title": "EVENTS",
1546 + "transformations": [
1547 + {
1548 + "id": "organize",
1549 + "options": {
1550 + "excludeByName": {
1551 + "@metadata_beat": true,
1552 + "@metadata_type": true,
1553 + "@metadata_version": true,
1554 + "IMPHASH": true,
1555 + "MD5": true,
1556 + "SHA1": true,
1557 + "SHA256": true,
1558 + "_id": false,
1559 + "_index": true,
1560 + "_type": true,
1561 + "agent_ephemeral_id": true,
1562 + "agent_hostname": true,
1563 + "agent_id": true,
1564 + "agent_ip_city_name": true,
1565 + "agent_ip_country_code": true,
1566 + "agent_ip_geolocation": true,
1567 + "agent_name": true,
1568 + "agent_type": true,
1569 + "agent_version": true,
1570 + "beats_type": true,
1571 + "cluster_name": true,
1572 + "cluster_node": true,
1573 + "collector_node_id": true,
1574 + "data_alert_action": true,
1575 + "data_alert_category": true,
1576 + "data_alert_gid": true,
1577 + "data_alert_rev": true,
1578 + "data_alert_severity": true,
1579 + "data_alert_signature": true,
1580 + "data_alert_signature_id": true,
1581 + "data_app_proto": true,
1582 + "data_audit_auid": true,
1583 + "data_audit_command": true,
1584 + "data_audit_euid": true,
1585 + "data_audit_exe": true,
1586 + "data_audit_gid": true,
1587 + "data_audit_id": true,
1588 + "data_audit_pid": true,
1589 + "data_audit_res": true,
1590 + "data_audit_session": true,
1591 + "data_audit_type": true,
1592 + "data_audit_uid": true,
1593 + "data_dest_ip": true,
1594 + "data_dest_port": true,
1595 + "data_dstuser": true,
1596 + "data_event_type": true,
1597 + "data_extra_data": true,
1598 + "data_file": true,
1599 + "data_flow_bytes_toclient": true,
1600 + "data_flow_bytes_toserver": true,
1601 + "data_flow_id": true,
1602 + "data_flow_pkts_toclient": true,
1603 + "data_flow_pkts_toserver": true,
1604 + "data_flow_start": true,
1605 + "data_http_http_content_type": true,
1606 + "data_http_http_port": true,
1607 + "data_http_length": true,
1608 + "data_http_status": true,
1609 + "data_http_url": true,
1610 + "data_id": true,
1611 + "data_in_iface": true,
1612 + "data_integration": true,
1613 + "data_metadata_flowbits": true,
1614 + "data_metadata_flowints_http_anomaly_count": true,
1615 + "data_metadata_flowints_tcp_retransmission_count": true,
1616 + "data_office365_AADGroupId": true,
1617 + "data_office365_Actor": true,
1618 + "data_office365_ActorContextId": true,
1619 + "data_office365_ActorIpAddress": false,
1620 + "data_office365_ActorIpAddress_city_name": true,
1621 + "data_office365_ActorIpAddress_country_code": true,
1622 + "data_office365_ActorIpAddress_geolocation": true,
1623 + "data_office365_AppAccessContext_AADSessionId": true,
1624 + "data_office365_AppAccessContext_APIId": true,
1625 + "data_office365_AppAccessContext_ClientAppId": true,
1626 + "data_office365_AppAccessContext_ClientAppName": true,
1627 + "data_office365_AppAccessContext_CorrelationId": true,
1628 + "data_office365_AppAccessContext_TokenIssuedAtTime": true,
1629 + "data_office365_AppAccessContext_UniqueTokenId": true,
1630 + "data_office365_AppId": true,
1631 + "data_office365_ApplicationDisplayName": true,
1632 + "data_office365_ApplicationId": true,
1633 + "data_office365_ArtifactsShared": true,
1634 + "data_office365_AssertingApplicationId": true,
1635 + "data_office365_Attendees": true,
1636 + "data_office365_AuthenticationType": true,
1637 + "data_office365_AzureActiveDirectoryEventType": true,
1638 + "data_office365_BrowserVersion": true,
1639 + "data_office365_BrowserVersion_city_name": true,
1640 + "data_office365_BrowserVersion_country_code": true,
1641 + "data_office365_BrowserVersion_geolocation": true,
1642 + "data_office365_ChannelGuid": true,
1643 + "data_office365_ChannelName": true,
1644 + "data_office365_ChatName": true,
1645 + "data_office365_ChatThreadId": true,
1646 + "data_office365_ClientAppId": true,
1647 + "data_office365_ClientIP": false,
1648 + "data_office365_ClientIPAddress": true,
1649 + "data_office365_ClientIPAddress_city_name": true,
1650 + "data_office365_ClientIPAddress_country_code": true,
1651 + "data_office365_ClientIPAddress_geolocation": true,
1652 + "data_office365_ClientIP_city_name": true,
1653 + "data_office365_ClientIP_country_code": true,
1654 + "data_office365_ClientIP_geolocation": true,
1655 + "data_office365_ClientInfoString": true,
1656 + "data_office365_ClientProcessName": true,
1657 + "data_office365_ClientRequestId": true,
1658 + "data_office365_ClientVersion": true,
1659 + "data_office365_CommunicationSubType": true,
1660 + "data_office365_CommunicationType": true,
1661 + "data_office365_CorrelationId": true,
1662 + "data_office365_CreationTime": false,
1663 + "data_office365_CrossMailboxOperation": true,
1664 + "data_office365_CustomUniqueId": true,
1665 + "data_office365_CustomizedDoclib": true,
1666 + "data_office365_DestFolder_Id": true,
1667 + "data_office365_DestFolder_Path": true,
1668 + "data_office365_DestinationFileExtension": true,
1669 + "data_office365_DestinationFileName": true,
1670 + "data_office365_DestinationRelativeUrl": true,
1671 + "data_office365_DeviceDisplayName": true,
1672 + "data_office365_DeviceDisplayName_city_name": true,
1673 + "data_office365_DeviceDisplayName_country_code": true,
1674 + "data_office365_DeviceDisplayName_geolocation": true,
1675 + "data_office365_DeviceId": true,
1676 + "data_office365_DeviceInformation": true,
1677 + "data_office365_DeviceProperties": true,
1678 + "data_office365_DoNotDistributeEvent": true,
1679 + "data_office365_EndTime": true,
1680 + "data_office365_ErrorNumber": true,
1681 + "data_office365_EventData": true,
1682 + "data_office365_EventSource": true,
1683 + "data_office365_ExchangeId": true,
1684 + "data_office365_ExtendedProperties": true,
1685 + "data_office365_ExternalAccess": true,
1686 + "data_office365_ExtraProperties": true,
1687 + "data_office365_FileSizeBytes": true,
1688 + "data_office365_FileSyncBytesCommitted": true,
1689 + "data_office365_Folder_Id": true,
1690 + "data_office365_Folder_Path": true,
1691 + "data_office365_FromApp": true,
1692 + "data_office365_HighPriorityMediaProcessing": true,
1693 + "data_office365_HostedContents": true,
1694 + "data_office365_ICalUid": true,
1695 + "data_office365_Id": true,
1696 + "data_office365_ImplicitShare": true,
1697 + "data_office365_InterSystemsId": true,
1698 + "data_office365_InternalLogonType": true,
1699 + "data_office365_IntraSystemId": true,
1700 + "data_office365_IsManagedDevice": true,
1701 + "data_office365_ItemCount": true,
1702 + "data_office365_ItemName": true,
1703 + "data_office365_ItemType": true,
1704 + "data_office365_Item_Id": true,
1705 + "data_office365_Item_InternetMessageId": true,
1706 + "data_office365_Item_IsRecord": true,
1707 + "data_office365_Item_ParentFolder_Id": true,
1708 + "data_office365_Item_SizeInBytes": true,
1709 + "data_office365_JoinTime": true,
1710 + "data_office365_LeaveTime": true,
1711 + "data_office365_ListBaseTemplateType": true,
1712 + "data_office365_ListBaseType": true,
1713 + "data_office365_ListId": true,
1714 + "data_office365_ListItemUniqueId": true,
1715 + "data_office365_ListServerTemplate": true,
1716 + "data_office365_ListTitle": true,
1717 + "data_office365_LogonError": true,
1718 + "data_office365_LogonType": true,
1719 + "data_office365_LogonUserSid": true,
1720 + "data_office365_MachineId": true,
1721 + "data_office365_MailboxGuid": true,
1722 + "data_office365_MailboxOwnerSid": true,
1723 + "data_office365_MailboxOwnerUPN": true,
1724 + "data_office365_MeetingDetailId": true,
1725 + "data_office365_MeetingURL": true,
1726 + "data_office365_Members": true,
1727 + "data_office365_MessageId": true,
1728 + "data_office365_MessageSizeInBytes": true,
1729 + "data_office365_MessageURLs": true,
1730 + "data_office365_MessageVersion": true,
1731 + "data_office365_Modalities": true,
1732 + "data_office365_ModifiedProperties": true,
1733 + "data_office365_Name": true,
1734 + "data_office365_NewValue": true,
1735 + "data_office365_ObjectId": true,
1736 + "data_office365_Operation": true,
1737 + "data_office365_OperationScope": true,
1738 + "data_office365_OrganizationId": true,
1739 + "data_office365_OrganizationName": true,
1740 + "data_office365_Organizer_OrganizationId": true,
1741 + "data_office365_Organizer_RecipientType": true,
1742 + "data_office365_Organizer_Role": true,
1743 + "data_office365_Organizer_UserObjectId": true,
1744 + "data_office365_OriginatingServer": true,
1745 + "data_office365_Parameters": true,
1746 + "data_office365_ParentMessageId": true,
1747 + "data_office365_Platform": true,
1748 + "data_office365_ProviderTypes": true,
1749 + "data_office365_RecordType": true,
1750 + "data_office365_ResultStatus": true,
1751 + "data_office365_SearchQueryText": true,
1752 + "data_office365_SessionId": true,
1753 + "data_office365_Site": true,
1754 + "data_office365_SiteUrl": true,
1755 + "data_office365_SkipForServiceWorker": true,
1756 + "data_office365_Source": true,
1757 + "data_office365_SourceFileExtension": true,
1758 + "data_office365_SourceRelativeUrl": true,
1759 + "data_office365_StartTime": true,
1760 + "data_office365_Subscription": true,
1761 + "data_office365_SubscriptionId": true,
1762 + "data_office365_Target": true,
1763 + "data_office365_TargetContextId": true,
1764 + "data_office365_TargetUserOrGroupName": true,
1765 + "data_office365_TargetUserOrGroupType": true,
1766 + "data_office365_TeamGuid": true,
1767 + "data_office365_TeamName": true,
1768 + "data_office365_UniqueSharingId": true,
1769 + "data_office365_UserAgent": true,
1770 + "data_office365_UserId": false,
1771 + "data_office365_UserKey": true,
1772 + "data_office365_UserType": true,
1773 + "data_office365_Version": true,
1774 + "data_office365_WebId": true,
1775 + "data_office365_Workload": true,
1776 + "data_osquery_action": true,
1777 + "data_osquery_calendarTime": true,
1778 + "data_osquery_columns_address": true,
1779 + "data_osquery_columns_address_city_name": true,
1780 + "data_osquery_columns_address_country_code": true,
1781 + "data_osquery_columns_address_geolocation": true,
1782 + "data_osquery_columns_cmdline": true,
1783 + "data_osquery_columns_cwd": true,
1784 + "data_osquery_columns_description": true,
1785 + "data_osquery_columns_directory": true,
1786 + "data_osquery_columns_disk_bytes_read": true,
1787 + "data_osquery_columns_disk_bytes_written": true,
1788 + "data_osquery_columns_egid": true,
1789 + "data_osquery_columns_euid": true,
1790 + "data_osquery_columns_family": true,
1791 + "data_osquery_columns_fd": true,
1792 + "data_osquery_columns_gid": true,
1793 + "data_osquery_columns_gid_signed": true,
1794 + "data_osquery_columns_host": true,
1795 + "data_osquery_columns_interface": true,
1796 + "data_osquery_columns_local_address": true,
1797 + "data_osquery_columns_local_address_city_name": true,
1798 + "data_osquery_columns_local_address_country_code": true,
1799 + "data_osquery_columns_local_address_geolocation": true,
1800 + "data_osquery_columns_local_port": true,
1801 + "data_osquery_columns_mac": true,
1802 + "data_osquery_columns_name": true,
1803 + "data_osquery_columns_net_namespace": true,
1804 + "data_osquery_columns_nice": true,
1805 + "data_osquery_columns_on_disk": true,
1806 + "data_osquery_columns_parent": true,
1807 + "data_osquery_columns_path": true,
1808 + "data_osquery_columns_pgroup": true,
1809 + "data_osquery_columns_pid": true,
1810 + "data_osquery_columns_port": true,
1811 + "data_osquery_columns_protocol": true,
1812 + "data_osquery_columns_remote_address": true,
1813 + "data_osquery_columns_remote_address_city_name": true,
1814 + "data_osquery_columns_remote_address_country_code": true,
1815 + "data_osquery_columns_remote_address_geolocation": true,
1816 + "data_osquery_columns_remote_port": true,
1817 + "data_osquery_columns_resident_size": true,
1818 + "data_osquery_columns_root": true,
1819 + "data_osquery_columns_sgid": true,
1820 + "data_osquery_columns_shell": true,
1821 + "data_osquery_columns_socket": true,
1822 + "data_osquery_columns_start_time": true,
1823 + "data_osquery_columns_state": true,
1824 + "data_osquery_columns_suid": true,
1825 + "data_osquery_columns_system_time": true,
1826 + "data_osquery_columns_threads": true,
1827 + "data_osquery_columns_time_utc": true,
1828 + "data_osquery_columns_total_size": true,
1829 + "data_osquery_columns_tty": true,
1830 + "data_osquery_columns_type": true,
1831 + "data_osquery_columns_uid": true,
1832 + "data_osquery_columns_uid_signed": true,
1833 + "data_osquery_columns_user": true,
1834 + "data_osquery_columns_user_time": true,
1835 + "data_osquery_columns_username": true,
1836 + "data_osquery_columns_wired_size": true,
1837 + "data_osquery_counter": true,
1838 + "data_osquery_decorations_host_uuid": true,
1839 + "data_osquery_decorations_hostname": true,
1840 + "data_osquery_epoch": true,
1841 + "data_osquery_hostIdentifier": true,
1842 + "data_osquery_name": true,
1843 + "data_osquery_numerics": true,
1844 + "data_osquery_unixTime": true,
1845 + "data_proto": true,
1846 + "data_sca_check_command": true,
1847 + "data_sca_check_compliance_cis": true,
1848 + "data_sca_check_compliance_cis_csc": true,
1849 + "data_sca_check_compliance_gdpr_IV": true,
1850 + "data_sca_check_compliance_gpg_13": true,
1851 + "data_sca_check_compliance_hipaa": true,
1852 + "data_sca_check_compliance_nist_800_53": true,
1853 + "data_sca_check_compliance_pci_dss": true,
1854 + "data_sca_check_compliance_tsc": true,
1855 + "data_sca_check_description": true,
1856 + "data_sca_check_id": true,
1857 + "data_sca_check_previous_result": true,
1858 + "data_sca_check_rationale": true,
1859 + "data_sca_check_remediation": true,
1860 + "data_sca_check_result": true,
1861 + "data_sca_check_title": true,
1862 + "data_sca_description": true,
1863 + "data_sca_failed": true,
1864 + "data_sca_file": true,
1865 + "data_sca_invalid": true,
1866 + "data_sca_passed": true,
1867 + "data_sca_policy": true,
1868 + "data_sca_policy_id": true,
1869 + "data_sca_scan_id": true,
1870 + "data_sca_score": true,
1871 + "data_sca_total_checks": true,
1872 + "data_sca_type": true,
1873 + "data_script": true,
1874 + "data_src_ip": true,
1875 + "data_src_ip_city_name": true,
1876 + "data_src_ip_country_code": true,
1877 + "data_src_ip_geolocation": true,
1878 + "data_src_port": true,
1879 + "data_srcip": true,
1880 + "data_srcip_city_name": true,
1881 + "data_srcip_country_code": true,
1882 + "data_srcip_geolocation": true,
1883 + "data_srcuser": true,
1884 + "data_timestamp": true,
1885 + "data_title": true,
1886 + "data_tls_session_resumed": true,
1887 + "data_tls_version": true,
1888 + "data_tx_id": true,
1889 + "data_type": true,
1890 + "data_win_eventXML_binaryData": true,
1891 + "data_win_eventXML_binaryDataSize": true,
1892 + "data_win_eventXML_param1": true,
1893 + "data_win_eventdata_authenticationPackageName": true,
1894 + "data_win_eventdata_callTrace": true,
1895 + "data_win_eventdata_commandLine": true,
1896 + "data_win_eventdata_company": true,
1897 + "data_win_eventdata_creationUtcTime": true,
1898 + "data_win_eventdata_currentDirectory": true,
1899 + "data_win_eventdata_description": true,
1900 + "data_win_eventdata_destinationHostname": true,
1901 + "data_win_eventdata_destinationIp": true,
1902 + "data_win_eventdata_destinationIp_city_name": true,
1903 + "data_win_eventdata_destinationIp_country_code": true,
1904 + "data_win_eventdata_destinationIp_geolocation": true,
1905 + "data_win_eventdata_destinationIsIpv6": true,
1906 + "data_win_eventdata_destinationPort": true,
1907 + "data_win_eventdata_destinationPortName": true,
1908 + "data_win_eventdata_details": true,
1909 + "data_win_eventdata_elevatedToken": true,
1910 + "data_win_eventdata_eventType": true,
1911 + "data_win_eventdata_fileVersion": true,
1912 + "data_win_eventdata_fileVersion_city_name": true,
1913 + "data_win_eventdata_fileVersion_country_code": true,
1914 + "data_win_eventdata_fileVersion_geolocation": true,
1915 + "data_win_eventdata_grantedAccess": true,
1916 + "data_win_eventdata_hashes": true,
1917 + "data_win_eventdata_image": true,
1918 + "data_win_eventdata_imageLoaded": true,
1919 + "data_win_eventdata_impersonationLevel": true,
1920 + "data_win_eventdata_initiated": true,
1921 + "data_win_eventdata_integrityLevel": true,
1922 + "data_win_eventdata_ipAddress": true,
1923 + "data_win_eventdata_ipPort": true,
1924 + "data_win_eventdata_keyLength": true,
1925 + "data_win_eventdata_logonGuid": true,
1926 + "data_win_eventdata_logonId": true,
1927 + "data_win_eventdata_logonProcessName": true,
1928 + "data_win_eventdata_logonType": true,
1929 + "data_win_eventdata_originalFileName": true,
1930 + "data_win_eventdata_param1": true,
1931 + "data_win_eventdata_param2": true,
1932 + "data_win_eventdata_param3": true,
1933 + "data_win_eventdata_param4": true,
1934 + "data_win_eventdata_parentCommandLine": true,
1935 + "data_win_eventdata_parentImage": true,
1936 + "data_win_eventdata_parentProcessGuid": true,
1937 + "data_win_eventdata_parentProcessId": true,
1938 + "data_win_eventdata_processGuid": true,
1939 + "data_win_eventdata_processId": true,
1940 + "data_win_eventdata_processName": true,
1941 + "data_win_eventdata_product": true,
1942 + "data_win_eventdata_protocol": true,
1943 + "data_win_eventdata_queryName": true,
1944 + "data_win_eventdata_queryResults": true,
1945 + "data_win_eventdata_queryStatus": true,
1946 + "data_win_eventdata_ruleName": true,
1947 + "data_win_eventdata_serviceName": true,
1948 + "data_win_eventdata_serviceSid": true,
1949 + "data_win_eventdata_signature": true,
1950 + "data_win_eventdata_signatureStatus": true,
1951 + "data_win_eventdata_signed": true,
1952 + "data_win_eventdata_sourceHostname": true,
1953 + "data_win_eventdata_sourceImage": true,
1954 + "data_win_eventdata_sourceIp": true,
1955 + "data_win_eventdata_sourceIp_city_name": true,
1956 + "data_win_eventdata_sourceIp_country_code": true,
1957 + "data_win_eventdata_sourceIp_geolocation": true,
1958 + "data_win_eventdata_sourceIsIpv6": true,
1959 + "data_win_eventdata_sourcePort": true,
1960 + "data_win_eventdata_sourceProcessGUID": true,
1961 + "data_win_eventdata_sourceProcessId": true,
1962 + "data_win_eventdata_sourceThreadId": true,
1963 + "data_win_eventdata_status": true,
1964 + "data_win_eventdata_subjectDomainName": true,
1965 + "data_win_eventdata_subjectLogonId": true,
1966 + "data_win_eventdata_subjectUserName": true,
1967 + "data_win_eventdata_subjectUserSid": true,
1968 + "data_win_eventdata_targetDomainName": true,
1969 + "data_win_eventdata_targetFilename": true,
1970 + "data_win_eventdata_targetImage": true,
1971 + "data_win_eventdata_targetLinkedLogonId": true,
1972 + "data_win_eventdata_targetLogonId": true,
1973 + "data_win_eventdata_targetObject": true,
1974 + "data_win_eventdata_targetProcessGUID": true,
1975 + "data_win_eventdata_targetProcessId": true,
1976 + "data_win_eventdata_targetUserName": true,
1977 + "data_win_eventdata_targetUserSid": true,
1978 + "data_win_eventdata_terminalSessionId": true,
1979 + "data_win_eventdata_ticketEncryptionType": true,
1980 + "data_win_eventdata_ticketOptions": true,
1981 + "data_win_eventdata_user": true,
1982 + "data_win_eventdata_utcTime": true,
1983 + "data_win_eventdata_virtualAccount": true,
1984 + "data_win_system_channel": true,
1985 + "data_win_system_computer": true,
1986 + "data_win_system_eventID": true,
1987 + "data_win_system_eventRecordID": true,
1988 + "data_win_system_eventSourceName": true,
1989 + "data_win_system_keywords": true,
1990 + "data_win_system_level": true,
1991 + "data_win_system_message": true,
1992 + "data_win_system_opcode": true,
1993 + "data_win_system_processID": true,
1994 + "data_win_system_providerGuid": true,
1995 + "data_win_system_providerName": true,
1996 + "data_win_system_severityValue": true,
1997 + "data_win_system_systemTime": true,
1998 + "data_win_system_task": true,
1999 + "data_win_system_threadID": true,
2000 + "data_win_system_version": true,
2001 + "decoder_name": true,
2002 + "decoder_parent": true,
2003 + "dns_query": true,
2004 + "dns_query_threat_indicated": true,
2005 + "dst_ip": true,
2006 + "dst_ip_city_name": true,
2007 + "dst_ip_country_code": true,
2008 + "dst_ip_geolocation": true,
2009 + "dst_ip_threat_indicated": true,
2010 + "dst_port": true,
2011 + "ecs_version": true,
2012 + "error": true,
2013 + "event_hash": true,
2014 + "file_path": true,
2015 + "firewall_rule_name": true,
2016 + "full_log": false,
2017 + "gl2_accounted_message_size": true,
2018 + "gl2_message_id": true,
2019 + "gl2_processing_error": true,
2020 + "gl2_remote_ip": true,
2021 + "gl2_remote_port": true,
2022 + "gl2_source_collector": true,
2023 + "gl2_source_input": true,
2024 + "gl2_source_node": true,
2025 + "hash_md5": true,
2026 + "hash_sha1": true,
2027 + "hash_sha256": true,
2028 + "highlight": true,
2029 + "host_architecture": true,
2030 + "host_containerized": true,
2031 + "host_hostname": true,
2032 + "host_id": true,
2033 + "host_ip": true,
2034 + "host_mac": true,
2035 + "host_name": true,
2036 + "host_os_codename": true,
2037 + "host_os_kernel": true,
2038 + "host_os_name": true,
2039 + "host_os_platform": true,
2040 + "host_os_version": true,
2041 + "hostname": true,
2042 + "id": true,
2043 + "input_type": true,
2044 + "level": true,
2045 + "location": true,
2046 + "log_file_path": true,
2047 + "log_offset": true,
2048 + "manager_name": true,
2049 + "message": true,
2050 + "module": true,
2051 + "msg_timestamp": true,
2052 + "parent_process_cmd_line": true,
2053 + "parent_process_id": true,
2054 + "parent_process_image": true,
2055 + "pid": true,
2056 + "predecoder_hostname": true,
2057 + "predecoder_program_name": true,
2058 + "predecoder_timestamp": true,
2059 + "previous_log": true,
2060 + "previous_output": true,
2061 + "process_cmd_line": true,
2062 + "process_id": true,
2063 + "process_image": true,
2064 + "process_name": true,
2065 + "protocol": true,
2066 + "rule_cis": true,
2067 + "rule_cis_csc": true,
2068 + "rule_firedtimes": true,
2069 + "rule_gdpr": true,
2070 + "rule_gdpr_IV": true,
2071 + "rule_gpg13": true,
2072 + "rule_gpg_13": true,
2073 + "rule_group1": true,
2074 + "rule_group2": true,
2075 + "rule_group3": true,
2076 + "rule_groups": true,
2077 + "rule_hipaa": true,
2078 + "rule_id": true,
2079 + "rule_info": true,
2080 + "rule_mail": true,
2081 + "rule_mitre_id": true,
2082 + "rule_mitre_tactic": false,
2083 + "rule_nist_800_53": true,
2084 + "rule_pci_dss": true,
2085 + "rule_tsc": true,
2086 + "scanid": true,
2087 + "service": true,
2088 + "software_package": true,
2089 + "software_vendor": true,
2090 + "sort": true,
2091 + "source": true,
2092 + "source_reserved_ip": true,
2093 + "src_ip": true,
2094 + "src_ip_city_name": true,
2095 + "src_ip_country_code": true,
2096 + "src_ip_geolocation": true,
2097 + "src_port": true,
2098 + "streams": true,
2099 + "syscheck_attrs_after": true,
2100 + "syscheck_audit_effective_user_id": true,
2101 + "syscheck_audit_effective_user_name": true,
2102 + "syscheck_audit_group_id": true,
2103 + "syscheck_audit_group_name": true,
2104 + "syscheck_audit_login_user_id": true,
2105 + "syscheck_audit_login_user_name": true,
2106 + "syscheck_audit_process_cwd": true,
2107 + "syscheck_audit_process_id": true,
2108 + "syscheck_audit_process_name": true,
2109 + "syscheck_audit_process_parent_cwd": true,
2110 + "syscheck_audit_process_parent_name": true,
2111 + "syscheck_audit_process_ppid": true,
2112 + "syscheck_audit_user_id": true,
2113 + "syscheck_audit_user_name": true,
2114 + "syscheck_changed_attributes": true,
2115 + "syscheck_event": true,
2116 + "syscheck_gid_after": true,
2117 + "syscheck_gname_after": true,
2118 + "syscheck_hard_links": true,
2119 + "syscheck_inode_after": true,
2120 + "syscheck_inode_before": true,
2121 + "syscheck_md5_after": true,
2122 + "syscheck_md5_before": true,
2123 + "syscheck_mode": true,
2124 + "syscheck_mtime_after": true,
2125 + "syscheck_mtime_before": true,
2126 + "syscheck_path": true,
2127 + "syscheck_perm_after": true,
2128 + "syscheck_perm_before": true,
2129 + "syscheck_sha1_after": true,
2130 + "syscheck_sha1_before": true,
2131 + "syscheck_sha256_after": true,
2132 + "syscheck_sha256_before": true,
2133 + "syscheck_size_after": true,
2134 + "syscheck_size_before": true,
2135 + "syscheck_uid_after": true,
2136 + "syscheck_uname_after": true,
2137 + "syscheck_win_perm_after": true,
2138 + "syscheck_win_perm_after_0_allowed": true,
2139 + "syscheck_win_perm_after_0_name": true,
2140 + "syscheck_win_perm_after_1_allowed": true,
2141 + "syscheck_win_perm_after_1_name": true,
2142 + "syscheck_win_perm_after_2_allowed": true,
2143 + "syscheck_win_perm_after_2_name": true,
2144 + "syscheck_win_perm_after_3_allowed": true,
2145 + "syscheck_win_perm_after_3_name": true,
2146 + "syslog_customer": true,
2147 + "syslog_level": true,
2148 + "syslog_tag": true,
2149 + "syslog_type": true,
2150 + "sysmon_event_description": true,
2151 + "threat_ids": true,
2152 + "threat_indicated": true,
2153 + "threat_names": true,
2154 + "time": true,
2155 + "timestamp": true,
2156 + "true": true,
2157 + "user_name": true,
2158 + "win_registry_key": true,
2159 + "win_system_eventID": true,
2160 + "windows_auth_package": true,
2161 + "windows_domain": true,
2162 + "windows_event_id": true,
2163 + "windows_event_severity": true,
2164 + "windows_logon_type": true
2165 + },
2166 + "indexByName": {
2167 + "_id": 2,
2168 + "_index": 9,
2169 + "_type": 10,
2170 + "agent_id": 11,
2171 + "agent_name": 5,
2172 + "cluster_name": 12,
2173 + "cluster_node": 13,
2174 + "data_office365_AppAccessContext_APIId": 49,
2175 + "data_office365_AppAccessContext_ClientAppId": 50,
2176 + "data_office365_AppAccessContext_ClientAppName": 51,
2177 + "data_office365_AppAccessContext_CorrelationId": 52,
2178 + "data_office365_ArtifactsShared": 53,
2179 + "data_office365_Attendees": 54,
2180 + "data_office365_ChatName": 55,
2181 + "data_office365_ChatThreadId": 56,
2182 + "data_office365_ClientIP": 4,
2183 + "data_office365_ClientIP_city_name": 14,
2184 + "data_office365_ClientIP_country_code": 15,
2185 + "data_office365_ClientIP_geolocation": 16,
2186 + "data_office365_CommunicationSubType": 57,
2187 + "data_office365_CommunicationType": 58,
2188 + "data_office365_CreationTime": 0,
2189 + "data_office365_DeviceId": 59,
2190 + "data_office365_DeviceInformation": 60,
2191 + "data_office365_EndTime": 61,
2192 + "data_office365_ExchangeId": 62,
2193 + "data_office365_ExtraProperties": 63,
2194 + "data_office365_ICalUid": 64,
2195 + "data_office365_Id": 17,
2196 + "data_office365_ItemName": 65,
2197 + "data_office365_JoinTime": 66,
2198 + "data_office365_LeaveTime": 67,
2199 + "data_office365_MeetingDetailId": 68,
2200 + "data_office365_MeetingURL": 69,
2201 + "data_office365_Members": 70,
2202 + "data_office365_MessageId": 71,
2203 + "data_office365_MessageSizeInBytes": 72,
2204 + "data_office365_MessageURLs": 73,
2205 + "data_office365_MessageVersion": 74,
2206 + "data_office365_Modalities": 75,
2207 + "data_office365_Name": 76,
2208 + "data_office365_NewValue": 77,
2209 + "data_office365_ObjectId": 18,
2210 + "data_office365_Operation": 24,
2211 + "data_office365_OperationScope": 78,
2212 + "data_office365_OrganizationId": 19,
2213 + "data_office365_Organizer_OrganizationId": 79,
2214 + "data_office365_Organizer_RecipientType": 80,
2215 + "data_office365_Organizer_Role": 81,
2216 + "data_office365_Organizer_UserObjectId": 82,
2217 + "data_office365_ProviderTypes": 83,
2218 + "data_office365_RecordType": 20,
2219 + "data_office365_StartTime": 84,
2220 + "data_office365_SubscriptionId": 85,
2221 + "data_office365_TeamGuid": 86,
2222 + "data_office365_UserId": 3,
2223 + "data_office365_UserKey": 21,
2224 + "data_office365_UserType": 22,
2225 + "data_office365_Version": 23,
2226 + "data_office365_Workload": 48,
2227 + "decoder_name": 25,
2228 + "gl2_accounted_message_size": 26,
2229 + "gl2_message_id": 27,
2230 + "gl2_processing_error": 28,
2231 + "gl2_remote_ip": 29,
2232 + "gl2_remote_port": 30,
2233 + "gl2_source_input": 31,
2234 + "gl2_source_node": 32,
2235 + "highlight": 33,
2236 + "id": 34,
2237 + "location": 35,
2238 + "manager_name": 36,
2239 + "message": 37,
2240 + "rule_description": 6,
2241 + "rule_firedtimes": 38,
2242 + "rule_group1": 39,
2243 + "rule_groups": 40,
2244 + "rule_id": 8,
2245 + "rule_level": 7,
2246 + "rule_mail": 41,
2247 + "sort": 42,
2248 + "source": 43,
2249 + "streams": 44,
2250 + "syslog_level": 45,
2251 + "syslog_type": 46,
2252 + "timestamp": 1,
2253 + "true": 47
2254 + },
2255 + "renameByName": {
2256 + "_id": "EVENT ID",
2257 + "agent_name": "",
2258 + "data_office365_ActorIpAddress": "SRC IP",
2259 + "data_office365_AffectedItems": "ITEMS",
2260 + "data_office365_BrowserName": "BROWSER",
2261 + "data_office365_ClientIP": "CLIENT IP",
2262 + "data_office365_ClientIP_city_name": "",
2263 + "data_office365_CreationTime": "EVENT TIME",
2264 + "data_office365_Item_Attachments": "ATTACHMENT",
2265 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2266 + "data_office365_Item_Subject": "SUBJECT",
2267 + "data_office365_ResultStatus": "RESULT",
2268 + "data_office365_SourceFileName": "FILE",
2269 + "data_office365_UserId": "ACCOUNT",
2270 + "rule_description": "DESCRIPTION",
2271 + "rule_id": "RULE ID",
2272 + "rule_level": "",
2273 + "rule_mitre_tactic": "MITRE TACTIC",
2274 + "rule_mitre_technique": "MITRE TECHNIQUE",
2275 + "timestamp": "Date/Time"
2276 + }
2277 + }
2278 + }
2279 + ],
2280 + "transparent": true,
2281 + "type": "table"
2282 + }
2283 + ],
2284 + "refresh": "",
2285 + "schemaVersion": 38,
2286 + "style": "dark",
2287 + "tags": ["O365"],
2288 + "templating": {
2289 + "list": [
2290 + {
2291 + "datasource": {
2292 + "type": "elasticsearch",
2293 + "uid": "replace_datasource_uid"
2294 + },
2295 + "filters": [],
2296 + "hide": 0,
2297 + "label": "",
2298 + "name": "Filters",
2299 + "skipUrlSync": false,
2300 + "type": "adhoc"
2301 + },
2302 + {
2303 + "current": {
2304 + "selected": false,
2305 + "text": "All",
2306 + "value": "$__all"
2307 + },
2308 + "datasource": {
2309 + "type": "elasticsearch",
2310 + "uid": "replace_datasource_uid"
2311 + },
2312 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SharePoint\"}",
2313 + "hide": 0,
2314 + "includeAll": true,
2315 + "label": "Operation",
2316 + "multi": false,
2317 + "name": "operation",
2318 + "options": [],
2319 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:SharePoint\"}",
2320 + "refresh": 2,
2321 + "regex": "",
2322 + "skipUrlSync": false,
2323 + "sort": 1,
2324 + "tagValuesQuery": "",
2325 + "tagsQuery": "",
2326 + "type": "query",
2327 + "useTags": false
2328 + },
2329 + {
2330 + "current": {
2331 + "selected": false,
2332 + "text": "All",
2333 + "value": "$__all"
2334 + },
2335 + "datasource": {
2336 + "type": "elasticsearch",
2337 + "uid": "replace_datasource_uid"
2338 + },
2339 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:SharePoint\"}",
2340 + "hide": 0,
2341 + "includeAll": true,
2342 + "label": "Rule Level",
2343 + "multi": false,
2344 + "name": "rule_level",
2345 + "options": [],
2346 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"data_office365_Workload:SharePoint\"}",
2347 + "refresh": 2,
2348 + "regex": "",
2349 + "skipUrlSync": false,
2350 + "sort": 0,
2351 + "type": "query"
2352 + }
2353 + ]
2354 + },
2355 + "time": {
2356 + "from": "now-6h",
2357 + "to": "now"
2358 + },
2359 + "timepicker": {
2360 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2361 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2362 + },
2363 + "timezone": "",
2364 + "title": "O365 - SHAREPOINT",
2365 + "weekStart": ""
2366 }
backend/app/connectors/grafana/dashboards/Office365/summary.json
+2676 -2727
@@ -1,2729 +1,2678 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "10.2.0",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Workload:$workload",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - },
172 - {
173 - "matcher": {
174 - "id": "byName",
175 - "options": "Count"
176 - },
177 - "properties": [
178 - {
179 - "id": "displayName",
180 - "value": "ALERTS"
181 - },
182 - {
183 - "id": "unit",
184 - "value": "short"
185 - },
186 - {
187 - "id": "decimals",
188 - "value": 0
189 - }
190 - ]
191 - }
192 - ]
193 - },
194 - "gridPos": {
195 - "h": 7,
196 - "w": 4,
197 - "x": 4,
198 - "y": 0
199 - },
200 - "id": 48,
201 - "options": {
202 - "legend": {
203 - "displayMode": "list",
204 - "placement": "bottom",
205 - "showLegend": false
206 - },
207 - "pieType": "pie",
208 - "reduceOptions": {
209 - "calcs": [
210 - "sum"
211 - ],
212 - "fields": "",
213 - "values": false
214 - },
215 - "tooltip": {
216 - "mode": "single",
217 - "sort": "none"
218 - }
219 - },
220 - "pluginVersion": "8.5.1",
221 - "targets": [
222 - {
223 - "bucketAggs": [
224 - {
225 - "fake": true,
226 - "field": "data_office365_Workload",
227 - "id": "4",
228 - "settings": {
229 - "min_doc_count": 1,
230 - "order": "desc",
231 - "orderBy": "_count",
232 - "size": "10"
233 - },
234 - "type": "terms"
235 - },
236 - {
237 - "field": "data_office365_CreationTime",
238 - "id": "5",
239 - "settings": {
240 - "interval": "auto",
241 - "min_doc_count": "0",
242 - "timeZone": "utc",
243 - "trimEdges": "0"
244 - },
245 - "type": "date_histogram"
246 - }
247 - ],
248 - "datasource": {
249 - "type": "elasticsearch",
250 - "uid": "replace_datasource_uid"
251 - },
252 - "metrics": [
253 - {
254 - "field": "select field",
255 - "id": "1",
256 - "type": "count"
257 - }
258 - ],
259 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
260 - "refId": "A",
261 - "timeField": "timestamp"
262 - }
263 - ],
264 - "title": "EVENTS BY WORKLOAD (Top 10)",
265 - "transformations": [],
266 - "type": "piechart"
267 - },
268 - {
269 - "datasource": {
270 - "type": "grafana-opensearch-datasource",
271 - "uid": "replace_datasource_uid"
272 - },
273 - "fieldConfig": {
274 - "defaults": {
275 - "color": {
276 - "mode": "thresholds"
277 - },
278 - "custom": {
279 - "align": "auto",
280 - "cellOptions": {
281 - "type": "auto"
282 - },
283 - "inspect": false
284 - },
285 - "mappings": [],
286 - "thresholds": {
287 - "mode": "absolute",
288 - "steps": [
289 - {
290 - "color": "red",
291 - "value": null
292 - }
293 - ]
294 - }
295 - },
296 - "overrides": [
297 - {
298 - "matcher": {
299 - "id": "byName",
300 - "options": "Count"
301 - },
302 - "properties": [
303 - {
304 - "id": "displayName",
305 - "value": "EVENTS"
306 - },
307 - {
308 - "id": "unit",
309 - "value": "short"
310 - },
311 - {
312 - "id": "decimals",
313 - "value": -1
314 - },
315 - {
316 - "id": "custom.align"
317 - },
318 - {
319 - "id": "thresholds",
320 - "value": {
321 - "mode": "absolute",
322 - "steps": [
323 - {
324 - "color": "red",
325 - "value": null
326 - }
327 - ]
328 - }
329 - }
330 - ]
331 - }
332 - ]
333 - },
334 - "gridPos": {
335 - "h": 7,
336 - "w": 6,
337 - "x": 8,
338 - "y": 0
339 - },
340 - "id": 31,
341 - "options": {
342 - "cellHeight": "sm",
343 - "footer": {
344 - "countRows": false,
345 - "fields": "",
346 - "reducer": [
347 - "sum"
348 - ],
349 - "show": false
350 - },
351 - "showHeader": true
352 - },
353 - "pluginVersion": "10.2.0",
354 - "targets": [
355 - {
356 - "bucketAggs": [
357 - {
358 - "fake": true,
359 - "field": "data_office365_Workload",
360 - "id": "4",
361 - "settings": {
362 - "min_doc_count": 1,
363 - "order": "desc",
364 - "orderBy": "_count",
365 - "size": "0"
366 - },
367 - "type": "terms"
368 - }
369 - ],
370 - "datasource": {
371 - "type": "elasticsearch",
372 - "uid": "replace_datasource_uid"
373 - },
374 - "metrics": [
375 - {
376 - "field": "select field",
377 - "id": "1",
378 - "type": "count"
379 - }
380 - ],
381 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
382 - "refId": "A",
383 - "timeField": "timestamp"
384 - }
385 - ],
386 - "title": "EVENTS BY WORKLOAD",
387 - "transformations": [
388 - {
389 - "id": "merge",
390 - "options": {
391 - "reducers": []
392 - }
393 - },
394 - {
395 - "id": "organize",
396 - "options": {
397 - "excludeByName": {},
398 - "indexByName": {},
399 - "renameByName": {
400 - "Count": "EVENTS",
401 - "data_office365_Workload": "WORKLOAD"
402 - }
403 - }
404 - }
405 - ],
406 - "type": "table"
407 - },
408 - {
409 - "datasource": {
410 - "type": "elasticsearch",
411 - "uid": "replace_datasource_uid"
412 - },
413 - "fieldConfig": {
414 - "defaults": {
415 - "color": {
416 - "mode": "palette-classic"
417 - },
418 - "custom": {
419 - "hideFrom": {
420 - "legend": false,
421 - "tooltip": false,
422 - "viz": false
423 - }
424 - },
425 - "mappings": []
426 - },
427 - "overrides": [
428 - {
429 - "matcher": {
430 - "id": "byName",
431 - "options": "Count"
432 - },
433 - "properties": [
434 - {
435 - "id": "displayName",
436 - "value": "EVENTS"
437 - },
438 - {
439 - "id": "unit",
440 - "value": "short"
441 - },
442 - {
443 - "id": "decimals",
444 - "value": -1
445 - }
446 - ]
447 - }
448 - ]
449 - },
450 - "gridPos": {
451 - "h": 7,
452 - "w": 4,
453 - "x": 14,
454 - "y": 0
455 - },
456 - "id": 53,
457 - "options": {
458 - "legend": {
459 - "displayMode": "list",
460 - "placement": "bottom",
461 - "showLegend": false
462 - },
463 - "pieType": "donut",
464 - "reduceOptions": {
465 - "calcs": [
466 - "sum"
467 - ],
468 - "fields": "",
469 - "values": false
470 - },
471 - "tooltip": {
472 - "mode": "single",
473 - "sort": "none"
474 - }
475 - },
476 - "pluginVersion": "8.5.1",
477 - "targets": [
478 - {
479 - "bucketAggs": [
480 - {
481 - "fake": true,
482 - "field": "data_office365_Operation",
483 - "id": "4",
484 - "settings": {
485 - "min_doc_count": 1,
486 - "order": "desc",
487 - "orderBy": "_count",
488 - "size": "10"
489 - },
490 - "type": "terms"
491 - },
492 - {
493 - "field": "data_office365_CreationTime",
494 - "id": "5",
495 - "settings": {
496 - "interval": "auto",
497 - "min_doc_count": "0",
498 - "timeZone": "utc",
499 - "trimEdges": "0"
500 - },
501 - "type": "date_histogram"
502 - }
503 - ],
504 - "datasource": {
505 - "type": "elasticsearch",
506 - "uid": "replace_datasource_uid"
507 - },
508 - "metrics": [
509 - {
510 - "field": "select field",
511 - "id": "1",
512 - "type": "count"
513 - }
514 - ],
515 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
516 - "refId": "A",
517 - "timeField": "timestamp"
518 - }
519 - ],
520 - "title": "EVENTS BY OPERATION (Top 10)",
521 - "transformations": [],
522 - "type": "piechart"
523 - },
524 - {
525 - "datasource": {
526 - "type": "elasticsearch",
527 - "uid": "replace_datasource_uid"
528 - },
529 - "fieldConfig": {
530 - "defaults": {
531 - "color": {
532 - "mode": "thresholds"
533 - },
534 - "custom": {
535 - "align": "auto",
536 - "cellOptions": {
537 - "type": "auto"
538 - },
539 - "inspect": false
540 - },
541 - "mappings": [],
542 - "thresholds": {
543 - "mode": "absolute",
544 - "steps": [
545 - {
546 - "color": "red",
547 - "value": null
548 - }
549 - ]
550 - }
551 - },
552 - "overrides": [
553 - {
554 - "matcher": {
555 - "id": "byName",
556 - "options": "Count"
557 - },
558 - "properties": [
559 - {
560 - "id": "displayName",
561 - "value": "EVENTS"
562 - },
563 - {
564 - "id": "unit",
565 - "value": "short"
566 - },
567 - {
568 - "id": "decimals",
569 - "value": -1
570 - },
571 - {
572 - "id": "custom.align"
573 - },
574 - {
575 - "id": "thresholds",
576 - "value": {
577 - "mode": "absolute",
578 - "steps": [
579 - {
580 - "color": "red",
581 - "value": null
582 - }
583 - ]
584 - }
585 - }
586 - ]
587 - }
588 - ]
589 - },
590 - "gridPos": {
591 - "h": 7,
592 - "w": 6,
593 - "x": 18,
594 - "y": 0
595 - },
596 - "id": 54,
597 - "options": {
598 - "cellHeight": "sm",
599 - "footer": {
600 - "countRows": false,
601 - "fields": "",
602 - "reducer": [
603 - "sum"
604 - ],
605 - "show": false
606 - },
607 - "showHeader": true
608 - },
609 - "pluginVersion": "10.2.0",
610 - "targets": [
611 - {
612 - "bucketAggs": [
613 - {
614 - "fake": true,
615 - "field": "data_office365_Operation",
616 - "id": "4",
617 - "settings": {
618 - "min_doc_count": 1,
619 - "order": "desc",
620 - "orderBy": "_count",
621 - "size": "0"
622 - },
623 - "type": "terms"
624 - }
625 - ],
626 - "datasource": {
627 - "type": "elasticsearch",
628 - "uid": "replace_datasource_uid"
629 - },
630 - "metrics": [
631 - {
632 - "field": "select field",
633 - "id": "1",
634 - "type": "count"
635 - }
636 - ],
637 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
638 - "refId": "A",
639 - "timeField": "timestamp"
640 - }
641 - ],
642 - "title": "EVENTS BY OPERATION",
643 - "transformations": [
644 - {
645 - "id": "merge",
646 - "options": {
647 - "reducers": []
648 - }
649 - },
650 - {
651 - "id": "organize",
652 - "options": {
653 - "excludeByName": {},
654 - "indexByName": {},
655 - "renameByName": {
656 - "Count": "EVENTS",
657 - "data_office365_Operation": "OPERATION",
658 - "data_office365_Workload": "WORKLOAD"
659 - }
660 - }
661 - }
662 - ],
663 - "type": "table"
664 - },
665 - {
666 - "datasource": {
667 - "type": "elasticsearch",
668 - "uid": "replace_datasource_uid"
669 - },
670 - "fieldConfig": {
671 - "defaults": {
672 - "color": {
673 - "mode": "thresholds"
674 - },
675 - "mappings": [
676 - {
677 - "options": {
678 - "match": "null",
679 - "result": {
680 - "text": "N/A"
681 - }
682 - },
683 - "type": "special"
684 - }
685 - ],
686 - "max": 15,
687 - "min": 0,
688 - "thresholds": {
689 - "mode": "absolute",
690 - "steps": [
691 - {
692 - "color": "#299c46",
693 - "value": null
694 - },
695 - {
696 - "color": "rgba(237, 129, 40, 0.89)",
697 - "value": 8
698 - },
699 - {
700 - "color": "#d44a3a",
701 - "value": 12
702 - }
703 - ]
704 - },
705 - "unit": "none"
706 - },
707 - "overrides": []
708 - },
709 - "gridPos": {
710 - "h": 7,
711 - "w": 4,
712 - "x": 0,
713 - "y": 7
714 - },
715 - "id": 16,
716 - "links": [],
717 - "options": {
718 - "minVizHeight": 75,
719 - "minVizWidth": 75,
720 - "orientation": "horizontal",
721 - "reduceOptions": {
722 - "calcs": [
723 - "max"
724 - ],
725 - "fields": "",
726 - "values": false
727 - },
728 - "showThresholdLabels": false,
729 - "showThresholdMarkers": true,
730 - "text": {}
731 - },
732 - "pluginVersion": "10.2.0",
733 - "targets": [
734 - {
735 - "bucketAggs": [
736 - {
737 - "field": "timestamp",
738 - "id": "2",
739 - "settings": {
740 - "interval": "auto",
741 - "min_doc_count": 0,
742 - "trimEdges": 0
743 - },
744 - "type": "date_histogram"
745 - }
746 - ],
747 - "datasource": {
748 - "type": "elasticsearch",
749 - "uid": "replace_datasource_uid"
750 - },
751 - "metrics": [
752 - {
753 - "field": "rule_level",
754 - "id": "1",
755 - "meta": {},
756 - "settings": {},
757 - "type": "max"
758 - }
759 - ],
760 - "query": "data_office365_Workload:$workload",
761 - "refId": "A",
762 - "timeField": "timestamp"
763 - }
764 - ],
765 - "title": "MAX SEVERITY (0 - 15)",
766 - "type": "gauge"
767 - },
768 - {
769 - "datasource": {
770 - "type": "grafana-opensearch-datasource",
771 - "uid": "replace_datasource_uid"
772 - },
773 - "fieldConfig": {
774 - "defaults": {
775 - "color": {
776 - "mode": "palette-classic"
777 - },
778 - "custom": {
779 - "axisBorderShow": false,
780 - "axisCenteredZero": false,
781 - "axisColorMode": "text",
782 - "axisLabel": "",
783 - "axisPlacement": "auto",
784 - "barAlignment": 0,
785 - "drawStyle": "line",
786 - "fillOpacity": 0,
787 - "gradientMode": "none",
788 - "hideFrom": {
789 - "legend": false,
790 - "tooltip": false,
791 - "viz": false
792 - },
793 - "insertNulls": false,
794 - "lineInterpolation": "linear",
795 - "lineWidth": 1,
796 - "pointSize": 5,
797 - "scaleDistribution": {
798 - "type": "linear"
799 - },
800 - "showPoints": "auto",
801 - "spanNulls": false,
802 - "stacking": {
803 - "group": "A",
804 - "mode": "none"
805 - },
806 - "thresholdsStyle": {
807 - "mode": "off"
808 - }
809 - },
810 - "mappings": [],
811 - "thresholds": {
812 - "mode": "absolute",
813 - "steps": [
814 - {
815 - "color": "green",
816 - "value": null
817 - },
818 - {
819 - "color": "red",
820 - "value": 80
821 - }
822 - ]
823 - }
824 - },
825 - "overrides": []
826 - },
827 - "gridPos": {
828 - "h": 13,
829 - "w": 20,
830 - "x": 4,
831 - "y": 7
832 - },
833 - "id": 58,
834 - "options": {
835 - "legend": {
836 - "calcs": [],
837 - "displayMode": "table",
838 - "placement": "right",
839 - "showLegend": true
840 - },
841 - "tooltip": {
842 - "mode": "single",
843 - "sort": "none"
844 - }
845 - },
846 - "targets": [
847 - {
848 - "alias": "",
849 - "bucketAggs": [
850 - {
851 - "field": "data_office365_Workload",
852 - "id": "3",
853 - "settings": {
854 - "min_doc_count": "1",
855 - "order": "desc",
856 - "orderBy": "_count",
857 - "size": "10"
858 - },
859 - "type": "terms"
860 - },
861 - {
862 - "field": "timestamp",
863 - "id": "2",
864 - "settings": {
865 - "interval": "auto"
866 - },
867 - "type": "date_histogram"
868 - }
869 - ],
870 - "datasource": {
871 - "type": "grafana-opensearch-datasource",
872 - "uid": "replace_datasource_uid"
873 - },
874 - "format": "table",
875 - "metrics": [
876 - {
877 - "id": "1",
878 - "type": "count"
879 - }
880 - ],
881 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
882 - "queryType": "lucene",
883 - "refId": "A",
884 - "timeField": "timestamp"
885 - }
886 - ],
887 - "title": "TOP 10 WORKLOADS - HISTOGRAM",
888 - "type": "timeseries"
889 - },
890 - {
891 - "datasource": {
892 - "type": "elasticsearch",
893 - "uid": "replace_datasource_uid"
894 - },
895 - "fieldConfig": {
896 - "defaults": {
897 - "mappings": [
898 - {
899 - "options": {
900 - "match": "null",
901 - "result": {
902 - "text": "N/A"
903 - }
904 - },
905 - "type": "special"
906 - }
907 - ],
908 - "thresholds": {
909 - "mode": "absolute",
910 - "steps": [
911 - {
912 - "color": "blue",
913 - "value": null
914 - }
915 - ]
916 - },
917 - "unit": "locale"
918 - },
919 - "overrides": []
920 - },
921 - "gridPos": {
922 - "h": 6,
923 - "w": 4,
924 - "x": 0,
925 - "y": 14
926 - },
927 - "id": 51,
928 - "links": [],
929 - "options": {
930 - "colorMode": "value",
931 - "graphMode": "area",
932 - "justifyMode": "auto",
933 - "orientation": "horizontal",
934 - "reduceOptions": {
935 - "calcs": [
936 - "sum"
937 - ],
938 - "fields": "",
939 - "values": false
940 - },
941 - "text": {},
942 - "textMode": "auto"
943 - },
944 - "pluginVersion": "10.2.0",
945 - "targets": [
946 - {
947 - "bucketAggs": [
948 - {
949 - "$$hashKey": "object:331",
950 - "field": "timestamp",
951 - "id": "2",
952 - "settings": {
953 - "interval": "auto",
954 - "min_doc_count": 0,
955 - "trimEdges": 0
956 - },
957 - "type": "date_histogram"
958 - }
959 - ],
960 - "datasource": {
961 - "type": "elasticsearch",
962 - "uid": "replace_datasource_uid"
963 - },
964 - "metrics": [
965 - {
966 - "$$hashKey": "object:329",
967 - "field": "select field",
968 - "id": "1",
969 - "type": "count"
970 - }
971 - ],
972 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
973 - "refId": "A",
974 - "timeField": "timestamp"
975 - }
976 - ],
977 - "title": "EVENTS (Total)",
978 - "type": "stat"
979 - },
980 - {
981 - "datasource": {
982 - "type": "elasticsearch",
983 - "uid": "replace_datasource_uid"
984 - },
985 - "fieldConfig": {
986 - "defaults": {
987 - "mappings": [
988 - {
989 - "options": {
990 - "match": "null",
991 - "result": {
992 - "text": "N/A"
993 - }
994 - },
995 - "type": "special"
996 - }
997 - ],
998 - "thresholds": {
999 - "mode": "absolute",
1000 - "steps": [
1001 - {
1002 - "color": "red",
1003 - "value": null
1004 - }
1005 - ]
1006 - },
1007 - "unit": "locale"
1008 - },
1009 - "overrides": []
1010 - },
1011 - "gridPos": {
1012 - "h": 6,
1013 - "w": 4,
1014 - "x": 0,
1015 - "y": 20
1016 - },
1017 - "id": 52,
1018 - "links": [],
1019 - "options": {
1020 - "colorMode": "value",
1021 - "graphMode": "area",
1022 - "justifyMode": "auto",
1023 - "orientation": "horizontal",
1024 - "reduceOptions": {
1025 - "calcs": [
1026 - "sum"
1027 - ],
1028 - "fields": "",
1029 - "values": false
1030 - },
1031 - "text": {},
1032 - "textMode": "auto"
1033 - },
1034 - "pluginVersion": "10.2.0",
1035 - "targets": [
1036 - {
1037 - "bucketAggs": [
1038 - {
1039 - "$$hashKey": "object:331",
1040 - "field": "timestamp",
1041 - "id": "2",
1042 - "settings": {
1043 - "interval": "auto",
1044 - "min_doc_count": 0,
1045 - "trimEdges": 0
1046 - },
1047 - "type": "date_histogram"
1048 - }
1049 - ],
1050 - "datasource": {
1051 - "type": "elasticsearch",
1052 - "uid": "replace_datasource_uid"
1053 - },
1054 - "metrics": [
1055 - {
1056 - "$$hashKey": "object:329",
1057 - "field": "select field",
1058 - "id": "1",
1059 - "type": "count"
1060 - }
1061 - ],
1062 - "query": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
1063 - "refId": "A",
1064 - "timeField": "timestamp"
1065 - }
1066 - ],
1067 - "title": "AZURE AD - FAILED AUTHS",
1068 - "type": "stat"
1069 - },
1070 - {
1071 - "circleMaxSize": 30,
1072 - "circleMinSize": 2,
1073 - "colors": [
1074 - "rgba(245, 54, 54, 0.9)",
1075 - "rgba(237, 129, 40, 0.89)",
1076 - "rgba(50, 172, 45, 0.97)"
1077 - ],
1078 - "datasource": {
1079 - "type": "elasticsearch",
1080 - "uid": "replace_datasource_uid"
1081 - },
1082 - "decimals": 0,
1083 - "esMetric": "Count",
1084 - "gridPos": {
1085 - "h": 12,
1086 - "w": 10,
1087 - "x": 4,
1088 - "y": 20
1089 - },
1090 - "hideEmpty": false,
1091 - "hideZero": false,
1092 - "id": 50,
1093 - "initialZoom": 1,
1094 - "locationData": "countries",
1095 - "mapCenter": "(0°, 0°)",
1096 - "mapCenterLatitude": 0,
1097 - "mapCenterLongitude": 0,
1098 - "maxDataPoints": 1,
1099 - "mouseWheelZoom": false,
1100 - "showLegend": true,
1101 - "stickyLabels": false,
1102 - "tableQueryOptions": {
1103 - "geohashField": "geohash",
1104 - "latitudeField": "latitude",
1105 - "longitudeField": "longitude",
1106 - "metricField": "metric",
1107 - "queryType": "geohash"
1108 - },
1109 - "targets": [
1110 - {
1111 - "bucketAggs": [
1112 - {
1113 - "fake": true,
1114 - "field": "data_office365_ActorIpAddress_country_code",
1115 - "id": "3",
1116 - "settings": {
1117 - "min_doc_count": 1,
1118 - "order": "desc",
1119 - "orderBy": "_term",
1120 - "size": "0"
1121 - },
1122 - "type": "terms"
1123 - },
1124 - {
1125 - "field": "timestamp",
1126 - "id": "2",
1127 - "settings": {
1128 - "interval": "auto",
1129 - "min_doc_count": 0,
1130 - "trimEdges": 0
1131 - },
1132 - "type": "date_histogram"
1133 - }
1134 - ],
1135 - "datasource": {
1136 - "type": "elasticsearch",
1137 - "uid": "replace_datasource_uid"
1138 - },
1139 - "metrics": [
1140 - {
1141 - "field": "select field",
1142 - "id": "1",
1143 - "type": "count"
1144 - }
1145 - ],
1146 - "query": "data_office365_Workload:AzureActiveDirectory AND rule_level:$rule_level",
1147 - "refId": "A",
1148 - "timeField": "timestamp"
1149 - }
1150 - ],
1151 - "thresholds": "0,10",
1152 - "title": "AZURE AD - ALL AUTH EVENTS BY COUNTRY",
1153 - "type": "grafana-worldmap-panel",
1154 - "unitPlural": "",
1155 - "unitSingle": "",
1156 - "valueName": "total"
1157 - },
1158 - {
1159 - "datasource": {
1160 - "type": "elasticsearch",
1161 - "uid": "replace_datasource_uid"
1162 - },
1163 - "fieldConfig": {
1164 - "defaults": {
1165 - "color": {
1166 - "mode": "thresholds"
1167 - },
1168 - "custom": {
1169 - "align": "auto",
1170 - "cellOptions": {
1171 - "type": "auto"
1172 - },
1173 - "inspect": false
1174 - },
1175 - "mappings": [],
1176 - "thresholds": {
1177 - "mode": "absolute",
1178 - "steps": [
1179 - {
1180 - "color": "orange",
1181 - "value": null
1182 - }
1183 - ]
1184 - }
1185 - },
1186 - "overrides": [
1187 - {
1188 - "matcher": {
1189 - "id": "byName",
1190 - "options": "Count"
1191 - },
1192 - "properties": [
1193 - {
1194 - "id": "displayName",
1195 - "value": "EVENTS"
1196 - },
1197 - {
1198 - "id": "unit",
1199 - "value": "short"
1200 - },
1201 - {
1202 - "id": "decimals",
1203 - "value": -1
1204 - },
1205 - {
1206 - "id": "custom.align"
1207 - },
1208 - {
1209 - "id": "custom.cellOptions",
1210 - "value": {
1211 - "type": "color-text"
1212 - }
1213 - }
1214 - ]
1215 - },
1216 - {
1217 - "matcher": {
1218 - "id": "byName",
1219 - "options": "AD ACCOUNT"
1220 - },
1221 - "properties": [
1222 - {
1223 - "id": "custom.width",
1224 - "value": 489
1225 - },
1226 - {
1227 - "id": "custom.cellOptions",
1228 - "value": {
1229 - "type": "color-text"
1230 - }
1231 - }
1232 - ]
1233 - }
1234 - ]
1235 - },
1236 - "gridPos": {
1237 - "h": 12,
1238 - "w": 10,
1239 - "x": 14,
1240 - "y": 20
1241 - },
1242 - "id": 55,
1243 - "options": {
1244 - "cellHeight": "sm",
1245 - "footer": {
1246 - "countRows": false,
1247 - "fields": "",
1248 - "reducer": [
1249 - "sum"
1250 - ],
1251 - "show": false
1252 - },
1253 - "showHeader": true,
1254 - "sortBy": []
1255 - },
1256 - "pluginVersion": "10.2.0",
1257 - "targets": [
1258 - {
1259 - "bucketAggs": [
1260 - {
1261 - "fake": true,
1262 - "field": "data_office365_UserId",
1263 - "id": "4",
1264 - "settings": {
1265 - "min_doc_count": 1,
1266 - "order": "desc",
1267 - "orderBy": "_count",
1268 - "size": "0"
1269 - },
1270 - "type": "terms"
1271 - }
1272 - ],
1273 - "datasource": {
1274 - "type": "elasticsearch",
1275 - "uid": "replace_datasource_uid"
1276 - },
1277 - "metrics": [
1278 - {
1279 - "field": "select field",
1280 - "id": "1",
1281 - "type": "count"
1282 - }
1283 - ],
1284 - "query": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
1285 - "refId": "A",
1286 - "timeField": "timestamp"
1287 - }
1288 - ],
1289 - "title": "FAILED AUTHS BY ACCOUNT",
1290 - "transformations": [
1291 - {
1292 - "id": "merge",
1293 - "options": {
1294 - "reducers": []
1295 - }
1296 - },
1297 - {
1298 - "id": "organize",
1299 - "options": {
1300 - "excludeByName": {},
1301 - "indexByName": {},
1302 - "renameByName": {
1303 - "Count": "EVENTS",
1304 - "data_office365_Operation": "OPERATION",
1305 - "data_office365_UserId": "AD ACCOUNT",
1306 - "data_office365_Workload": "WORKLOAD"
1307 - }
1308 - }
1309 - }
1310 - ],
1311 - "type": "table"
1312 - },
1313 - {
1314 - "datasource": {
1315 - "type": "elasticsearch",
1316 - "uid": "replace_datasource_uid"
1317 - },
1318 - "fieldConfig": {
1319 - "defaults": {
1320 - "mappings": [
1321 - {
1322 - "options": {
1323 - "match": "null",
1324 - "result": {
1325 - "text": "N/A"
1326 - }
1327 - },
1328 - "type": "special"
1329 - }
1330 - ],
1331 - "thresholds": {
1332 - "mode": "absolute",
1333 - "steps": [
1334 - {
1335 - "color": "blue",
1336 - "value": null
1337 - }
1338 - ]
1339 - },
1340 - "unit": "locale"
1341 - },
1342 - "overrides": []
1343 - },
1344 - "gridPos": {
1345 - "h": 6,
1346 - "w": 4,
1347 - "x": 0,
1348 - "y": 26
1349 - },
1350 - "id": 18,
1351 - "links": [],
1352 - "options": {
1353 - "colorMode": "value",
1354 - "graphMode": "area",
1355 - "justifyMode": "auto",
1356 - "orientation": "horizontal",
1357 - "reduceOptions": {
1358 - "calcs": [
1359 - "sum"
1360 - ],
1361 - "fields": "",
1362 - "values": false
1363 - },
1364 - "text": {},
1365 - "textMode": "auto"
1366 - },
1367 - "pluginVersion": "10.2.0",
1368 - "targets": [
1369 - {
1370 - "bucketAggs": [
1371 - {
1372 - "$$hashKey": "object:331",
1373 - "field": "timestamp",
1374 - "id": "2",
1375 - "settings": {
1376 - "interval": "auto",
1377 - "min_doc_count": 0,
1378 - "trimEdges": 0
1379 - },
1380 - "type": "date_histogram"
1381 - }
1382 - ],
1383 - "datasource": {
1384 - "type": "elasticsearch",
1385 - "uid": "replace_datasource_uid"
1386 - },
1387 - "metrics": [
1388 - {
1389 - "$$hashKey": "object:329",
1390 - "field": "select field",
1391 - "id": "1",
1392 - "type": "count"
1393 - }
1394 - ],
1395 - "query": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoggedIn AND rule_level:$rule_level",
1396 - "refId": "A",
1397 - "timeField": "timestamp"
1398 - }
1399 - ],
1400 - "title": "AZURE AD - TOTAL AUTHS",
1401 - "type": "stat"
1402 - },
1403 - {
1404 - "datasource": {
1405 - "type": "elasticsearch",
1406 - "uid": "replace_datasource_uid"
1407 - },
1408 - "fieldConfig": {
1409 - "defaults": {
1410 - "color": {
1411 - "mode": "thresholds"
1412 - },
1413 - "custom": {
1414 - "align": "auto",
1415 - "cellOptions": {
1416 - "type": "auto"
1417 - },
1418 - "filterable": true,
1419 - "inspect": false
1420 - },
1421 - "mappings": [],
1422 - "thresholds": {
1423 - "mode": "absolute",
1424 - "steps": [
1425 - {
1426 - "color": "green",
1427 - "value": null
1428 - },
1429 - {
1430 - "color": "red",
1431 - "value": 80
1432 - }
1433 - ]
1434 - }
1435 - },
1436 - "overrides": [
1437 - {
1438 - "matcher": {
1439 - "id": "byName",
1440 - "options": "timestamp"
1441 - },
1442 - "properties": [
1443 - {
1444 - "id": "displayName",
1445 - "value": "Date/Time"
1446 - },
1447 - {
1448 - "id": "unit",
1449 - "value": "time: YYYY-MM-DD HH:mm:ss"
1450 - },
1451 - {
1452 - "id": "custom.align"
1453 - }
1454 - ]
1455 - },
1456 - {
1457 - "matcher": {
1458 - "id": "byName",
1459 - "options": "agent_name"
1460 - },
1461 - "properties": [
1462 - {
1463 - "id": "displayName",
1464 - "value": "AGENT"
1465 - },
1466 - {
1467 - "id": "unit",
1468 - "value": "short"
1469 - },
1470 - {
1471 - "id": "decimals",
1472 - "value": 2
1473 - },
1474 - {
1475 - "id": "custom.align"
1476 - }
1477 - ]
1478 - },
1479 - {
1480 - "matcher": {
1481 - "id": "byName",
1482 - "options": "agent_ip"
1483 - },
1484 - "properties": [
1485 - {
1486 - "id": "displayName",
1487 - "value": "IP ADDRESS"
1488 - },
1489 - {
1490 - "id": "unit",
1491 - "value": "short"
1492 - },
1493 - {
1494 - "id": "decimals",
1495 - "value": 2
1496 - },
1497 - {
1498 - "id": "custom.align"
1499 - }
1500 - ]
1501 - },
1502 - {
1503 - "matcher": {
1504 - "id": "byName",
1505 - "options": "rule_level"
1506 - },
1507 - "properties": [
1508 - {
1509 - "id": "displayName",
1510 - "value": "RULE LEVEL"
1511 - },
1512 - {
1513 - "id": "unit",
1514 - "value": "short"
1515 - },
1516 - {
1517 - "id": "decimals",
1518 - "value": -1
1519 - },
1520 - {
1521 - "id": "custom.cellOptions",
1522 - "value": {
1523 - "mode": "gradient",
1524 - "type": "color-background"
1525 - }
1526 - },
1527 - {
1528 - "id": "custom.align"
1529 - },
1530 - {
1531 - "id": "thresholds",
1532 - "value": {
1533 - "mode": "absolute",
1534 - "steps": [
1535 - {
1536 - "color": "#37872D",
1537 - "value": null
1538 - },
1539 - {
1540 - "color": "rgba(237, 129, 40, 0.89)",
1541 - "value": 7
1542 - },
1543 - {
1544 - "color": "rgba(245, 54, 54, 0.9)",
1545 - "value": 12
1546 - }
1547 - ]
1548 - }
1549 - }
1550 - ]
1551 - },
1552 - {
1553 - "matcher": {
1554 - "id": "byName",
1555 - "options": "rule_description"
1556 - },
1557 - "properties": [
1558 - {
1559 - "id": "displayName",
1560 - "value": "RULE DESCRIPTION"
1561 - },
1562 - {
1563 - "id": "unit",
1564 - "value": "short"
1565 - },
1566 - {
1567 - "id": "decimals",
1568 - "value": 2
1569 - },
1570 - {
1571 - "id": "custom.align"
1572 - }
1573 - ]
1574 - },
1575 - {
1576 - "matcher": {
1577 - "id": "byName",
1578 - "options": "Date/Time"
1579 - },
1580 - "properties": [
1581 - {
1582 - "id": "custom.width",
1583 - "value": 242
1584 - }
1585 - ]
1586 - },
1587 - {
1588 - "matcher": {
1589 - "id": "byName",
1590 - "options": "AGENT"
1591 - },
1592 - "properties": [
1593 - {
1594 - "id": "custom.width",
1595 - "value": 160
1596 - }
1597 - ]
1598 - },
1599 - {
1600 - "matcher": {
1601 - "id": "byName",
1602 - "options": "MITRE TACTIC"
1603 - },
1604 - "properties": [
1605 - {
1606 - "id": "custom.width",
1607 - "value": 206
1608 - }
1609 - ]
1610 - },
1611 - {
1612 - "matcher": {
1613 - "id": "byName",
1614 - "options": "RULE LEVEL"
1615 - },
1616 - "properties": [
1617 - {
1618 - "id": "custom.width",
1619 - "value": 122
1620 - }
1621 - ]
1622 - },
1623 - {
1624 - "matcher": {
1625 - "id": "byName",
1626 - "options": "IP ADDRESS"
1627 - },
1628 - "properties": [
1629 - {
1630 - "id": "custom.width",
1631 - "value": 163
1632 - }
1633 - ]
1634 - },
1635 - {
1636 - "matcher": {
1637 - "id": "byName",
1638 - "options": "MITRE TECHNIQUE"
1639 - },
1640 - "properties": [
1641 - {
1642 - "id": "custom.width",
1643 - "value": 312
1644 - }
1645 - ]
1646 - },
1647 - {
1648 - "matcher": {
1649 - "id": "byName",
1650 - "options": "rule_id"
1651 - },
1652 - "properties": [
1653 - {
1654 - "id": "custom.width",
1655 - "value": 96
1656 - }
1657 - ]
1658 - },
1659 - {
1660 - "matcher": {
1661 - "id": "byName",
1662 - "options": "EVENT ID"
1663 - },
1664 - "properties": [
1665 - {
1666 - "id": "links",
1667 - "value": [
1668 - {
1669 - "targetBlank": true,
1670 - "title": "VIEW EVENT DETAILS",
1671 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1672 - }
1673 - ]
1674 - },
1675 - {
1676 - "id": "custom.width",
1677 - "value": 317
1678 - }
1679 - ]
1680 - },
1681 - {
1682 - "matcher": {
1683 - "id": "byName",
1684 - "options": "MITRE ID"
1685 - },
1686 - "properties": [
1687 - {
1688 - "id": "custom.width",
1689 - "value": 146
1690 - }
1691 - ]
1692 - },
1693 - {
1694 - "matcher": {
1695 - "id": "byName",
1696 - "options": "RULE DESCRIPTION"
1697 - },
1698 - "properties": [
1699 - {
1700 - "id": "custom.width",
1701 - "value": 1105
1702 - }
1703 - ]
1704 - },
1705 - {
1706 - "matcher": {
1707 - "id": "byName",
1708 - "options": "LEVEL"
1709 - },
1710 - "properties": [
1711 - {
1712 - "id": "custom.width",
1713 - "value": 112
1714 - }
1715 - ]
1716 - }
1717 - ]
1718 - },
1719 - "gridPos": {
1720 - "h": 16,
1721 - "w": 24,
1722 - "x": 0,
1723 - "y": 32
1724 - },
1725 - "id": 27,
1726 - "options": {
1727 - "cellHeight": "sm",
1728 - "footer": {
1729 - "countRows": false,
1730 - "enablePagination": true,
1731 - "fields": "",
1732 - "reducer": [
1733 - "sum"
1734 - ],
1735 - "show": false
1736 - },
1737 - "showHeader": true,
1738 - "sortBy": []
1739 - },
1740 - "pluginVersion": "10.2.0",
1741 - "targets": [
1742 - {
1743 - "bucketAggs": [],
1744 - "datasource": {
1745 - "type": "elasticsearch",
1746 - "uid": "replace_datasource_uid"
1747 - },
1748 - "metrics": [
1749 - {
1750 - "id": "1",
1751 - "settings": {
1752 - "size": "250"
1753 - },
1754 - "type": "raw_data"
1755 - }
1756 - ],
1757 - "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1758 - "refId": "A",
1759 - "timeField": "timestamp"
1760 - }
1761 - ],
1762 - "title": "EVENTS",
1763 - "transformations": [
1764 - {
1765 - "id": "filterFieldsByName",
1766 - "options": {
1767 - "include": {
1768 - "names": [
1769 - "timestamp",
1770 - "_id",
1771 - "data_office365_Operation",
1772 - "data_office365_Workload",
1773 - "rule_description",
1774 - "rule_mitre_id",
1775 - "rule_mitre_tactic",
1776 - "rule_mitre_technique",
1777 - "syslog_level"
1778 - ]
1779 - }
1780 - }
1781 - },
1782 - {
1783 - "id": "organize",
1784 - "options": {
1785 - "excludeByName": {
1786 - "@metadata_beat": true,
1787 - "@metadata_type": true,
1788 - "@metadata_version": true,
1789 - "IMPHASH": true,
1790 - "MD5": true,
1791 - "SHA1": true,
1792 - "SHA256": true,
1793 - "_id": false,
1794 - "_index": true,
1795 - "_type": true,
1796 - "agent_ephemeral_id": true,
1797 - "agent_hostname": true,
1798 - "agent_id": true,
1799 - "agent_ip_city_name": true,
1800 - "agent_ip_country_code": true,
1801 - "agent_ip_geolocation": true,
1802 - "agent_name": true,
1803 - "agent_type": true,
1804 - "agent_version": true,
1805 - "beats_type": true,
1806 - "cluster_name": true,
1807 - "cluster_node": true,
1808 - "collector_node_id": true,
1809 - "data_alert_action": true,
1810 - "data_alert_category": true,
1811 - "data_alert_gid": true,
1812 - "data_alert_rev": true,
1813 - "data_alert_severity": true,
1814 - "data_alert_signature": true,
1815 - "data_alert_signature_id": true,
1816 - "data_app_proto": true,
1817 - "data_audit_auid": true,
1818 - "data_audit_command": true,
1819 - "data_audit_euid": true,
1820 - "data_audit_exe": true,
1821 - "data_audit_gid": true,
1822 - "data_audit_id": true,
1823 - "data_audit_pid": true,
1824 - "data_audit_res": true,
1825 - "data_audit_session": true,
1826 - "data_audit_type": true,
1827 - "data_audit_uid": true,
1828 - "data_dest_ip": true,
1829 - "data_dest_port": true,
1830 - "data_dstuser": true,
1831 - "data_event_type": true,
1832 - "data_extra_data": true,
1833 - "data_file": true,
1834 - "data_flow_bytes_toclient": true,
1835 - "data_flow_bytes_toserver": true,
1836 - "data_flow_id": true,
1837 - "data_flow_pkts_toclient": true,
1838 - "data_flow_pkts_toserver": true,
1839 - "data_flow_start": true,
1840 - "data_http_http_content_type": true,
1841 - "data_http_http_port": true,
1842 - "data_http_length": true,
1843 - "data_http_status": true,
1844 - "data_http_url": true,
1845 - "data_id": true,
1846 - "data_in_iface": true,
1847 - "data_metadata_flowbits": true,
1848 - "data_metadata_flowints_http_anomaly_count": true,
1849 - "data_metadata_flowints_tcp_retransmission_count": true,
1850 - "data_office365_AADGroupId": true,
1851 - "data_office365_AadAppId": true,
1852 - "data_office365_Action": true,
1853 - "data_office365_Activity": true,
1854 - "data_office365_ActivityId": true,
1855 - "data_office365_ActivityParameters": true,
1856 - "data_office365_Actor": true,
1857 - "data_office365_ActorContextId": true,
1858 - "data_office365_ActorIpAddress": true,
1859 - "data_office365_ActorIpAddress_city_name": true,
1860 - "data_office365_ActorIpAddress_country_code": true,
1861 - "data_office365_ActorIpAddress_geolocation": true,
1862 - "data_office365_ActorUserId": true,
1863 - "data_office365_ActorYammerUserId": true,
1864 - "data_office365_AddOnGuid": true,
1865 - "data_office365_AddOnName": true,
1866 - "data_office365_AddOnType": true,
1867 - "data_office365_AdditionalActionsAndResults": true,
1868 - "data_office365_AdditionalData": true,
1869 - "data_office365_AdditionalInfo": true,
1870 - "data_office365_AffectedItems": true,
1871 - "data_office365_AggregatedWorkspaceInformation_WorkspaceCount": true,
1872 - "data_office365_AggregatedWorkspaceInformation_WorkspacesByCapacitySku": true,
1873 - "data_office365_AggregatedWorkspaceInformation_WorkspacesByType": true,
1874 - "data_office365_AlertEntityId": true,
1875 - "data_office365_AlertId": true,
1876 - "data_office365_AlertLinks": true,
1877 - "data_office365_AlertType": true,
1878 - "data_office365_AppAccessContext_AADSessionId": true,
1879 - "data_office365_AppAccessContext_APIId": true,
1880 - "data_office365_AppAccessContext_ClientAppId": true,
1881 - "data_office365_AppAccessContext_ClientAppName": true,
1882 - "data_office365_AppAccessContext_CorrelationId": true,
1883 - "data_office365_AppAccessContext_UniqueTokenId": true,
1884 - "data_office365_AppDistributionMode": true,
1885 - "data_office365_AppId": true,
1886 - "data_office365_AppName": true,
1887 - "data_office365_AppReportId": true,
1888 - "data_office365_ApplicationDisplayName": true,
1889 - "data_office365_ApplicationId": true,
1890 - "data_office365_ArtifactsShared": true,
1891 - "data_office365_AssertingApplicationId": true,
1892 - "data_office365_Attendees": true,
1893 - "data_office365_AuthDetails": true,
1894 - "data_office365_AzureADAppId": true,
1895 - "data_office365_AzureActiveDirectoryEventType": true,
1896 - "data_office365_BCLValue": true,
1897 - "data_office365_CapacityId": true,
1898 - "data_office365_CapacityName": true,
1899 - "data_office365_Category": true,
1900 - "data_office365_ChannelGuid": true,
1901 - "data_office365_ChannelName": true,
1902 - "data_office365_ChatName": true,
1903 - "data_office365_ChatThreadId": true,
1904 - "data_office365_ClientAppId": true,
1905 - "data_office365_ClientApplication": true,
1906 - "data_office365_ClientApplicationId": true,
1907 - "data_office365_ClientIP": true,
1908 - "data_office365_ClientIPAddress": true,
1909 - "data_office365_ClientIPAddress_city_name": true,
1910 - "data_office365_ClientIPAddress_country_code": true,
1911 - "data_office365_ClientIPAddress_geolocation": true,
1912 - "data_office365_ClientIP_city_name": true,
1913 - "data_office365_ClientIP_country_code": true,
1914 - "data_office365_ClientIP_geolocation": true,
1915 - "data_office365_ClientInfoString": true,
1916 - "data_office365_ClientProcessName": true,
1917 - "data_office365_ClientRequestId": true,
1918 - "data_office365_ClientVersion": true,
1919 - "data_office365_CmdletVersion": true,
1920 - "data_office365_Comments": true,
1921 - "data_office365_Common_ApplicationId": true,
1922 - "data_office365_Common_ApplicationName": true,
1923 - "data_office365_Common_DeviceName": true,
1924 - "data_office365_Common_Platform": true,
1925 - "data_office365_Common_ProcessName": true,
1926 - "data_office365_Common_ProductVersion": true,
1927 - "data_office365_CommunicationSubType": true,
1928 - "data_office365_CommunicationType": true,
1929 - "data_office365_ConsumptionMethod": true,
1930 - "data_office365_CorrelationId": true,
1931 - "data_office365_CreationTime": false,
1932 - "data_office365_CrossMailboxOperation": true,
1933 - "data_office365_CrossScopeSyncDelete": true,
1934 - "data_office365_CustomData": true,
1935 - "data_office365_CustomUniqueId": true,
1936 - "data_office365_CustomizedDoclib": true,
1937 - "data_office365_DashboardId": true,
1938 - "data_office365_DashboardName": true,
1939 - "data_office365_Data": true,
1940 - "data_office365_DataConnectivityMode": true,
1941 - "data_office365_DataType": true,
1942 - "data_office365_DatabaseType": true,
1943 - "data_office365_DataflowAccessTokenRequestParameters_entityName": true,
1944 - "data_office365_DataflowAccessTokenRequestParameters_partitionUri": true,
1945 - "data_office365_DataflowAccessTokenRequestParameters_permissions": true,
1946 - "data_office365_DataflowAccessTokenRequestParameters_tokenLifetimeInMinutes": true,
1947 - "data_office365_DataflowId": true,
1948 - "data_office365_DataflowName": true,
1949 - "data_office365_DataflowType": true,
1950 - "data_office365_DatasetId": true,
1951 - "data_office365_DatasetName": true,
1952 - "data_office365_Datasets": true,
1953 - "data_office365_DatasourceId": true,
1954 - "data_office365_DeliveryAction": true,
1955 - "data_office365_Description": true,
1956 - "data_office365_DestFolder_Id": true,
1957 - "data_office365_DestFolder_Path": true,
1958 - "data_office365_DestinationFileExtension": true,
1959 - "data_office365_DestinationFileName": true,
1960 - "data_office365_DestinationRelativeUrl": true,
1961 - "data_office365_DetectionMethod": true,
1962 - "data_office365_DetectionType": true,
1963 - "data_office365_DeviceId": true,
1964 - "data_office365_DeviceInformation": true,
1965 - "data_office365_DeviceProperties": true,
1966 - "data_office365_Directionality": true,
1967 - "data_office365_DistributionMethod": true,
1968 - "data_office365_DoNotDistributeEvent": true,
1969 - "data_office365_EffectiveOrganization": true,
1970 - "data_office365_EndTime": true,
1971 - "data_office365_Entity": true,
1972 - "data_office365_EntityPath": true,
1973 - "data_office365_EntityType": true,
1974 - "data_office365_ErrorNumber": true,
1975 - "data_office365_EventData": true,
1976 - "data_office365_EventDeepLink": true,
1977 - "data_office365_EventSource": true,
1978 - "data_office365_ExceptionInfo_Reason": true,
1979 - "data_office365_ExchangeId": true,
1980 - "data_office365_ExchangeLocations": true,
1981 - "data_office365_ExchangeMetaData_BCC": true,
1982 - "data_office365_ExchangeMetaData_CC": true,
1983 - "data_office365_ExchangeMetaData_FileSize": true,
1984 - "data_office365_ExchangeMetaData_From": true,
1985 - "data_office365_ExchangeMetaData_MessageID": true,
1986 - "data_office365_ExchangeMetaData_RecipientCount": true,
1987 - "data_office365_ExchangeMetaData_Sent": true,
1988 - "data_office365_ExchangeMetaData_Subject": true,
1989 - "data_office365_ExchangeMetaData_To": true,
1990 - "data_office365_ExchangeMetaData_UniqueID": true,
1991 - "data_office365_ExportedArtifactInfo_ArtifactId": true,
1992 - "data_office365_ExportedArtifactInfo_ArtifactType": true,
1993 - "data_office365_ExportedArtifactInfo_ExportType": true,
1994 - "data_office365_ExtendedProperties": true,
1995 - "data_office365_ExternalAccess": true,
1996 - "data_office365_ExtraProperties": true,
1997 - "data_office365_FileId": true,
1998 - "data_office365_FileName": true,
1999 - "data_office365_FileSizeBytes": true,
2000 - "data_office365_FileSyncBytesCommitted": true,
2001 - "data_office365_FilteringDate": true,
2002 - "data_office365_FlowConnectorNames": true,
2003 - "data_office365_FlowDetailsUrl": true,
2004 - "data_office365_Folder_Id": true,
2005 - "data_office365_Folder_Path": true,
2006 - "data_office365_FormId": true,
2007 - "data_office365_FormName": true,
2008 - "data_office365_FormsUserType": true,
2009 - "data_office365_FromApp": true,
2010 - "data_office365_GatewayClusterDatasources": true,
2011 - "data_office365_GatewayClusterId": true,
2012 - "data_office365_GatewayClusters": true,
2013 - "data_office365_GatewayStatus": true,
2014 - "data_office365_GradingResult_FirstTriagedBy": true,
2015 - "data_office365_GradingResult_Id": true,
2016 - "data_office365_GradingResult_LastUpdatedBy": true,
2017 - "data_office365_GradingResult_Timestamp": true,
2018 - "data_office365_GradingResult_TriageCategory": true,
2019 - "data_office365_GradingResult_TriageVerdict": true,
2020 - "data_office365_HighPriorityMediaProcessing": true,
2021 - "data_office365_HostedContents": true,
2022 - "data_office365_ICalUid": true,
2023 - "data_office365_Id": true,
2024 - "data_office365_ImplicitShare": true,
2025 - "data_office365_ImportDisplayName": true,
2026 - "data_office365_ImportId": true,
2027 - "data_office365_ImportSource": true,
2028 - "data_office365_ImportType": true,
2029 - "data_office365_IncidentId": true,
2030 - "data_office365_InsightData": true,
2031 - "data_office365_InsightId": true,
2032 - "data_office365_InterSystemsId": true,
2033 - "data_office365_InternalLogonType": true,
2034 - "data_office365_InternetMessageId": true,
2035 - "data_office365_IntraSystemId": true,
2036 - "data_office365_IsManagedDevice": true,
2037 - "data_office365_IsSuccess": true,
2038 - "data_office365_IsTenantAdminApi": true,
2039 - "data_office365_ItemCount": true,
2040 - "data_office365_ItemName": true,
2041 - "data_office365_ItemType": true,
2042 - "data_office365_Item_Attachments": true,
2043 - "data_office365_Item_Id": true,
2044 - "data_office365_Item_InternetMessageId": true,
2045 - "data_office365_Item_IsRecord": true,
2046 - "data_office365_Item_ParentFolder_Id": true,
2047 - "data_office365_Item_ParentFolder_Path": true,
2048 - "data_office365_Item_SizeInBytes": true,
2049 - "data_office365_Item_Subject": true,
2050 - "data_office365_JoinTime": true,
2051 - "data_office365_KesMailId": true,
2052 - "data_office365_Language": true,
2053 - "data_office365_LastRefreshTime": true,
2054 - "data_office365_LatestDeliveryLocation": true,
2055 - "data_office365_LeaveTime": true,
2056 - "data_office365_ListBaseTemplateType": true,
2057 - "data_office365_ListBaseType": true,
2058 - "data_office365_ListId": true,
2059 - "data_office365_ListItemUniqueId": true,
2060 - "data_office365_ListTitle": true,
2061 - "data_office365_LogonError": true,
2062 - "data_office365_LogonType": true,
2063 - "data_office365_LogonUserSid": true,
2064 - "data_office365_MachineDomainInfo": true,
2065 - "data_office365_MachineId": true,
2066 - "data_office365_MailboxGuid": true,
2067 - "data_office365_MailboxOwnerSid": true,
2068 - "data_office365_MailboxOwnerUPN": true,
2069 - "data_office365_MeetingDetailId": true,
2070 - "data_office365_MeetingURL": true,
2071 - "data_office365_Members": true,
2072 - "data_office365_MessageDate": true,
2073 - "data_office365_MessageDeleteType": true,
2074 - "data_office365_MessageId": true,
2075 - "data_office365_MessageSizeInBytes": true,
2076 - "data_office365_MessageTime": true,
2077 - "data_office365_MessageURLs": true,
2078 - "data_office365_MessageVersion": true,
2079 - "data_office365_Modalities": true,
2080 - "data_office365_ModelsSnapshots": true,
2081 - "data_office365_ModifiedProperties": true,
2082 - "data_office365_Name": true,
2083 - "data_office365_NetworkMessageId": true,
2084 - "data_office365_NewValue": true,
2085 - "data_office365_NonPIIParameters": true,
2086 - "data_office365_ObjectId": true,
2087 - "data_office365_ObjectName": true,
2088 - "data_office365_ObjectType": true,
2089 - "data_office365_Operation": false,
2090 - "data_office365_OperationDetails": true,
2091 - "data_office365_OperationScope": true,
2092 - "data_office365_OrgAppPermission_permissions": true,
2093 - "data_office365_OrgAppPermission_recipients": true,
2094 - "data_office365_OrganizationId": true,
2095 - "data_office365_OrganizationName": true,
2096 - "data_office365_Organizer_OrganizationId": true,
2097 - "data_office365_Organizer_RecipientType": true,
2098 - "data_office365_Organizer_Role": true,
2099 - "data_office365_Organizer_UserObjectId": true,
2100 - "data_office365_OriginalDeliveryLocation": true,
2101 - "data_office365_OriginatingServer": true,
2102 - "data_office365_P1Sender": true,
2103 - "data_office365_P1SenderDomain": true,
2104 - "data_office365_P2Sender": true,
2105 - "data_office365_P2SenderDomain": true,
2106 - "data_office365_Parameters": true,
2107 - "data_office365_ParentMessageId": true,
2108 - "data_office365_PhishConfidenceLevel": true,
2109 - "data_office365_Policy": true,
2110 - "data_office365_PolicyAction": true,
2111 - "data_office365_PolicyDetails": true,
2112 - "data_office365_PolicyId": true,
2113 - "data_office365_ProviderTypes": true,
2114 - "data_office365_Query": true,
2115 - "data_office365_Recipients": true,
2116 - "data_office365_RecordType": true,
2117 - "data_office365_RefreshType": true,
2118 - "data_office365_RelativeUrl": true,
2119 - "data_office365_ReportId": true,
2120 - "data_office365_ReportName": true,
2121 - "data_office365_ReportType": true,
2122 - "data_office365_RequestId": true,
2123 - "data_office365_RequestSource": true,
2124 - "data_office365_RequestType": true,
2125 - "data_office365_RescanResult_Id": true,
2126 - "data_office365_RescanResult_RescanVerdict": true,
2127 - "data_office365_RescanResult_Timestamp": true,
2128 - "data_office365_ResourceTitle": true,
2129 - "data_office365_ResourceUrl": true,
2130 - "data_office365_ResultCount": true,
2131 - "data_office365_ResultStatus": true,
2132 - "data_office365_Schedules_Days": true,
2133 - "data_office365_Schedules_RefreshFrequency": true,
2134 - "data_office365_Schedules_Time": true,
2135 - "data_office365_Schedules_TimeZone": true,
2136 - "data_office365_Scope": true,
2137 - "data_office365_SecurityComplianceCenterEventType": true,
2138 - "data_office365_SendAsUserMailboxGuid": true,
2139 - "data_office365_SendAsUserSmtp": true,
2140 - "data_office365_SenderIP": true,
2141 - "data_office365_SenderIP_city_name": true,
2142 - "data_office365_SenderIP_country_code": true,
2143 - "data_office365_SenderIP_geolocation": true,
2144 - "data_office365_SenderIp": true,
2145 - "data_office365_SenderIp_city_name": true,
2146 - "data_office365_SenderIp_country_code": true,
2147 - "data_office365_SenderIp_geolocation": true,
2148 - "data_office365_SensitiveInfoDetectionIsIncluded": true,
2149 - "data_office365_SessionId": true,
2150 - "data_office365_Severity": true,
2151 - "data_office365_SharePointMetaData_FileID": true,
2152 - "data_office365_SharePointMetaData_FileName": true,
2153 - "data_office365_SharePointMetaData_FileOwner": true,
2154 - "data_office365_SharePointMetaData_FilePathUrl": true,
2155 - "data_office365_SharePointMetaData_FileSize": true,
2156 - "data_office365_SharePointMetaData_From": true,
2157 - "data_office365_SharePointMetaData_IsViewableByExternalUsers": true,
2158 - "data_office365_SharePointMetaData_IsVisibleOnlyToOdbOwner": true,
2159 - "data_office365_SharePointMetaData_ItemCreationTime": true,
2160 - "data_office365_SharePointMetaData_ItemLastModifiedTime": true,
2161 - "data_office365_SharePointMetaData_ItemLastSharedTime": true,
2162 - "data_office365_SharePointMetaData_SiteCollectionGuid": true,
2163 - "data_office365_SharePointMetaData_SiteCollectionUrl": true,
2164 - "data_office365_SharePointMetaData_UniqueID": true,
2165 - "data_office365_SharingPermission": true,
2166 - "data_office365_Site": true,
2167 - "data_office365_SiteUrl": true,
2168 - "data_office365_SkypeForBusinessEventType": true,
2169 - "data_office365_Source": true,
2170 - "data_office365_SourceApp": true,
2171 - "data_office365_SourceFileExtension": true,
2172 - "data_office365_SourceFileName": true,
2173 - "data_office365_SourceRelativeUrl": true,
2174 - "data_office365_StartTime": true,
2175 - "data_office365_Status": true,
2176 - "data_office365_Subject": true,
2177 - "data_office365_SubmissionId": true,
2178 - "data_office365_SubmissionState": true,
2179 - "data_office365_SubmissionType": true,
2180 - "data_office365_SubscriptionId": true,
2181 - "data_office365_TabType": true,
2182 - "data_office365_Target": true,
2183 - "data_office365_TargetContextId": true,
2184 - "data_office365_TargetUserId": true,
2185 - "data_office365_TargetUserOrGroupName": true,
2186 - "data_office365_TargetUserOrGroupType": true,
2187 - "data_office365_TeamGuid": true,
2188 - "data_office365_TeamName": true,
2189 - "data_office365_TenantName": true,
2190 - "data_office365_ThreadID": true,
2191 - "data_office365_ThreatsAndDetectionTech": true,
2192 - "data_office365_UniqueSharingId": true,
2193 - "data_office365_UserAgent": true,
2194 - "data_office365_UserId": true,
2195 - "data_office365_UserKey": true,
2196 - "data_office365_UserType": true,
2197 - "data_office365_UserTypeInitiated": true,
2198 - "data_office365_UserUPN": true,
2199 - "data_office365_Verdict": true,
2200 - "data_office365_Version": true,
2201 - "data_office365_VersionId": true,
2202 - "data_office365_WebId": true,
2203 - "data_office365_WorkSpaceName": true,
2204 - "data_office365_Workload": false,
2205 - "data_office365_WorkspaceId": true,
2206 - "data_office365_YammerNetworkId": true,
2207 - "data_osquery_action": true,
2208 - "data_osquery_calendarTime": true,
2209 - "data_osquery_columns_address": true,
2210 - "data_osquery_columns_address_city_name": true,
2211 - "data_osquery_columns_address_country_code": true,
2212 - "data_osquery_columns_address_geolocation": true,
2213 - "data_osquery_columns_cmdline": true,
2214 - "data_osquery_columns_cwd": true,
2215 - "data_osquery_columns_description": true,
2216 - "data_osquery_columns_directory": true,
2217 - "data_osquery_columns_disk_bytes_read": true,
2218 - "data_osquery_columns_disk_bytes_written": true,
2219 - "data_osquery_columns_egid": true,
2220 - "data_osquery_columns_euid": true,
2221 - "data_osquery_columns_family": true,
2222 - "data_osquery_columns_fd": true,
2223 - "data_osquery_columns_gid": true,
2224 - "data_osquery_columns_gid_signed": true,
2225 - "data_osquery_columns_host": true,
2226 - "data_osquery_columns_interface": true,
2227 - "data_osquery_columns_local_address": true,
2228 - "data_osquery_columns_local_address_city_name": true,
2229 - "data_osquery_columns_local_address_country_code": true,
2230 - "data_osquery_columns_local_address_geolocation": true,
2231 - "data_osquery_columns_local_port": true,
2232 - "data_osquery_columns_mac": true,
2233 - "data_osquery_columns_name": true,
2234 - "data_osquery_columns_net_namespace": true,
2235 - "data_osquery_columns_nice": true,
2236 - "data_osquery_columns_on_disk": true,
2237 - "data_osquery_columns_parent": true,
2238 - "data_osquery_columns_path": true,
2239 - "data_osquery_columns_pgroup": true,
2240 - "data_osquery_columns_pid": true,
2241 - "data_osquery_columns_port": true,
2242 - "data_osquery_columns_protocol": true,
2243 - "data_osquery_columns_remote_address": true,
2244 - "data_osquery_columns_remote_address_city_name": true,
2245 - "data_osquery_columns_remote_address_country_code": true,
2246 - "data_osquery_columns_remote_address_geolocation": true,
2247 - "data_osquery_columns_remote_port": true,
2248 - "data_osquery_columns_resident_size": true,
2249 - "data_osquery_columns_root": true,
2250 - "data_osquery_columns_sgid": true,
2251 - "data_osquery_columns_shell": true,
2252 - "data_osquery_columns_socket": true,
2253 - "data_osquery_columns_start_time": true,
2254 - "data_osquery_columns_state": true,
2255 - "data_osquery_columns_suid": true,
2256 - "data_osquery_columns_system_time": true,
2257 - "data_osquery_columns_threads": true,
2258 - "data_osquery_columns_time_utc": true,
2259 - "data_osquery_columns_total_size": true,
2260 - "data_osquery_columns_tty": true,
2261 - "data_osquery_columns_type": true,
2262 - "data_osquery_columns_uid": true,
2263 - "data_osquery_columns_uid_signed": true,
2264 - "data_osquery_columns_user": true,
2265 - "data_osquery_columns_user_time": true,
2266 - "data_osquery_columns_username": true,
2267 - "data_osquery_columns_wired_size": true,
2268 - "data_osquery_counter": true,
2269 - "data_osquery_decorations_host_uuid": true,
2270 - "data_osquery_decorations_hostname": true,
2271 - "data_osquery_epoch": true,
2272 - "data_osquery_hostIdentifier": true,
2273 - "data_osquery_name": true,
2274 - "data_osquery_numerics": true,
2275 - "data_osquery_unixTime": true,
2276 - "data_proto": true,
2277 - "data_sca_check_command": true,
2278 - "data_sca_check_compliance_cis": true,
2279 - "data_sca_check_compliance_cis_csc": true,
2280 - "data_sca_check_compliance_gdpr_IV": true,
2281 - "data_sca_check_compliance_gpg_13": true,
2282 - "data_sca_check_compliance_hipaa": true,
2283 - "data_sca_check_compliance_nist_800_53": true,
2284 - "data_sca_check_compliance_pci_dss": true,
2285 - "data_sca_check_compliance_tsc": true,
2286 - "data_sca_check_description": true,
2287 - "data_sca_check_id": true,
2288 - "data_sca_check_previous_result": true,
2289 - "data_sca_check_rationale": true,
2290 - "data_sca_check_remediation": true,
2291 - "data_sca_check_result": true,
2292 - "data_sca_check_title": true,
2293 - "data_sca_description": true,
2294 - "data_sca_failed": true,
2295 - "data_sca_file": true,
2296 - "data_sca_invalid": true,
2297 - "data_sca_passed": true,
2298 - "data_sca_policy": true,
2299 - "data_sca_policy_id": true,
2300 - "data_sca_scan_id": true,
2301 - "data_sca_score": true,
2302 - "data_sca_total_checks": true,
2303 - "data_sca_type": true,
2304 - "data_script": true,
2305 - "data_src_ip": true,
2306 - "data_src_ip_city_name": true,
2307 - "data_src_ip_country_code": true,
2308 - "data_src_ip_geolocation": true,
2309 - "data_src_port": true,
2310 - "data_srcip": true,
2311 - "data_srcip_city_name": true,
2312 - "data_srcip_country_code": true,
2313 - "data_srcip_geolocation": true,
2314 - "data_srcuser": true,
2315 - "data_timestamp": true,
2316 - "data_title": true,
2317 - "data_tls_session_resumed": true,
2318 - "data_tls_version": true,
2319 - "data_tx_id": true,
2320 - "data_type": true,
2321 - "data_win_eventXML_binaryData": true,
2322 - "data_win_eventXML_binaryDataSize": true,
2323 - "data_win_eventXML_param1": true,
2324 - "data_win_eventdata_authenticationPackageName": true,
2325 - "data_win_eventdata_callTrace": true,
2326 - "data_win_eventdata_commandLine": true,
2327 - "data_win_eventdata_company": true,
2328 - "data_win_eventdata_creationUtcTime": true,
2329 - "data_win_eventdata_currentDirectory": true,
2330 - "data_win_eventdata_description": true,
2331 - "data_win_eventdata_destinationHostname": true,
2332 - "data_win_eventdata_destinationIp": true,
2333 - "data_win_eventdata_destinationIp_city_name": true,
2334 - "data_win_eventdata_destinationIp_country_code": true,
2335 - "data_win_eventdata_destinationIp_geolocation": true,
2336 - "data_win_eventdata_destinationIsIpv6": true,
2337 - "data_win_eventdata_destinationPort": true,
2338 - "data_win_eventdata_destinationPortName": true,
2339 - "data_win_eventdata_details": true,
2340 - "data_win_eventdata_elevatedToken": true,
2341 - "data_win_eventdata_eventType": true,
2342 - "data_win_eventdata_fileVersion": true,
2343 - "data_win_eventdata_fileVersion_city_name": true,
2344 - "data_win_eventdata_fileVersion_country_code": true,
2345 - "data_win_eventdata_fileVersion_geolocation": true,
2346 - "data_win_eventdata_grantedAccess": true,
2347 - "data_win_eventdata_hashes": true,
2348 - "data_win_eventdata_image": true,
2349 - "data_win_eventdata_imageLoaded": true,
2350 - "data_win_eventdata_impersonationLevel": true,
2351 - "data_win_eventdata_initiated": true,
2352 - "data_win_eventdata_integrityLevel": true,
2353 - "data_win_eventdata_ipAddress": true,
2354 - "data_win_eventdata_ipPort": true,
2355 - "data_win_eventdata_keyLength": true,
2356 - "data_win_eventdata_logonGuid": true,
2357 - "data_win_eventdata_logonId": true,
2358 - "data_win_eventdata_logonProcessName": true,
2359 - "data_win_eventdata_logonType": true,
2360 - "data_win_eventdata_originalFileName": true,
2361 - "data_win_eventdata_param1": true,
2362 - "data_win_eventdata_param2": true,
2363 - "data_win_eventdata_param3": true,
2364 - "data_win_eventdata_param4": true,
2365 - "data_win_eventdata_parentCommandLine": true,
2366 - "data_win_eventdata_parentImage": true,
2367 - "data_win_eventdata_parentProcessGuid": true,
2368 - "data_win_eventdata_parentProcessId": true,
2369 - "data_win_eventdata_processGuid": true,
2370 - "data_win_eventdata_processId": true,
2371 - "data_win_eventdata_processName": true,
2372 - "data_win_eventdata_product": true,
2373 - "data_win_eventdata_protocol": true,
2374 - "data_win_eventdata_queryName": true,
2375 - "data_win_eventdata_queryResults": true,
2376 - "data_win_eventdata_queryStatus": true,
2377 - "data_win_eventdata_ruleName": true,
2378 - "data_win_eventdata_serviceName": true,
2379 - "data_win_eventdata_serviceSid": true,
2380 - "data_win_eventdata_signature": true,
2381 - "data_win_eventdata_signatureStatus": true,
2382 - "data_win_eventdata_signed": true,
2383 - "data_win_eventdata_sourceHostname": true,
2384 - "data_win_eventdata_sourceImage": true,
2385 - "data_win_eventdata_sourceIp": true,
2386 - "data_win_eventdata_sourceIp_city_name": true,
2387 - "data_win_eventdata_sourceIp_country_code": true,
2388 - "data_win_eventdata_sourceIp_geolocation": true,
2389 - "data_win_eventdata_sourceIsIpv6": true,
2390 - "data_win_eventdata_sourcePort": true,
2391 - "data_win_eventdata_sourceProcessGUID": true,
2392 - "data_win_eventdata_sourceProcessId": true,
2393 - "data_win_eventdata_sourceThreadId": true,
2394 - "data_win_eventdata_status": true,
2395 - "data_win_eventdata_subjectDomainName": true,
2396 - "data_win_eventdata_subjectLogonId": true,
2397 - "data_win_eventdata_subjectUserName": true,
2398 - "data_win_eventdata_subjectUserSid": true,
2399 - "data_win_eventdata_targetDomainName": true,
2400 - "data_win_eventdata_targetFilename": true,
2401 - "data_win_eventdata_targetImage": true,
2402 - "data_win_eventdata_targetLinkedLogonId": true,
2403 - "data_win_eventdata_targetLogonId": true,
2404 - "data_win_eventdata_targetObject": true,
2405 - "data_win_eventdata_targetProcessGUID": true,
2406 - "data_win_eventdata_targetProcessId": true,
2407 - "data_win_eventdata_targetUserName": true,
2408 - "data_win_eventdata_targetUserSid": true,
2409 - "data_win_eventdata_terminalSessionId": true,
2410 - "data_win_eventdata_ticketEncryptionType": true,
2411 - "data_win_eventdata_ticketOptions": true,
2412 - "data_win_eventdata_user": true,
2413 - "data_win_eventdata_utcTime": true,
2414 - "data_win_eventdata_virtualAccount": true,
2415 - "data_win_system_channel": true,
2416 - "data_win_system_computer": true,
2417 - "data_win_system_eventID": true,
2418 - "data_win_system_eventRecordID": true,
2419 - "data_win_system_eventSourceName": true,
2420 - "data_win_system_keywords": true,
2421 - "data_win_system_level": true,
2422 - "data_win_system_message": true,
2423 - "data_win_system_opcode": true,
2424 - "data_win_system_processID": true,
2425 - "data_win_system_providerGuid": true,
2426 - "data_win_system_providerName": true,
2427 - "data_win_system_severityValue": true,
2428 - "data_win_system_systemTime": true,
2429 - "data_win_system_task": true,
2430 - "data_win_system_threadID": true,
2431 - "data_win_system_version": true,
2432 - "decoder_name": true,
2433 - "decoder_parent": true,
2434 - "dns_query": true,
2435 - "dns_query_threat_indicated": true,
2436 - "dst_ip": true,
2437 - "dst_ip_city_name": true,
2438 - "dst_ip_country_code": true,
2439 - "dst_ip_geolocation": true,
2440 - "dst_ip_threat_indicated": true,
2441 - "dst_port": true,
2442 - "ecs_version": true,
2443 - "error": true,
2444 - "event_hash": true,
2445 - "file_path": true,
2446 - "firewall_rule_name": true,
2447 - "full_log": false,
2448 - "gl2_accounted_message_size": true,
2449 - "gl2_message_id": true,
2450 - "gl2_processing_error": true,
2451 - "gl2_remote_ip": true,
2452 - "gl2_remote_port": true,
2453 - "gl2_source_collector": true,
2454 - "gl2_source_input": true,
2455 - "gl2_source_node": true,
2456 - "hash_md5": true,
2457 - "hash_sha1": true,
2458 - "hash_sha256": true,
2459 - "highlight": true,
2460 - "host_architecture": true,
2461 - "host_containerized": true,
2462 - "host_hostname": true,
2463 - "host_id": true,
2464 - "host_ip": true,
2465 - "host_mac": true,
2466 - "host_name": true,
2467 - "host_os_codename": true,
2468 - "host_os_kernel": true,
2469 - "host_os_name": true,
2470 - "host_os_platform": true,
2471 - "host_os_version": true,
2472 - "hostname": true,
2473 - "id": true,
2474 - "input_type": true,
2475 - "level": true,
2476 - "location": true,
2477 - "log_file_path": true,
2478 - "log_offset": true,
2479 - "manager_name": true,
2480 - "message": true,
2481 - "module": true,
2482 - "office_365_login_origin": true,
2483 - "parent_process_cmd_line": true,
2484 - "parent_process_id": true,
2485 - "parent_process_image": true,
2486 - "pid": true,
2487 - "predecoder_hostname": true,
2488 - "predecoder_program_name": true,
2489 - "predecoder_timestamp": true,
2490 - "previous_log": true,
2491 - "previous_output": true,
2492 - "process_cmd_line": true,
2493 - "process_id": true,
2494 - "process_image": true,
2495 - "process_name": true,
2496 - "protocol": true,
2497 - "rule_cis": true,
2498 - "rule_cis_csc": true,
2499 - "rule_firedtimes": true,
2500 - "rule_gdpr": true,
2501 - "rule_gdpr_IV": true,
2502 - "rule_gpg13": true,
2503 - "rule_gpg_13": true,
2504 - "rule_group1": true,
2505 - "rule_groups": true,
2506 - "rule_hipaa": true,
2507 - "rule_id": true,
2508 - "rule_info": true,
2509 - "rule_mail": true,
2510 - "rule_mitre_id": false,
2511 - "rule_mitre_tactic": false,
2512 - "rule_nist_800_53": true,
2513 - "rule_pci_dss": true,
2514 - "rule_tsc": true,
2515 - "scanid": true,
2516 - "service": true,
2517 - "software_package": true,
2518 - "software_vendor": true,
2519 - "sort": true,
2520 - "source": true,
2521 - "src_ip": true,
2522 - "src_ip_city_name": true,
2523 - "src_ip_country_code": true,
2524 - "src_ip_geolocation": true,
2525 - "src_port": true,
2526 - "streams": true,
2527 - "syscheck_attrs_after": true,
2528 - "syscheck_audit_effective_user_id": true,
2529 - "syscheck_audit_effective_user_name": true,
2530 - "syscheck_audit_group_id": true,
2531 - "syscheck_audit_group_name": true,
2532 - "syscheck_audit_login_user_id": true,
2533 - "syscheck_audit_login_user_name": true,
2534 - "syscheck_audit_process_cwd": true,
2535 - "syscheck_audit_process_id": true,
2536 - "syscheck_audit_process_name": true,
2537 - "syscheck_audit_process_parent_cwd": true,
2538 - "syscheck_audit_process_parent_name": true,
2539 - "syscheck_audit_process_ppid": true,
2540 - "syscheck_audit_user_id": true,
2541 - "syscheck_audit_user_name": true,
2542 - "syscheck_changed_attributes": true,
2543 - "syscheck_event": true,
2544 - "syscheck_gid_after": true,
2545 - "syscheck_gname_after": true,
2546 - "syscheck_hard_links": true,
2547 - "syscheck_inode_after": true,
2548 - "syscheck_inode_before": true,
2549 - "syscheck_md5_after": true,
2550 - "syscheck_md5_before": true,
2551 - "syscheck_mode": true,
2552 - "syscheck_mtime_after": true,
2553 - "syscheck_mtime_before": true,
2554 - "syscheck_path": true,
2555 - "syscheck_perm_after": true,
2556 - "syscheck_perm_before": true,
2557 - "syscheck_sha1_after": true,
2558 - "syscheck_sha1_before": true,
2559 - "syscheck_sha256_after": true,
2560 - "syscheck_sha256_before": true,
2561 - "syscheck_size_after": true,
2562 - "syscheck_size_before": true,
2563 - "syscheck_uid_after": true,
2564 - "syscheck_uname_after": true,
2565 - "syscheck_win_perm_after": true,
2566 - "syscheck_win_perm_after_0_allowed": true,
2567 - "syscheck_win_perm_after_0_name": true,
2568 - "syscheck_win_perm_after_1_allowed": true,
2569 - "syscheck_win_perm_after_1_name": true,
2570 - "syscheck_win_perm_after_2_allowed": true,
2571 - "syscheck_win_perm_after_2_name": true,
2572 - "syscheck_win_perm_after_3_allowed": true,
2573 - "syscheck_win_perm_after_3_name": true,
2574 - "syslog_customer": true,
2575 - "syslog_level": false,
2576 - "syslog_tag": true,
2577 - "syslog_type": true,
2578 - "sysmon_event_description": true,
2579 - "threat_ids": true,
2580 - "threat_indicated": true,
2581 - "threat_names": true,
2582 - "time": true,
2583 - "timestamp": true,
2584 - "true": true,
2585 - "user_name": true,
2586 - "win_registry_key": true,
2587 - "win_system_eventID": true,
2588 - "windows_auth_package": true,
2589 - "windows_domain": true,
2590 - "windows_event_id": true,
2591 - "windows_event_severity": true,
2592 - "windows_logon_type": true
2593 - },
2594 - "indexByName": {
2595 - "_id": 1,
2596 - "data_office365_Operation": 4,
2597 - "data_office365_Workload": 3,
2598 - "rule_description": 2,
2599 - "rule_mitre_id": 6,
2600 - "rule_mitre_tactic": 7,
2601 - "rule_mitre_technique": 8,
2602 - "syslog_level": 5,
2603 - "timestamp": 0
2604 - },
2605 - "renameByName": {
2606 - "_id": "EVENT ID",
2607 - "data_office365_CreationTime": "EVENT TIME",
2608 - "data_office365_Operation": "OPERATION",
2609 - "data_office365_Workload": "WORKLOAD",
2610 - "rule_description": "DESCRIPTION",
2611 - "rule_id": "RULE ID",
2612 - "rule_mitre_id": "MITRE ID",
2613 - "rule_mitre_tactic": "MITRE TACTIC",
2614 - "rule_mitre_technique": "MITRE TECHNIQUE",
2615 - "syslog_level": "LEVEL",
2616 - "timestamp": "Date/Time"
2617 - }
2618 - }
2619 - }
2620 - ],
2621 - "transparent": true,
2622 - "type": "table"
2623 - }
2624 - ],
2625 - "refresh": "",
2626 - "schemaVersion": 38,
2627 - "tags": [
2628 - "O365"
2629 - ],
2630 - "templating": {
2631 - "list": [
2632 - {
2633 - "datasource": {
2634 - "type": "elasticsearch",
2635 - "uid": "replace_datasource_uid"
2636 - },
2637 - "filters": [],
2638 - "hide": 0,
2639 - "label": "",
2640 - "name": "Filters",
2641 - "skipUrlSync": false,
2642 - "type": "adhoc"
2643 - },
2644 - {
2645 - "current": {
2646 - "selected": false,
2647 - "text": "All",
2648 - "value": "$__all"
2649 - },
2650 - "datasource": {
2651 - "type": "elasticsearch",
2652 - "uid": "replace_datasource_uid"
2653 - },
2654 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"\"}",
2655 - "hide": 0,
2656 - "includeAll": true,
2657 - "label": "Workload",
2658 - "multi": false,
2659 - "name": "workload",
2660 - "options": [],
2661 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Workload\", \"query\": \"\"}",
2662 - "refresh": 2,
2663 - "regex": "",
2664 - "skipUrlSync": false,
2665 - "sort": 1,
2666 - "tagValuesQuery": "",
2667 - "tagsQuery": "",
2668 - "type": "query",
2669 - "useTags": false
2670 - },
2671 - {
2672 - "current": {
2673 - "selected": false,
2674 - "text": "All",
2675 - "value": "$__all"
2676 - },
2677 - "datasource": {
2678 - "type": "elasticsearch",
2679 - "uid": "replace_datasource_uid"
2680 - },
2681 - "definition": "{\"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2682 - "hide": 0,
2683 - "includeAll": true,
2684 - "label": "Rule Level",
2685 - "multi": false,
2686 - "name": "rule_level",
2687 - "options": [],
2688 - "query": "{\"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2689 - "refresh": 2,
2690 - "regex": "",
2691 - "skipUrlSync": false,
2692 - "sort": 0,
2693 - "type": "query"
2694 - }
2695 - ]
2696 - },
2697 - "time": {
2698 - "from": "now-6h",
2699 - "to": "now"
2700 - },
2701 - "timepicker": {
2702 - "refresh_intervals": [
2703 - "5s",
2704 - "10s",
2705 - "30s",
2706 - "1m",
2707 - "5m",
2708 - "15m",
2709 - "30m",
2710 - "1h",
2711 - "2h",
2712 - "1d"
2713 - ],
2714 - "time_options": [
2715 - "5m",
2716 - "15m",
2717 - "1h",
2718 - "6h",
2719 - "12h",
2720 - "24h",
2721 - "2d",
2722 - "7d",
2723 - "30d"
2724 - ]
2725 - },
2726 - "timezone": "",
2727 - "title": "O365 - _SUMMARY",
2728 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "10.2.0",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Workload:$workload",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + },
168 + {
169 + "matcher": {
170 + "id": "byName",
171 + "options": "Count"
172 + },
173 + "properties": [
174 + {
175 + "id": "displayName",
176 + "value": "ALERTS"
177 + },
178 + {
179 + "id": "unit",
180 + "value": "short"
181 + },
182 + {
183 + "id": "decimals",
184 + "value": 0
185 + }
186 + ]
187 + }
188 + ]
189 + },
190 + "gridPos": {
191 + "h": 7,
192 + "w": 4,
193 + "x": 4,
194 + "y": 0
195 + },
196 + "id": 48,
197 + "options": {
198 + "legend": {
199 + "displayMode": "list",
200 + "placement": "bottom",
201 + "showLegend": false
202 + },
203 + "pieType": "pie",
204 + "reduceOptions": {
205 + "calcs": ["sum"],
206 + "fields": "",
207 + "values": false
208 + },
209 + "tooltip": {
210 + "mode": "single",
211 + "sort": "none"
212 + }
213 + },
214 + "pluginVersion": "8.5.1",
215 + "targets": [
216 + {
217 + "bucketAggs": [
218 + {
219 + "fake": true,
220 + "field": "data_office365_Workload",
221 + "id": "4",
222 + "settings": {
223 + "min_doc_count": 1,
224 + "order": "desc",
225 + "orderBy": "_count",
226 + "size": "10"
227 + },
228 + "type": "terms"
229 + },
230 + {
231 + "field": "data_office365_CreationTime",
232 + "id": "5",
233 + "settings": {
234 + "interval": "auto",
235 + "min_doc_count": "0",
236 + "timeZone": "utc",
237 + "trimEdges": "0"
238 + },
239 + "type": "date_histogram"
240 + }
241 + ],
242 + "datasource": {
243 + "type": "elasticsearch",
244 + "uid": "replace_datasource_uid"
245 + },
246 + "metrics": [
247 + {
248 + "field": "select field",
249 + "id": "1",
250 + "type": "count"
251 + }
252 + ],
253 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
254 + "refId": "A",
255 + "timeField": "timestamp"
256 + }
257 + ],
258 + "title": "EVENTS BY WORKLOAD (Top 10)",
259 + "transformations": [],
260 + "type": "piechart"
261 + },
262 + {
263 + "datasource": {
264 + "type": "grafana-opensearch-datasource",
265 + "uid": "replace_datasource_uid"
266 + },
267 + "fieldConfig": {
268 + "defaults": {
269 + "color": {
270 + "mode": "thresholds"
271 + },
272 + "custom": {
273 + "align": "auto",
274 + "cellOptions": {
275 + "type": "auto"
276 + },
277 + "inspect": false
278 + },
279 + "mappings": [],
280 + "thresholds": {
281 + "mode": "absolute",
282 + "steps": [
283 + {
284 + "color": "red",
285 + "value": null
286 + }
287 + ]
288 + }
289 + },
290 + "overrides": [
291 + {
292 + "matcher": {
293 + "id": "byName",
294 + "options": "Count"
295 + },
296 + "properties": [
297 + {
298 + "id": "displayName",
299 + "value": "EVENTS"
300 + },
301 + {
302 + "id": "unit",
303 + "value": "short"
304 + },
305 + {
306 + "id": "decimals",
307 + "value": -1
308 + },
309 + {
310 + "id": "custom.align"
311 + },
312 + {
313 + "id": "thresholds",
314 + "value": {
315 + "mode": "absolute",
316 + "steps": [
317 + {
318 + "color": "red",
319 + "value": null
320 + }
321 + ]
322 + }
323 + }
324 + ]
325 + }
326 + ]
327 + },
328 + "gridPos": {
329 + "h": 7,
330 + "w": 6,
331 + "x": 8,
332 + "y": 0
333 + },
334 + "id": 31,
335 + "options": {
336 + "cellHeight": "sm",
337 + "footer": {
338 + "countRows": false,
339 + "fields": "",
340 + "reducer": ["sum"],
341 + "show": false
342 + },
343 + "showHeader": true
344 + },
345 + "pluginVersion": "10.2.0",
346 + "targets": [
347 + {
348 + "bucketAggs": [
349 + {
350 + "fake": true,
351 + "field": "data_office365_Workload",
352 + "id": "4",
353 + "settings": {
354 + "min_doc_count": 1,
355 + "order": "desc",
356 + "orderBy": "_count",
357 + "size": "0"
358 + },
359 + "type": "terms"
360 + }
361 + ],
362 + "datasource": {
363 + "type": "elasticsearch",
364 + "uid": "replace_datasource_uid"
365 + },
366 + "metrics": [
367 + {
368 + "field": "select field",
369 + "id": "1",
370 + "type": "count"
371 + }
372 + ],
373 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
374 + "refId": "A",
375 + "timeField": "timestamp"
376 + }
377 + ],
378 + "title": "EVENTS BY WORKLOAD",
379 + "transformations": [
380 + {
381 + "id": "merge",
382 + "options": {
383 + "reducers": []
384 + }
385 + },
386 + {
387 + "id": "organize",
388 + "options": {
389 + "excludeByName": {},
390 + "indexByName": {},
391 + "renameByName": {
392 + "Count": "EVENTS",
393 + "data_office365_Workload": "WORKLOAD"
394 + }
395 + }
396 + }
397 + ],
398 + "type": "table"
399 + },
400 + {
401 + "datasource": {
402 + "type": "elasticsearch",
403 + "uid": "replace_datasource_uid"
404 + },
405 + "fieldConfig": {
406 + "defaults": {
407 + "color": {
408 + "mode": "palette-classic"
409 + },
410 + "custom": {
411 + "hideFrom": {
412 + "legend": false,
413 + "tooltip": false,
414 + "viz": false
415 + }
416 + },
417 + "mappings": []
418 + },
419 + "overrides": [
420 + {
421 + "matcher": {
422 + "id": "byName",
423 + "options": "Count"
424 + },
425 + "properties": [
426 + {
427 + "id": "displayName",
428 + "value": "EVENTS"
429 + },
430 + {
431 + "id": "unit",
432 + "value": "short"
433 + },
434 + {
435 + "id": "decimals",
436 + "value": -1
437 + }
438 + ]
439 + }
440 + ]
441 + },
442 + "gridPos": {
443 + "h": 7,
444 + "w": 4,
445 + "x": 14,
446 + "y": 0
447 + },
448 + "id": 53,
449 + "options": {
450 + "legend": {
451 + "displayMode": "list",
452 + "placement": "bottom",
453 + "showLegend": false
454 + },
455 + "pieType": "donut",
456 + "reduceOptions": {
457 + "calcs": ["sum"],
458 + "fields": "",
459 + "values": false
460 + },
461 + "tooltip": {
462 + "mode": "single",
463 + "sort": "none"
464 + }
465 + },
466 + "pluginVersion": "8.5.1",
467 + "targets": [
468 + {
469 + "bucketAggs": [
470 + {
471 + "fake": true,
472 + "field": "data_office365_Operation",
473 + "id": "4",
474 + "settings": {
475 + "min_doc_count": 1,
476 + "order": "desc",
477 + "orderBy": "_count",
478 + "size": "10"
479 + },
480 + "type": "terms"
481 + },
482 + {
483 + "field": "data_office365_CreationTime",
484 + "id": "5",
485 + "settings": {
486 + "interval": "auto",
487 + "min_doc_count": "0",
488 + "timeZone": "utc",
489 + "trimEdges": "0"
490 + },
491 + "type": "date_histogram"
492 + }
493 + ],
494 + "datasource": {
495 + "type": "elasticsearch",
496 + "uid": "replace_datasource_uid"
497 + },
498 + "metrics": [
499 + {
500 + "field": "select field",
501 + "id": "1",
502 + "type": "count"
503 + }
504 + ],
505 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
506 + "refId": "A",
507 + "timeField": "timestamp"
508 + }
509 + ],
510 + "title": "EVENTS BY OPERATION (Top 10)",
511 + "transformations": [],
512 + "type": "piechart"
513 + },
514 + {
515 + "datasource": {
516 + "type": "elasticsearch",
517 + "uid": "replace_datasource_uid"
518 + },
519 + "fieldConfig": {
520 + "defaults": {
521 + "color": {
522 + "mode": "thresholds"
523 + },
524 + "custom": {
525 + "align": "auto",
526 + "cellOptions": {
527 + "type": "auto"
528 + },
529 + "inspect": false
530 + },
531 + "mappings": [],
532 + "thresholds": {
533 + "mode": "absolute",
534 + "steps": [
535 + {
536 + "color": "red",
537 + "value": null
538 + }
539 + ]
540 + }
541 + },
542 + "overrides": [
543 + {
544 + "matcher": {
545 + "id": "byName",
546 + "options": "Count"
547 + },
548 + "properties": [
549 + {
550 + "id": "displayName",
551 + "value": "EVENTS"
552 + },
553 + {
554 + "id": "unit",
555 + "value": "short"
556 + },
557 + {
558 + "id": "decimals",
559 + "value": -1
560 + },
561 + {
562 + "id": "custom.align"
563 + },
564 + {
565 + "id": "thresholds",
566 + "value": {
567 + "mode": "absolute",
568 + "steps": [
569 + {
570 + "color": "red",
571 + "value": null
572 + }
573 + ]
574 + }
575 + }
576 + ]
577 + }
578 + ]
579 + },
580 + "gridPos": {
581 + "h": 7,
582 + "w": 6,
583 + "x": 18,
584 + "y": 0
585 + },
586 + "id": 54,
587 + "options": {
588 + "cellHeight": "sm",
589 + "footer": {
590 + "countRows": false,
591 + "fields": "",
592 + "reducer": ["sum"],
593 + "show": false
594 + },
595 + "showHeader": true
596 + },
597 + "pluginVersion": "10.2.0",
598 + "targets": [
599 + {
600 + "bucketAggs": [
601 + {
602 + "fake": true,
603 + "field": "data_office365_Operation",
604 + "id": "4",
605 + "settings": {
606 + "min_doc_count": 1,
607 + "order": "desc",
608 + "orderBy": "_count",
609 + "size": "0"
610 + },
611 + "type": "terms"
612 + }
613 + ],
614 + "datasource": {
615 + "type": "elasticsearch",
616 + "uid": "replace_datasource_uid"
617 + },
618 + "metrics": [
619 + {
620 + "field": "select field",
621 + "id": "1",
622 + "type": "count"
623 + }
624 + ],
625 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
626 + "refId": "A",
627 + "timeField": "timestamp"
628 + }
629 + ],
630 + "title": "EVENTS BY OPERATION",
631 + "transformations": [
632 + {
633 + "id": "merge",
634 + "options": {
635 + "reducers": []
636 + }
637 + },
638 + {
639 + "id": "organize",
640 + "options": {
641 + "excludeByName": {},
642 + "indexByName": {},
643 + "renameByName": {
644 + "Count": "EVENTS",
645 + "data_office365_Operation": "OPERATION",
646 + "data_office365_Workload": "WORKLOAD"
647 + }
648 + }
649 + }
650 + ],
651 + "type": "table"
652 + },
653 + {
654 + "datasource": {
655 + "type": "elasticsearch",
656 + "uid": "replace_datasource_uid"
657 + },
658 + "fieldConfig": {
659 + "defaults": {
660 + "color": {
661 + "mode": "thresholds"
662 + },
663 + "mappings": [
664 + {
665 + "options": {
666 + "match": "null",
667 + "result": {
668 + "text": "N/A"
669 + }
670 + },
671 + "type": "special"
672 + }
673 + ],
674 + "max": 15,
675 + "min": 0,
676 + "thresholds": {
677 + "mode": "absolute",
678 + "steps": [
679 + {
680 + "color": "#299c46",
681 + "value": null
682 + },
683 + {
684 + "color": "rgba(237, 129, 40, 0.89)",
685 + "value": 8
686 + },
687 + {
688 + "color": "#d44a3a",
689 + "value": 12
690 + }
691 + ]
692 + },
693 + "unit": "none"
694 + },
695 + "overrides": []
696 + },
697 + "gridPos": {
698 + "h": 7,
699 + "w": 4,
700 + "x": 0,
701 + "y": 7
702 + },
703 + "id": 16,
704 + "links": [],
705 + "options": {
706 + "minVizHeight": 75,
707 + "minVizWidth": 75,
708 + "orientation": "horizontal",
709 + "reduceOptions": {
710 + "calcs": ["max"],
711 + "fields": "",
712 + "values": false
713 + },
714 + "showThresholdLabels": false,
715 + "showThresholdMarkers": true,
716 + "text": {}
717 + },
718 + "pluginVersion": "10.2.0",
719 + "targets": [
720 + {
721 + "bucketAggs": [
722 + {
723 + "field": "timestamp",
724 + "id": "2",
725 + "settings": {
726 + "interval": "auto",
727 + "min_doc_count": 0,
728 + "trimEdges": 0
729 + },
730 + "type": "date_histogram"
731 + }
732 + ],
733 + "datasource": {
734 + "type": "elasticsearch",
735 + "uid": "replace_datasource_uid"
736 + },
737 + "metrics": [
738 + {
739 + "field": "rule_level",
740 + "id": "1",
741 + "meta": {},
742 + "settings": {},
743 + "type": "max"
744 + }
745 + ],
746 + "query": "data_office365_Workload:$workload",
747 + "refId": "A",
748 + "timeField": "timestamp"
749 + }
750 + ],
751 + "title": "MAX SEVERITY (0 - 15)",
752 + "type": "gauge"
753 + },
754 + {
755 + "datasource": {
756 + "type": "grafana-opensearch-datasource",
757 + "uid": "replace_datasource_uid"
758 + },
759 + "fieldConfig": {
760 + "defaults": {
761 + "color": {
762 + "mode": "palette-classic"
763 + },
764 + "custom": {
765 + "axisBorderShow": false,
766 + "axisCenteredZero": false,
767 + "axisColorMode": "text",
768 + "axisLabel": "",
769 + "axisPlacement": "auto",
770 + "barAlignment": 0,
771 + "drawStyle": "line",
772 + "fillOpacity": 0,
773 + "gradientMode": "none",
774 + "hideFrom": {
775 + "legend": false,
776 + "tooltip": false,
777 + "viz": false
778 + },
779 + "insertNulls": false,
780 + "lineInterpolation": "linear",
781 + "lineWidth": 1,
782 + "pointSize": 5,
783 + "scaleDistribution": {
784 + "type": "linear"
785 + },
786 + "showPoints": "auto",
787 + "spanNulls": false,
788 + "stacking": {
789 + "group": "A",
790 + "mode": "none"
791 + },
792 + "thresholdsStyle": {
793 + "mode": "off"
794 + }
795 + },
796 + "mappings": [],
797 + "thresholds": {
798 + "mode": "absolute",
799 + "steps": [
800 + {
801 + "color": "green",
802 + "value": null
803 + },
804 + {
805 + "color": "red",
806 + "value": 80
807 + }
808 + ]
809 + }
810 + },
811 + "overrides": []
812 + },
813 + "gridPos": {
814 + "h": 13,
815 + "w": 20,
816 + "x": 4,
817 + "y": 7
818 + },
819 + "id": 58,
820 + "options": {
821 + "legend": {
822 + "calcs": [],
823 + "displayMode": "table",
824 + "placement": "right",
825 + "showLegend": true
826 + },
827 + "tooltip": {
828 + "mode": "single",
829 + "sort": "none"
830 + }
831 + },
832 + "targets": [
833 + {
834 + "alias": "",
835 + "bucketAggs": [
836 + {
837 + "field": "data_office365_Workload",
838 + "id": "3",
839 + "settings": {
840 + "min_doc_count": "1",
841 + "order": "desc",
842 + "orderBy": "_count",
843 + "size": "10"
844 + },
845 + "type": "terms"
846 + },
847 + {
848 + "field": "timestamp",
849 + "id": "2",
850 + "settings": {
851 + "interval": "auto"
852 + },
853 + "type": "date_histogram"
854 + }
855 + ],
856 + "datasource": {
857 + "type": "grafana-opensearch-datasource",
858 + "uid": "replace_datasource_uid"
859 + },
860 + "format": "table",
861 + "metrics": [
862 + {
863 + "id": "1",
864 + "type": "count"
865 + }
866 + ],
867 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
868 + "queryType": "lucene",
869 + "refId": "A",
870 + "timeField": "timestamp"
871 + }
872 + ],
873 + "title": "TOP 10 WORKLOADS - HISTOGRAM",
874 + "type": "timeseries"
875 + },
876 + {
877 + "datasource": {
878 + "type": "elasticsearch",
879 + "uid": "replace_datasource_uid"
880 + },
881 + "fieldConfig": {
882 + "defaults": {
883 + "mappings": [
884 + {
885 + "options": {
886 + "match": "null",
887 + "result": {
888 + "text": "N/A"
889 + }
890 + },
891 + "type": "special"
892 + }
893 + ],
894 + "thresholds": {
895 + "mode": "absolute",
896 + "steps": [
897 + {
898 + "color": "blue",
899 + "value": null
900 + }
901 + ]
902 + },
903 + "unit": "locale"
904 + },
905 + "overrides": []
906 + },
907 + "gridPos": {
908 + "h": 6,
909 + "w": 4,
910 + "x": 0,
911 + "y": 14
912 + },
913 + "id": 51,
914 + "links": [],
915 + "options": {
916 + "colorMode": "value",
917 + "graphMode": "area",
918 + "justifyMode": "auto",
919 + "orientation": "horizontal",
920 + "reduceOptions": {
921 + "calcs": ["sum"],
922 + "fields": "",
923 + "values": false
924 + },
925 + "text": {},
926 + "textMode": "auto"
927 + },
928 + "pluginVersion": "10.2.0",
929 + "targets": [
930 + {
931 + "bucketAggs": [
932 + {
933 + "$$hashKey": "object:331",
934 + "field": "timestamp",
935 + "id": "2",
936 + "settings": {
937 + "interval": "auto",
938 + "min_doc_count": 0,
939 + "trimEdges": 0
940 + },
941 + "type": "date_histogram"
942 + }
943 + ],
944 + "datasource": {
945 + "type": "elasticsearch",
946 + "uid": "replace_datasource_uid"
947 + },
948 + "metrics": [
949 + {
950 + "$$hashKey": "object:329",
951 + "field": "select field",
952 + "id": "1",
953 + "type": "count"
954 + }
955 + ],
956 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
957 + "refId": "A",
958 + "timeField": "timestamp"
959 + }
960 + ],
961 + "title": "EVENTS (Total)",
962 + "type": "stat"
963 + },
964 + {
965 + "datasource": {
966 + "type": "elasticsearch",
967 + "uid": "replace_datasource_uid"
968 + },
969 + "fieldConfig": {
970 + "defaults": {
971 + "mappings": [
972 + {
973 + "options": {
974 + "match": "null",
975 + "result": {
976 + "text": "N/A"
977 + }
978 + },
979 + "type": "special"
980 + }
981 + ],
982 + "thresholds": {
983 + "mode": "absolute",
984 + "steps": [
985 + {
986 + "color": "red",
987 + "value": null
988 + }
989 + ]
990 + },
991 + "unit": "locale"
992 + },
993 + "overrides": []
994 + },
995 + "gridPos": {
996 + "h": 6,
997 + "w": 4,
998 + "x": 0,
999 + "y": 20
1000 + },
1001 + "id": 52,
1002 + "links": [],
1003 + "options": {
1004 + "colorMode": "value",
1005 + "graphMode": "area",
1006 + "justifyMode": "auto",
1007 + "orientation": "horizontal",
1008 + "reduceOptions": {
1009 + "calcs": ["sum"],
1010 + "fields": "",
1011 + "values": false
1012 + },
1013 + "text": {},
1014 + "textMode": "auto"
1015 + },
1016 + "pluginVersion": "10.2.0",
1017 + "targets": [
1018 + {
1019 + "bucketAggs": [
1020 + {
1021 + "$$hashKey": "object:331",
1022 + "field": "timestamp",
1023 + "id": "2",
1024 + "settings": {
1025 + "interval": "auto",
1026 + "min_doc_count": 0,
1027 + "trimEdges": 0
1028 + },
1029 + "type": "date_histogram"
1030 + }
1031 + ],
1032 + "datasource": {
1033 + "type": "elasticsearch",
1034 + "uid": "replace_datasource_uid"
1035 + },
1036 + "metrics": [
1037 + {
1038 + "$$hashKey": "object:329",
1039 + "field": "select field",
1040 + "id": "1",
1041 + "type": "count"
1042 + }
1043 + ],
1044 + "query": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
1045 + "refId": "A",
1046 + "timeField": "timestamp"
1047 + }
1048 + ],
1049 + "title": "AZURE AD - FAILED AUTHS",
1050 + "type": "stat"
1051 + },
1052 + {
1053 + "circleMaxSize": 30,
1054 + "circleMinSize": 2,
1055 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
1056 + "datasource": {
1057 + "type": "elasticsearch",
1058 + "uid": "replace_datasource_uid"
1059 + },
1060 + "decimals": 0,
1061 + "esMetric": "Count",
1062 + "gridPos": {
1063 + "h": 12,
1064 + "w": 10,
1065 + "x": 4,
1066 + "y": 20
1067 + },
1068 + "hideEmpty": false,
1069 + "hideZero": false,
1070 + "id": 50,
1071 + "initialZoom": 1,
1072 + "locationData": "countries",
1073 + "mapCenter": "(0°, 0°)",
1074 + "mapCenterLatitude": 0,
1075 + "mapCenterLongitude": 0,
1076 + "maxDataPoints": 1,
1077 + "mouseWheelZoom": false,
1078 + "showLegend": true,
1079 + "stickyLabels": false,
1080 + "tableQueryOptions": {
1081 + "geohashField": "geohash",
1082 + "latitudeField": "latitude",
1083 + "longitudeField": "longitude",
1084 + "metricField": "metric",
1085 + "queryType": "geohash"
1086 + },
1087 + "targets": [
1088 + {
1089 + "bucketAggs": [
1090 + {
1091 + "fake": true,
1092 + "field": "data_office365_ActorIpAddress_country_code",
1093 + "id": "3",
1094 + "settings": {
1095 + "min_doc_count": 1,
1096 + "order": "desc",
1097 + "orderBy": "_term",
1098 + "size": "0"
1099 + },
1100 + "type": "terms"
1101 + },
1102 + {
1103 + "field": "timestamp",
1104 + "id": "2",
1105 + "settings": {
1106 + "interval": "auto",
1107 + "min_doc_count": 0,
1108 + "trimEdges": 0
1109 + },
1110 + "type": "date_histogram"
1111 + }
1112 + ],
1113 + "datasource": {
1114 + "type": "elasticsearch",
1115 + "uid": "replace_datasource_uid"
1116 + },
1117 + "metrics": [
1118 + {
1119 + "field": "select field",
1120 + "id": "1",
1121 + "type": "count"
1122 + }
1123 + ],
1124 + "query": "data_office365_Workload:AzureActiveDirectory AND rule_level:$rule_level",
1125 + "refId": "A",
1126 + "timeField": "timestamp"
1127 + }
1128 + ],
1129 + "thresholds": "0,10",
1130 + "title": "AZURE AD - ALL AUTH EVENTS BY COUNTRY",
1131 + "type": "grafana-worldmap-panel",
1132 + "unitPlural": "",
1133 + "unitSingle": "",
1134 + "valueName": "total"
1135 + },
1136 + {
1137 + "datasource": {
1138 + "type": "elasticsearch",
1139 + "uid": "replace_datasource_uid"
1140 + },
1141 + "fieldConfig": {
1142 + "defaults": {
1143 + "color": {
1144 + "mode": "thresholds"
1145 + },
1146 + "custom": {
1147 + "align": "auto",
1148 + "cellOptions": {
1149 + "type": "auto"
1150 + },
1151 + "inspect": false
1152 + },
1153 + "mappings": [],
1154 + "thresholds": {
1155 + "mode": "absolute",
1156 + "steps": [
1157 + {
1158 + "color": "orange",
1159 + "value": null
1160 + }
1161 + ]
1162 + }
1163 + },
1164 + "overrides": [
1165 + {
1166 + "matcher": {
1167 + "id": "byName",
1168 + "options": "Count"
1169 + },
1170 + "properties": [
1171 + {
1172 + "id": "displayName",
1173 + "value": "EVENTS"
1174 + },
1175 + {
1176 + "id": "unit",
1177 + "value": "short"
1178 + },
1179 + {
1180 + "id": "decimals",
1181 + "value": -1
1182 + },
1183 + {
1184 + "id": "custom.align"
1185 + },
1186 + {
1187 + "id": "custom.cellOptions",
1188 + "value": {
1189 + "type": "color-text"
1190 + }
1191 + }
1192 + ]
1193 + },
1194 + {
1195 + "matcher": {
1196 + "id": "byName",
1197 + "options": "AD ACCOUNT"
1198 + },
1199 + "properties": [
1200 + {
1201 + "id": "custom.width",
1202 + "value": 489
1203 + },
1204 + {
1205 + "id": "custom.cellOptions",
1206 + "value": {
1207 + "type": "color-text"
1208 + }
1209 + }
1210 + ]
1211 + }
1212 + ]
1213 + },
1214 + "gridPos": {
1215 + "h": 12,
1216 + "w": 10,
1217 + "x": 14,
1218 + "y": 20
1219 + },
1220 + "id": 55,
1221 + "options": {
1222 + "cellHeight": "sm",
1223 + "footer": {
1224 + "countRows": false,
1225 + "fields": "",
1226 + "reducer": ["sum"],
1227 + "show": false
1228 + },
1229 + "showHeader": true,
1230 + "sortBy": []
1231 + },
1232 + "pluginVersion": "10.2.0",
1233 + "targets": [
1234 + {
1235 + "bucketAggs": [
1236 + {
1237 + "fake": true,
1238 + "field": "data_office365_UserId",
1239 + "id": "4",
1240 + "settings": {
1241 + "min_doc_count": 1,
1242 + "order": "desc",
1243 + "orderBy": "_count",
1244 + "size": "0"
1245 + },
1246 + "type": "terms"
1247 + }
1248 + ],
1249 + "datasource": {
1250 + "type": "elasticsearch",
1251 + "uid": "replace_datasource_uid"
1252 + },
1253 + "metrics": [
1254 + {
1255 + "field": "select field",
1256 + "id": "1",
1257 + "type": "count"
1258 + }
1259 + ],
1260 + "query": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoginFailed AND rule_level:$rule_level",
1261 + "refId": "A",
1262 + "timeField": "timestamp"
1263 + }
1264 + ],
1265 + "title": "FAILED AUTHS BY ACCOUNT",
1266 + "transformations": [
1267 + {
1268 + "id": "merge",
1269 + "options": {
1270 + "reducers": []
1271 + }
1272 + },
1273 + {
1274 + "id": "organize",
1275 + "options": {
1276 + "excludeByName": {},
1277 + "indexByName": {},
1278 + "renameByName": {
1279 + "Count": "EVENTS",
1280 + "data_office365_Operation": "OPERATION",
1281 + "data_office365_UserId": "AD ACCOUNT",
1282 + "data_office365_Workload": "WORKLOAD"
1283 + }
1284 + }
1285 + }
1286 + ],
1287 + "type": "table"
1288 + },
1289 + {
1290 + "datasource": {
1291 + "type": "elasticsearch",
1292 + "uid": "replace_datasource_uid"
1293 + },
1294 + "fieldConfig": {
1295 + "defaults": {
1296 + "mappings": [
1297 + {
1298 + "options": {
1299 + "match": "null",
1300 + "result": {
1301 + "text": "N/A"
1302 + }
1303 + },
1304 + "type": "special"
1305 + }
1306 + ],
1307 + "thresholds": {
1308 + "mode": "absolute",
1309 + "steps": [
1310 + {
1311 + "color": "blue",
1312 + "value": null
1313 + }
1314 + ]
1315 + },
1316 + "unit": "locale"
1317 + },
1318 + "overrides": []
1319 + },
1320 + "gridPos": {
1321 + "h": 6,
1322 + "w": 4,
1323 + "x": 0,
1324 + "y": 26
1325 + },
1326 + "id": 18,
1327 + "links": [],
1328 + "options": {
1329 + "colorMode": "value",
1330 + "graphMode": "area",
1331 + "justifyMode": "auto",
1332 + "orientation": "horizontal",
1333 + "reduceOptions": {
1334 + "calcs": ["sum"],
1335 + "fields": "",
1336 + "values": false
1337 + },
1338 + "text": {},
1339 + "textMode": "auto"
1340 + },
1341 + "pluginVersion": "10.2.0",
1342 + "targets": [
1343 + {
1344 + "bucketAggs": [
1345 + {
1346 + "$$hashKey": "object:331",
1347 + "field": "timestamp",
1348 + "id": "2",
1349 + "settings": {
1350 + "interval": "auto",
1351 + "min_doc_count": 0,
1352 + "trimEdges": 0
1353 + },
1354 + "type": "date_histogram"
1355 + }
1356 + ],
1357 + "datasource": {
1358 + "type": "elasticsearch",
1359 + "uid": "replace_datasource_uid"
1360 + },
1361 + "metrics": [
1362 + {
1363 + "$$hashKey": "object:329",
1364 + "field": "select field",
1365 + "id": "1",
1366 + "type": "count"
1367 + }
1368 + ],
1369 + "query": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoggedIn AND rule_level:$rule_level",
1370 + "refId": "A",
1371 + "timeField": "timestamp"
1372 + }
1373 + ],
1374 + "title": "AZURE AD - TOTAL AUTHS",
1375 + "type": "stat"
1376 + },
1377 + {
1378 + "datasource": {
1379 + "type": "elasticsearch",
1380 + "uid": "replace_datasource_uid"
1381 + },
1382 + "fieldConfig": {
1383 + "defaults": {
1384 + "color": {
1385 + "mode": "thresholds"
1386 + },
1387 + "custom": {
1388 + "align": "auto",
1389 + "cellOptions": {
1390 + "type": "auto"
1391 + },
1392 + "filterable": true,
1393 + "inspect": false
1394 + },
1395 + "mappings": [],
1396 + "thresholds": {
1397 + "mode": "absolute",
1398 + "steps": [
1399 + {
1400 + "color": "green",
1401 + "value": null
1402 + },
1403 + {
1404 + "color": "red",
1405 + "value": 80
1406 + }
1407 + ]
1408 + }
1409 + },
1410 + "overrides": [
1411 + {
1412 + "matcher": {
1413 + "id": "byName",
1414 + "options": "timestamp"
1415 + },
1416 + "properties": [
1417 + {
1418 + "id": "displayName",
1419 + "value": "Date/Time"
1420 + },
1421 + {
1422 + "id": "unit",
1423 + "value": "time: YYYY-MM-DD HH:mm:ss"
1424 + },
1425 + {
1426 + "id": "custom.align"
1427 + }
1428 + ]
1429 + },
1430 + {
1431 + "matcher": {
1432 + "id": "byName",
1433 + "options": "agent_name"
1434 + },
1435 + "properties": [
1436 + {
1437 + "id": "displayName",
1438 + "value": "AGENT"
1439 + },
1440 + {
1441 + "id": "unit",
1442 + "value": "short"
1443 + },
1444 + {
1445 + "id": "decimals",
1446 + "value": 2
1447 + },
1448 + {
1449 + "id": "custom.align"
1450 + }
1451 + ]
1452 + },
1453 + {
1454 + "matcher": {
1455 + "id": "byName",
1456 + "options": "agent_ip"
1457 + },
1458 + "properties": [
1459 + {
1460 + "id": "displayName",
1461 + "value": "IP ADDRESS"
1462 + },
1463 + {
1464 + "id": "unit",
1465 + "value": "short"
1466 + },
1467 + {
1468 + "id": "decimals",
1469 + "value": 2
1470 + },
1471 + {
1472 + "id": "custom.align"
1473 + }
1474 + ]
1475 + },
1476 + {
1477 + "matcher": {
1478 + "id": "byName",
1479 + "options": "rule_level"
1480 + },
1481 + "properties": [
1482 + {
1483 + "id": "displayName",
1484 + "value": "RULE LEVEL"
1485 + },
1486 + {
1487 + "id": "unit",
1488 + "value": "short"
1489 + },
1490 + {
1491 + "id": "decimals",
1492 + "value": -1
1493 + },
1494 + {
1495 + "id": "custom.cellOptions",
1496 + "value": {
1497 + "mode": "gradient",
1498 + "type": "color-background"
1499 + }
1500 + },
1501 + {
1502 + "id": "custom.align"
1503 + },
1504 + {
1505 + "id": "thresholds",
1506 + "value": {
1507 + "mode": "absolute",
1508 + "steps": [
1509 + {
1510 + "color": "#37872D",
1511 + "value": null
1512 + },
1513 + {
1514 + "color": "rgba(237, 129, 40, 0.89)",
1515 + "value": 7
1516 + },
1517 + {
1518 + "color": "rgba(245, 54, 54, 0.9)",
1519 + "value": 12
1520 + }
1521 + ]
1522 + }
1523 + }
1524 + ]
1525 + },
1526 + {
1527 + "matcher": {
1528 + "id": "byName",
1529 + "options": "rule_description"
1530 + },
1531 + "properties": [
1532 + {
1533 + "id": "displayName",
1534 + "value": "RULE DESCRIPTION"
1535 + },
1536 + {
1537 + "id": "unit",
1538 + "value": "short"
1539 + },
1540 + {
1541 + "id": "decimals",
1542 + "value": 2
1543 + },
1544 + {
1545 + "id": "custom.align"
1546 + }
1547 + ]
1548 + },
1549 + {
1550 + "matcher": {
1551 + "id": "byName",
1552 + "options": "Date/Time"
1553 + },
1554 + "properties": [
1555 + {
1556 + "id": "custom.width",
1557 + "value": 242
1558 + }
1559 + ]
1560 + },
1561 + {
1562 + "matcher": {
1563 + "id": "byName",
1564 + "options": "AGENT"
1565 + },
1566 + "properties": [
1567 + {
1568 + "id": "custom.width",
1569 + "value": 160
1570 + }
1571 + ]
1572 + },
1573 + {
1574 + "matcher": {
1575 + "id": "byName",
1576 + "options": "MITRE TACTIC"
1577 + },
1578 + "properties": [
1579 + {
1580 + "id": "custom.width",
1581 + "value": 206
1582 + }
1583 + ]
1584 + },
1585 + {
1586 + "matcher": {
1587 + "id": "byName",
1588 + "options": "RULE LEVEL"
1589 + },
1590 + "properties": [
1591 + {
1592 + "id": "custom.width",
1593 + "value": 122
1594 + }
1595 + ]
1596 + },
1597 + {
1598 + "matcher": {
1599 + "id": "byName",
1600 + "options": "IP ADDRESS"
1601 + },
1602 + "properties": [
1603 + {
1604 + "id": "custom.width",
1605 + "value": 163
1606 + }
1607 + ]
1608 + },
1609 + {
1610 + "matcher": {
1611 + "id": "byName",
1612 + "options": "MITRE TECHNIQUE"
1613 + },
1614 + "properties": [
1615 + {
1616 + "id": "custom.width",
1617 + "value": 312
1618 + }
1619 + ]
1620 + },
1621 + {
1622 + "matcher": {
1623 + "id": "byName",
1624 + "options": "rule_id"
1625 + },
1626 + "properties": [
1627 + {
1628 + "id": "custom.width",
1629 + "value": 96
1630 + }
1631 + ]
1632 + },
1633 + {
1634 + "matcher": {
1635 + "id": "byName",
1636 + "options": "EVENT ID"
1637 + },
1638 + "properties": [
1639 + {
1640 + "id": "links",
1641 + "value": [
1642 + {
1643 + "targetBlank": true,
1644 + "title": "VIEW EVENT DETAILS",
1645 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1646 + }
1647 + ]
1648 + },
1649 + {
1650 + "id": "custom.width",
1651 + "value": 317
1652 + }
1653 + ]
1654 + },
1655 + {
1656 + "matcher": {
1657 + "id": "byName",
1658 + "options": "MITRE ID"
1659 + },
1660 + "properties": [
1661 + {
1662 + "id": "custom.width",
1663 + "value": 146
1664 + }
1665 + ]
1666 + },
1667 + {
1668 + "matcher": {
1669 + "id": "byName",
1670 + "options": "RULE DESCRIPTION"
1671 + },
1672 + "properties": [
1673 + {
1674 + "id": "custom.width",
1675 + "value": 1105
1676 + }
1677 + ]
1678 + },
1679 + {
1680 + "matcher": {
1681 + "id": "byName",
1682 + "options": "LEVEL"
1683 + },
1684 + "properties": [
1685 + {
1686 + "id": "custom.width",
1687 + "value": 112
1688 + }
1689 + ]
1690 + }
1691 + ]
1692 + },
1693 + "gridPos": {
1694 + "h": 16,
1695 + "w": 24,
1696 + "x": 0,
1697 + "y": 32
1698 + },
1699 + "id": 27,
1700 + "options": {
1701 + "cellHeight": "sm",
1702 + "footer": {
1703 + "countRows": false,
1704 + "enablePagination": true,
1705 + "fields": "",
1706 + "reducer": ["sum"],
1707 + "show": false
1708 + },
1709 + "showHeader": true,
1710 + "sortBy": []
1711 + },
1712 + "pluginVersion": "10.2.0",
1713 + "targets": [
1714 + {
1715 + "bucketAggs": [],
1716 + "datasource": {
1717 + "type": "elasticsearch",
1718 + "uid": "replace_datasource_uid"
1719 + },
1720 + "metrics": [
1721 + {
1722 + "id": "1",
1723 + "settings": {
1724 + "size": "250"
1725 + },
1726 + "type": "raw_data"
1727 + }
1728 + ],
1729 + "query": "data_office365_Workload:$workload AND rule_level:$rule_level",
1730 + "refId": "A",
1731 + "timeField": "timestamp"
1732 + }
1733 + ],
1734 + "title": "EVENTS",
1735 + "transformations": [
1736 + {
1737 + "id": "filterFieldsByName",
1738 + "options": {
1739 + "include": {
1740 + "names": [
1741 + "timestamp",
1742 + "_id",
1743 + "data_office365_Operation",
1744 + "data_office365_Workload",
1745 + "rule_description",
1746 + "rule_mitre_id",
1747 + "rule_mitre_tactic",
1748 + "rule_mitre_technique",
1749 + "syslog_level"
1750 + ]
1751 + }
1752 + }
1753 + },
1754 + {
1755 + "id": "organize",
1756 + "options": {
1757 + "excludeByName": {
1758 + "@metadata_beat": true,
1759 + "@metadata_type": true,
1760 + "@metadata_version": true,
1761 + "IMPHASH": true,
1762 + "MD5": true,
1763 + "SHA1": true,
1764 + "SHA256": true,
1765 + "_id": false,
1766 + "_index": true,
1767 + "_type": true,
1768 + "agent_ephemeral_id": true,
1769 + "agent_hostname": true,
1770 + "agent_id": true,
1771 + "agent_ip_city_name": true,
1772 + "agent_ip_country_code": true,
1773 + "agent_ip_geolocation": true,
1774 + "agent_name": true,
1775 + "agent_type": true,
1776 + "agent_version": true,
1777 + "beats_type": true,
1778 + "cluster_name": true,
1779 + "cluster_node": true,
1780 + "collector_node_id": true,
1781 + "data_alert_action": true,
1782 + "data_alert_category": true,
1783 + "data_alert_gid": true,
1784 + "data_alert_rev": true,
1785 + "data_alert_severity": true,
1786 + "data_alert_signature": true,
1787 + "data_alert_signature_id": true,
1788 + "data_app_proto": true,
1789 + "data_audit_auid": true,
1790 + "data_audit_command": true,
1791 + "data_audit_euid": true,
1792 + "data_audit_exe": true,
1793 + "data_audit_gid": true,
1794 + "data_audit_id": true,
1795 + "data_audit_pid": true,
1796 + "data_audit_res": true,
1797 + "data_audit_session": true,
1798 + "data_audit_type": true,
1799 + "data_audit_uid": true,
1800 + "data_dest_ip": true,
1801 + "data_dest_port": true,
1802 + "data_dstuser": true,
1803 + "data_event_type": true,
1804 + "data_extra_data": true,
1805 + "data_file": true,
1806 + "data_flow_bytes_toclient": true,
1807 + "data_flow_bytes_toserver": true,
1808 + "data_flow_id": true,
1809 + "data_flow_pkts_toclient": true,
1810 + "data_flow_pkts_toserver": true,
1811 + "data_flow_start": true,
1812 + "data_http_http_content_type": true,
1813 + "data_http_http_port": true,
1814 + "data_http_length": true,
1815 + "data_http_status": true,
1816 + "data_http_url": true,
1817 + "data_id": true,
1818 + "data_in_iface": true,
1819 + "data_metadata_flowbits": true,
1820 + "data_metadata_flowints_http_anomaly_count": true,
1821 + "data_metadata_flowints_tcp_retransmission_count": true,
1822 + "data_office365_AADGroupId": true,
1823 + "data_office365_AadAppId": true,
1824 + "data_office365_Action": true,
1825 + "data_office365_Activity": true,
1826 + "data_office365_ActivityId": true,
1827 + "data_office365_ActivityParameters": true,
1828 + "data_office365_Actor": true,
1829 + "data_office365_ActorContextId": true,
1830 + "data_office365_ActorIpAddress": true,
1831 + "data_office365_ActorIpAddress_city_name": true,
1832 + "data_office365_ActorIpAddress_country_code": true,
1833 + "data_office365_ActorIpAddress_geolocation": true,
1834 + "data_office365_ActorUserId": true,
1835 + "data_office365_ActorYammerUserId": true,
1836 + "data_office365_AddOnGuid": true,
1837 + "data_office365_AddOnName": true,
1838 + "data_office365_AddOnType": true,
1839 + "data_office365_AdditionalActionsAndResults": true,
1840 + "data_office365_AdditionalData": true,
1841 + "data_office365_AdditionalInfo": true,
1842 + "data_office365_AffectedItems": true,
1843 + "data_office365_AggregatedWorkspaceInformation_WorkspaceCount": true,
1844 + "data_office365_AggregatedWorkspaceInformation_WorkspacesByCapacitySku": true,
1845 + "data_office365_AggregatedWorkspaceInformation_WorkspacesByType": true,
1846 + "data_office365_AlertEntityId": true,
1847 + "data_office365_AlertId": true,
1848 + "data_office365_AlertLinks": true,
1849 + "data_office365_AlertType": true,
1850 + "data_office365_AppAccessContext_AADSessionId": true,
1851 + "data_office365_AppAccessContext_APIId": true,
1852 + "data_office365_AppAccessContext_ClientAppId": true,
1853 + "data_office365_AppAccessContext_ClientAppName": true,
1854 + "data_office365_AppAccessContext_CorrelationId": true,
1855 + "data_office365_AppAccessContext_UniqueTokenId": true,
1856 + "data_office365_AppDistributionMode": true,
1857 + "data_office365_AppId": true,
1858 + "data_office365_AppName": true,
1859 + "data_office365_AppReportId": true,
1860 + "data_office365_ApplicationDisplayName": true,
1861 + "data_office365_ApplicationId": true,
1862 + "data_office365_ArtifactsShared": true,
1863 + "data_office365_AssertingApplicationId": true,
1864 + "data_office365_Attendees": true,
1865 + "data_office365_AuthDetails": true,
1866 + "data_office365_AzureADAppId": true,
1867 + "data_office365_AzureActiveDirectoryEventType": true,
1868 + "data_office365_BCLValue": true,
1869 + "data_office365_CapacityId": true,
1870 + "data_office365_CapacityName": true,
1871 + "data_office365_Category": true,
1872 + "data_office365_ChannelGuid": true,
1873 + "data_office365_ChannelName": true,
1874 + "data_office365_ChatName": true,
1875 + "data_office365_ChatThreadId": true,
1876 + "data_office365_ClientAppId": true,
1877 + "data_office365_ClientApplication": true,
1878 + "data_office365_ClientApplicationId": true,
1879 + "data_office365_ClientIP": true,
1880 + "data_office365_ClientIPAddress": true,
1881 + "data_office365_ClientIPAddress_city_name": true,
1882 + "data_office365_ClientIPAddress_country_code": true,
1883 + "data_office365_ClientIPAddress_geolocation": true,
1884 + "data_office365_ClientIP_city_name": true,
1885 + "data_office365_ClientIP_country_code": true,
1886 + "data_office365_ClientIP_geolocation": true,
1887 + "data_office365_ClientInfoString": true,
1888 + "data_office365_ClientProcessName": true,
1889 + "data_office365_ClientRequestId": true,
1890 + "data_office365_ClientVersion": true,
1891 + "data_office365_CmdletVersion": true,
1892 + "data_office365_Comments": true,
1893 + "data_office365_Common_ApplicationId": true,
1894 + "data_office365_Common_ApplicationName": true,
1895 + "data_office365_Common_DeviceName": true,
1896 + "data_office365_Common_Platform": true,
1897 + "data_office365_Common_ProcessName": true,
1898 + "data_office365_Common_ProductVersion": true,
1899 + "data_office365_CommunicationSubType": true,
1900 + "data_office365_CommunicationType": true,
1901 + "data_office365_ConsumptionMethod": true,
1902 + "data_office365_CorrelationId": true,
1903 + "data_office365_CreationTime": false,
1904 + "data_office365_CrossMailboxOperation": true,
1905 + "data_office365_CrossScopeSyncDelete": true,
1906 + "data_office365_CustomData": true,
1907 + "data_office365_CustomUniqueId": true,
1908 + "data_office365_CustomizedDoclib": true,
1909 + "data_office365_DashboardId": true,
1910 + "data_office365_DashboardName": true,
1911 + "data_office365_Data": true,
1912 + "data_office365_DataConnectivityMode": true,
1913 + "data_office365_DataType": true,
1914 + "data_office365_DatabaseType": true,
1915 + "data_office365_DataflowAccessTokenRequestParameters_entityName": true,
1916 + "data_office365_DataflowAccessTokenRequestParameters_partitionUri": true,
1917 + "data_office365_DataflowAccessTokenRequestParameters_permissions": true,
1918 + "data_office365_DataflowAccessTokenRequestParameters_tokenLifetimeInMinutes": true,
1919 + "data_office365_DataflowId": true,
1920 + "data_office365_DataflowName": true,
1921 + "data_office365_DataflowType": true,
1922 + "data_office365_DatasetId": true,
1923 + "data_office365_DatasetName": true,
1924 + "data_office365_Datasets": true,
1925 + "data_office365_DatasourceId": true,
1926 + "data_office365_DeliveryAction": true,
1927 + "data_office365_Description": true,
1928 + "data_office365_DestFolder_Id": true,
1929 + "data_office365_DestFolder_Path": true,
1930 + "data_office365_DestinationFileExtension": true,
1931 + "data_office365_DestinationFileName": true,
1932 + "data_office365_DestinationRelativeUrl": true,
1933 + "data_office365_DetectionMethod": true,
1934 + "data_office365_DetectionType": true,
1935 + "data_office365_DeviceId": true,
1936 + "data_office365_DeviceInformation": true,
1937 + "data_office365_DeviceProperties": true,
1938 + "data_office365_Directionality": true,
1939 + "data_office365_DistributionMethod": true,
1940 + "data_office365_DoNotDistributeEvent": true,
1941 + "data_office365_EffectiveOrganization": true,
1942 + "data_office365_EndTime": true,
1943 + "data_office365_Entity": true,
1944 + "data_office365_EntityPath": true,
1945 + "data_office365_EntityType": true,
1946 + "data_office365_ErrorNumber": true,
1947 + "data_office365_EventData": true,
1948 + "data_office365_EventDeepLink": true,
1949 + "data_office365_EventSource": true,
1950 + "data_office365_ExceptionInfo_Reason": true,
1951 + "data_office365_ExchangeId": true,
1952 + "data_office365_ExchangeLocations": true,
1953 + "data_office365_ExchangeMetaData_BCC": true,
1954 + "data_office365_ExchangeMetaData_CC": true,
1955 + "data_office365_ExchangeMetaData_FileSize": true,
1956 + "data_office365_ExchangeMetaData_From": true,
1957 + "data_office365_ExchangeMetaData_MessageID": true,
1958 + "data_office365_ExchangeMetaData_RecipientCount": true,
1959 + "data_office365_ExchangeMetaData_Sent": true,
1960 + "data_office365_ExchangeMetaData_Subject": true,
1961 + "data_office365_ExchangeMetaData_To": true,
1962 + "data_office365_ExchangeMetaData_UniqueID": true,
1963 + "data_office365_ExportedArtifactInfo_ArtifactId": true,
1964 + "data_office365_ExportedArtifactInfo_ArtifactType": true,
1965 + "data_office365_ExportedArtifactInfo_ExportType": true,
1966 + "data_office365_ExtendedProperties": true,
1967 + "data_office365_ExternalAccess": true,
1968 + "data_office365_ExtraProperties": true,
1969 + "data_office365_FileId": true,
1970 + "data_office365_FileName": true,
1971 + "data_office365_FileSizeBytes": true,
1972 + "data_office365_FileSyncBytesCommitted": true,
1973 + "data_office365_FilteringDate": true,
1974 + "data_office365_FlowConnectorNames": true,
1975 + "data_office365_FlowDetailsUrl": true,
1976 + "data_office365_Folder_Id": true,
1977 + "data_office365_Folder_Path": true,
1978 + "data_office365_FormId": true,
1979 + "data_office365_FormName": true,
1980 + "data_office365_FormsUserType": true,
1981 + "data_office365_FromApp": true,
1982 + "data_office365_GatewayClusterDatasources": true,
1983 + "data_office365_GatewayClusterId": true,
1984 + "data_office365_GatewayClusters": true,
1985 + "data_office365_GatewayStatus": true,
1986 + "data_office365_GradingResult_FirstTriagedBy": true,
1987 + "data_office365_GradingResult_Id": true,
1988 + "data_office365_GradingResult_LastUpdatedBy": true,
1989 + "data_office365_GradingResult_Timestamp": true,
1990 + "data_office365_GradingResult_TriageCategory": true,
1991 + "data_office365_GradingResult_TriageVerdict": true,
1992 + "data_office365_HighPriorityMediaProcessing": true,
1993 + "data_office365_HostedContents": true,
1994 + "data_office365_ICalUid": true,
1995 + "data_office365_Id": true,
1996 + "data_office365_ImplicitShare": true,
1997 + "data_office365_ImportDisplayName": true,
1998 + "data_office365_ImportId": true,
1999 + "data_office365_ImportSource": true,
2000 + "data_office365_ImportType": true,
2001 + "data_office365_IncidentId": true,
2002 + "data_office365_InsightData": true,
2003 + "data_office365_InsightId": true,
2004 + "data_office365_InterSystemsId": true,
2005 + "data_office365_InternalLogonType": true,
2006 + "data_office365_InternetMessageId": true,
2007 + "data_office365_IntraSystemId": true,
2008 + "data_office365_IsManagedDevice": true,
2009 + "data_office365_IsSuccess": true,
2010 + "data_office365_IsTenantAdminApi": true,
2011 + "data_office365_ItemCount": true,
2012 + "data_office365_ItemName": true,
2013 + "data_office365_ItemType": true,
2014 + "data_office365_Item_Attachments": true,
2015 + "data_office365_Item_Id": true,
2016 + "data_office365_Item_InternetMessageId": true,
2017 + "data_office365_Item_IsRecord": true,
2018 + "data_office365_Item_ParentFolder_Id": true,
2019 + "data_office365_Item_ParentFolder_Path": true,
2020 + "data_office365_Item_SizeInBytes": true,
2021 + "data_office365_Item_Subject": true,
2022 + "data_office365_JoinTime": true,
2023 + "data_office365_KesMailId": true,
2024 + "data_office365_Language": true,
2025 + "data_office365_LastRefreshTime": true,
2026 + "data_office365_LatestDeliveryLocation": true,
2027 + "data_office365_LeaveTime": true,
2028 + "data_office365_ListBaseTemplateType": true,
2029 + "data_office365_ListBaseType": true,
2030 + "data_office365_ListId": true,
2031 + "data_office365_ListItemUniqueId": true,
2032 + "data_office365_ListTitle": true,
2033 + "data_office365_LogonError": true,
2034 + "data_office365_LogonType": true,
2035 + "data_office365_LogonUserSid": true,
2036 + "data_office365_MachineDomainInfo": true,
2037 + "data_office365_MachineId": true,
2038 + "data_office365_MailboxGuid": true,
2039 + "data_office365_MailboxOwnerSid": true,
2040 + "data_office365_MailboxOwnerUPN": true,
2041 + "data_office365_MeetingDetailId": true,
2042 + "data_office365_MeetingURL": true,
2043 + "data_office365_Members": true,
2044 + "data_office365_MessageDate": true,
2045 + "data_office365_MessageDeleteType": true,
2046 + "data_office365_MessageId": true,
2047 + "data_office365_MessageSizeInBytes": true,
2048 + "data_office365_MessageTime": true,
2049 + "data_office365_MessageURLs": true,
2050 + "data_office365_MessageVersion": true,
2051 + "data_office365_Modalities": true,
2052 + "data_office365_ModelsSnapshots": true,
2053 + "data_office365_ModifiedProperties": true,
2054 + "data_office365_Name": true,
2055 + "data_office365_NetworkMessageId": true,
2056 + "data_office365_NewValue": true,
2057 + "data_office365_NonPIIParameters": true,
2058 + "data_office365_ObjectId": true,
2059 + "data_office365_ObjectName": true,
2060 + "data_office365_ObjectType": true,
2061 + "data_office365_Operation": false,
2062 + "data_office365_OperationDetails": true,
2063 + "data_office365_OperationScope": true,
2064 + "data_office365_OrgAppPermission_permissions": true,
2065 + "data_office365_OrgAppPermission_recipients": true,
2066 + "data_office365_OrganizationId": true,
2067 + "data_office365_OrganizationName": true,
2068 + "data_office365_Organizer_OrganizationId": true,
2069 + "data_office365_Organizer_RecipientType": true,
2070 + "data_office365_Organizer_Role": true,
2071 + "data_office365_Organizer_UserObjectId": true,
2072 + "data_office365_OriginalDeliveryLocation": true,
2073 + "data_office365_OriginatingServer": true,
2074 + "data_office365_P1Sender": true,
2075 + "data_office365_P1SenderDomain": true,
2076 + "data_office365_P2Sender": true,
2077 + "data_office365_P2SenderDomain": true,
2078 + "data_office365_Parameters": true,
2079 + "data_office365_ParentMessageId": true,
2080 + "data_office365_PhishConfidenceLevel": true,
2081 + "data_office365_Policy": true,
2082 + "data_office365_PolicyAction": true,
2083 + "data_office365_PolicyDetails": true,
2084 + "data_office365_PolicyId": true,
2085 + "data_office365_ProviderTypes": true,
2086 + "data_office365_Query": true,
2087 + "data_office365_Recipients": true,
2088 + "data_office365_RecordType": true,
2089 + "data_office365_RefreshType": true,
2090 + "data_office365_RelativeUrl": true,
2091 + "data_office365_ReportId": true,
2092 + "data_office365_ReportName": true,
2093 + "data_office365_ReportType": true,
2094 + "data_office365_RequestId": true,
2095 + "data_office365_RequestSource": true,
2096 + "data_office365_RequestType": true,
2097 + "data_office365_RescanResult_Id": true,
2098 + "data_office365_RescanResult_RescanVerdict": true,
2099 + "data_office365_RescanResult_Timestamp": true,
2100 + "data_office365_ResourceTitle": true,
2101 + "data_office365_ResourceUrl": true,
2102 + "data_office365_ResultCount": true,
2103 + "data_office365_ResultStatus": true,
2104 + "data_office365_Schedules_Days": true,
2105 + "data_office365_Schedules_RefreshFrequency": true,
2106 + "data_office365_Schedules_Time": true,
2107 + "data_office365_Schedules_TimeZone": true,
2108 + "data_office365_Scope": true,
2109 + "data_office365_SecurityComplianceCenterEventType": true,
2110 + "data_office365_SendAsUserMailboxGuid": true,
2111 + "data_office365_SendAsUserSmtp": true,
2112 + "data_office365_SenderIP": true,
2113 + "data_office365_SenderIP_city_name": true,
2114 + "data_office365_SenderIP_country_code": true,
2115 + "data_office365_SenderIP_geolocation": true,
2116 + "data_office365_SenderIp": true,
2117 + "data_office365_SenderIp_city_name": true,
2118 + "data_office365_SenderIp_country_code": true,
2119 + "data_office365_SenderIp_geolocation": true,
2120 + "data_office365_SensitiveInfoDetectionIsIncluded": true,
2121 + "data_office365_SessionId": true,
2122 + "data_office365_Severity": true,
2123 + "data_office365_SharePointMetaData_FileID": true,
2124 + "data_office365_SharePointMetaData_FileName": true,
2125 + "data_office365_SharePointMetaData_FileOwner": true,
2126 + "data_office365_SharePointMetaData_FilePathUrl": true,
2127 + "data_office365_SharePointMetaData_FileSize": true,
2128 + "data_office365_SharePointMetaData_From": true,
2129 + "data_office365_SharePointMetaData_IsViewableByExternalUsers": true,
2130 + "data_office365_SharePointMetaData_IsVisibleOnlyToOdbOwner": true,
2131 + "data_office365_SharePointMetaData_ItemCreationTime": true,
2132 + "data_office365_SharePointMetaData_ItemLastModifiedTime": true,
2133 + "data_office365_SharePointMetaData_ItemLastSharedTime": true,
2134 + "data_office365_SharePointMetaData_SiteCollectionGuid": true,
2135 + "data_office365_SharePointMetaData_SiteCollectionUrl": true,
2136 + "data_office365_SharePointMetaData_UniqueID": true,
2137 + "data_office365_SharingPermission": true,
2138 + "data_office365_Site": true,
2139 + "data_office365_SiteUrl": true,
2140 + "data_office365_SkypeForBusinessEventType": true,
2141 + "data_office365_Source": true,
2142 + "data_office365_SourceApp": true,
2143 + "data_office365_SourceFileExtension": true,
2144 + "data_office365_SourceFileName": true,
2145 + "data_office365_SourceRelativeUrl": true,
2146 + "data_office365_StartTime": true,
2147 + "data_office365_Status": true,
2148 + "data_office365_Subject": true,
2149 + "data_office365_SubmissionId": true,
2150 + "data_office365_SubmissionState": true,
2151 + "data_office365_SubmissionType": true,
2152 + "data_office365_SubscriptionId": true,
2153 + "data_office365_TabType": true,
2154 + "data_office365_Target": true,
2155 + "data_office365_TargetContextId": true,
2156 + "data_office365_TargetUserId": true,
2157 + "data_office365_TargetUserOrGroupName": true,
2158 + "data_office365_TargetUserOrGroupType": true,
2159 + "data_office365_TeamGuid": true,
2160 + "data_office365_TeamName": true,
2161 + "data_office365_TenantName": true,
2162 + "data_office365_ThreadID": true,
2163 + "data_office365_ThreatsAndDetectionTech": true,
2164 + "data_office365_UniqueSharingId": true,
2165 + "data_office365_UserAgent": true,
2166 + "data_office365_UserId": true,
2167 + "data_office365_UserKey": true,
2168 + "data_office365_UserType": true,
2169 + "data_office365_UserTypeInitiated": true,
2170 + "data_office365_UserUPN": true,
2171 + "data_office365_Verdict": true,
2172 + "data_office365_Version": true,
2173 + "data_office365_VersionId": true,
2174 + "data_office365_WebId": true,
2175 + "data_office365_WorkSpaceName": true,
2176 + "data_office365_Workload": false,
2177 + "data_office365_WorkspaceId": true,
2178 + "data_office365_YammerNetworkId": true,
2179 + "data_osquery_action": true,
2180 + "data_osquery_calendarTime": true,
2181 + "data_osquery_columns_address": true,
2182 + "data_osquery_columns_address_city_name": true,
2183 + "data_osquery_columns_address_country_code": true,
2184 + "data_osquery_columns_address_geolocation": true,
2185 + "data_osquery_columns_cmdline": true,
2186 + "data_osquery_columns_cwd": true,
2187 + "data_osquery_columns_description": true,
2188 + "data_osquery_columns_directory": true,
2189 + "data_osquery_columns_disk_bytes_read": true,
2190 + "data_osquery_columns_disk_bytes_written": true,
2191 + "data_osquery_columns_egid": true,
2192 + "data_osquery_columns_euid": true,
2193 + "data_osquery_columns_family": true,
2194 + "data_osquery_columns_fd": true,
2195 + "data_osquery_columns_gid": true,
2196 + "data_osquery_columns_gid_signed": true,
2197 + "data_osquery_columns_host": true,
2198 + "data_osquery_columns_interface": true,
2199 + "data_osquery_columns_local_address": true,
2200 + "data_osquery_columns_local_address_city_name": true,
2201 + "data_osquery_columns_local_address_country_code": true,
2202 + "data_osquery_columns_local_address_geolocation": true,
2203 + "data_osquery_columns_local_port": true,
2204 + "data_osquery_columns_mac": true,
2205 + "data_osquery_columns_name": true,
2206 + "data_osquery_columns_net_namespace": true,
2207 + "data_osquery_columns_nice": true,
2208 + "data_osquery_columns_on_disk": true,
2209 + "data_osquery_columns_parent": true,
2210 + "data_osquery_columns_path": true,
2211 + "data_osquery_columns_pgroup": true,
2212 + "data_osquery_columns_pid": true,
2213 + "data_osquery_columns_port": true,
2214 + "data_osquery_columns_protocol": true,
2215 + "data_osquery_columns_remote_address": true,
2216 + "data_osquery_columns_remote_address_city_name": true,
2217 + "data_osquery_columns_remote_address_country_code": true,
2218 + "data_osquery_columns_remote_address_geolocation": true,
2219 + "data_osquery_columns_remote_port": true,
2220 + "data_osquery_columns_resident_size": true,
2221 + "data_osquery_columns_root": true,
2222 + "data_osquery_columns_sgid": true,
2223 + "data_osquery_columns_shell": true,
2224 + "data_osquery_columns_socket": true,
2225 + "data_osquery_columns_start_time": true,
2226 + "data_osquery_columns_state": true,
2227 + "data_osquery_columns_suid": true,
2228 + "data_osquery_columns_system_time": true,
2229 + "data_osquery_columns_threads": true,
2230 + "data_osquery_columns_time_utc": true,
2231 + "data_osquery_columns_total_size": true,
2232 + "data_osquery_columns_tty": true,
2233 + "data_osquery_columns_type": true,
2234 + "data_osquery_columns_uid": true,
2235 + "data_osquery_columns_uid_signed": true,
2236 + "data_osquery_columns_user": true,
2237 + "data_osquery_columns_user_time": true,
2238 + "data_osquery_columns_username": true,
2239 + "data_osquery_columns_wired_size": true,
2240 + "data_osquery_counter": true,
2241 + "data_osquery_decorations_host_uuid": true,
2242 + "data_osquery_decorations_hostname": true,
2243 + "data_osquery_epoch": true,
2244 + "data_osquery_hostIdentifier": true,
2245 + "data_osquery_name": true,
2246 + "data_osquery_numerics": true,
2247 + "data_osquery_unixTime": true,
2248 + "data_proto": true,
2249 + "data_sca_check_command": true,
2250 + "data_sca_check_compliance_cis": true,
2251 + "data_sca_check_compliance_cis_csc": true,
2252 + "data_sca_check_compliance_gdpr_IV": true,
2253 + "data_sca_check_compliance_gpg_13": true,
2254 + "data_sca_check_compliance_hipaa": true,
2255 + "data_sca_check_compliance_nist_800_53": true,
2256 + "data_sca_check_compliance_pci_dss": true,
2257 + "data_sca_check_compliance_tsc": true,
2258 + "data_sca_check_description": true,
2259 + "data_sca_check_id": true,
2260 + "data_sca_check_previous_result": true,
2261 + "data_sca_check_rationale": true,
2262 + "data_sca_check_remediation": true,
2263 + "data_sca_check_result": true,
2264 + "data_sca_check_title": true,
2265 + "data_sca_description": true,
2266 + "data_sca_failed": true,
2267 + "data_sca_file": true,
2268 + "data_sca_invalid": true,
2269 + "data_sca_passed": true,
2270 + "data_sca_policy": true,
2271 + "data_sca_policy_id": true,
2272 + "data_sca_scan_id": true,

This file is too large to show in full.

backend/app/connectors/grafana/dashboards/Office365/teams.json
+2083 -2130
@@ -1,2132 +1,2085 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto"
97 - },
98 - "pluginVersion": "9.2.0",
99 - "targets": [
100 - {
101 - "bucketAggs": [
102 - {
103 - "field": "timestamp",
104 - "id": "2",
105 - "settings": {
106 - "interval": "auto",
107 - "min_doc_count": 0,
108 - "trimEdges": 0
109 - },
110 - "type": "date_histogram"
111 - }
112 - ],
113 - "datasource": {
114 - "type": "elasticsearch",
115 - "uid": "replace_datasource_uid"
116 - },
117 - "metrics": [
118 - {
119 - "field": "select field",
120 - "id": "1",
121 - "type": "count"
122 - }
123 - ],
124 - "query": "rule_level:>=12 AND data_office365_Operation:$operation",
125 - "refId": "A",
126 - "timeField": "timestamp"
127 - }
128 - ],
129 - "title": "ALERTS",
130 - "type": "stat"
131 - },
132 - {
133 - "datasource": {
134 - "type": "elasticsearch",
135 - "uid": "replace_datasource_uid"
136 - },
137 - "fieldConfig": {
138 - "defaults": {
139 - "color": {
140 - "mode": "palette-classic"
141 - },
142 - "custom": {
143 - "hideFrom": {
144 - "legend": false,
145 - "tooltip": false,
146 - "viz": false
147 - }
148 - },
149 - "mappings": []
150 - },
151 - "overrides": [
152 - {
153 - "matcher": {
154 - "id": "byName",
155 - "options": "Count"
156 - },
157 - "properties": [
158 - {
159 - "id": "displayName",
160 - "value": "EVENTS"
161 - },
162 - {
163 - "id": "unit",
164 - "value": "short"
165 - },
166 - {
167 - "id": "decimals",
168 - "value": -1
169 - }
170 - ]
171 - }
172 - ]
173 - },
174 - "gridPos": {
175 - "h": 7,
176 - "w": 4,
177 - "x": 4,
178 - "y": 0
179 - },
180 - "id": 53,
181 - "options": {
182 - "legend": {
183 - "displayMode": "list",
184 - "placement": "bottom",
185 - "showLegend": false
186 - },
187 - "pieType": "donut",
188 - "reduceOptions": {
189 - "calcs": [
190 - "sum"
191 - ],
192 - "fields": "",
193 - "values": false
194 - },
195 - "tooltip": {
196 - "mode": "single",
197 - "sort": "none"
198 - }
199 - },
200 - "pluginVersion": "8.5.1",
201 - "targets": [
202 - {
203 - "bucketAggs": [
204 - {
205 - "fake": true,
206 - "field": "data_office365_Operation",
207 - "id": "4",
208 - "settings": {
209 - "min_doc_count": 1,
210 - "order": "desc",
211 - "orderBy": "_count",
212 - "size": "10"
213 - },
214 - "type": "terms"
215 - },
216 - {
217 - "field": "data_office365_CreationTime",
218 - "id": "5",
219 - "settings": {
220 - "interval": "auto",
221 - "min_doc_count": "0",
222 - "timeZone": "utc",
223 - "trimEdges": "0"
224 - },
225 - "type": "date_histogram"
226 - }
227 - ],
228 - "datasource": {
229 - "type": "elasticsearch",
230 - "uid": "replace_datasource_uid"
231 - },
232 - "metrics": [
233 - {
234 - "field": "select field",
235 - "id": "1",
236 - "type": "count"
237 - }
238 - ],
239 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
240 - "refId": "A",
241 - "timeField": "timestamp"
242 - }
243 - ],
244 - "title": "EVENTS BY OPERATION (Top 10)",
245 - "transformations": [],
246 - "type": "piechart"
247 - },
248 - {
249 - "datasource": {
250 - "type": "elasticsearch",
251 - "uid": "replace_datasource_uid"
252 - },
253 - "fieldConfig": {
254 - "defaults": {
255 - "color": {
256 - "mode": "thresholds"
257 - },
258 - "custom": {
259 - "align": "auto",
260 - "displayMode": "auto",
261 - "inspect": false
262 - },
263 - "mappings": [],
264 - "thresholds": {
265 - "mode": "absolute",
266 - "steps": [
267 - {
268 - "color": "red",
269 - "value": null
270 - }
271 - ]
272 - }
273 - },
274 - "overrides": [
275 - {
276 - "matcher": {
277 - "id": "byName",
278 - "options": "Count"
279 - },
280 - "properties": [
281 - {
282 - "id": "displayName",
283 - "value": "EVENTS"
284 - },
285 - {
286 - "id": "unit",
287 - "value": "short"
288 - },
289 - {
290 - "id": "decimals",
291 - "value": -1
292 - },
293 - {
294 - "id": "custom.align"
295 - },
296 - {
297 - "id": "thresholds",
298 - "value": {
299 - "mode": "absolute",
300 - "steps": [
301 - {
302 - "color": "red",
303 - "value": null
304 - }
305 - ]
306 - }
307 - }
308 - ]
309 - }
310 - ]
311 - },
312 - "gridPos": {
313 - "h": 7,
314 - "w": 6,
315 - "x": 8,
316 - "y": 0
317 - },
318 - "id": 54,
319 - "options": {
320 - "footer": {
321 - "fields": "",
322 - "reducer": [
323 - "sum"
324 - ],
325 - "show": false
326 - },
327 - "showHeader": true
328 - },
329 - "pluginVersion": "9.2.0",
330 - "targets": [
331 - {
332 - "bucketAggs": [
333 - {
334 - "fake": true,
335 - "field": "data_office365_Operation",
336 - "id": "4",
337 - "settings": {
338 - "min_doc_count": 1,
339 - "order": "desc",
340 - "orderBy": "_count",
341 - "size": "0"
342 - },
343 - "type": "terms"
344 - }
345 - ],
346 - "datasource": {
347 - "type": "elasticsearch",
348 - "uid": "replace_datasource_uid"
349 - },
350 - "metrics": [
351 - {
352 - "field": "select field",
353 - "id": "1",
354 - "type": "count"
355 - }
356 - ],
357 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
358 - "refId": "A",
359 - "timeField": "timestamp"
360 - }
361 - ],
362 - "title": "EVENTS BY OPERATION",
363 - "transformations": [
364 - {
365 - "id": "merge",
366 - "options": {
367 - "reducers": []
368 - }
369 - },
370 - {
371 - "id": "organize",
372 - "options": {
373 - "excludeByName": {},
374 - "indexByName": {},
375 - "renameByName": {
376 - "Count": "EVENTS",
377 - "data_office365_Operation": "OPERATION"
378 - }
379 - }
380 - }
381 - ],
382 - "type": "table"
383 - },
384 - {
385 - "datasource": {
386 - "type": "elasticsearch",
387 - "uid": "replace_datasource_uid"
388 - },
389 - "fieldConfig": {
390 - "defaults": {
391 - "color": {
392 - "mode": "thresholds"
393 - },
394 - "mappings": [
395 - {
396 - "options": {
397 - "match": "null",
398 - "result": {
399 - "text": "N/A"
400 - }
401 - },
402 - "type": "special"
403 - }
404 - ],
405 - "max": 15,
406 - "min": 0,
407 - "thresholds": {
408 - "mode": "absolute",
409 - "steps": [
410 - {
411 - "color": "#299c46",
412 - "value": null
413 - },
414 - {
415 - "color": "rgba(237, 129, 40, 0.89)",
416 - "value": 8
417 - },
418 - {
419 - "color": "#d44a3a",
420 - "value": 12
421 - }
422 - ]
423 - },
424 - "unit": "none"
425 - },
426 - "overrides": []
427 - },
428 - "gridPos": {
429 - "h": 7,
430 - "w": 4,
431 - "x": 0,
432 - "y": 7
433 - },
434 - "id": 16,
435 - "links": [],
436 - "options": {
437 - "orientation": "horizontal",
438 - "reduceOptions": {
439 - "calcs": [
440 - "max"
441 - ],
442 - "fields": "",
443 - "values": false
444 - },
445 - "showThresholdLabels": false,
446 - "showThresholdMarkers": true,
447 - "text": {}
448 - },
449 - "pluginVersion": "9.2.0",
450 - "targets": [
451 - {
452 - "bucketAggs": [
453 - {
454 - "field": "timestamp",
455 - "id": "2",
456 - "settings": {
457 - "interval": "auto",
458 - "min_doc_count": 0,
459 - "trimEdges": 0
460 - },
461 - "type": "date_histogram"
462 - }
463 - ],
464 - "datasource": {
465 - "type": "elasticsearch",
466 - "uid": "replace_datasource_uid"
467 - },
468 - "metrics": [
469 - {
470 - "field": "rule_level",
471 - "id": "1",
472 - "meta": {},
473 - "settings": {},
474 - "type": "max"
475 - }
476 - ],
477 - "query": "data_office365_Operation:$operation",
478 - "refId": "A",
479 - "timeField": "timestamp"
480 - }
481 - ],
482 - "title": "MAX SEVERITY (0 - 15)",
483 - "type": "gauge"
484 - },
485 - {
486 - "datasource": {
487 - "type": "elasticsearch",
488 - "uid": "replace_datasource_uid"
489 - },
490 - "fieldConfig": {
491 - "defaults": {
492 - "color": {
493 - "mode": "palette-classic"
494 - },
495 - "custom": {
496 - "axisCenteredZero": false,
497 - "axisColorMode": "text",
498 - "axisLabel": "",
499 - "axisPlacement": "auto",
500 - "barAlignment": 0,
501 - "drawStyle": "bars",
502 - "fillOpacity": 0,
503 - "gradientMode": "none",
504 - "hideFrom": {
505 - "legend": false,
506 - "tooltip": false,
507 - "viz": false
508 - },
509 - "lineInterpolation": "linear",
510 - "lineWidth": 1,
511 - "pointSize": 5,
512 - "scaleDistribution": {
513 - "type": "linear"
514 - },
515 - "showPoints": "auto",
516 - "spanNulls": false,
517 - "stacking": {
518 - "group": "A",
519 - "mode": "normal"
520 - },
521 - "thresholdsStyle": {
522 - "mode": "off"
523 - }
524 - },
525 - "mappings": [],
526 - "thresholds": {
527 - "mode": "absolute",
528 - "steps": [
529 - {
530 - "color": "green",
531 - "value": null
532 - },
533 - {
534 - "color": "red",
535 - "value": 80
536 - }
537 - ]
538 - }
539 - },
540 - "overrides": []
541 - },
542 - "gridPos": {
543 - "h": 13,
544 - "w": 20,
545 - "x": 4,
546 - "y": 7
547 - },
548 - "id": 60,
549 - "options": {
550 - "legend": {
551 - "calcs": [],
552 - "displayMode": "table",
553 - "placement": "right",
554 - "showLegend": true
555 - },
556 - "tooltip": {
557 - "mode": "single",
558 - "sort": "none"
559 - }
560 - },
561 - "targets": [
562 - {
563 - "alias": "",
564 - "bucketAggs": [
565 - {
566 - "field": "data_office365_Operation",
567 - "id": "3",
568 - "settings": {
569 - "min_doc_count": "1",
570 - "order": "desc",
571 - "orderBy": "_count",
572 - "size": "10"
573 - },
574 - "type": "terms"
575 - },
576 - {
577 - "field": "timestamp",
578 - "id": "2",
579 - "settings": {
580 - "interval": "auto"
581 - },
582 - "type": "date_histogram"
583 - }
584 - ],
585 - "datasource": {
586 - "type": "elasticsearch",
587 - "uid": "replace_datasource_uid"
588 - },
589 - "metrics": [
590 - {
591 - "id": "1",
592 - "type": "count"
593 - }
594 - ],
595 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
596 - "refId": "A",
597 - "timeField": "timestamp"
598 - }
599 - ],
600 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
601 - "transparent": true,
602 - "type": "timeseries"
603 - },
604 - {
605 - "datasource": {
606 - "type": "elasticsearch",
607 - "uid": "replace_datasource_uid"
608 - },
609 - "fieldConfig": {
610 - "defaults": {
611 - "mappings": [
612 - {
613 - "options": {
614 - "match": "null",
615 - "result": {
616 - "text": "N/A"
617 - }
618 - },
619 - "type": "special"
620 - }
621 - ],
622 - "thresholds": {
623 - "mode": "absolute",
624 - "steps": [
625 - {
626 - "color": "blue",
627 - "value": null
628 - }
629 - ]
630 - },
631 - "unit": "locale"
632 - },
633 - "overrides": []
634 - },
635 - "gridPos": {
636 - "h": 6,
637 - "w": 4,
638 - "x": 0,
639 - "y": 14
640 - },
641 - "id": 51,
642 - "links": [],
643 - "options": {
644 - "colorMode": "value",
645 - "graphMode": "area",
646 - "justifyMode": "auto",
647 - "orientation": "horizontal",
648 - "reduceOptions": {
649 - "calcs": [
650 - "sum"
651 - ],
652 - "fields": "",
653 - "values": false
654 - },
655 - "text": {},
656 - "textMode": "auto"
657 - },
658 - "pluginVersion": "9.2.0",
659 - "targets": [
660 - {
661 - "bucketAggs": [
662 - {
663 - "$$hashKey": "object:331",
664 - "field": "timestamp",
665 - "id": "2",
666 - "settings": {
667 - "interval": "auto",
668 - "min_doc_count": 0,
669 - "trimEdges": 0
670 - },
671 - "type": "date_histogram"
672 - }
673 - ],
674 - "datasource": {
675 - "type": "elasticsearch",
676 - "uid": "replace_datasource_uid"
677 - },
678 - "metrics": [
679 - {
680 - "$$hashKey": "object:329",
681 - "field": "select field",
682 - "id": "1",
683 - "type": "count"
684 - }
685 - ],
686 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
687 - "refId": "A",
688 - "timeField": "timestamp"
689 - }
690 - ],
691 - "title": "EVENTS (Total)",
692 - "type": "stat"
693 - },
694 - {
695 - "datasource": {
696 - "type": "elasticsearch",
697 - "uid": "replace_datasource_uid"
698 - },
699 - "fieldConfig": {
700 - "defaults": {
701 - "mappings": [
702 - {
703 - "options": {
704 - "match": "null",
705 - "result": {
706 - "text": "N/A"
707 - }
708 - },
709 - "type": "special"
710 - }
711 - ],
712 - "thresholds": {
713 - "mode": "absolute",
714 - "steps": [
715 - {
716 - "color": "orange",
717 - "value": null
718 - }
719 - ]
720 - },
721 - "unit": "locale"
722 - },
723 - "overrides": []
724 - },
725 - "gridPos": {
726 - "h": 6,
727 - "w": 4,
728 - "x": 0,
729 - "y": 20
730 - },
731 - "id": 52,
732 - "links": [],
733 - "options": {
734 - "colorMode": "value",
735 - "graphMode": "area",
736 - "justifyMode": "auto",
737 - "orientation": "horizontal",
738 - "reduceOptions": {
739 - "calcs": [
740 - "sum"
741 - ],
742 - "fields": "",
743 - "values": false
744 - },
745 - "text": {},
746 - "textMode": "auto"
747 - },
748 - "pluginVersion": "9.2.0",
749 - "targets": [
750 - {
751 - "bucketAggs": [
752 - {
753 - "$$hashKey": "object:331",
754 - "field": "timestamp",
755 - "id": "2",
756 - "settings": {
757 - "interval": "auto",
758 - "min_doc_count": 0,
759 - "trimEdges": 0
760 - },
761 - "type": "date_histogram"
762 - }
763 - ],
764 - "datasource": {
765 - "type": "elasticsearch",
766 - "uid": "replace_datasource_uid"
767 - },
768 - "metrics": [
769 - {
770 - "$$hashKey": "object:329",
771 - "field": "select field",
772 - "id": "1",
773 - "type": "count"
774 - }
775 - ],
776 - "query": "data_office365_Operation:MessageCreatedHasLink AND rule_level:$rule_level",
777 - "refId": "A",
778 - "timeField": "timestamp"
779 - }
780 - ],
781 - "title": "TEAMS - MESSAGES CONTAINING LINK",
782 - "type": "stat"
783 - },
784 - {
785 - "circleMaxSize": 30,
786 - "circleMinSize": 2,
787 - "colors": [
788 - "rgba(245, 54, 54, 0.9)",
789 - "rgba(237, 129, 40, 0.89)",
790 - "rgba(50, 172, 45, 0.97)"
791 - ],
792 - "datasource": {
793 - "type": "elasticsearch",
794 - "uid": "replace_datasource_uid"
795 - },
796 - "decimals": 0,
797 - "esMetric": "Count",
798 - "gridPos": {
799 - "h": 12,
800 - "w": 10,
801 - "x": 4,
802 - "y": 20
803 - },
804 - "hideEmpty": false,
805 - "hideZero": false,
806 - "id": 50,
807 - "initialZoom": 1,
808 - "locationData": "countries",
809 - "mapCenter": "(0°, 0°)",
810 - "mapCenterLatitude": 0,
811 - "mapCenterLongitude": 0,
812 - "maxDataPoints": 1,
813 - "mouseWheelZoom": false,
814 - "showLegend": true,
815 - "stickyLabels": false,
816 - "tableQueryOptions": {
817 - "geohashField": "geohash",
818 - "latitudeField": "latitude",
819 - "longitudeField": "longitude",
820 - "metricField": "metric",
821 - "queryType": "geohash"
822 - },
823 - "targets": [
824 - {
825 - "bucketAggs": [
826 - {
827 - "fake": true,
828 - "field": "data_office365_ClientIP_country_code",
829 - "id": "3",
830 - "settings": {
831 - "min_doc_count": 1,
832 - "order": "desc",
833 - "orderBy": "_term",
834 - "size": "0"
835 - },
836 - "type": "terms"
837 - },
838 - {
839 - "field": "timestamp",
840 - "id": "2",
841 - "settings": {
842 - "interval": "auto",
843 - "min_doc_count": 0,
844 - "trimEdges": 0
845 - },
846 - "type": "date_histogram"
847 - }
848 - ],
849 - "datasource": {
850 - "type": "elasticsearch",
851 - "uid": "replace_datasource_uid"
852 - },
853 - "metrics": [
854 - {
855 - "field": "select field",
856 - "id": "1",
857 - "type": "count"
858 - }
859 - ],
860 - "query": "data_office365_Workload:MicrosoftTeams AND rule_level:$rule_level",
861 - "refId": "A",
862 - "timeField": "timestamp"
863 - }
864 - ],
865 - "thresholds": "0,10",
866 - "title": "TEAMS - ALL EVENTS BY SRC COUNTRY",
867 - "type": "grafana-worldmap-panel",
868 - "unitPlural": "",
869 - "unitSingle": "",
870 - "valueName": "total"
871 - },
872 - {
873 - "datasource": {
874 - "type": "elasticsearch",
875 - "uid": "replace_datasource_uid"
876 - },
877 - "fieldConfig": {
878 - "defaults": {
879 - "color": {
880 - "mode": "thresholds"
881 - },
882 - "custom": {
883 - "align": "auto",
884 - "displayMode": "auto",
885 - "inspect": false
886 - },
887 - "mappings": [],
888 - "thresholds": {
889 - "mode": "absolute",
890 - "steps": [
891 - {
892 - "color": "orange",
893 - "value": null
894 - }
895 - ]
896 - }
897 - },
898 - "overrides": [
899 - {
900 - "matcher": {
901 - "id": "byName",
902 - "options": "Count"
903 - },
904 - "properties": [
905 - {
906 - "id": "displayName",
907 - "value": "EVENTS"
908 - },
909 - {
910 - "id": "unit",
911 - "value": "short"
912 - },
913 - {
914 - "id": "decimals",
915 - "value": -1
916 - },
917 - {
918 - "id": "custom.align"
919 - }
920 - ]
921 - },
922 - {
923 - "matcher": {
924 - "id": "byName",
925 - "options": "AD ACCOUNT"
926 - },
927 - "properties": [
928 - {
929 - "id": "custom.width",
930 - "value": 377
931 - }
932 - ]
933 - }
934 - ]
935 - },
936 - "gridPos": {
937 - "h": 12,
938 - "w": 10,
939 - "x": 14,
940 - "y": 20
941 - },
942 - "id": 58,
943 - "options": {
944 - "footer": {
945 - "fields": "",
946 - "reducer": [
947 - "sum"
948 - ],
949 - "show": false
950 - },
951 - "showHeader": true,
952 - "sortBy": []
953 - },
954 - "pluginVersion": "9.2.0",
955 - "targets": [
956 - {
957 - "bucketAggs": [
958 - {
959 - "fake": true,
960 - "field": "data_office365_UserId",
961 - "id": "4",
962 - "settings": {
963 - "min_doc_count": 1,
964 - "order": "desc",
965 - "orderBy": "_count",
966 - "size": "0"
967 - },
968 - "type": "terms"
969 - },
970 - {
971 - "field": "data_office365_ClientIP_country_code",
972 - "id": "5",
973 - "settings": {
974 - "min_doc_count": "1",
975 - "order": "desc",
976 - "orderBy": "_term",
977 - "size": "10"
978 - },
979 - "type": "terms"
980 - }
981 - ],
982 - "datasource": {
983 - "type": "elasticsearch",
984 - "uid": "replace_datasource_uid"
985 - },
986 - "metrics": [
987 - {
988 - "field": "select field",
989 - "id": "1",
990 - "type": "count"
991 - }
992 - ],
993 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
994 - "refId": "A",
995 - "timeField": "timestamp"
996 - }
997 - ],
998 - "title": "TEAMS EVENTS BY ACCOUNT",
999 - "transformations": [
1000 - {
1001 - "id": "merge",
1002 - "options": {
1003 - "reducers": []
1004 - }
1005 - },
1006 - {
1007 - "id": "organize",
1008 - "options": {
1009 - "excludeByName": {},
1010 - "indexByName": {},
1011 - "renameByName": {
1012 - "Count": "EVENTS",
1013 - "data_office365_ClientIP_country_code": "COUNTRY",
1014 - "data_office365_LogonError": "ERROR",
1015 - "data_office365_Operation": "WORKLOAD",
1016 - "data_office365_UserId": "AD ACCOUNT"
1017 - }
1018 - }
1019 - }
1020 - ],
1021 - "type": "table"
1022 - },
1023 - {
1024 - "datasource": {
1025 - "type": "elasticsearch",
1026 - "uid": "replace_datasource_uid"
1027 - },
1028 - "fieldConfig": {
1029 - "defaults": {
1030 - "mappings": [
1031 - {
1032 - "options": {
1033 - "match": "null",
1034 - "result": {
1035 - "text": "N/A"
1036 - }
1037 - },
1038 - "type": "special"
1039 - }
1040 - ],
1041 - "thresholds": {
1042 - "mode": "absolute",
1043 - "steps": [
1044 - {
1045 - "color": "blue",
1046 - "value": null
1047 - }
1048 - ]
1049 - },
1050 - "unit": "locale"
1051 - },
1052 - "overrides": []
1053 - },
1054 - "gridPos": {
1055 - "h": 6,
1056 - "w": 4,
1057 - "x": 0,
1058 - "y": 26
1059 - },
1060 - "id": 18,
1061 - "links": [],
1062 - "options": {
1063 - "colorMode": "value",
1064 - "graphMode": "area",
1065 - "justifyMode": "auto",
1066 - "orientation": "horizontal",
1067 - "reduceOptions": {
1068 - "calcs": [
1069 - "sum"
1070 - ],
1071 - "fields": "",
1072 - "values": false
1073 - },
1074 - "text": {},
1075 - "textMode": "auto"
1076 - },
1077 - "pluginVersion": "9.2.0",
1078 - "targets": [
1079 - {
1080 - "bucketAggs": [
1081 - {
1082 - "$$hashKey": "object:331",
1083 - "field": "timestamp",
1084 - "id": "2",
1085 - "settings": {
1086 - "interval": "auto",
1087 - "min_doc_count": 0,
1088 - "trimEdges": 0
1089 - },
1090 - "type": "date_histogram"
1091 - }
1092 - ],
1093 - "datasource": {
1094 - "type": "elasticsearch",
1095 - "uid": "replace_datasource_uid"
1096 - },
1097 - "metrics": [
1098 - {
1099 - "$$hashKey": "object:329",
1100 - "field": "select field",
1101 - "id": "1",
1102 - "type": "count"
1103 - }
1104 - ],
1105 - "query": "data_office365_Operation:TeamsSessionStarted AND rule_level:$rule_level",
1106 - "refId": "A",
1107 - "timeField": "timestamp"
1108 - }
1109 - ],
1110 - "title": "TEAMS - SESSIONS STARTED",
1111 - "type": "stat"
1112 - },
1113 - {
1114 - "datasource": {
1115 - "type": "elasticsearch",
1116 - "uid": "replace_datasource_uid"
1117 - },
1118 - "fieldConfig": {
1119 - "defaults": {
1120 - "color": {
1121 - "mode": "thresholds"
1122 - },
1123 - "custom": {
1124 - "align": "auto",
1125 - "displayMode": "auto",
1126 - "filterable": true,
1127 - "inspect": false
1128 - },
1129 - "mappings": [],
1130 - "thresholds": {
1131 - "mode": "absolute",
1132 - "steps": [
1133 - {
1134 - "color": "green",
1135 - "value": null
1136 - },
1137 - {
1138 - "color": "red",
1139 - "value": 80
1140 - }
1141 - ]
1142 - }
1143 - },
1144 - "overrides": [
1145 - {
1146 - "matcher": {
1147 - "id": "byName",
1148 - "options": "rule_level"
1149 - },
1150 - "properties": [
1151 - {
1152 - "id": "displayName",
1153 - "value": "RULE LEVEL"
1154 - },
1155 - {
1156 - "id": "unit",
1157 - "value": "short"
1158 - },
1159 - {
1160 - "id": "decimals",
1161 - "value": -1
1162 - },
1163 - {
1164 - "id": "custom.displayMode",
1165 - "value": "color-background"
1166 - },
1167 - {
1168 - "id": "custom.align"
1169 - },
1170 - {
1171 - "id": "thresholds",
1172 - "value": {
1173 - "mode": "absolute",
1174 - "steps": [
1175 - {
1176 - "color": "#37872D",
1177 - "value": null
1178 - },
1179 - {
1180 - "color": "rgba(237, 129, 40, 0.89)",
1181 - "value": 7
1182 - },
1183 - {
1184 - "color": "rgba(245, 54, 54, 0.9)",
1185 - "value": 12
1186 - }
1187 - ]
1188 - }
1189 - }
1190 - ]
1191 - },
1192 - {
1193 - "matcher": {
1194 - "id": "byName",
1195 - "options": "Date/Time"
1196 - },
1197 - "properties": [
1198 - {
1199 - "id": "custom.width",
1200 - "value": 242
1201 - }
1202 - ]
1203 - },
1204 - {
1205 - "matcher": {
1206 - "id": "byName",
1207 - "options": "MITRE TACTIC"
1208 - },
1209 - "properties": [
1210 - {
1211 - "id": "custom.width",
1212 - "value": 332
1213 - }
1214 - ]
1215 - },
1216 - {
1217 - "matcher": {
1218 - "id": "byName",
1219 - "options": "IP ADDRESS"
1220 - },
1221 - "properties": [
1222 - {
1223 - "id": "custom.width",
1224 - "value": 163
1225 - }
1226 - ]
1227 - },
1228 - {
1229 - "matcher": {
1230 - "id": "byName",
1231 - "options": "MITRE TECHNIQUE"
1232 - },
1233 - "properties": [
1234 - {
1235 - "id": "custom.width",
1236 - "value": 312
1237 - }
1238 - ]
1239 - },
1240 - {
1241 - "matcher": {
1242 - "id": "byName",
1243 - "options": "EVENT ID"
1244 - },
1245 - "properties": [
1246 - {
1247 - "id": "links",
1248 - "value": [
1249 - {
1250 - "targetBlank": true,
1251 - "title": "VIEW EVENT DETAILS",
1252 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1253 - }
1254 - ]
1255 - },
1256 - {
1257 - "id": "custom.width",
1258 - "value": 336
1259 - }
1260 - ]
1261 - },
1262 - {
1263 - "matcher": {
1264 - "id": "byName",
1265 - "options": "RESULT"
1266 - },
1267 - "properties": [
1268 - {
1269 - "id": "custom.width",
1270 - "value": 118
1271 - },
1272 - {
1273 - "id": "mappings",
1274 - "value": [
1275 - {
1276 - "options": {
1277 - "Failed": {
1278 - "color": "orange",
1279 - "index": 1
1280 - },
1281 - "Success": {
1282 - "color": "green",
1283 - "index": 0
1284 - }
1285 - },
1286 - "type": "value"
1287 - }
1288 - ]
1289 - },
1290 - {
1291 - "id": "custom.displayMode",
1292 - "value": "color-text"
1293 - }
1294 - ]
1295 - },
1296 - {
1297 - "matcher": {
1298 - "id": "byName",
1299 - "options": "SRC IP"
1300 - },
1301 - "properties": [
1302 - {
1303 - "id": "custom.width",
1304 - "value": 265
1305 - }
1306 - ]
1307 - },
1308 - {
1309 - "matcher": {
1310 - "id": "byName",
1311 - "options": "ACCOUNT"
1312 - },
1313 - "properties": [
1314 - {
1315 - "id": "custom.width",
1316 - "value": 343
1317 - }
1318 - ]
1319 - },
1320 - {
1321 - "matcher": {
1322 - "id": "byName",
1323 - "options": "EVENT TIME"
1324 - },
1325 - "properties": [
1326 - {
1327 - "id": "custom.width",
1328 - "value": 195
1329 - }
1330 - ]
1331 - }
1332 - ]
1333 - },
1334 - "gridPos": {
1335 - "h": 16,
1336 - "w": 24,
1337 - "x": 0,
1338 - "y": 32
1339 - },
1340 - "id": 27,
1341 - "options": {
1342 - "footer": {
1343 - "fields": "",
1344 - "reducer": [
1345 - "sum"
1346 - ],
1347 - "show": false
1348 - },
1349 - "showHeader": true,
1350 - "sortBy": []
1351 - },
1352 - "pluginVersion": "9.2.0",
1353 - "targets": [
1354 - {
1355 - "bucketAggs": [],
1356 - "datasource": {
1357 - "type": "elasticsearch",
1358 - "uid": "replace_datasource_uid"
1359 - },
1360 - "metrics": [
1361 - {
1362 - "id": "1",
1363 - "settings": {
1364 - "size": "250"
1365 - },
1366 - "type": "raw_data"
1367 - }
1368 - ],
1369 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1370 - "refId": "A",
1371 - "timeField": "timestamp"
1372 - }
1373 - ],
1374 - "title": "EVENTS",
1375 - "transformations": [
1376 - {
1377 - "id": "merge",
1378 - "options": {
1379 - "reducers": []
1380 - }
1381 - },
1382 - {
1383 - "id": "organize",
1384 - "options": {
1385 - "excludeByName": {
1386 - "@metadata_beat": true,
1387 - "@metadata_type": true,
1388 - "@metadata_version": true,
1389 - "IMPHASH": true,
1390 - "MD5": true,
1391 - "SHA1": true,
1392 - "SHA256": true,
1393 - "_id": false,
1394 - "_index": true,
1395 - "_type": true,
1396 - "agent_ephemeral_id": true,
1397 - "agent_hostname": true,
1398 - "agent_id": true,
1399 - "agent_ip_city_name": true,
1400 - "agent_ip_country_code": true,
1401 - "agent_ip_geolocation": true,
1402 - "agent_name": true,
1403 - "agent_type": true,
1404 - "agent_version": true,
1405 - "beats_type": true,
1406 - "cluster_name": true,
1407 - "cluster_node": true,
1408 - "collector_node_id": true,
1409 - "data_alert_action": true,
1410 - "data_alert_category": true,
1411 - "data_alert_gid": true,
1412 - "data_alert_rev": true,
1413 - "data_alert_severity": true,
1414 - "data_alert_signature": true,
1415 - "data_alert_signature_id": true,
1416 - "data_app_proto": true,
1417 - "data_audit_auid": true,
1418 - "data_audit_command": true,
1419 - "data_audit_euid": true,
1420 - "data_audit_exe": true,
1421 - "data_audit_gid": true,
1422 - "data_audit_id": true,
1423 - "data_audit_pid": true,
1424 - "data_audit_res": true,
1425 - "data_audit_session": true,
1426 - "data_audit_type": true,
1427 - "data_audit_uid": true,
1428 - "data_dest_ip": true,
1429 - "data_dest_port": true,
1430 - "data_dstuser": true,
1431 - "data_event_type": true,
1432 - "data_extra_data": true,
1433 - "data_file": true,
1434 - "data_flow_bytes_toclient": true,
1435 - "data_flow_bytes_toserver": true,
1436 - "data_flow_id": true,
1437 - "data_flow_pkts_toclient": true,
1438 - "data_flow_pkts_toserver": true,
1439 - "data_flow_start": true,
1440 - "data_http_http_content_type": true,
1441 - "data_http_http_port": true,
1442 - "data_http_length": true,
1443 - "data_http_status": true,
1444 - "data_http_url": true,
1445 - "data_id": true,
1446 - "data_in_iface": true,
1447 - "data_metadata_flowbits": true,
1448 - "data_metadata_flowints_http_anomaly_count": true,
1449 - "data_metadata_flowints_tcp_retransmission_count": true,
1450 - "data_office365_AADGroupId": true,
1451 - "data_office365_Actor": true,
1452 - "data_office365_ActorContextId": true,
1453 - "data_office365_ActorIpAddress": false,
1454 - "data_office365_ActorIpAddress_city_name": true,
1455 - "data_office365_ActorIpAddress_country_code": true,
1456 - "data_office365_ActorIpAddress_geolocation": true,
1457 - "data_office365_AppAccessContext_APIId": true,
1458 - "data_office365_AppAccessContext_ClientAppId": true,
1459 - "data_office365_AppAccessContext_ClientAppName": true,
1460 - "data_office365_AppAccessContext_CorrelationId": true,
1461 - "data_office365_ApplicationId": true,
1462 - "data_office365_ArtifactsShared": true,
1463 - "data_office365_Attendees": true,
1464 - "data_office365_AzureActiveDirectoryEventType": true,
1465 - "data_office365_ChannelGuid": true,
1466 - "data_office365_ChannelName": true,
1467 - "data_office365_ChatName": true,
1468 - "data_office365_ChatThreadId": true,
1469 - "data_office365_ClientIP": false,
1470 - "data_office365_ClientIP_city_name": true,
1471 - "data_office365_ClientIP_country_code": true,
1472 - "data_office365_ClientIP_geolocation": true,
1473 - "data_office365_CommunicationSubType": true,
1474 - "data_office365_CommunicationType": true,
1475 - "data_office365_CreationTime": false,
1476 - "data_office365_DeviceId": true,
1477 - "data_office365_DeviceInformation": true,
1478 - "data_office365_DeviceProperties": true,
1479 - "data_office365_EndTime": true,
1480 - "data_office365_ErrorNumber": true,
1481 - "data_office365_ExchangeId": true,
1482 - "data_office365_ExtendedProperties": true,
1483 - "data_office365_ExtraProperties": true,
1484 - "data_office365_HostedContents": true,
1485 - "data_office365_ICalUid": true,
1486 - "data_office365_Id": true,
1487 - "data_office365_InterSystemsId": true,
1488 - "data_office365_IntraSystemId": true,
1489 - "data_office365_ItemName": true,
1490 - "data_office365_JoinTime": true,
1491 - "data_office365_LeaveTime": true,
1492 - "data_office365_LogonError": true,
1493 - "data_office365_MeetingDetailId": true,
1494 - "data_office365_MeetingURL": true,
1495 - "data_office365_Members": true,
1496 - "data_office365_MessageId": true,
1497 - "data_office365_MessageSizeInBytes": true,
1498 - "data_office365_MessageURLs": true,
1499 - "data_office365_MessageVersion": true,
1500 - "data_office365_Modalities": true,
1501 - "data_office365_ModifiedProperties": true,
1502 - "data_office365_Name": true,
1503 - "data_office365_NewValue": true,
1504 - "data_office365_ObjectId": true,
1505 - "data_office365_Operation": true,
1506 - "data_office365_OperationScope": true,
1507 - "data_office365_OrganizationId": true,
1508 - "data_office365_Organizer_OrganizationId": true,
1509 - "data_office365_Organizer_RecipientType": true,
1510 - "data_office365_Organizer_Role": true,
1511 - "data_office365_Organizer_UserObjectId": true,
1512 - "data_office365_ParentMessageId": true,
1513 - "data_office365_ProviderTypes": true,
1514 - "data_office365_RecordType": true,
1515 - "data_office365_ResultStatus": false,
1516 - "data_office365_StartTime": true,
1517 - "data_office365_SubscriptionId": true,
1518 - "data_office365_Target": true,
1519 - "data_office365_TargetContextId": true,
1520 - "data_office365_TeamGuid": true,
1521 - "data_office365_TeamName": true,
1522 - "data_office365_UserId": false,
1523 - "data_office365_UserKey": true,
1524 - "data_office365_UserType": true,
1525 - "data_office365_Version": true,
1526 - "data_office365_Workload": true,
1527 - "data_osquery_action": true,
1528 - "data_osquery_calendarTime": true,
1529 - "data_osquery_columns_address": true,
1530 - "data_osquery_columns_address_city_name": true,
1531 - "data_osquery_columns_address_country_code": true,
1532 - "data_osquery_columns_address_geolocation": true,
1533 - "data_osquery_columns_cmdline": true,
1534 - "data_osquery_columns_cwd": true,
1535 - "data_osquery_columns_description": true,
1536 - "data_osquery_columns_directory": true,
1537 - "data_osquery_columns_disk_bytes_read": true,
1538 - "data_osquery_columns_disk_bytes_written": true,
1539 - "data_osquery_columns_egid": true,
1540 - "data_osquery_columns_euid": true,
1541 - "data_osquery_columns_family": true,
1542 - "data_osquery_columns_fd": true,
1543 - "data_osquery_columns_gid": true,
1544 - "data_osquery_columns_gid_signed": true,
1545 - "data_osquery_columns_host": true,
1546 - "data_osquery_columns_interface": true,
1547 - "data_osquery_columns_local_address": true,
1548 - "data_osquery_columns_local_address_city_name": true,
1549 - "data_osquery_columns_local_address_country_code": true,
1550 - "data_osquery_columns_local_address_geolocation": true,
1551 - "data_osquery_columns_local_port": true,
1552 - "data_osquery_columns_mac": true,
1553 - "data_osquery_columns_name": true,
1554 - "data_osquery_columns_net_namespace": true,
1555 - "data_osquery_columns_nice": true,
1556 - "data_osquery_columns_on_disk": true,
1557 - "data_osquery_columns_parent": true,
1558 - "data_osquery_columns_path": true,
1559 - "data_osquery_columns_pgroup": true,
1560 - "data_osquery_columns_pid": true,
1561 - "data_osquery_columns_port": true,
1562 - "data_osquery_columns_protocol": true,
1563 - "data_osquery_columns_remote_address": true,
1564 - "data_osquery_columns_remote_address_city_name": true,
1565 - "data_osquery_columns_remote_address_country_code": true,
1566 - "data_osquery_columns_remote_address_geolocation": true,
1567 - "data_osquery_columns_remote_port": true,
1568 - "data_osquery_columns_resident_size": true,
1569 - "data_osquery_columns_root": true,
1570 - "data_osquery_columns_sgid": true,
1571 - "data_osquery_columns_shell": true,
1572 - "data_osquery_columns_socket": true,
1573 - "data_osquery_columns_start_time": true,
1574 - "data_osquery_columns_state": true,
1575 - "data_osquery_columns_suid": true,
1576 - "data_osquery_columns_system_time": true,
1577 - "data_osquery_columns_threads": true,
1578 - "data_osquery_columns_time_utc": true,
1579 - "data_osquery_columns_total_size": true,
1580 - "data_osquery_columns_tty": true,
1581 - "data_osquery_columns_type": true,
1582 - "data_osquery_columns_uid": true,
1583 - "data_osquery_columns_uid_signed": true,
1584 - "data_osquery_columns_user": true,
1585 - "data_osquery_columns_user_time": true,
1586 - "data_osquery_columns_username": true,
1587 - "data_osquery_columns_wired_size": true,
1588 - "data_osquery_counter": true,
1589 - "data_osquery_decorations_host_uuid": true,
1590 - "data_osquery_decorations_hostname": true,
1591 - "data_osquery_epoch": true,
1592 - "data_osquery_hostIdentifier": true,
1593 - "data_osquery_name": true,
1594 - "data_osquery_numerics": true,
1595 - "data_osquery_unixTime": true,
1596 - "data_proto": true,
1597 - "data_sca_check_command": true,
1598 - "data_sca_check_compliance_cis": true,
1599 - "data_sca_check_compliance_cis_csc": true,
1600 - "data_sca_check_compliance_gdpr_IV": true,
1601 - "data_sca_check_compliance_gpg_13": true,
1602 - "data_sca_check_compliance_hipaa": true,
1603 - "data_sca_check_compliance_nist_800_53": true,
1604 - "data_sca_check_compliance_pci_dss": true,
1605 - "data_sca_check_compliance_tsc": true,
1606 - "data_sca_check_description": true,
1607 - "data_sca_check_id": true,
1608 - "data_sca_check_previous_result": true,
1609 - "data_sca_check_rationale": true,
1610 - "data_sca_check_remediation": true,
1611 - "data_sca_check_result": true,
1612 - "data_sca_check_title": true,
1613 - "data_sca_description": true,
1614 - "data_sca_failed": true,
1615 - "data_sca_file": true,
1616 - "data_sca_invalid": true,
1617 - "data_sca_passed": true,
1618 - "data_sca_policy": true,
1619 - "data_sca_policy_id": true,
1620 - "data_sca_scan_id": true,
1621 - "data_sca_score": true,
1622 - "data_sca_total_checks": true,
1623 - "data_sca_type": true,
1624 - "data_script": true,
1625 - "data_src_ip": true,
1626 - "data_src_ip_city_name": true,
1627 - "data_src_ip_country_code": true,
1628 - "data_src_ip_geolocation": true,
1629 - "data_src_port": true,
1630 - "data_srcip": true,
1631 - "data_srcip_city_name": true,
1632 - "data_srcip_country_code": true,
1633 - "data_srcip_geolocation": true,
1634 - "data_srcuser": true,
1635 - "data_timestamp": true,
1636 - "data_title": true,
1637 - "data_tls_session_resumed": true,
1638 - "data_tls_version": true,
1639 - "data_tx_id": true,
1640 - "data_type": true,
1641 - "data_win_eventXML_binaryData": true,
1642 - "data_win_eventXML_binaryDataSize": true,
1643 - "data_win_eventXML_param1": true,
1644 - "data_win_eventdata_authenticationPackageName": true,
1645 - "data_win_eventdata_callTrace": true,
1646 - "data_win_eventdata_commandLine": true,
1647 - "data_win_eventdata_company": true,
1648 - "data_win_eventdata_creationUtcTime": true,
1649 - "data_win_eventdata_currentDirectory": true,
1650 - "data_win_eventdata_description": true,
1651 - "data_win_eventdata_destinationHostname": true,
1652 - "data_win_eventdata_destinationIp": true,
1653 - "data_win_eventdata_destinationIp_city_name": true,
1654 - "data_win_eventdata_destinationIp_country_code": true,
1655 - "data_win_eventdata_destinationIp_geolocation": true,
1656 - "data_win_eventdata_destinationIsIpv6": true,
1657 - "data_win_eventdata_destinationPort": true,
1658 - "data_win_eventdata_destinationPortName": true,
1659 - "data_win_eventdata_details": true,
1660 - "data_win_eventdata_elevatedToken": true,
1661 - "data_win_eventdata_eventType": true,
1662 - "data_win_eventdata_fileVersion": true,
1663 - "data_win_eventdata_fileVersion_city_name": true,
1664 - "data_win_eventdata_fileVersion_country_code": true,
1665 - "data_win_eventdata_fileVersion_geolocation": true,
1666 - "data_win_eventdata_grantedAccess": true,
1667 - "data_win_eventdata_hashes": true,
1668 - "data_win_eventdata_image": true,
1669 - "data_win_eventdata_imageLoaded": true,
1670 - "data_win_eventdata_impersonationLevel": true,
1671 - "data_win_eventdata_initiated": true,
1672 - "data_win_eventdata_integrityLevel": true,
1673 - "data_win_eventdata_ipAddress": true,
1674 - "data_win_eventdata_ipPort": true,
1675 - "data_win_eventdata_keyLength": true,
1676 - "data_win_eventdata_logonGuid": true,
1677 - "data_win_eventdata_logonId": true,
1678 - "data_win_eventdata_logonProcessName": true,
1679 - "data_win_eventdata_logonType": true,
1680 - "data_win_eventdata_originalFileName": true,
1681 - "data_win_eventdata_param1": true,
1682 - "data_win_eventdata_param2": true,
1683 - "data_win_eventdata_param3": true,
1684 - "data_win_eventdata_param4": true,
1685 - "data_win_eventdata_parentCommandLine": true,
1686 - "data_win_eventdata_parentImage": true,
1687 - "data_win_eventdata_parentProcessGuid": true,
1688 - "data_win_eventdata_parentProcessId": true,
1689 - "data_win_eventdata_processGuid": true,
1690 - "data_win_eventdata_processId": true,
1691 - "data_win_eventdata_processName": true,
1692 - "data_win_eventdata_product": true,
1693 - "data_win_eventdata_protocol": true,
1694 - "data_win_eventdata_queryName": true,
1695 - "data_win_eventdata_queryResults": true,
1696 - "data_win_eventdata_queryStatus": true,
1697 - "data_win_eventdata_ruleName": true,
1698 - "data_win_eventdata_serviceName": true,
1699 - "data_win_eventdata_serviceSid": true,
1700 - "data_win_eventdata_signature": true,
1701 - "data_win_eventdata_signatureStatus": true,
1702 - "data_win_eventdata_signed": true,
1703 - "data_win_eventdata_sourceHostname": true,
1704 - "data_win_eventdata_sourceImage": true,
1705 - "data_win_eventdata_sourceIp": true,
1706 - "data_win_eventdata_sourceIp_city_name": true,
1707 - "data_win_eventdata_sourceIp_country_code": true,
1708 - "data_win_eventdata_sourceIp_geolocation": true,
1709 - "data_win_eventdata_sourceIsIpv6": true,
1710 - "data_win_eventdata_sourcePort": true,
1711 - "data_win_eventdata_sourceProcessGUID": true,
1712 - "data_win_eventdata_sourceProcessId": true,
1713 - "data_win_eventdata_sourceThreadId": true,
1714 - "data_win_eventdata_status": true,
1715 - "data_win_eventdata_subjectDomainName": true,
1716 - "data_win_eventdata_subjectLogonId": true,
1717 - "data_win_eventdata_subjectUserName": true,
1718 - "data_win_eventdata_subjectUserSid": true,
1719 - "data_win_eventdata_targetDomainName": true,
1720 - "data_win_eventdata_targetFilename": true,
1721 - "data_win_eventdata_targetImage": true,
1722 - "data_win_eventdata_targetLinkedLogonId": true,
1723 - "data_win_eventdata_targetLogonId": true,
1724 - "data_win_eventdata_targetObject": true,
1725 - "data_win_eventdata_targetProcessGUID": true,
1726 - "data_win_eventdata_targetProcessId": true,
1727 - "data_win_eventdata_targetUserName": true,
1728 - "data_win_eventdata_targetUserSid": true,
1729 - "data_win_eventdata_terminalSessionId": true,
1730 - "data_win_eventdata_ticketEncryptionType": true,
1731 - "data_win_eventdata_ticketOptions": true,
1732 - "data_win_eventdata_user": true,
1733 - "data_win_eventdata_utcTime": true,
1734 - "data_win_eventdata_virtualAccount": true,
1735 - "data_win_system_channel": true,
1736 - "data_win_system_computer": true,
1737 - "data_win_system_eventID": true,
1738 - "data_win_system_eventRecordID": true,
1739 - "data_win_system_eventSourceName": true,
1740 - "data_win_system_keywords": true,
1741 - "data_win_system_level": true,
1742 - "data_win_system_message": true,
1743 - "data_win_system_opcode": true,
1744 - "data_win_system_processID": true,
1745 - "data_win_system_providerGuid": true,
1746 - "data_win_system_providerName": true,
1747 - "data_win_system_severityValue": true,
1748 - "data_win_system_systemTime": true,
1749 - "data_win_system_task": true,
1750 - "data_win_system_threadID": true,
1751 - "data_win_system_version": true,
1752 - "decoder_name": true,
1753 - "decoder_parent": true,
1754 - "dns_query": true,
1755 - "dns_query_threat_indicated": true,
1756 - "dst_ip": true,
1757 - "dst_ip_city_name": true,
1758 - "dst_ip_country_code": true,
1759 - "dst_ip_geolocation": true,
1760 - "dst_ip_threat_indicated": true,
1761 - "dst_port": true,
1762 - "ecs_version": true,
1763 - "error": true,
1764 - "event_hash": true,
1765 - "file_path": true,
1766 - "firewall_rule_name": true,
1767 - "full_log": false,
1768 - "gl2_accounted_message_size": true,
1769 - "gl2_message_id": true,
1770 - "gl2_processing_error": true,
1771 - "gl2_remote_ip": true,
1772 - "gl2_remote_port": true,
1773 - "gl2_source_collector": true,
1774 - "gl2_source_input": true,
1775 - "gl2_source_node": true,
1776 - "hash_md5": true,
1777 - "hash_sha1": true,
1778 - "hash_sha256": true,
1779 - "highlight": true,
1780 - "host_architecture": true,
1781 - "host_containerized": true,
1782 - "host_hostname": true,
1783 - "host_id": true,
1784 - "host_ip": true,
1785 - "host_mac": true,
1786 - "host_name": true,
1787 - "host_os_codename": true,
1788 - "host_os_kernel": true,
1789 - "host_os_name": true,
1790 - "host_os_platform": true,
1791 - "host_os_version": true,
1792 - "hostname": true,
1793 - "id": true,
1794 - "input_type": true,
1795 - "level": true,
1796 - "location": true,
1797 - "log_file_path": true,
1798 - "log_offset": true,
1799 - "manager_name": true,
1800 - "message": true,
1801 - "module": true,
1802 - "parent_process_cmd_line": true,
1803 - "parent_process_id": true,
1804 - "parent_process_image": true,
1805 - "pid": true,
1806 - "predecoder_hostname": true,
1807 - "predecoder_program_name": true,
1808 - "predecoder_timestamp": true,
1809 - "previous_log": true,
1810 - "previous_output": true,
1811 - "process_cmd_line": true,
1812 - "process_id": true,
1813 - "process_image": true,
1814 - "process_name": true,
1815 - "protocol": true,
1816 - "rule_cis": true,
1817 - "rule_cis_csc": true,
1818 - "rule_firedtimes": true,
1819 - "rule_gdpr": true,
1820 - "rule_gdpr_IV": true,
1821 - "rule_gpg13": true,
1822 - "rule_gpg_13": true,
1823 - "rule_group1": true,
1824 - "rule_groups": true,
1825 - "rule_hipaa": true,
1826 - "rule_id": true,
1827 - "rule_info": true,
1828 - "rule_mail": true,
1829 - "rule_mitre_id": true,
1830 - "rule_mitre_tactic": false,
1831 - "rule_nist_800_53": true,
1832 - "rule_pci_dss": true,
1833 - "rule_tsc": true,
1834 - "scanid": true,
1835 - "service": true,
1836 - "software_package": true,
1837 - "software_vendor": true,
1838 - "sort": true,
1839 - "source": true,
1840 - "src_ip": true,
1841 - "src_ip_city_name": true,
1842 - "src_ip_country_code": true,
1843 - "src_ip_geolocation": true,
1844 - "src_port": true,
1845 - "streams": true,
1846 - "syscheck_attrs_after": true,
1847 - "syscheck_audit_effective_user_id": true,
1848 - "syscheck_audit_effective_user_name": true,
1849 - "syscheck_audit_group_id": true,
1850 - "syscheck_audit_group_name": true,
1851 - "syscheck_audit_login_user_id": true,
1852 - "syscheck_audit_login_user_name": true,
1853 - "syscheck_audit_process_cwd": true,
1854 - "syscheck_audit_process_id": true,
1855 - "syscheck_audit_process_name": true,
1856 - "syscheck_audit_process_parent_cwd": true,
1857 - "syscheck_audit_process_parent_name": true,
1858 - "syscheck_audit_process_ppid": true,
1859 - "syscheck_audit_user_id": true,
1860 - "syscheck_audit_user_name": true,
1861 - "syscheck_changed_attributes": true,
1862 - "syscheck_event": true,
1863 - "syscheck_gid_after": true,
1864 - "syscheck_gname_after": true,
1865 - "syscheck_hard_links": true,
1866 - "syscheck_inode_after": true,
1867 - "syscheck_inode_before": true,
1868 - "syscheck_md5_after": true,
1869 - "syscheck_md5_before": true,
1870 - "syscheck_mode": true,
1871 - "syscheck_mtime_after": true,
1872 - "syscheck_mtime_before": true,
1873 - "syscheck_path": true,
1874 - "syscheck_perm_after": true,
1875 - "syscheck_perm_before": true,
1876 - "syscheck_sha1_after": true,
1877 - "syscheck_sha1_before": true,
1878 - "syscheck_sha256_after": true,
1879 - "syscheck_sha256_before": true,
1880 - "syscheck_size_after": true,
1881 - "syscheck_size_before": true,
1882 - "syscheck_uid_after": true,
1883 - "syscheck_uname_after": true,
1884 - "syscheck_win_perm_after": true,
1885 - "syscheck_win_perm_after_0_allowed": true,
1886 - "syscheck_win_perm_after_0_name": true,
1887 - "syscheck_win_perm_after_1_allowed": true,
1888 - "syscheck_win_perm_after_1_name": true,
1889 - "syscheck_win_perm_after_2_allowed": true,
1890 - "syscheck_win_perm_after_2_name": true,
1891 - "syscheck_win_perm_after_3_allowed": true,
1892 - "syscheck_win_perm_after_3_name": true,
1893 - "syslog_customer": true,
1894 - "syslog_level": true,
1895 - "syslog_tag": true,
1896 - "syslog_type": true,
1897 - "sysmon_event_description": true,
1898 - "threat_ids": true,
1899 - "threat_indicated": true,
1900 - "threat_names": true,
1901 - "time": true,
1902 - "timestamp": true,
1903 - "true": true,
1904 - "user_name": true,
1905 - "win_registry_key": true,
1906 - "win_system_eventID": true,
1907 - "windows_auth_package": true,
1908 - "windows_domain": true,
1909 - "windows_event_id": true,
1910 - "windows_event_severity": true,
1911 - "windows_logon_type": true
1912 - },
1913 - "indexByName": {
1914 - "_id": 2,
1915 - "_index": 9,
1916 - "_type": 10,
1917 - "agent_id": 11,
1918 - "agent_name": 5,
1919 - "cluster_name": 12,
1920 - "cluster_node": 13,
1921 - "data_office365_AppAccessContext_APIId": 49,
1922 - "data_office365_AppAccessContext_ClientAppId": 50,
1923 - "data_office365_AppAccessContext_ClientAppName": 51,
1924 - "data_office365_AppAccessContext_CorrelationId": 52,
1925 - "data_office365_ArtifactsShared": 53,
1926 - "data_office365_Attendees": 54,
1927 - "data_office365_ChatName": 55,
1928 - "data_office365_ChatThreadId": 56,
1929 - "data_office365_ClientIP": 4,
1930 - "data_office365_ClientIP_city_name": 14,
1931 - "data_office365_ClientIP_country_code": 15,
1932 - "data_office365_ClientIP_geolocation": 16,
1933 - "data_office365_CommunicationSubType": 57,
1934 - "data_office365_CommunicationType": 58,
1935 - "data_office365_CreationTime": 0,
1936 - "data_office365_DeviceId": 59,
1937 - "data_office365_DeviceInformation": 60,
1938 - "data_office365_EndTime": 61,
1939 - "data_office365_ExchangeId": 62,
1940 - "data_office365_ExtraProperties": 63,
1941 - "data_office365_ICalUid": 64,
1942 - "data_office365_Id": 17,
1943 - "data_office365_ItemName": 65,
1944 - "data_office365_JoinTime": 66,
1945 - "data_office365_LeaveTime": 67,
1946 - "data_office365_MeetingDetailId": 68,
1947 - "data_office365_MeetingURL": 69,
1948 - "data_office365_Members": 70,
1949 - "data_office365_MessageId": 71,
1950 - "data_office365_MessageSizeInBytes": 72,
1951 - "data_office365_MessageURLs": 73,
1952 - "data_office365_MessageVersion": 74,
1953 - "data_office365_Modalities": 75,
1954 - "data_office365_Name": 76,
1955 - "data_office365_NewValue": 77,
1956 - "data_office365_ObjectId": 18,
1957 - "data_office365_Operation": 24,
1958 - "data_office365_OperationScope": 78,
1959 - "data_office365_OrganizationId": 19,
1960 - "data_office365_Organizer_OrganizationId": 79,
1961 - "data_office365_Organizer_RecipientType": 80,
1962 - "data_office365_Organizer_Role": 81,
1963 - "data_office365_Organizer_UserObjectId": 82,
1964 - "data_office365_ProviderTypes": 83,
1965 - "data_office365_RecordType": 20,
1966 - "data_office365_StartTime": 84,
1967 - "data_office365_SubscriptionId": 85,
1968 - "data_office365_TeamGuid": 86,
1969 - "data_office365_UserId": 3,
1970 - "data_office365_UserKey": 21,
1971 - "data_office365_UserType": 22,
1972 - "data_office365_Version": 23,
1973 - "data_office365_Workload": 48,
1974 - "decoder_name": 25,
1975 - "gl2_accounted_message_size": 26,
1976 - "gl2_message_id": 27,
1977 - "gl2_processing_error": 28,
1978 - "gl2_remote_ip": 29,
1979 - "gl2_remote_port": 30,
1980 - "gl2_source_input": 31,
1981 - "gl2_source_node": 32,
1982 - "highlight": 33,
1983 - "id": 34,
1984 - "location": 35,
1985 - "manager_name": 36,
1986 - "message": 37,
1987 - "rule_description": 6,
1988 - "rule_firedtimes": 38,
1989 - "rule_group1": 39,
1990 - "rule_groups": 40,
1991 - "rule_id": 8,
1992 - "rule_level": 7,
1993 - "rule_mail": 41,
1994 - "sort": 42,
1995 - "source": 43,
1996 - "streams": 44,
1997 - "syslog_level": 45,
1998 - "syslog_type": 46,
1999 - "timestamp": 1,
2000 - "true": 47
2001 - },
2002 - "renameByName": {
2003 - "_id": "EVENT ID",
2004 - "agent_name": "",
2005 - "data_office365_ActorIpAddress": "SRC IP",
2006 - "data_office365_ClientIP": "CLIENT IP",
2007 - "data_office365_ClientIP_city_name": "",
2008 - "data_office365_CreationTime": "EVENT TIME",
2009 - "data_office365_ResultStatus": "RESULT",
2010 - "data_office365_UserId": "ACCOUNT",
2011 - "rule_description": "DESCRIPTION",
2012 - "rule_id": "RULE ID",
2013 - "rule_level": "",
2014 - "rule_mitre_tactic": "MITRE TACTIC",
2015 - "rule_mitre_technique": "MITRE TECHNIQUE",
2016 - "timestamp": "Date/Time"
2017 - }
2018 - }
2019 - }
2020 - ],
2021 - "transparent": true,
2022 - "type": "table"
2023 - }
2024 - ],
2025 - "refresh": false,
2026 - "schemaVersion": 37,
2027 - "style": "dark",
2028 - "tags": [
2029 - "O365"
2030 - ],
2031 - "templating": {
2032 - "list": [
2033 - {
2034 - "datasource": {
2035 - "type": "elasticsearch",
2036 - "uid": "replace_datasource_uid"
2037 - },
2038 - "filters": [],
2039 - "hide": 0,
2040 - "label": "",
2041 - "name": "Filters",
2042 - "skipUrlSync": false,
2043 - "type": "adhoc"
2044 - },
2045 - {
2046 - "current": {
2047 - "selected": false,
2048 - "text": "All",
2049 - "value": "$__all"
2050 - },
2051 - "datasource": {
2052 - "type": "elasticsearch",
2053 - "uid": "replace_datasource_uid"
2054 - },
2055 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftTeams\"}",
2056 - "hide": 0,
2057 - "includeAll": true,
2058 - "label": "Operation",
2059 - "multi": false,
2060 - "name": "operation",
2061 - "options": [],
2062 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftTeams\"}",
2063 - "refresh": 2,
2064 - "regex": "",
2065 - "skipUrlSync": false,
2066 - "sort": 1,
2067 - "tagValuesQuery": "",
2068 - "tagsQuery": "",
2069 - "type": "query",
2070 - "useTags": false
2071 - },
2072 - {
2073 - "current": {
2074 - "selected": false,
2075 - "text": "All",
2076 - "value": "$__all"
2077 - },
2078 - "datasource": {
2079 - "type": "elasticsearch",
2080 - "uid": "replace_datasource_uid"
2081 - },
2082 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2083 - "hide": 0,
2084 - "includeAll": true,
2085 - "label": "Rule Level",
2086 - "multi": false,
2087 - "name": "rule_level",
2088 - "options": [],
2089 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2090 - "refresh": 2,
2091 - "regex": "",
2092 - "skipUrlSync": false,
2093 - "sort": 0,
2094 - "type": "query"
2095 - }
2096 - ]
2097 - },
2098 - "time": {
2099 - "from": "now-12h",
2100 - "to": "now"
2101 - },
2102 - "timepicker": {
2103 - "refresh_intervals": [
2104 - "5s",
2105 - "10s",
2106 - "30s",
2107 - "1m",
2108 - "5m",
2109 - "15m",
2110 - "30m",
2111 - "1h",
2112 - "2h",
2113 - "1d"
2114 - ],
2115 - "time_options": [
2116 - "5m",
2117 - "15m",
2118 - "1h",
2119 - "6h",
2120 - "12h",
2121 - "24h",
2122 - "2d",
2123 - "7d",
2124 - "30d"
2125 - ]
2126 - },
2127 - "timezone": "",
2128 - "title": "O365 - MICROSOFT TEAMS",
2129 - "uid": "dslr7w3nz",
2130 - "version": 1,
2131 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto"
93 + },
94 + "pluginVersion": "9.2.0",
95 + "targets": [
96 + {
97 + "bucketAggs": [
98 + {
99 + "field": "timestamp",
100 + "id": "2",
101 + "settings": {
102 + "interval": "auto",
103 + "min_doc_count": 0,
104 + "trimEdges": 0
105 + },
106 + "type": "date_histogram"
107 + }
108 + ],
109 + "datasource": {
110 + "type": "elasticsearch",
111 + "uid": "replace_datasource_uid"
112 + },
113 + "metrics": [
114 + {
115 + "field": "select field",
116 + "id": "1",
117 + "type": "count"
118 + }
119 + ],
120 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
121 + "refId": "A",
122 + "timeField": "timestamp"
123 + }
124 + ],
125 + "title": "ALERTS",
126 + "type": "stat"
127 + },
128 + {
129 + "datasource": {
130 + "type": "elasticsearch",
131 + "uid": "replace_datasource_uid"
132 + },
133 + "fieldConfig": {
134 + "defaults": {
135 + "color": {
136 + "mode": "palette-classic"
137 + },
138 + "custom": {
139 + "hideFrom": {
140 + "legend": false,
141 + "tooltip": false,
142 + "viz": false
143 + }
144 + },
145 + "mappings": []
146 + },
147 + "overrides": [
148 + {
149 + "matcher": {
150 + "id": "byName",
151 + "options": "Count"
152 + },
153 + "properties": [
154 + {
155 + "id": "displayName",
156 + "value": "EVENTS"
157 + },
158 + {
159 + "id": "unit",
160 + "value": "short"
161 + },
162 + {
163 + "id": "decimals",
164 + "value": -1
165 + }
166 + ]
167 + }
168 + ]
169 + },
170 + "gridPos": {
171 + "h": 7,
172 + "w": 4,
173 + "x": 4,
174 + "y": 0
175 + },
176 + "id": 53,
177 + "options": {
178 + "legend": {
179 + "displayMode": "list",
180 + "placement": "bottom",
181 + "showLegend": false
182 + },
183 + "pieType": "donut",
184 + "reduceOptions": {
185 + "calcs": ["sum"],
186 + "fields": "",
187 + "values": false
188 + },
189 + "tooltip": {
190 + "mode": "single",
191 + "sort": "none"
192 + }
193 + },
194 + "pluginVersion": "8.5.1",
195 + "targets": [
196 + {
197 + "bucketAggs": [
198 + {
199 + "fake": true,
200 + "field": "data_office365_Operation",
201 + "id": "4",
202 + "settings": {
203 + "min_doc_count": 1,
204 + "order": "desc",
205 + "orderBy": "_count",
206 + "size": "10"
207 + },
208 + "type": "terms"
209 + },
210 + {
211 + "field": "data_office365_CreationTime",
212 + "id": "5",
213 + "settings": {
214 + "interval": "auto",
215 + "min_doc_count": "0",
216 + "timeZone": "utc",
217 + "trimEdges": "0"
218 + },
219 + "type": "date_histogram"
220 + }
221 + ],
222 + "datasource": {
223 + "type": "elasticsearch",
224 + "uid": "replace_datasource_uid"
225 + },
226 + "metrics": [
227 + {
228 + "field": "select field",
229 + "id": "1",
230 + "type": "count"
231 + }
232 + ],
233 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
234 + "refId": "A",
235 + "timeField": "timestamp"
236 + }
237 + ],
238 + "title": "EVENTS BY OPERATION (Top 10)",
239 + "transformations": [],
240 + "type": "piechart"
241 + },
242 + {
243 + "datasource": {
244 + "type": "elasticsearch",
245 + "uid": "replace_datasource_uid"
246 + },
247 + "fieldConfig": {
248 + "defaults": {
249 + "color": {
250 + "mode": "thresholds"
251 + },
252 + "custom": {
253 + "align": "auto",
254 + "displayMode": "auto",
255 + "inspect": false
256 + },
257 + "mappings": [],
258 + "thresholds": {
259 + "mode": "absolute",
260 + "steps": [
261 + {
262 + "color": "red",
263 + "value": null
264 + }
265 + ]
266 + }
267 + },
268 + "overrides": [
269 + {
270 + "matcher": {
271 + "id": "byName",
272 + "options": "Count"
273 + },
274 + "properties": [
275 + {
276 + "id": "displayName",
277 + "value": "EVENTS"
278 + },
279 + {
280 + "id": "unit",
281 + "value": "short"
282 + },
283 + {
284 + "id": "decimals",
285 + "value": -1
286 + },
287 + {
288 + "id": "custom.align"
289 + },
290 + {
291 + "id": "thresholds",
292 + "value": {
293 + "mode": "absolute",
294 + "steps": [
295 + {
296 + "color": "red",
297 + "value": null
298 + }
299 + ]
300 + }
301 + }
302 + ]
303 + }
304 + ]
305 + },
306 + "gridPos": {
307 + "h": 7,
308 + "w": 6,
309 + "x": 8,
310 + "y": 0
311 + },
312 + "id": 54,
313 + "options": {
314 + "footer": {
315 + "fields": "",
316 + "reducer": ["sum"],
317 + "show": false
318 + },
319 + "showHeader": true
320 + },
321 + "pluginVersion": "9.2.0",
322 + "targets": [
323 + {
324 + "bucketAggs": [
325 + {
326 + "fake": true,
327 + "field": "data_office365_Operation",
328 + "id": "4",
329 + "settings": {
330 + "min_doc_count": 1,
331 + "order": "desc",
332 + "orderBy": "_count",
333 + "size": "0"
334 + },
335 + "type": "terms"
336 + }
337 + ],
338 + "datasource": {
339 + "type": "elasticsearch",
340 + "uid": "replace_datasource_uid"
341 + },
342 + "metrics": [
343 + {
344 + "field": "select field",
345 + "id": "1",
346 + "type": "count"
347 + }
348 + ],
349 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
350 + "refId": "A",
351 + "timeField": "timestamp"
352 + }
353 + ],
354 + "title": "EVENTS BY OPERATION",
355 + "transformations": [
356 + {
357 + "id": "merge",
358 + "options": {
359 + "reducers": []
360 + }
361 + },
362 + {
363 + "id": "organize",
364 + "options": {
365 + "excludeByName": {},
366 + "indexByName": {},
367 + "renameByName": {
368 + "Count": "EVENTS",
369 + "data_office365_Operation": "OPERATION"
370 + }
371 + }
372 + }
373 + ],
374 + "type": "table"
375 + },
376 + {
377 + "datasource": {
378 + "type": "elasticsearch",
379 + "uid": "replace_datasource_uid"
380 + },
381 + "fieldConfig": {
382 + "defaults": {
383 + "color": {
384 + "mode": "thresholds"
385 + },
386 + "mappings": [
387 + {
388 + "options": {
389 + "match": "null",
390 + "result": {
391 + "text": "N/A"
392 + }
393 + },
394 + "type": "special"
395 + }
396 + ],
397 + "max": 15,
398 + "min": 0,
399 + "thresholds": {
400 + "mode": "absolute",
401 + "steps": [
402 + {
403 + "color": "#299c46",
404 + "value": null
405 + },
406 + {
407 + "color": "rgba(237, 129, 40, 0.89)",
408 + "value": 8
409 + },
410 + {
411 + "color": "#d44a3a",
412 + "value": 12
413 + }
414 + ]
415 + },
416 + "unit": "none"
417 + },
418 + "overrides": []
419 + },
420 + "gridPos": {
421 + "h": 7,
422 + "w": 4,
423 + "x": 0,
424 + "y": 7
425 + },
426 + "id": 16,
427 + "links": [],
428 + "options": {
429 + "orientation": "horizontal",
430 + "reduceOptions": {
431 + "calcs": ["max"],
432 + "fields": "",
433 + "values": false
434 + },
435 + "showThresholdLabels": false,
436 + "showThresholdMarkers": true,
437 + "text": {}
438 + },
439 + "pluginVersion": "9.2.0",
440 + "targets": [
441 + {
442 + "bucketAggs": [
443 + {
444 + "field": "timestamp",
445 + "id": "2",
446 + "settings": {
447 + "interval": "auto",
448 + "min_doc_count": 0,
449 + "trimEdges": 0
450 + },
451 + "type": "date_histogram"
452 + }
453 + ],
454 + "datasource": {
455 + "type": "elasticsearch",
456 + "uid": "replace_datasource_uid"
457 + },
458 + "metrics": [
459 + {
460 + "field": "rule_level",
461 + "id": "1",
462 + "meta": {},
463 + "settings": {},
464 + "type": "max"
465 + }
466 + ],
467 + "query": "data_office365_Operation:$operation",
468 + "refId": "A",
469 + "timeField": "timestamp"
470 + }
471 + ],
472 + "title": "MAX SEVERITY (0 - 15)",
473 + "type": "gauge"
474 + },
475 + {
476 + "datasource": {
477 + "type": "elasticsearch",
478 + "uid": "replace_datasource_uid"
479 + },
480 + "fieldConfig": {
481 + "defaults": {
482 + "color": {
483 + "mode": "palette-classic"
484 + },
485 + "custom": {
486 + "axisCenteredZero": false,
487 + "axisColorMode": "text",
488 + "axisLabel": "",
489 + "axisPlacement": "auto",
490 + "barAlignment": 0,
491 + "drawStyle": "bars",
492 + "fillOpacity": 0,
493 + "gradientMode": "none",
494 + "hideFrom": {
495 + "legend": false,
496 + "tooltip": false,
497 + "viz": false
498 + },
499 + "lineInterpolation": "linear",
500 + "lineWidth": 1,
501 + "pointSize": 5,
502 + "scaleDistribution": {
503 + "type": "linear"
504 + },
505 + "showPoints": "auto",
506 + "spanNulls": false,
507 + "stacking": {
508 + "group": "A",
509 + "mode": "normal"
510 + },
511 + "thresholdsStyle": {
512 + "mode": "off"
513 + }
514 + },
515 + "mappings": [],
516 + "thresholds": {
517 + "mode": "absolute",
518 + "steps": [
519 + {
520 + "color": "green",
521 + "value": null
522 + },
523 + {
524 + "color": "red",
525 + "value": 80
526 + }
527 + ]
528 + }
529 + },
530 + "overrides": []
531 + },
532 + "gridPos": {
533 + "h": 13,
534 + "w": 20,
535 + "x": 4,
536 + "y": 7
537 + },
538 + "id": 60,
539 + "options": {
540 + "legend": {
541 + "calcs": [],
542 + "displayMode": "table",
543 + "placement": "right",
544 + "showLegend": true
545 + },
546 + "tooltip": {
547 + "mode": "single",
548 + "sort": "none"
549 + }
550 + },
551 + "targets": [
552 + {
553 + "alias": "",
554 + "bucketAggs": [
555 + {
556 + "field": "data_office365_Operation",
557 + "id": "3",
558 + "settings": {
559 + "min_doc_count": "1",
560 + "order": "desc",
561 + "orderBy": "_count",
562 + "size": "10"
563 + },
564 + "type": "terms"
565 + },
566 + {
567 + "field": "timestamp",
568 + "id": "2",
569 + "settings": {
570 + "interval": "auto"
571 + },
572 + "type": "date_histogram"
573 + }
574 + ],
575 + "datasource": {
576 + "type": "elasticsearch",
577 + "uid": "replace_datasource_uid"
578 + },
579 + "metrics": [
580 + {
581 + "id": "1",
582 + "type": "count"
583 + }
584 + ],
585 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
586 + "refId": "A",
587 + "timeField": "timestamp"
588 + }
589 + ],
590 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
591 + "transparent": true,
592 + "type": "timeseries"
593 + },
594 + {
595 + "datasource": {
596 + "type": "elasticsearch",
597 + "uid": "replace_datasource_uid"
598 + },
599 + "fieldConfig": {
600 + "defaults": {
601 + "mappings": [
602 + {
603 + "options": {
604 + "match": "null",
605 + "result": {
606 + "text": "N/A"
607 + }
608 + },
609 + "type": "special"
610 + }
611 + ],
612 + "thresholds": {
613 + "mode": "absolute",
614 + "steps": [
615 + {
616 + "color": "blue",
617 + "value": null
618 + }
619 + ]
620 + },
621 + "unit": "locale"
622 + },
623 + "overrides": []
624 + },
625 + "gridPos": {
626 + "h": 6,
627 + "w": 4,
628 + "x": 0,
629 + "y": 14
630 + },
631 + "id": 51,
632 + "links": [],
633 + "options": {
634 + "colorMode": "value",
635 + "graphMode": "area",
636 + "justifyMode": "auto",
637 + "orientation": "horizontal",
638 + "reduceOptions": {
639 + "calcs": ["sum"],
640 + "fields": "",
641 + "values": false
642 + },
643 + "text": {},
644 + "textMode": "auto"
645 + },
646 + "pluginVersion": "9.2.0",
647 + "targets": [
648 + {
649 + "bucketAggs": [
650 + {
651 + "$$hashKey": "object:331",
652 + "field": "timestamp",
653 + "id": "2",
654 + "settings": {
655 + "interval": "auto",
656 + "min_doc_count": 0,
657 + "trimEdges": 0
658 + },
659 + "type": "date_histogram"
660 + }
661 + ],
662 + "datasource": {
663 + "type": "elasticsearch",
664 + "uid": "replace_datasource_uid"
665 + },
666 + "metrics": [
667 + {
668 + "$$hashKey": "object:329",
669 + "field": "select field",
670 + "id": "1",
671 + "type": "count"
672 + }
673 + ],
674 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
675 + "refId": "A",
676 + "timeField": "timestamp"
677 + }
678 + ],
679 + "title": "EVENTS (Total)",
680 + "type": "stat"
681 + },
682 + {
683 + "datasource": {
684 + "type": "elasticsearch",
685 + "uid": "replace_datasource_uid"
686 + },
687 + "fieldConfig": {
688 + "defaults": {
689 + "mappings": [
690 + {
691 + "options": {
692 + "match": "null",
693 + "result": {
694 + "text": "N/A"
695 + }
696 + },
697 + "type": "special"
698 + }
699 + ],
700 + "thresholds": {
701 + "mode": "absolute",
702 + "steps": [
703 + {
704 + "color": "orange",
705 + "value": null
706 + }
707 + ]
708 + },
709 + "unit": "locale"
710 + },
711 + "overrides": []
712 + },
713 + "gridPos": {
714 + "h": 6,
715 + "w": 4,
716 + "x": 0,
717 + "y": 20
718 + },
719 + "id": 52,
720 + "links": [],
721 + "options": {
722 + "colorMode": "value",
723 + "graphMode": "area",
724 + "justifyMode": "auto",
725 + "orientation": "horizontal",
726 + "reduceOptions": {
727 + "calcs": ["sum"],
728 + "fields": "",
729 + "values": false
730 + },
731 + "text": {},
732 + "textMode": "auto"
733 + },
734 + "pluginVersion": "9.2.0",
735 + "targets": [
736 + {
737 + "bucketAggs": [
738 + {
739 + "$$hashKey": "object:331",
740 + "field": "timestamp",
741 + "id": "2",
742 + "settings": {
743 + "interval": "auto",
744 + "min_doc_count": 0,
745 + "trimEdges": 0
746 + },
747 + "type": "date_histogram"
748 + }
749 + ],
750 + "datasource": {
751 + "type": "elasticsearch",
752 + "uid": "replace_datasource_uid"
753 + },
754 + "metrics": [
755 + {
756 + "$$hashKey": "object:329",
757 + "field": "select field",
758 + "id": "1",
759 + "type": "count"
760 + }
761 + ],
762 + "query": "data_office365_Operation:MessageCreatedHasLink AND rule_level:$rule_level",
763 + "refId": "A",
764 + "timeField": "timestamp"
765 + }
766 + ],
767 + "title": "TEAMS - MESSAGES CONTAINING LINK",
768 + "type": "stat"
769 + },
770 + {
771 + "circleMaxSize": 30,
772 + "circleMinSize": 2,
773 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
774 + "datasource": {
775 + "type": "elasticsearch",
776 + "uid": "replace_datasource_uid"
777 + },
778 + "decimals": 0,
779 + "esMetric": "Count",
780 + "gridPos": {
781 + "h": 12,
782 + "w": 10,
783 + "x": 4,
784 + "y": 20
785 + },
786 + "hideEmpty": false,
787 + "hideZero": false,
788 + "id": 50,
789 + "initialZoom": 1,
790 + "locationData": "countries",
791 + "mapCenter": "(0°, 0°)",
792 + "mapCenterLatitude": 0,
793 + "mapCenterLongitude": 0,
794 + "maxDataPoints": 1,
795 + "mouseWheelZoom": false,
796 + "showLegend": true,
797 + "stickyLabels": false,
798 + "tableQueryOptions": {
799 + "geohashField": "geohash",
800 + "latitudeField": "latitude",
801 + "longitudeField": "longitude",
802 + "metricField": "metric",
803 + "queryType": "geohash"
804 + },
805 + "targets": [
806 + {
807 + "bucketAggs": [
808 + {
809 + "fake": true,
810 + "field": "data_office365_ClientIP_country_code",
811 + "id": "3",
812 + "settings": {
813 + "min_doc_count": 1,
814 + "order": "desc",
815 + "orderBy": "_term",
816 + "size": "0"
817 + },
818 + "type": "terms"
819 + },
820 + {
821 + "field": "timestamp",
822 + "id": "2",
823 + "settings": {
824 + "interval": "auto",
825 + "min_doc_count": 0,
826 + "trimEdges": 0
827 + },
828 + "type": "date_histogram"
829 + }
830 + ],
831 + "datasource": {
832 + "type": "elasticsearch",
833 + "uid": "replace_datasource_uid"
834 + },
835 + "metrics": [
836 + {
837 + "field": "select field",
838 + "id": "1",
839 + "type": "count"
840 + }
841 + ],
842 + "query": "data_office365_Workload:MicrosoftTeams AND rule_level:$rule_level",
843 + "refId": "A",
844 + "timeField": "timestamp"
845 + }
846 + ],
847 + "thresholds": "0,10",
848 + "title": "TEAMS - ALL EVENTS BY SRC COUNTRY",
849 + "type": "grafana-worldmap-panel",
850 + "unitPlural": "",
851 + "unitSingle": "",
852 + "valueName": "total"
853 + },
854 + {
855 + "datasource": {
856 + "type": "elasticsearch",
857 + "uid": "replace_datasource_uid"
858 + },
859 + "fieldConfig": {
860 + "defaults": {
861 + "color": {
862 + "mode": "thresholds"
863 + },
864 + "custom": {
865 + "align": "auto",
866 + "displayMode": "auto",
867 + "inspect": false
868 + },
869 + "mappings": [],
870 + "thresholds": {
871 + "mode": "absolute",
872 + "steps": [
873 + {
874 + "color": "orange",
875 + "value": null
876 + }
877 + ]
878 + }
879 + },
880 + "overrides": [
881 + {
882 + "matcher": {
883 + "id": "byName",
884 + "options": "Count"
885 + },
886 + "properties": [
887 + {
888 + "id": "displayName",
889 + "value": "EVENTS"
890 + },
891 + {
892 + "id": "unit",
893 + "value": "short"
894 + },
895 + {
896 + "id": "decimals",
897 + "value": -1
898 + },
899 + {
900 + "id": "custom.align"
901 + }
902 + ]
903 + },
904 + {
905 + "matcher": {
906 + "id": "byName",
907 + "options": "AD ACCOUNT"
908 + },
909 + "properties": [
910 + {
911 + "id": "custom.width",
912 + "value": 377
913 + }
914 + ]
915 + }
916 + ]
917 + },
918 + "gridPos": {
919 + "h": 12,
920 + "w": 10,
921 + "x": 14,
922 + "y": 20
923 + },
924 + "id": 58,
925 + "options": {
926 + "footer": {
927 + "fields": "",
928 + "reducer": ["sum"],
929 + "show": false
930 + },
931 + "showHeader": true,
932 + "sortBy": []
933 + },
934 + "pluginVersion": "9.2.0",
935 + "targets": [
936 + {
937 + "bucketAggs": [
938 + {
939 + "fake": true,
940 + "field": "data_office365_UserId",
941 + "id": "4",
942 + "settings": {
943 + "min_doc_count": 1,
944 + "order": "desc",
945 + "orderBy": "_count",
946 + "size": "0"
947 + },
948 + "type": "terms"
949 + },
950 + {
951 + "field": "data_office365_ClientIP_country_code",
952 + "id": "5",
953 + "settings": {
954 + "min_doc_count": "1",
955 + "order": "desc",
956 + "orderBy": "_term",
957 + "size": "10"
958 + },
959 + "type": "terms"
960 + }
961 + ],
962 + "datasource": {
963 + "type": "elasticsearch",
964 + "uid": "replace_datasource_uid"
965 + },
966 + "metrics": [
967 + {
968 + "field": "select field",
969 + "id": "1",
970 + "type": "count"
971 + }
972 + ],
973 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
974 + "refId": "A",
975 + "timeField": "timestamp"
976 + }
977 + ],
978 + "title": "TEAMS EVENTS BY ACCOUNT",
979 + "transformations": [
980 + {
981 + "id": "merge",
982 + "options": {
983 + "reducers": []
984 + }
985 + },
986 + {
987 + "id": "organize",
988 + "options": {
989 + "excludeByName": {},
990 + "indexByName": {},
991 + "renameByName": {
992 + "Count": "EVENTS",
993 + "data_office365_ClientIP_country_code": "COUNTRY",
994 + "data_office365_LogonError": "ERROR",
995 + "data_office365_Operation": "WORKLOAD",
996 + "data_office365_UserId": "AD ACCOUNT"
997 + }
998 + }
999 + }
1000 + ],
1001 + "type": "table"
1002 + },
1003 + {
1004 + "datasource": {
1005 + "type": "elasticsearch",
1006 + "uid": "replace_datasource_uid"
1007 + },
1008 + "fieldConfig": {
1009 + "defaults": {
1010 + "mappings": [
1011 + {
1012 + "options": {
1013 + "match": "null",
1014 + "result": {
1015 + "text": "N/A"
1016 + }
1017 + },
1018 + "type": "special"
1019 + }
1020 + ],
1021 + "thresholds": {
1022 + "mode": "absolute",
1023 + "steps": [
1024 + {
1025 + "color": "blue",
1026 + "value": null
1027 + }
1028 + ]
1029 + },
1030 + "unit": "locale"
1031 + },
1032 + "overrides": []
1033 + },
1034 + "gridPos": {
1035 + "h": 6,
1036 + "w": 4,
1037 + "x": 0,
1038 + "y": 26
1039 + },
1040 + "id": 18,
1041 + "links": [],
1042 + "options": {
1043 + "colorMode": "value",
1044 + "graphMode": "area",
1045 + "justifyMode": "auto",
1046 + "orientation": "horizontal",
1047 + "reduceOptions": {
1048 + "calcs": ["sum"],
1049 + "fields": "",
1050 + "values": false
1051 + },
1052 + "text": {},
1053 + "textMode": "auto"
1054 + },
1055 + "pluginVersion": "9.2.0",
1056 + "targets": [
1057 + {
1058 + "bucketAggs": [
1059 + {
1060 + "$$hashKey": "object:331",
1061 + "field": "timestamp",
1062 + "id": "2",
1063 + "settings": {
1064 + "interval": "auto",
1065 + "min_doc_count": 0,
1066 + "trimEdges": 0
1067 + },
1068 + "type": "date_histogram"
1069 + }
1070 + ],
1071 + "datasource": {
1072 + "type": "elasticsearch",
1073 + "uid": "replace_datasource_uid"
1074 + },
1075 + "metrics": [
1076 + {
1077 + "$$hashKey": "object:329",
1078 + "field": "select field",
1079 + "id": "1",
1080 + "type": "count"
1081 + }
1082 + ],
1083 + "query": "data_office365_Operation:TeamsSessionStarted AND rule_level:$rule_level",
1084 + "refId": "A",
1085 + "timeField": "timestamp"
1086 + }
1087 + ],
1088 + "title": "TEAMS - SESSIONS STARTED",
1089 + "type": "stat"
1090 + },
1091 + {
1092 + "datasource": {
1093 + "type": "elasticsearch",
1094 + "uid": "replace_datasource_uid"
1095 + },
1096 + "fieldConfig": {
1097 + "defaults": {
1098 + "color": {
1099 + "mode": "thresholds"
1100 + },
1101 + "custom": {
1102 + "align": "auto",
1103 + "displayMode": "auto",
1104 + "filterable": true,
1105 + "inspect": false
1106 + },
1107 + "mappings": [],
1108 + "thresholds": {
1109 + "mode": "absolute",
1110 + "steps": [
1111 + {
1112 + "color": "green",
1113 + "value": null
1114 + },
1115 + {
1116 + "color": "red",
1117 + "value": 80
1118 + }
1119 + ]
1120 + }
1121 + },
1122 + "overrides": [
1123 + {
1124 + "matcher": {
1125 + "id": "byName",
1126 + "options": "rule_level"
1127 + },
1128 + "properties": [
1129 + {
1130 + "id": "displayName",
1131 + "value": "RULE LEVEL"
1132 + },
1133 + {
1134 + "id": "unit",
1135 + "value": "short"
1136 + },
1137 + {
1138 + "id": "decimals",
1139 + "value": -1
1140 + },
1141 + {
1142 + "id": "custom.displayMode",
1143 + "value": "color-background"
1144 + },
1145 + {
1146 + "id": "custom.align"
1147 + },
1148 + {
1149 + "id": "thresholds",
1150 + "value": {
1151 + "mode": "absolute",
1152 + "steps": [
1153 + {
1154 + "color": "#37872D",
1155 + "value": null
1156 + },
1157 + {
1158 + "color": "rgba(237, 129, 40, 0.89)",
1159 + "value": 7
1160 + },
1161 + {
1162 + "color": "rgba(245, 54, 54, 0.9)",
1163 + "value": 12
1164 + }
1165 + ]
1166 + }
1167 + }
1168 + ]
1169 + },
1170 + {
1171 + "matcher": {
1172 + "id": "byName",
1173 + "options": "Date/Time"
1174 + },
1175 + "properties": [
1176 + {
1177 + "id": "custom.width",
1178 + "value": 242
1179 + }
1180 + ]
1181 + },
1182 + {
1183 + "matcher": {
1184 + "id": "byName",
1185 + "options": "MITRE TACTIC"
1186 + },
1187 + "properties": [
1188 + {
1189 + "id": "custom.width",
1190 + "value": 332
1191 + }
1192 + ]
1193 + },
1194 + {
1195 + "matcher": {
1196 + "id": "byName",
1197 + "options": "IP ADDRESS"
1198 + },
1199 + "properties": [
1200 + {
1201 + "id": "custom.width",
1202 + "value": 163
1203 + }
1204 + ]
1205 + },
1206 + {
1207 + "matcher": {
1208 + "id": "byName",
1209 + "options": "MITRE TECHNIQUE"
1210 + },
1211 + "properties": [
1212 + {
1213 + "id": "custom.width",
1214 + "value": 312
1215 + }
1216 + ]
1217 + },
1218 + {
1219 + "matcher": {
1220 + "id": "byName",
1221 + "options": "EVENT ID"
1222 + },
1223 + "properties": [
1224 + {
1225 + "id": "links",
1226 + "value": [
1227 + {
1228 + "targetBlank": true,
1229 + "title": "VIEW EVENT DETAILS",
1230 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1231 + }
1232 + ]
1233 + },
1234 + {
1235 + "id": "custom.width",
1236 + "value": 336
1237 + }
1238 + ]
1239 + },
1240 + {
1241 + "matcher": {
1242 + "id": "byName",
1243 + "options": "RESULT"
1244 + },
1245 + "properties": [
1246 + {
1247 + "id": "custom.width",
1248 + "value": 118
1249 + },
1250 + {
1251 + "id": "mappings",
1252 + "value": [
1253 + {
1254 + "options": {
1255 + "Failed": {
1256 + "color": "orange",
1257 + "index": 1
1258 + },
1259 + "Success": {
1260 + "color": "green",
1261 + "index": 0
1262 + }
1263 + },
1264 + "type": "value"
1265 + }
1266 + ]
1267 + },
1268 + {
1269 + "id": "custom.displayMode",
1270 + "value": "color-text"
1271 + }
1272 + ]
1273 + },
1274 + {
1275 + "matcher": {
1276 + "id": "byName",
1277 + "options": "SRC IP"
1278 + },
1279 + "properties": [
1280 + {
1281 + "id": "custom.width",
1282 + "value": 265
1283 + }
1284 + ]
1285 + },
1286 + {
1287 + "matcher": {
1288 + "id": "byName",
1289 + "options": "ACCOUNT"
1290 + },
1291 + "properties": [
1292 + {
1293 + "id": "custom.width",
1294 + "value": 343
1295 + }
1296 + ]
1297 + },
1298 + {
1299 + "matcher": {
1300 + "id": "byName",
1301 + "options": "EVENT TIME"
1302 + },
1303 + "properties": [
1304 + {
1305 + "id": "custom.width",
1306 + "value": 195
1307 + }
1308 + ]
1309 + }
1310 + ]
1311 + },
1312 + "gridPos": {
1313 + "h": 16,
1314 + "w": 24,
1315 + "x": 0,
1316 + "y": 32
1317 + },
1318 + "id": 27,
1319 + "options": {
1320 + "footer": {
1321 + "fields": "",
1322 + "reducer": ["sum"],
1323 + "show": false
1324 + },
1325 + "showHeader": true,
1326 + "sortBy": []
1327 + },
1328 + "pluginVersion": "9.2.0",
1329 + "targets": [
1330 + {
1331 + "bucketAggs": [],
1332 + "datasource": {
1333 + "type": "elasticsearch",
1334 + "uid": "replace_datasource_uid"
1335 + },
1336 + "metrics": [
1337 + {
1338 + "id": "1",
1339 + "settings": {
1340 + "size": "250"
1341 + },
1342 + "type": "raw_data"
1343 + }
1344 + ],
1345 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1346 + "refId": "A",
1347 + "timeField": "timestamp"
1348 + }
1349 + ],
1350 + "title": "EVENTS",
1351 + "transformations": [
1352 + {
1353 + "id": "merge",
1354 + "options": {
1355 + "reducers": []
1356 + }
1357 + },
1358 + {
1359 + "id": "organize",
1360 + "options": {
1361 + "excludeByName": {
1362 + "@metadata_beat": true,
1363 + "@metadata_type": true,
1364 + "@metadata_version": true,
1365 + "IMPHASH": true,
1366 + "MD5": true,
1367 + "SHA1": true,
1368 + "SHA256": true,
1369 + "_id": false,
1370 + "_index": true,
1371 + "_type": true,
1372 + "agent_ephemeral_id": true,
1373 + "agent_hostname": true,
1374 + "agent_id": true,
1375 + "agent_ip_city_name": true,
1376 + "agent_ip_country_code": true,
1377 + "agent_ip_geolocation": true,
1378 + "agent_name": true,
1379 + "agent_type": true,
1380 + "agent_version": true,
1381 + "beats_type": true,
1382 + "cluster_name": true,
1383 + "cluster_node": true,
1384 + "collector_node_id": true,
1385 + "data_alert_action": true,
1386 + "data_alert_category": true,
1387 + "data_alert_gid": true,
1388 + "data_alert_rev": true,
1389 + "data_alert_severity": true,
1390 + "data_alert_signature": true,
1391 + "data_alert_signature_id": true,
1392 + "data_app_proto": true,
1393 + "data_audit_auid": true,
1394 + "data_audit_command": true,
1395 + "data_audit_euid": true,
1396 + "data_audit_exe": true,
1397 + "data_audit_gid": true,
1398 + "data_audit_id": true,
1399 + "data_audit_pid": true,
1400 + "data_audit_res": true,
1401 + "data_audit_session": true,
1402 + "data_audit_type": true,
1403 + "data_audit_uid": true,
1404 + "data_dest_ip": true,
1405 + "data_dest_port": true,
1406 + "data_dstuser": true,
1407 + "data_event_type": true,
1408 + "data_extra_data": true,
1409 + "data_file": true,
1410 + "data_flow_bytes_toclient": true,
1411 + "data_flow_bytes_toserver": true,
1412 + "data_flow_id": true,
1413 + "data_flow_pkts_toclient": true,
1414 + "data_flow_pkts_toserver": true,
1415 + "data_flow_start": true,
1416 + "data_http_http_content_type": true,
1417 + "data_http_http_port": true,
1418 + "data_http_length": true,
1419 + "data_http_status": true,
1420 + "data_http_url": true,
1421 + "data_id": true,
1422 + "data_in_iface": true,
1423 + "data_metadata_flowbits": true,
1424 + "data_metadata_flowints_http_anomaly_count": true,
1425 + "data_metadata_flowints_tcp_retransmission_count": true,
1426 + "data_office365_AADGroupId": true,
1427 + "data_office365_Actor": true,
1428 + "data_office365_ActorContextId": true,
1429 + "data_office365_ActorIpAddress": false,
1430 + "data_office365_ActorIpAddress_city_name": true,
1431 + "data_office365_ActorIpAddress_country_code": true,
1432 + "data_office365_ActorIpAddress_geolocation": true,
1433 + "data_office365_AppAccessContext_APIId": true,
1434 + "data_office365_AppAccessContext_ClientAppId": true,
1435 + "data_office365_AppAccessContext_ClientAppName": true,
1436 + "data_office365_AppAccessContext_CorrelationId": true,
1437 + "data_office365_ApplicationId": true,
1438 + "data_office365_ArtifactsShared": true,
1439 + "data_office365_Attendees": true,
1440 + "data_office365_AzureActiveDirectoryEventType": true,
1441 + "data_office365_ChannelGuid": true,
1442 + "data_office365_ChannelName": true,
1443 + "data_office365_ChatName": true,
1444 + "data_office365_ChatThreadId": true,
1445 + "data_office365_ClientIP": false,
1446 + "data_office365_ClientIP_city_name": true,
1447 + "data_office365_ClientIP_country_code": true,
1448 + "data_office365_ClientIP_geolocation": true,
1449 + "data_office365_CommunicationSubType": true,
1450 + "data_office365_CommunicationType": true,
1451 + "data_office365_CreationTime": false,
1452 + "data_office365_DeviceId": true,
1453 + "data_office365_DeviceInformation": true,
1454 + "data_office365_DeviceProperties": true,
1455 + "data_office365_EndTime": true,
1456 + "data_office365_ErrorNumber": true,
1457 + "data_office365_ExchangeId": true,
1458 + "data_office365_ExtendedProperties": true,
1459 + "data_office365_ExtraProperties": true,
1460 + "data_office365_HostedContents": true,
1461 + "data_office365_ICalUid": true,
1462 + "data_office365_Id": true,
1463 + "data_office365_InterSystemsId": true,
1464 + "data_office365_IntraSystemId": true,
1465 + "data_office365_ItemName": true,
1466 + "data_office365_JoinTime": true,
1467 + "data_office365_LeaveTime": true,
1468 + "data_office365_LogonError": true,
1469 + "data_office365_MeetingDetailId": true,
1470 + "data_office365_MeetingURL": true,
1471 + "data_office365_Members": true,
1472 + "data_office365_MessageId": true,
1473 + "data_office365_MessageSizeInBytes": true,
1474 + "data_office365_MessageURLs": true,
1475 + "data_office365_MessageVersion": true,
1476 + "data_office365_Modalities": true,
1477 + "data_office365_ModifiedProperties": true,
1478 + "data_office365_Name": true,
1479 + "data_office365_NewValue": true,
1480 + "data_office365_ObjectId": true,
1481 + "data_office365_Operation": true,
1482 + "data_office365_OperationScope": true,
1483 + "data_office365_OrganizationId": true,
1484 + "data_office365_Organizer_OrganizationId": true,
1485 + "data_office365_Organizer_RecipientType": true,
1486 + "data_office365_Organizer_Role": true,
1487 + "data_office365_Organizer_UserObjectId": true,
1488 + "data_office365_ParentMessageId": true,
1489 + "data_office365_ProviderTypes": true,
1490 + "data_office365_RecordType": true,
1491 + "data_office365_ResultStatus": false,
1492 + "data_office365_StartTime": true,
1493 + "data_office365_SubscriptionId": true,
1494 + "data_office365_Target": true,
1495 + "data_office365_TargetContextId": true,
1496 + "data_office365_TeamGuid": true,
1497 + "data_office365_TeamName": true,
1498 + "data_office365_UserId": false,
1499 + "data_office365_UserKey": true,
1500 + "data_office365_UserType": true,
1501 + "data_office365_Version": true,
1502 + "data_office365_Workload": true,
1503 + "data_osquery_action": true,
1504 + "data_osquery_calendarTime": true,
1505 + "data_osquery_columns_address": true,
1506 + "data_osquery_columns_address_city_name": true,
1507 + "data_osquery_columns_address_country_code": true,
1508 + "data_osquery_columns_address_geolocation": true,
1509 + "data_osquery_columns_cmdline": true,
1510 + "data_osquery_columns_cwd": true,
1511 + "data_osquery_columns_description": true,
1512 + "data_osquery_columns_directory": true,
1513 + "data_osquery_columns_disk_bytes_read": true,
1514 + "data_osquery_columns_disk_bytes_written": true,
1515 + "data_osquery_columns_egid": true,
1516 + "data_osquery_columns_euid": true,
1517 + "data_osquery_columns_family": true,
1518 + "data_osquery_columns_fd": true,
1519 + "data_osquery_columns_gid": true,
1520 + "data_osquery_columns_gid_signed": true,
1521 + "data_osquery_columns_host": true,
1522 + "data_osquery_columns_interface": true,
1523 + "data_osquery_columns_local_address": true,
1524 + "data_osquery_columns_local_address_city_name": true,
1525 + "data_osquery_columns_local_address_country_code": true,
1526 + "data_osquery_columns_local_address_geolocation": true,
1527 + "data_osquery_columns_local_port": true,
1528 + "data_osquery_columns_mac": true,
1529 + "data_osquery_columns_name": true,
1530 + "data_osquery_columns_net_namespace": true,
1531 + "data_osquery_columns_nice": true,
1532 + "data_osquery_columns_on_disk": true,
1533 + "data_osquery_columns_parent": true,
1534 + "data_osquery_columns_path": true,
1535 + "data_osquery_columns_pgroup": true,
1536 + "data_osquery_columns_pid": true,
1537 + "data_osquery_columns_port": true,
1538 + "data_osquery_columns_protocol": true,
1539 + "data_osquery_columns_remote_address": true,
1540 + "data_osquery_columns_remote_address_city_name": true,
1541 + "data_osquery_columns_remote_address_country_code": true,
1542 + "data_osquery_columns_remote_address_geolocation": true,
1543 + "data_osquery_columns_remote_port": true,
1544 + "data_osquery_columns_resident_size": true,
1545 + "data_osquery_columns_root": true,
1546 + "data_osquery_columns_sgid": true,
1547 + "data_osquery_columns_shell": true,
1548 + "data_osquery_columns_socket": true,
1549 + "data_osquery_columns_start_time": true,
1550 + "data_osquery_columns_state": true,
1551 + "data_osquery_columns_suid": true,
1552 + "data_osquery_columns_system_time": true,
1553 + "data_osquery_columns_threads": true,
1554 + "data_osquery_columns_time_utc": true,
1555 + "data_osquery_columns_total_size": true,
1556 + "data_osquery_columns_tty": true,
1557 + "data_osquery_columns_type": true,
1558 + "data_osquery_columns_uid": true,
1559 + "data_osquery_columns_uid_signed": true,
1560 + "data_osquery_columns_user": true,
1561 + "data_osquery_columns_user_time": true,
1562 + "data_osquery_columns_username": true,
1563 + "data_osquery_columns_wired_size": true,
1564 + "data_osquery_counter": true,
1565 + "data_osquery_decorations_host_uuid": true,
1566 + "data_osquery_decorations_hostname": true,
1567 + "data_osquery_epoch": true,
1568 + "data_osquery_hostIdentifier": true,
1569 + "data_osquery_name": true,
1570 + "data_osquery_numerics": true,
1571 + "data_osquery_unixTime": true,
1572 + "data_proto": true,
1573 + "data_sca_check_command": true,
1574 + "data_sca_check_compliance_cis": true,
1575 + "data_sca_check_compliance_cis_csc": true,
1576 + "data_sca_check_compliance_gdpr_IV": true,
1577 + "data_sca_check_compliance_gpg_13": true,
1578 + "data_sca_check_compliance_hipaa": true,
1579 + "data_sca_check_compliance_nist_800_53": true,
1580 + "data_sca_check_compliance_pci_dss": true,
1581 + "data_sca_check_compliance_tsc": true,
1582 + "data_sca_check_description": true,
1583 + "data_sca_check_id": true,
1584 + "data_sca_check_previous_result": true,
1585 + "data_sca_check_rationale": true,
1586 + "data_sca_check_remediation": true,
1587 + "data_sca_check_result": true,
1588 + "data_sca_check_title": true,
1589 + "data_sca_description": true,
1590 + "data_sca_failed": true,
1591 + "data_sca_file": true,
1592 + "data_sca_invalid": true,
1593 + "data_sca_passed": true,
1594 + "data_sca_policy": true,
1595 + "data_sca_policy_id": true,
1596 + "data_sca_scan_id": true,
1597 + "data_sca_score": true,
1598 + "data_sca_total_checks": true,
1599 + "data_sca_type": true,
1600 + "data_script": true,
1601 + "data_src_ip": true,
1602 + "data_src_ip_city_name": true,
1603 + "data_src_ip_country_code": true,
1604 + "data_src_ip_geolocation": true,
1605 + "data_src_port": true,
1606 + "data_srcip": true,
1607 + "data_srcip_city_name": true,
1608 + "data_srcip_country_code": true,
1609 + "data_srcip_geolocation": true,
1610 + "data_srcuser": true,
1611 + "data_timestamp": true,
1612 + "data_title": true,
1613 + "data_tls_session_resumed": true,
1614 + "data_tls_version": true,
1615 + "data_tx_id": true,
1616 + "data_type": true,
1617 + "data_win_eventXML_binaryData": true,
1618 + "data_win_eventXML_binaryDataSize": true,
1619 + "data_win_eventXML_param1": true,
1620 + "data_win_eventdata_authenticationPackageName": true,
1621 + "data_win_eventdata_callTrace": true,
1622 + "data_win_eventdata_commandLine": true,
1623 + "data_win_eventdata_company": true,
1624 + "data_win_eventdata_creationUtcTime": true,
1625 + "data_win_eventdata_currentDirectory": true,
1626 + "data_win_eventdata_description": true,
1627 + "data_win_eventdata_destinationHostname": true,
1628 + "data_win_eventdata_destinationIp": true,
1629 + "data_win_eventdata_destinationIp_city_name": true,
1630 + "data_win_eventdata_destinationIp_country_code": true,
1631 + "data_win_eventdata_destinationIp_geolocation": true,
1632 + "data_win_eventdata_destinationIsIpv6": true,
1633 + "data_win_eventdata_destinationPort": true,
1634 + "data_win_eventdata_destinationPortName": true,
1635 + "data_win_eventdata_details": true,
1636 + "data_win_eventdata_elevatedToken": true,
1637 + "data_win_eventdata_eventType": true,
1638 + "data_win_eventdata_fileVersion": true,
1639 + "data_win_eventdata_fileVersion_city_name": true,
1640 + "data_win_eventdata_fileVersion_country_code": true,
1641 + "data_win_eventdata_fileVersion_geolocation": true,
1642 + "data_win_eventdata_grantedAccess": true,
1643 + "data_win_eventdata_hashes": true,
1644 + "data_win_eventdata_image": true,
1645 + "data_win_eventdata_imageLoaded": true,
1646 + "data_win_eventdata_impersonationLevel": true,
1647 + "data_win_eventdata_initiated": true,
1648 + "data_win_eventdata_integrityLevel": true,
1649 + "data_win_eventdata_ipAddress": true,
1650 + "data_win_eventdata_ipPort": true,
1651 + "data_win_eventdata_keyLength": true,
1652 + "data_win_eventdata_logonGuid": true,
1653 + "data_win_eventdata_logonId": true,
1654 + "data_win_eventdata_logonProcessName": true,
1655 + "data_win_eventdata_logonType": true,
1656 + "data_win_eventdata_originalFileName": true,
1657 + "data_win_eventdata_param1": true,
1658 + "data_win_eventdata_param2": true,
1659 + "data_win_eventdata_param3": true,
1660 + "data_win_eventdata_param4": true,
1661 + "data_win_eventdata_parentCommandLine": true,
1662 + "data_win_eventdata_parentImage": true,
1663 + "data_win_eventdata_parentProcessGuid": true,
1664 + "data_win_eventdata_parentProcessId": true,
1665 + "data_win_eventdata_processGuid": true,
1666 + "data_win_eventdata_processId": true,
1667 + "data_win_eventdata_processName": true,
1668 + "data_win_eventdata_product": true,
1669 + "data_win_eventdata_protocol": true,
1670 + "data_win_eventdata_queryName": true,
1671 + "data_win_eventdata_queryResults": true,
1672 + "data_win_eventdata_queryStatus": true,
1673 + "data_win_eventdata_ruleName": true,
1674 + "data_win_eventdata_serviceName": true,
1675 + "data_win_eventdata_serviceSid": true,
1676 + "data_win_eventdata_signature": true,
1677 + "data_win_eventdata_signatureStatus": true,
1678 + "data_win_eventdata_signed": true,
1679 + "data_win_eventdata_sourceHostname": true,
1680 + "data_win_eventdata_sourceImage": true,
1681 + "data_win_eventdata_sourceIp": true,
1682 + "data_win_eventdata_sourceIp_city_name": true,
1683 + "data_win_eventdata_sourceIp_country_code": true,
1684 + "data_win_eventdata_sourceIp_geolocation": true,
1685 + "data_win_eventdata_sourceIsIpv6": true,
1686 + "data_win_eventdata_sourcePort": true,
1687 + "data_win_eventdata_sourceProcessGUID": true,
1688 + "data_win_eventdata_sourceProcessId": true,
1689 + "data_win_eventdata_sourceThreadId": true,
1690 + "data_win_eventdata_status": true,
1691 + "data_win_eventdata_subjectDomainName": true,
1692 + "data_win_eventdata_subjectLogonId": true,
1693 + "data_win_eventdata_subjectUserName": true,
1694 + "data_win_eventdata_subjectUserSid": true,
1695 + "data_win_eventdata_targetDomainName": true,
1696 + "data_win_eventdata_targetFilename": true,
1697 + "data_win_eventdata_targetImage": true,
1698 + "data_win_eventdata_targetLinkedLogonId": true,
1699 + "data_win_eventdata_targetLogonId": true,
1700 + "data_win_eventdata_targetObject": true,
1701 + "data_win_eventdata_targetProcessGUID": true,
1702 + "data_win_eventdata_targetProcessId": true,
1703 + "data_win_eventdata_targetUserName": true,
1704 + "data_win_eventdata_targetUserSid": true,
1705 + "data_win_eventdata_terminalSessionId": true,
1706 + "data_win_eventdata_ticketEncryptionType": true,
1707 + "data_win_eventdata_ticketOptions": true,
1708 + "data_win_eventdata_user": true,
1709 + "data_win_eventdata_utcTime": true,
1710 + "data_win_eventdata_virtualAccount": true,
1711 + "data_win_system_channel": true,
1712 + "data_win_system_computer": true,
1713 + "data_win_system_eventID": true,
1714 + "data_win_system_eventRecordID": true,
1715 + "data_win_system_eventSourceName": true,
1716 + "data_win_system_keywords": true,
1717 + "data_win_system_level": true,
1718 + "data_win_system_message": true,
1719 + "data_win_system_opcode": true,
1720 + "data_win_system_processID": true,
1721 + "data_win_system_providerGuid": true,
1722 + "data_win_system_providerName": true,
1723 + "data_win_system_severityValue": true,
1724 + "data_win_system_systemTime": true,
1725 + "data_win_system_task": true,
1726 + "data_win_system_threadID": true,
1727 + "data_win_system_version": true,
1728 + "decoder_name": true,
1729 + "decoder_parent": true,
1730 + "dns_query": true,
1731 + "dns_query_threat_indicated": true,
1732 + "dst_ip": true,
1733 + "dst_ip_city_name": true,
1734 + "dst_ip_country_code": true,
1735 + "dst_ip_geolocation": true,
1736 + "dst_ip_threat_indicated": true,
1737 + "dst_port": true,
1738 + "ecs_version": true,
1739 + "error": true,
1740 + "event_hash": true,
1741 + "file_path": true,
1742 + "firewall_rule_name": true,
1743 + "full_log": false,
1744 + "gl2_accounted_message_size": true,
1745 + "gl2_message_id": true,
1746 + "gl2_processing_error": true,
1747 + "gl2_remote_ip": true,
1748 + "gl2_remote_port": true,
1749 + "gl2_source_collector": true,
1750 + "gl2_source_input": true,
1751 + "gl2_source_node": true,
1752 + "hash_md5": true,
1753 + "hash_sha1": true,
1754 + "hash_sha256": true,
1755 + "highlight": true,
1756 + "host_architecture": true,
1757 + "host_containerized": true,
1758 + "host_hostname": true,
1759 + "host_id": true,
1760 + "host_ip": true,
1761 + "host_mac": true,
1762 + "host_name": true,
1763 + "host_os_codename": true,
1764 + "host_os_kernel": true,
1765 + "host_os_name": true,
1766 + "host_os_platform": true,
1767 + "host_os_version": true,
1768 + "hostname": true,
1769 + "id": true,
1770 + "input_type": true,
1771 + "level": true,
1772 + "location": true,
1773 + "log_file_path": true,
1774 + "log_offset": true,
1775 + "manager_name": true,
1776 + "message": true,
1777 + "module": true,
1778 + "parent_process_cmd_line": true,
1779 + "parent_process_id": true,
1780 + "parent_process_image": true,
1781 + "pid": true,
1782 + "predecoder_hostname": true,
1783 + "predecoder_program_name": true,
1784 + "predecoder_timestamp": true,
1785 + "previous_log": true,
1786 + "previous_output": true,
1787 + "process_cmd_line": true,
1788 + "process_id": true,
1789 + "process_image": true,
1790 + "process_name": true,
1791 + "protocol": true,
1792 + "rule_cis": true,
1793 + "rule_cis_csc": true,
1794 + "rule_firedtimes": true,
1795 + "rule_gdpr": true,
1796 + "rule_gdpr_IV": true,
1797 + "rule_gpg13": true,
1798 + "rule_gpg_13": true,
1799 + "rule_group1": true,
1800 + "rule_groups": true,
1801 + "rule_hipaa": true,
1802 + "rule_id": true,
1803 + "rule_info": true,
1804 + "rule_mail": true,
1805 + "rule_mitre_id": true,
1806 + "rule_mitre_tactic": false,
1807 + "rule_nist_800_53": true,
1808 + "rule_pci_dss": true,
1809 + "rule_tsc": true,
1810 + "scanid": true,
1811 + "service": true,
1812 + "software_package": true,
1813 + "software_vendor": true,
1814 + "sort": true,
1815 + "source": true,
1816 + "src_ip": true,
1817 + "src_ip_city_name": true,
1818 + "src_ip_country_code": true,
1819 + "src_ip_geolocation": true,
1820 + "src_port": true,
1821 + "streams": true,
1822 + "syscheck_attrs_after": true,
1823 + "syscheck_audit_effective_user_id": true,
1824 + "syscheck_audit_effective_user_name": true,
1825 + "syscheck_audit_group_id": true,
1826 + "syscheck_audit_group_name": true,
1827 + "syscheck_audit_login_user_id": true,
1828 + "syscheck_audit_login_user_name": true,
1829 + "syscheck_audit_process_cwd": true,
1830 + "syscheck_audit_process_id": true,
1831 + "syscheck_audit_process_name": true,
1832 + "syscheck_audit_process_parent_cwd": true,
1833 + "syscheck_audit_process_parent_name": true,
1834 + "syscheck_audit_process_ppid": true,
1835 + "syscheck_audit_user_id": true,
1836 + "syscheck_audit_user_name": true,
1837 + "syscheck_changed_attributes": true,
1838 + "syscheck_event": true,
1839 + "syscheck_gid_after": true,
1840 + "syscheck_gname_after": true,
1841 + "syscheck_hard_links": true,
1842 + "syscheck_inode_after": true,
1843 + "syscheck_inode_before": true,
1844 + "syscheck_md5_after": true,
1845 + "syscheck_md5_before": true,
1846 + "syscheck_mode": true,
1847 + "syscheck_mtime_after": true,
1848 + "syscheck_mtime_before": true,
1849 + "syscheck_path": true,
1850 + "syscheck_perm_after": true,
1851 + "syscheck_perm_before": true,
1852 + "syscheck_sha1_after": true,
1853 + "syscheck_sha1_before": true,
1854 + "syscheck_sha256_after": true,
1855 + "syscheck_sha256_before": true,
1856 + "syscheck_size_after": true,
1857 + "syscheck_size_before": true,
1858 + "syscheck_uid_after": true,
1859 + "syscheck_uname_after": true,
1860 + "syscheck_win_perm_after": true,
1861 + "syscheck_win_perm_after_0_allowed": true,
1862 + "syscheck_win_perm_after_0_name": true,
1863 + "syscheck_win_perm_after_1_allowed": true,
1864 + "syscheck_win_perm_after_1_name": true,
1865 + "syscheck_win_perm_after_2_allowed": true,
1866 + "syscheck_win_perm_after_2_name": true,
1867 + "syscheck_win_perm_after_3_allowed": true,
1868 + "syscheck_win_perm_after_3_name": true,
1869 + "syslog_customer": true,
1870 + "syslog_level": true,
1871 + "syslog_tag": true,
1872 + "syslog_type": true,
1873 + "sysmon_event_description": true,
1874 + "threat_ids": true,
1875 + "threat_indicated": true,
1876 + "threat_names": true,
1877 + "time": true,
1878 + "timestamp": true,
1879 + "true": true,
1880 + "user_name": true,
1881 + "win_registry_key": true,
1882 + "win_system_eventID": true,
1883 + "windows_auth_package": true,
1884 + "windows_domain": true,
1885 + "windows_event_id": true,
1886 + "windows_event_severity": true,
1887 + "windows_logon_type": true
1888 + },
1889 + "indexByName": {
1890 + "_id": 2,
1891 + "_index": 9,
1892 + "_type": 10,
1893 + "agent_id": 11,
1894 + "agent_name": 5,
1895 + "cluster_name": 12,
1896 + "cluster_node": 13,
1897 + "data_office365_AppAccessContext_APIId": 49,
1898 + "data_office365_AppAccessContext_ClientAppId": 50,
1899 + "data_office365_AppAccessContext_ClientAppName": 51,
1900 + "data_office365_AppAccessContext_CorrelationId": 52,
1901 + "data_office365_ArtifactsShared": 53,
1902 + "data_office365_Attendees": 54,
1903 + "data_office365_ChatName": 55,
1904 + "data_office365_ChatThreadId": 56,
1905 + "data_office365_ClientIP": 4,
1906 + "data_office365_ClientIP_city_name": 14,
1907 + "data_office365_ClientIP_country_code": 15,
1908 + "data_office365_ClientIP_geolocation": 16,
1909 + "data_office365_CommunicationSubType": 57,
1910 + "data_office365_CommunicationType": 58,
1911 + "data_office365_CreationTime": 0,
1912 + "data_office365_DeviceId": 59,
1913 + "data_office365_DeviceInformation": 60,
1914 + "data_office365_EndTime": 61,
1915 + "data_office365_ExchangeId": 62,
1916 + "data_office365_ExtraProperties": 63,
1917 + "data_office365_ICalUid": 64,
1918 + "data_office365_Id": 17,
1919 + "data_office365_ItemName": 65,
1920 + "data_office365_JoinTime": 66,
1921 + "data_office365_LeaveTime": 67,
1922 + "data_office365_MeetingDetailId": 68,
1923 + "data_office365_MeetingURL": 69,
1924 + "data_office365_Members": 70,
1925 + "data_office365_MessageId": 71,
1926 + "data_office365_MessageSizeInBytes": 72,
1927 + "data_office365_MessageURLs": 73,
1928 + "data_office365_MessageVersion": 74,
1929 + "data_office365_Modalities": 75,
1930 + "data_office365_Name": 76,
1931 + "data_office365_NewValue": 77,
1932 + "data_office365_ObjectId": 18,
1933 + "data_office365_Operation": 24,
1934 + "data_office365_OperationScope": 78,
1935 + "data_office365_OrganizationId": 19,
1936 + "data_office365_Organizer_OrganizationId": 79,
1937 + "data_office365_Organizer_RecipientType": 80,
1938 + "data_office365_Organizer_Role": 81,
1939 + "data_office365_Organizer_UserObjectId": 82,
1940 + "data_office365_ProviderTypes": 83,
1941 + "data_office365_RecordType": 20,
1942 + "data_office365_StartTime": 84,
1943 + "data_office365_SubscriptionId": 85,
1944 + "data_office365_TeamGuid": 86,
1945 + "data_office365_UserId": 3,
1946 + "data_office365_UserKey": 21,
1947 + "data_office365_UserType": 22,
1948 + "data_office365_Version": 23,
1949 + "data_office365_Workload": 48,
1950 + "decoder_name": 25,
1951 + "gl2_accounted_message_size": 26,
1952 + "gl2_message_id": 27,
1953 + "gl2_processing_error": 28,
1954 + "gl2_remote_ip": 29,
1955 + "gl2_remote_port": 30,
1956 + "gl2_source_input": 31,
1957 + "gl2_source_node": 32,
1958 + "highlight": 33,
1959 + "id": 34,
1960 + "location": 35,
1961 + "manager_name": 36,
1962 + "message": 37,
1963 + "rule_description": 6,
1964 + "rule_firedtimes": 38,
1965 + "rule_group1": 39,
1966 + "rule_groups": 40,
1967 + "rule_id": 8,
1968 + "rule_level": 7,
1969 + "rule_mail": 41,
1970 + "sort": 42,
1971 + "source": 43,
1972 + "streams": 44,
1973 + "syslog_level": 45,
1974 + "syslog_type": 46,
1975 + "timestamp": 1,
1976 + "true": 47
1977 + },
1978 + "renameByName": {
1979 + "_id": "EVENT ID",
1980 + "agent_name": "",
1981 + "data_office365_ActorIpAddress": "SRC IP",
1982 + "data_office365_ClientIP": "CLIENT IP",
1983 + "data_office365_ClientIP_city_name": "",
1984 + "data_office365_CreationTime": "EVENT TIME",
1985 + "data_office365_ResultStatus": "RESULT",
1986 + "data_office365_UserId": "ACCOUNT",
1987 + "rule_description": "DESCRIPTION",
1988 + "rule_id": "RULE ID",
1989 + "rule_level": "",
1990 + "rule_mitre_tactic": "MITRE TACTIC",
1991 + "rule_mitre_technique": "MITRE TECHNIQUE",
1992 + "timestamp": "Date/Time"
1993 + }
1994 + }
1995 + }
1996 + ],
1997 + "transparent": true,
1998 + "type": "table"
1999 + }
2000 + ],
2001 + "refresh": false,
2002 + "schemaVersion": 37,
2003 + "style": "dark",
2004 + "tags": ["O365"],
2005 + "templating": {
2006 + "list": [
2007 + {
2008 + "datasource": {
2009 + "type": "elasticsearch",
2010 + "uid": "replace_datasource_uid"
2011 + },
2012 + "filters": [],
2013 + "hide": 0,
2014 + "label": "",
2015 + "name": "Filters",
2016 + "skipUrlSync": false,
2017 + "type": "adhoc"
2018 + },
2019 + {
2020 + "current": {
2021 + "selected": false,
2022 + "text": "All",
2023 + "value": "$__all"
2024 + },
2025 + "datasource": {
2026 + "type": "elasticsearch",
2027 + "uid": "replace_datasource_uid"
2028 + },
2029 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftTeams\"}",
2030 + "hide": 0,
2031 + "includeAll": true,
2032 + "label": "Operation",
2033 + "multi": false,
2034 + "name": "operation",
2035 + "options": [],
2036 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:MicrosoftTeams\"}",
2037 + "refresh": 2,
2038 + "regex": "",
2039 + "skipUrlSync": false,
2040 + "sort": 1,
2041 + "tagValuesQuery": "",
2042 + "tagsQuery": "",
2043 + "type": "query",
2044 + "useTags": false
2045 + },
2046 + {
2047 + "current": {
2048 + "selected": false,
2049 + "text": "All",
2050 + "value": "$__all"
2051 + },
2052 + "datasource": {
2053 + "type": "elasticsearch",
2054 + "uid": "replace_datasource_uid"
2055 + },
2056 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2057 + "hide": 0,
2058 + "includeAll": true,
2059 + "label": "Rule Level",
2060 + "multi": false,
2061 + "name": "rule_level",
2062 + "options": [],
2063 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2064 + "refresh": 2,
2065 + "regex": "",
2066 + "skipUrlSync": false,
2067 + "sort": 0,
2068 + "type": "query"
2069 + }
2070 + ]
2071 + },
2072 + "time": {
2073 + "from": "now-12h",
2074 + "to": "now"
2075 + },
2076 + "timepicker": {
2077 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2078 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2079 + },
2080 + "timezone": "",
2081 + "title": "O365 - MICROSOFT TEAMS",
2082 + "uid": "dslr7w3nz",
2083 + "version": 1,
2084 + "weekStart": ""
2085 }
backend/app/connectors/grafana/dashboards/Office365/threat_intelligence.json
+2455 -2504
@@ -1,2506 +1,2457 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "O365"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "datasource": {
46 - "type": "elasticsearch",
47 - "uid": "replace_datasource_uid"
48 - },
49 - "fieldConfig": {
50 - "defaults": {
51 - "mappings": [
52 - {
53 - "options": {
54 - "match": "null",
55 - "result": {
56 - "text": "N/A"
57 - }
58 - },
59 - "type": "special"
60 - }
61 - ],
62 - "thresholds": {
63 - "mode": "absolute",
64 - "steps": [
65 - {
66 - "color": "red",
67 - "value": null
68 - }
69 - ]
70 - },
71 - "unit": "locale"
72 - },
73 - "overrides": []
74 - },
75 - "gridPos": {
76 - "h": 7,
77 - "w": 4,
78 - "x": 0,
79 - "y": 0
80 - },
81 - "id": 43,
82 - "links": [],
83 - "options": {
84 - "colorMode": "value",
85 - "graphMode": "area",
86 - "justifyMode": "auto",
87 - "orientation": "horizontal",
88 - "reduceOptions": {
89 - "calcs": [
90 - "sum"
91 - ],
92 - "fields": "",
93 - "values": false
94 - },
95 - "text": {},
96 - "textMode": "auto",
97 - "wideLayout": true
98 - },
99 - "pluginVersion": "10.2.2",
100 - "targets": [
101 - {
102 - "bucketAggs": [
103 - {
104 - "field": "timestamp",
105 - "id": "2",
106 - "settings": {
107 - "interval": "auto",
108 - "min_doc_count": 0,
109 - "trimEdges": 0
110 - },
111 - "type": "date_histogram"
112 - }
113 - ],
114 - "datasource": {
115 - "type": "elasticsearch",
116 - "uid": "replace_datasource_uid"
117 - },
118 - "metrics": [
119 - {
120 - "field": "select field",
121 - "id": "1",
122 - "type": "count"
123 - }
124 - ],
125 - "query": "rule_level:>=12 AND data_office365_Operation:$operation",
126 - "refId": "A",
127 - "timeField": "timestamp"
128 - }
129 - ],
130 - "title": "ALERTS",
131 - "type": "stat"
132 - },
133 - {
134 - "datasource": {
135 - "type": "elasticsearch",
136 - "uid": "replace_datasource_uid"
137 - },
138 - "fieldConfig": {
139 - "defaults": {
140 - "color": {
141 - "mode": "palette-classic"
142 - },
143 - "custom": {
144 - "hideFrom": {
145 - "legend": false,
146 - "tooltip": false,
147 - "viz": false
148 - }
149 - },
150 - "mappings": []
151 - },
152 - "overrides": [
153 - {
154 - "matcher": {
155 - "id": "byName",
156 - "options": "Count"
157 - },
158 - "properties": [
159 - {
160 - "id": "displayName",
161 - "value": "EVENTS"
162 - },
163 - {
164 - "id": "unit",
165 - "value": "short"
166 - },
167 - {
168 - "id": "decimals",
169 - "value": -1
170 - }
171 - ]
172 - }
173 - ]
174 - },
175 - "gridPos": {
176 - "h": 7,
177 - "w": 4,
178 - "x": 4,
179 - "y": 0
180 - },
181 - "id": 53,
182 - "options": {
183 - "legend": {
184 - "displayMode": "list",
185 - "placement": "bottom",
186 - "showLegend": false
187 - },
188 - "pieType": "donut",
189 - "reduceOptions": {
190 - "calcs": [
191 - "sum"
192 - ],
193 - "fields": "",
194 - "values": false
195 - },
196 - "tooltip": {
197 - "mode": "single",
198 - "sort": "none"
199 - }
200 - },
201 - "pluginVersion": "8.5.1",
202 - "targets": [
203 - {
204 - "bucketAggs": [
205 - {
206 - "fake": true,
207 - "field": "data_office365_Operation",
208 - "id": "4",
209 - "settings": {
210 - "min_doc_count": 1,
211 - "order": "desc",
212 - "orderBy": "_count",
213 - "size": "10"
214 - },
215 - "type": "terms"
216 - },
217 - {
218 - "field": "data_office365_CreationTime",
219 - "id": "5",
220 - "settings": {
221 - "interval": "auto",
222 - "min_doc_count": "0",
223 - "timeZone": "utc",
224 - "trimEdges": "0"
225 - },
226 - "type": "date_histogram"
227 - }
228 - ],
229 - "datasource": {
230 - "type": "elasticsearch",
231 - "uid": "replace_datasource_uid"
232 - },
233 - "metrics": [
234 - {
235 - "field": "select field",
236 - "id": "1",
237 - "type": "count"
238 - }
239 - ],
240 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
241 - "refId": "A",
242 - "timeField": "timestamp"
243 - }
244 - ],
245 - "title": "EVENTS BY OPERATION (Top 10)",
246 - "transformations": [],
247 - "type": "piechart"
248 - },
249 - {
250 - "datasource": {
251 - "type": "elasticsearch",
252 - "uid": "replace_datasource_uid"
253 - },
254 - "fieldConfig": {
255 - "defaults": {
256 - "color": {
257 - "mode": "thresholds"
258 - },
259 - "custom": {
260 - "align": "auto",
261 - "cellOptions": {
262 - "type": "auto"
263 - },
264 - "inspect": false
265 - },
266 - "mappings": [],
267 - "thresholds": {
268 - "mode": "absolute",
269 - "steps": [
270 - {
271 - "color": "red",
272 - "value": null
273 - }
274 - ]
275 - }
276 - },
277 - "overrides": [
278 - {
279 - "matcher": {
280 - "id": "byName",
281 - "options": "Count"
282 - },
283 - "properties": [
284 - {
285 - "id": "displayName",
286 - "value": "EVENTS"
287 - },
288 - {
289 - "id": "unit",
290 - "value": "short"
291 - },
292 - {
293 - "id": "decimals",
294 - "value": -1
295 - },
296 - {
297 - "id": "custom.align"
298 - },
299 - {
300 - "id": "thresholds",
301 - "value": {
302 - "mode": "absolute",
303 - "steps": [
304 - {
305 - "color": "red",
306 - "value": null
307 - }
308 - ]
309 - }
310 - }
311 - ]
312 - }
313 - ]
314 - },
315 - "gridPos": {
316 - "h": 7,
317 - "w": 5,
318 - "x": 8,
319 - "y": 0
320 - },
321 - "id": 54,
322 - "options": {
323 - "cellHeight": "sm",
324 - "footer": {
325 - "countRows": false,
326 - "fields": "",
327 - "reducer": [
328 - "sum"
329 - ],
330 - "show": false
331 - },
332 - "showHeader": true
333 - },
334 - "pluginVersion": "10.2.2",
335 - "targets": [
336 - {
337 - "bucketAggs": [
338 - {
339 - "fake": true,
340 - "field": "data_office365_Operation",
341 - "id": "4",
342 - "settings": {
343 - "min_doc_count": 1,
344 - "order": "desc",
345 - "orderBy": "_count",
346 - "size": "0"
347 - },
348 - "type": "terms"
349 - }
350 - ],
351 - "datasource": {
352 - "type": "elasticsearch",
353 - "uid": "replace_datasource_uid"
354 - },
355 - "metrics": [
356 - {
357 - "field": "select field",
358 - "id": "1",
359 - "type": "count"
360 - }
361 - ],
362 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
363 - "refId": "A",
364 - "timeField": "timestamp"
365 - }
366 - ],
367 - "title": "EVENTS BY OPERATION",
368 - "transformations": [
369 - {
370 - "id": "merge",
371 - "options": {
372 - "reducers": []
373 - }
374 - },
375 - {
376 - "id": "organize",
377 - "options": {
378 - "excludeByName": {},
379 - "indexByName": {},
380 - "renameByName": {
381 - "Count": "EVENTS",
382 - "data_office365_Operation": "OPERATION"
383 - }
384 - }
385 - }
386 - ],
387 - "type": "table"
388 - },
389 - {
390 - "datasource": {
391 - "type": "grafana-opensearch-datasource",
392 - "uid": "replace_datasource_uid"
393 - },
394 - "fieldConfig": {
395 - "defaults": {
396 - "color": {
397 - "mode": "thresholds"
398 - },
399 - "custom": {
400 - "align": "auto",
401 - "cellOptions": {
402 - "type": "auto"
403 - },
404 - "inspect": false
405 - },
406 - "mappings": [],
407 - "thresholds": {
408 - "mode": "absolute",
409 - "steps": [
410 - {
411 - "color": "red",
412 - "value": null
413 - }
414 - ]
415 - }
416 - },
417 - "overrides": [
418 - {
419 - "matcher": {
420 - "id": "byName",
421 - "options": "Count"
422 - },
423 - "properties": [
424 - {
425 - "id": "displayName",
426 - "value": "EVENTS"
427 - },
428 - {
429 - "id": "unit",
430 - "value": "short"
431 - },
432 - {
433 - "id": "decimals",
434 - "value": -1
435 - },
436 - {
437 - "id": "custom.align"
438 - },
439 - {
440 - "id": "thresholds",
441 - "value": {
442 - "mode": "absolute",
443 - "steps": [
444 - {
445 - "color": "red",
446 - "value": null
447 - }
448 - ]
449 - }
450 - }
451 - ]
452 - }
453 - ]
454 - },
455 - "gridPos": {
456 - "h": 7,
457 - "w": 6,
458 - "x": 13,
459 - "y": 0
460 - },
461 - "id": 61,
462 - "options": {
463 - "cellHeight": "sm",
464 - "footer": {
465 - "countRows": false,
466 - "fields": "",
467 - "reducer": [
468 - "sum"
469 - ],
470 - "show": false
471 - },
472 - "showHeader": true
473 - },
474 - "pluginVersion": "10.2.2",
475 - "targets": [
476 - {
477 - "bucketAggs": [
478 - {
479 - "fake": true,
480 - "field": "data_office365_DetectionMethod",
481 - "id": "4",
482 - "settings": {
483 - "min_doc_count": 1,
484 - "order": "desc",
485 - "orderBy": "_count",
486 - "size": "0"
487 - },
488 - "type": "terms"
489 - }
490 - ],
491 - "datasource": {
492 - "type": "elasticsearch",
493 - "uid": "replace_datasource_uid"
494 - },
495 - "metrics": [
496 - {
497 - "field": "select field",
498 - "id": "1",
499 - "type": "count"
500 - }
501 - ],
502 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
503 - "queryType": "lucene",
504 - "refId": "A",
505 - "timeField": "timestamp"
506 - }
507 - ],
508 - "title": "EVENTS BY DETECTION",
509 - "transformations": [
510 - {
511 - "id": "organize",
512 - "options": {
513 - "excludeByName": {},
514 - "indexByName": {},
515 - "renameByName": {
516 - "Count": "EVENTS",
517 - "data_office365_DetectionMethod": "DETECTION METHOD",
518 - "data_office365_Operation": "OPERATION"
519 - }
520 - }
521 - }
522 - ],
523 - "type": "table"
524 - },
525 - {
526 - "datasource": {
527 - "type": "grafana-opensearch-datasource",
528 - "uid": "replace_datasource_uid"
529 - },
530 - "fieldConfig": {
531 - "defaults": {
532 - "color": {
533 - "mode": "thresholds"
534 - },
535 - "custom": {
536 - "align": "auto",
537 - "cellOptions": {
538 - "type": "auto"
539 - },
540 - "inspect": false
541 - },
542 - "mappings": [],
543 - "thresholds": {
544 - "mode": "absolute",
545 - "steps": [
546 - {
547 - "color": "red",
548 - "value": null
549 - }
550 - ]
551 - }
552 - },
553 - "overrides": [
554 - {
555 - "matcher": {
556 - "id": "byName",
557 - "options": "Count"
558 - },
559 - "properties": [
560 - {
561 - "id": "displayName",
562 - "value": "EVENTS"
563 - },
564 - {
565 - "id": "unit",
566 - "value": "short"
567 - },
568 - {
569 - "id": "decimals",
570 - "value": -1
571 - },
572 - {
573 - "id": "custom.align"
574 - },
575 - {
576 - "id": "thresholds",
577 - "value": {
578 - "mode": "absolute",
579 - "steps": [
580 - {
581 - "color": "red",
582 - "value": null
583 - }
584 - ]
585 - }
586 - }
587 - ]
588 - },
589 - {
590 - "matcher": {
591 - "id": "byName",
592 - "options": "DELIVERY ACTION"
593 - },
594 - "properties": [
595 - {
596 - "id": "color",
597 - "value": {
598 - "mode": "fixed"
599 - }
600 - },
601 - {
602 - "id": "mappings",
603 - "value": [
604 - {
605 - "options": {
606 - "Blocked": {
607 - "color": "green",
608 - "index": 0
609 - },
610 - "Delivered": {
611 - "color": "light-red",
612 - "index": 1
613 - },
614 - "DeliveredAsSpam": {
615 - "color": "orange",
616 - "index": 2
617 - }
618 - },
619 - "type": "value"
620 - }
621 - ]
622 - },
623 - {
624 - "id": "custom.cellOptions",
625 - "value": {
626 - "type": "color-text"
627 - }
628 - }
629 - ]
630 - }
631 - ]
632 - },
633 - "gridPos": {
634 - "h": 7,
635 - "w": 5,
636 - "x": 19,
637 - "y": 0
638 - },
639 - "id": 62,
640 - "options": {
641 - "cellHeight": "sm",
642 - "footer": {
643 - "countRows": false,
644 - "fields": "",
645 - "reducer": [
646 - "sum"
647 - ],
648 - "show": false
649 - },
650 - "showHeader": true
651 - },
652 - "pluginVersion": "10.2.2",
653 - "targets": [
654 - {
655 - "bucketAggs": [
656 - {
657 - "fake": true,
658 - "field": "data_office365_DeliveryAction",
659 - "id": "4",
660 - "settings": {
661 - "min_doc_count": 1,
662 - "order": "desc",
663 - "orderBy": "_count",
664 - "size": "0"
665 - },
666 - "type": "terms"
667 - }
668 - ],
669 - "datasource": {
670 - "type": "elasticsearch",
671 - "uid": "replace_datasource_uid"
672 - },
673 - "metrics": [
674 - {
675 - "field": "select field",
676 - "id": "1",
677 - "type": "count"
678 - }
679 - ],
680 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
681 - "queryType": "lucene",
682 - "refId": "A",
683 - "timeField": "timestamp"
684 - }
685 - ],
686 - "title": "EVENTS BY ACTION (EXCHANGE)",
687 - "transformations": [
688 - {
689 - "id": "organize",
690 - "options": {
691 - "excludeByName": {},
692 - "indexByName": {},
693 - "renameByName": {
694 - "Count": "EVENTS",
695 - "data_office365_DeliveryAction": "DELIVERY ACTION",
696 - "data_office365_DetectionMethod": "DETECTION METHOD",
697 - "data_office365_Operation": "OPERATION"
698 - }
699 - }
700 - }
701 - ],
702 - "type": "table"
703 - },
704 - {
705 - "datasource": {
706 - "type": "elasticsearch",
707 - "uid": "replace_datasource_uid"
708 - },
709 - "fieldConfig": {
710 - "defaults": {
711 - "color": {
712 - "mode": "thresholds"
713 - },
714 - "mappings": [
715 - {
716 - "options": {
717 - "match": "null",
718 - "result": {
719 - "text": "N/A"
720 - }
721 - },
722 - "type": "special"
723 - }
724 - ],
725 - "max": 15,
726 - "min": 0,
727 - "thresholds": {
728 - "mode": "absolute",
729 - "steps": [
730 - {
731 - "color": "#299c46",
732 - "value": null
733 - },
734 - {
735 - "color": "rgba(237, 129, 40, 0.89)",
736 - "value": 8
737 - },
738 - {
739 - "color": "#d44a3a",
740 - "value": 12
741 - }
742 - ]
743 - },
744 - "unit": "none"
745 - },
746 - "overrides": []
747 - },
748 - "gridPos": {
749 - "h": 7,
750 - "w": 4,
751 - "x": 0,
752 - "y": 7
753 - },
754 - "id": 16,
755 - "links": [],
756 - "options": {
757 - "minVizHeight": 75,
758 - "minVizWidth": 75,
759 - "orientation": "horizontal",
760 - "reduceOptions": {
761 - "calcs": [
762 - "max"
763 - ],
764 - "fields": "",
765 - "values": false
766 - },
767 - "showThresholdLabels": false,
768 - "showThresholdMarkers": true,
769 - "text": {}
770 - },
771 - "pluginVersion": "10.2.2",
772 - "targets": [
773 - {
774 - "bucketAggs": [
775 - {
776 - "field": "timestamp",
777 - "id": "2",
778 - "settings": {
779 - "interval": "auto",
780 - "min_doc_count": 0,
781 - "trimEdges": 0
782 - },
783 - "type": "date_histogram"
784 - }
785 - ],
786 - "datasource": {
787 - "type": "elasticsearch",
788 - "uid": "replace_datasource_uid"
789 - },
790 - "metrics": [
791 - {
792 - "field": "rule_level",
793 - "id": "1",
794 - "meta": {},
795 - "settings": {},
796 - "type": "max"
797 - }
798 - ],
799 - "query": "data_office365_Operation:$operation",
800 - "refId": "A",
801 - "timeField": "timestamp"
802 - }
803 - ],
804 - "title": "MAX SEVERITY (0 - 15)",
805 - "type": "gauge"
806 - },
807 - {
808 - "datasource": {
809 - "type": "elasticsearch",
810 - "uid": "replace_datasource_uid"
811 - },
812 - "fieldConfig": {
813 - "defaults": {
814 - "color": {
815 - "mode": "palette-classic"
816 - },
817 - "custom": {
818 - "axisBorderShow": false,
819 - "axisCenteredZero": false,
820 - "axisColorMode": "text",
821 - "axisLabel": "",
822 - "axisPlacement": "auto",
823 - "barAlignment": 0,
824 - "drawStyle": "bars",
825 - "fillOpacity": 0,
826 - "gradientMode": "none",
827 - "hideFrom": {
828 - "legend": false,
829 - "tooltip": false,
830 - "viz": false
831 - },
832 - "insertNulls": false,
833 - "lineInterpolation": "linear",
834 - "lineWidth": 1,
835 - "pointSize": 5,
836 - "scaleDistribution": {
837 - "type": "linear"
838 - },
839 - "showPoints": "auto",
840 - "spanNulls": false,
841 - "stacking": {
842 - "group": "A",
843 - "mode": "normal"
844 - },
845 - "thresholdsStyle": {
846 - "mode": "off"
847 - }
848 - },
849 - "mappings": [],
850 - "thresholds": {
851 - "mode": "absolute",
852 - "steps": [
853 - {
854 - "color": "green",
855 - "value": null
856 - },
857 - {
858 - "color": "red",
859 - "value": 80
860 - }
861 - ]
862 - }
863 - },
864 - "overrides": []
865 - },
866 - "gridPos": {
867 - "h": 13,
868 - "w": 20,
869 - "x": 4,
870 - "y": 7
871 - },
872 - "id": 60,
873 - "options": {
874 - "legend": {
875 - "calcs": [],
876 - "displayMode": "table",
877 - "placement": "right",
878 - "showLegend": true
879 - },
880 - "tooltip": {
881 - "mode": "single",
882 - "sort": "none"
883 - }
884 - },
885 - "targets": [
886 - {
887 - "alias": "",
888 - "bucketAggs": [
889 - {
890 - "field": "data_office365_Operation",
891 - "id": "3",
892 - "settings": {
893 - "min_doc_count": "1",
894 - "order": "desc",
895 - "orderBy": "_count",
896 - "size": "10"
897 - },
898 - "type": "terms"
899 - },
900 - {
901 - "field": "timestamp",
902 - "id": "2",
903 - "settings": {
904 - "interval": "auto"
905 - },
906 - "type": "date_histogram"
907 - }
908 - ],
909 - "datasource": {
910 - "type": "elasticsearch",
911 - "uid": "replace_datasource_uid"
912 - },
913 - "metrics": [
914 - {
915 - "id": "1",
916 - "type": "count"
917 - }
918 - ],
919 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
920 - "refId": "A",
921 - "timeField": "timestamp"
922 - }
923 - ],
924 - "title": "TOP 10 OPERATIONS - HISTOGRAM",
925 - "transparent": true,
926 - "type": "timeseries"
927 - },
928 - {
929 - "datasource": {
930 - "type": "elasticsearch",
931 - "uid": "replace_datasource_uid"
932 - },
933 - "fieldConfig": {
934 - "defaults": {
935 - "mappings": [
936 - {
937 - "options": {
938 - "match": "null",
939 - "result": {
940 - "text": "N/A"
941 - }
942 - },
943 - "type": "special"
944 - }
945 - ],
946 - "thresholds": {
947 - "mode": "absolute",
948 - "steps": [
949 - {
950 - "color": "orange",
951 - "value": null
952 - }
953 - ]
954 - },
955 - "unit": "locale"
956 - },
957 - "overrides": []
958 - },
959 - "gridPos": {
960 - "h": 6,
961 - "w": 4,
962 - "x": 0,
963 - "y": 14
964 - },
965 - "id": 51,
966 - "links": [],
967 - "options": {
968 - "colorMode": "value",
969 - "graphMode": "area",
970 - "justifyMode": "auto",
971 - "orientation": "horizontal",
972 - "reduceOptions": {
973 - "calcs": [
974 - "sum"
975 - ],
976 - "fields": "",
977 - "values": false
978 - },
979 - "text": {},
980 - "textMode": "auto",
981 - "wideLayout": true
982 - },
983 - "pluginVersion": "10.2.2",
984 - "targets": [
985 - {
986 - "bucketAggs": [
987 - {
988 - "$$hashKey": "object:331",
989 - "field": "timestamp",
990 - "id": "2",
991 - "settings": {
992 - "interval": "auto",
993 - "min_doc_count": 0,
994 - "trimEdges": 0
995 - },
996 - "type": "date_histogram"
997 - }
998 - ],
999 - "datasource": {
1000 - "type": "elasticsearch",
1001 - "uid": "replace_datasource_uid"
1002 - },
1003 - "metrics": [
1004 - {
1005 - "$$hashKey": "object:329",
1006 - "field": "select field",
1007 - "id": "1",
1008 - "type": "count"
1009 - }
1010 - ],
1011 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1012 - "refId": "A",
1013 - "timeField": "timestamp"
1014 - }
1015 - ],
1016 - "title": "EVENTS (Total)",
1017 - "type": "stat"
1018 - },
1019 - {
1020 - "datasource": {
1021 - "type": "grafana-opensearch-datasource",
1022 - "uid": "replace_datasource_uid"
1023 - },
1024 - "fieldConfig": {
1025 - "defaults": {
1026 - "color": {
1027 - "mode": "thresholds"
1028 - },
1029 - "custom": {
1030 - "align": "auto",
1031 - "cellOptions": {
1032 - "type": "auto"
1033 - },
1034 - "inspect": false
1035 - },
1036 - "mappings": [],
1037 - "thresholds": {
1038 - "mode": "absolute",
1039 - "steps": [
1040 - {
1041 - "color": "orange",
1042 - "value": null
1043 - }
1044 - ]
1045 - }
1046 - },
1047 - "overrides": [
1048 - {
1049 - "matcher": {
1050 - "id": "byName",
1051 - "options": "Count"
1052 - },
1053 - "properties": [
1054 - {
1055 - "id": "displayName",
1056 - "value": "EVENTS"
1057 - },
1058 - {
1059 - "id": "unit",
1060 - "value": "short"
1061 - },
1062 - {
1063 - "id": "decimals",
1064 - "value": -1
1065 - },
1066 - {
1067 - "id": "custom.align"
1068 - }
1069 - ]
1070 - },
1071 - {
1072 - "matcher": {
1073 - "id": "byName",
1074 - "options": "AD ACCOUNT"
1075 - },
1076 - "properties": [
1077 - {
1078 - "id": "custom.width",
1079 - "value": 377
1080 - }
1081 - ]
1082 - }
1083 - ]
1084 - },
1085 - "gridPos": {
1086 - "h": 12,
1087 - "w": 7,
1088 - "x": 0,
1089 - "y": 20
1090 - },
1091 - "id": 63,
1092 - "options": {
1093 - "cellHeight": "sm",
1094 - "footer": {
1095 - "countRows": false,
1096 - "fields": "",
1097 - "reducer": [
1098 - "sum"
1099 - ],
1100 - "show": false
1101 - },
1102 - "showHeader": true,
1103 - "sortBy": []
1104 - },
1105 - "pluginVersion": "10.2.2",
1106 - "targets": [
1107 - {
1108 - "bucketAggs": [
1109 - {
1110 - "fake": true,
1111 - "field": "data_office365_Directionality",
1112 - "id": "4",
1113 - "settings": {
1114 - "min_doc_count": 1,
1115 - "order": "desc",
1116 - "orderBy": "_count",
1117 - "size": "0"
1118 - },
1119 - "type": "terms"
1120 - }
1121 - ],
1122 - "datasource": {
1123 - "type": "elasticsearch",
1124 - "uid": "replace_datasource_uid"
1125 - },
1126 - "metrics": [
1127 - {
1128 - "field": "select field",
1129 - "id": "1",
1130 - "type": "count"
1131 - }
1132 - ],
1133 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1134 - "queryType": "lucene",
1135 - "refId": "A",
1136 - "timeField": "timestamp"
1137 - }
1138 - ],
1139 - "title": "EVENTS BY DIRECTION",
1140 - "transformations": [
1141 - {
1142 - "id": "organize",
1143 - "options": {
1144 - "excludeByName": {},
1145 - "indexByName": {},
1146 - "renameByName": {
1147 - "Count": "EVENTS",
1148 - "data_office365_ClientIP_country_code": "COUNTRY",
1149 - "data_office365_Directionality": "DIRECTION",
1150 - "data_office365_LogonError": "ERROR",
1151 - "data_office365_Operation": "WORKLOAD",
1152 - "data_office365_P1Sender": "SENDER",
1153 - "data_office365_UserId": "AD ACCOUNT"
1154 - }
1155 - }
1156 - }
1157 - ],
1158 - "type": "table"
1159 - },
1160 - {
1161 - "circleMaxSize": 30,
1162 - "circleMinSize": 2,
1163 - "colors": [
1164 - "rgba(245, 54, 54, 0.9)",
1165 - "rgba(237, 129, 40, 0.89)",
1166 - "rgba(50, 172, 45, 0.97)"
1167 - ],
1168 - "datasource": {
1169 - "type": "grafana-opensearch-datasource",
1170 - "uid": "replace_datasource_uid"
1171 - },
1172 - "decimals": 0,
1173 - "esMetric": "Count",
1174 - "gridPos": {
1175 - "h": 12,
1176 - "w": 7,
1177 - "x": 7,
1178 - "y": 20
1179 - },
1180 - "hideEmpty": false,
1181 - "hideZero": false,
1182 - "id": 50,
1183 - "initialZoom": 1,
1184 - "locationData": "countries",
1185 - "mapCenter": "(0°, 0°)",
1186 - "mapCenterLatitude": 0,
1187 - "mapCenterLongitude": 0,
1188 - "maxDataPoints": 1,
1189 - "mouseWheelZoom": false,
1190 - "showLegend": true,
1191 - "stickyLabels": false,
1192 - "tableQueryOptions": {
1193 - "geohashField": "geohash",
1194 - "latitudeField": "latitude",
1195 - "longitudeField": "longitude",
1196 - "metricField": "metric",
1197 - "queryType": "geohash"
1198 - },
1199 - "targets": [
1200 - {
1201 - "bucketAggs": [
1202 - {
1203 - "fake": true,
1204 - "field": "data_office365_SenderIp_country_code",
1205 - "id": "3",
1206 - "settings": {
1207 - "min_doc_count": 1,
1208 - "order": "desc",
1209 - "orderBy": "_term",
1210 - "size": "0"
1211 - },
1212 - "type": "terms"
1213 - },
1214 - {
1215 - "field": "timestamp",
1216 - "id": "2",
1217 - "settings": {
1218 - "interval": "auto",
1219 - "min_doc_count": 0,
1220 - "trimEdges": 0
1221 - },
1222 - "type": "date_histogram"
1223 - }
1224 - ],
1225 - "datasource": {
1226 - "type": "elasticsearch",
1227 - "uid": "replace_datasource_uid"
1228 - },
1229 - "metrics": [
1230 - {
1231 - "field": "select field",
1232 - "id": "1",
1233 - "type": "count"
1234 - }
1235 - ],
1236 - "query": "data_office365_Workload:ThreatIntelligence AND rule_level:$rule_level",
1237 - "queryType": "lucene",
1238 - "refId": "A",
1239 - "timeField": "timestamp"
1240 - }
1241 - ],
1242 - "thresholds": "0,10",
1243 - "title": "ALL EVENTS BY SENDER COUNTRY",
1244 - "type": "grafana-worldmap-panel",
1245 - "unitPlural": "",
1246 - "unitSingle": "",
1247 - "valueName": "total"
1248 - },
1249 - {
1250 - "datasource": {
1251 - "type": "grafana-opensearch-datasource",
1252 - "uid": "replace_datasource_uid"
1253 - },
1254 - "fieldConfig": {
1255 - "defaults": {
1256 - "color": {
1257 - "mode": "thresholds"
1258 - },
1259 - "custom": {
1260 - "align": "auto",
1261 - "cellOptions": {
1262 - "type": "auto"
1263 - },
1264 - "inspect": false
1265 - },
1266 - "mappings": [],
1267 - "thresholds": {
1268 - "mode": "absolute",
1269 - "steps": [
1270 - {
1271 - "color": "orange",
1272 - "value": null
1273 - }
1274 - ]
1275 - }
1276 - },
1277 - "overrides": [
1278 - {
1279 - "matcher": {
1280 - "id": "byName",
1281 - "options": "Count"
1282 - },
1283 - "properties": [
1284 - {
1285 - "id": "displayName",
1286 - "value": "EVENTS"
1287 - },
1288 - {
1289 - "id": "unit",
1290 - "value": "short"
1291 - },
1292 - {
1293 - "id": "decimals",
1294 - "value": -1
1295 - },
1296 - {
1297 - "id": "custom.align"
1298 - }
1299 - ]
1300 - },
1301 - {
1302 - "matcher": {
1303 - "id": "byName",
1304 - "options": "AD ACCOUNT"
1305 - },
1306 - "properties": [
1307 - {
1308 - "id": "custom.width",
1309 - "value": 377
1310 - }
1311 - ]
1312 - }
1313 - ]
1314 - },
1315 - "gridPos": {
1316 - "h": 12,
1317 - "w": 10,
1318 - "x": 14,
1319 - "y": 20
1320 - },
1321 - "id": 58,
1322 - "options": {
1323 - "cellHeight": "sm",
1324 - "footer": {
1325 - "countRows": false,
1326 - "fields": "",
1327 - "reducer": [
1328 - "sum"
1329 - ],
1330 - "show": false
1331 - },
1332 - "showHeader": true,
1333 - "sortBy": []
1334 - },
1335 - "pluginVersion": "10.2.2",
1336 - "targets": [
1337 - {
1338 - "bucketAggs": [
1339 - {
1340 - "fake": true,
1341 - "field": "data_office365_P1Sender",
1342 - "id": "4",
1343 - "settings": {
1344 - "min_doc_count": 1,
1345 - "order": "desc",
1346 - "orderBy": "_count",
1347 - "size": "0"
1348 - },
1349 - "type": "terms"
1350 - }
1351 - ],
1352 - "datasource": {
1353 - "type": "elasticsearch",
1354 - "uid": "replace_datasource_uid"
1355 - },
1356 - "metrics": [
1357 - {
1358 - "field": "select field",
1359 - "id": "1",
1360 - "type": "count"
1361 - }
1362 - ],
1363 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1364 - "queryType": "lucene",
1365 - "refId": "A",
1366 - "timeField": "timestamp"
1367 - }
1368 - ],
1369 - "title": "EVENTS BY SENDER",
1370 - "transformations": [
1371 - {
1372 - "id": "organize",
1373 - "options": {
1374 - "excludeByName": {},
1375 - "indexByName": {},
1376 - "renameByName": {
1377 - "Count": "EVENTS",
1378 - "data_office365_ClientIP_country_code": "COUNTRY",
1379 - "data_office365_LogonError": "ERROR",
1380 - "data_office365_Operation": "WORKLOAD",
1381 - "data_office365_P1Sender": "SENDER",
1382 - "data_office365_UserId": "AD ACCOUNT"
1383 - }
1384 - }
1385 - }
1386 - ],
1387 - "type": "table"
1388 - },
1389 - {
1390 - "datasource": {
1391 - "type": "grafana-opensearch-datasource",
1392 - "uid": "replace_datasource_uid"
1393 - },
1394 - "fieldConfig": {
1395 - "defaults": {
1396 - "color": {
1397 - "mode": "thresholds"
1398 - },
1399 - "custom": {
1400 - "align": "auto",
1401 - "cellOptions": {
1402 - "type": "auto"
1403 - },
1404 - "filterable": true,
1405 - "inspect": false
1406 - },
1407 - "mappings": [],
1408 - "thresholds": {
1409 - "mode": "absolute",
1410 - "steps": [
1411 - {
1412 - "color": "green",
1413 - "value": null
1414 - },
1415 - {
1416 - "color": "red",
1417 - "value": 80
1418 - }
1419 - ]
1420 - }
1421 - },
1422 - "overrides": [
1423 - {
1424 - "matcher": {
1425 - "id": "byName",
1426 - "options": "rule_level"
1427 - },
1428 - "properties": [
1429 - {
1430 - "id": "displayName",
1431 - "value": "RULE LEVEL"
1432 - },
1433 - {
1434 - "id": "unit",
1435 - "value": "short"
1436 - },
1437 - {
1438 - "id": "decimals",
1439 - "value": -1
1440 - },
1441 - {
1442 - "id": "custom.cellOptions",
1443 - "value": {
1444 - "mode": "gradient",
1445 - "type": "color-background"
1446 - }
1447 - },
1448 - {
1449 - "id": "custom.align"
1450 - },
1451 - {
1452 - "id": "thresholds",
1453 - "value": {
1454 - "mode": "absolute",
1455 - "steps": [
1456 - {
1457 - "color": "#37872D",
1458 - "value": null
1459 - },
1460 - {
1461 - "color": "rgba(237, 129, 40, 0.89)",
1462 - "value": 7
1463 - },
1464 - {
1465 - "color": "rgba(245, 54, 54, 0.9)",
1466 - "value": 12
1467 - }
1468 - ]
1469 - }
1470 - }
1471 - ]
1472 - },
1473 - {
1474 - "matcher": {
1475 - "id": "byName",
1476 - "options": "Date/Time"
1477 - },
1478 - "properties": [
1479 - {
1480 - "id": "custom.width",
1481 - "value": 242
1482 - }
1483 - ]
1484 - },
1485 - {
1486 - "matcher": {
1487 - "id": "byName",
1488 - "options": "MITRE TACTIC"
1489 - },
1490 - "properties": [
1491 - {
1492 - "id": "custom.width",
1493 - "value": 332
1494 - }
1495 - ]
1496 - },
1497 - {
1498 - "matcher": {
1499 - "id": "byName",
1500 - "options": "IP ADDRESS"
1501 - },
1502 - "properties": [
1503 - {
1504 - "id": "custom.width",
1505 - "value": 163
1506 - }
1507 - ]
1508 - },
1509 - {
1510 - "matcher": {
1511 - "id": "byName",
1512 - "options": "MITRE TECHNIQUE"
1513 - },
1514 - "properties": [
1515 - {
1516 - "id": "custom.width",
1517 - "value": 312
1518 - }
1519 - ]
1520 - },
1521 - {
1522 - "matcher": {
1523 - "id": "byName",
1524 - "options": "EVENT ID"
1525 - },
1526 - "properties": [
1527 - {
1528 - "id": "links",
1529 - "value": [
1530 - {
1531 - "targetBlank": true,
1532 - "title": "VIEW EVENT DETAILS",
1533 - "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1534 - }
1535 - ]
1536 - },
1537 - {
1538 - "id": "custom.width",
1539 - "value": 265
1540 - }
1541 - ]
1542 - },
1543 - {
1544 - "matcher": {
1545 - "id": "byName",
1546 - "options": "RESULT"
1547 - },
1548 - "properties": [
1549 - {
1550 - "id": "custom.width",
1551 - "value": 118
1552 - },
1553 - {
1554 - "id": "mappings",
1555 - "value": [
1556 - {
1557 - "options": {
1558 - "Failed": {
1559 - "color": "orange",
1560 - "index": 1
1561 - },
1562 - "Success": {
1563 - "color": "green",
1564 - "index": 0
1565 - }
1566 - },
1567 - "type": "value"
1568 - }
1569 - ]
1570 - },
1571 - {
1572 - "id": "custom.cellOptions",
1573 - "value": {
1574 - "type": "color-text"
1575 - }
1576 - }
1577 - ]
1578 - },
1579 - {
1580 - "matcher": {
1581 - "id": "byName",
1582 - "options": "SRC IP"
1583 - },
1584 - "properties": [
1585 - {
1586 - "id": "custom.width",
1587 - "value": 265
1588 - }
1589 - ]
1590 - },
1591 - {
1592 - "matcher": {
1593 - "id": "byName",
1594 - "options": "ACCOUNT"
1595 - },
1596 - "properties": [
1597 - {
1598 - "id": "custom.width",
1599 - "value": 227
1600 - }
1601 - ]
1602 - },
1603 - {
1604 - "matcher": {
1605 - "id": "byName",
1606 - "options": "EVENT TIME"
1607 - },
1608 - "properties": [
1609 - {
1610 - "id": "custom.width",
1611 - "value": 195
1612 - }
1613 - ]
1614 - },
1615 - {
1616 - "matcher": {
1617 - "id": "byName",
1618 - "options": "CLIENT IP"
1619 - },
1620 - "properties": [
1621 - {
1622 - "id": "custom.width",
1623 - "value": 229
1624 - }
1625 - ]
1626 - },
1627 - {
1628 - "matcher": {
1629 - "id": "byName",
1630 - "options": "DESCRIPTION"
1631 - },
1632 - "properties": [
1633 - {
1634 - "id": "custom.width",
1635 - "value": 491
1636 - }
1637 - ]
1638 - }
1639 - ]
1640 - },
1641 - "gridPos": {
1642 - "h": 16,
1643 - "w": 24,
1644 - "x": 0,
1645 - "y": 32
1646 - },
1647 - "id": 27,
1648 - "options": {
1649 - "cellHeight": "sm",
1650 - "footer": {
1651 - "countRows": false,
1652 - "enablePagination": true,
1653 - "fields": "",
1654 - "reducer": [
1655 - "sum"
1656 - ],
1657 - "show": false
1658 - },
1659 - "showHeader": true,
1660 - "sortBy": []
1661 - },
1662 - "pluginVersion": "10.2.2",
1663 - "targets": [
1664 - {
1665 - "bucketAggs": [],
1666 - "datasource": {
1667 - "type": "elasticsearch",
1668 - "uid": "replace_datasource_uid"
1669 - },
1670 - "metrics": [
1671 - {
1672 - "id": "1",
1673 - "settings": {
1674 - "size": "250"
1675 - },
1676 - "type": "raw_data"
1677 - }
1678 - ],
1679 - "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1680 - "queryType": "lucene",
1681 - "refId": "A",
1682 - "timeField": "timestamp"
1683 - }
1684 - ],
1685 - "title": "EVENTS",
1686 - "transformations": [
1687 - {
1688 - "id": "organize",
1689 - "options": {
1690 - "excludeByName": {
1691 - "@metadata_beat": true,
1692 - "@metadata_type": true,
1693 - "@metadata_version": true,
1694 - "IMPHASH": true,
1695 - "MD5": true,
1696 - "SHA1": true,
1697 - "SHA256": true,
1698 - "_id": false,
1699 - "_index": true,
1700 - "_type": true,
1701 - "agent_ephemeral_id": true,
1702 - "agent_hostname": true,
1703 - "agent_id": true,
1704 - "agent_ip_city_name": true,
1705 - "agent_ip_country_code": true,
1706 - "agent_ip_geolocation": true,
1707 - "agent_name": true,
1708 - "agent_type": true,
1709 - "agent_version": true,
1710 - "beats_type": true,
1711 - "cluster_name": true,
1712 - "cluster_node": true,
1713 - "collector_node_id": true,
1714 - "data_alert_action": true,
1715 - "data_alert_category": true,
1716 - "data_alert_gid": true,
1717 - "data_alert_rev": true,
1718 - "data_alert_severity": true,
1719 - "data_alert_signature": true,
1720 - "data_alert_signature_id": true,
1721 - "data_app_proto": true,
1722 - "data_audit_auid": true,
1723 - "data_audit_command": true,
1724 - "data_audit_euid": true,
1725 - "data_audit_exe": true,
1726 - "data_audit_gid": true,
1727 - "data_audit_id": true,
1728 - "data_audit_pid": true,
1729 - "data_audit_res": true,
1730 - "data_audit_session": true,
1731 - "data_audit_type": true,
1732 - "data_audit_uid": true,
1733 - "data_dest_ip": true,
1734 - "data_dest_port": true,
1735 - "data_dstuser": true,
1736 - "data_event_type": true,
1737 - "data_extra_data": true,
1738 - "data_file": true,
1739 - "data_flow_bytes_toclient": true,
1740 - "data_flow_bytes_toserver": true,
1741 - "data_flow_id": true,
1742 - "data_flow_pkts_toclient": true,
1743 - "data_flow_pkts_toserver": true,
1744 - "data_flow_start": true,
1745 - "data_http_http_content_type": true,
1746 - "data_http_http_port": true,
1747 - "data_http_length": true,
1748 - "data_http_status": true,
1749 - "data_http_url": true,
1750 - "data_id": true,
1751 - "data_in_iface": true,
1752 - "data_integration": true,
1753 - "data_metadata_flowbits": true,
1754 - "data_metadata_flowints_http_anomaly_count": true,
1755 - "data_metadata_flowints_tcp_retransmission_count": true,
1756 - "data_office365_AADGroupId": true,
1757 - "data_office365_Actor": true,
1758 - "data_office365_ActorContextId": true,
1759 - "data_office365_ActorIpAddress": false,
1760 - "data_office365_ActorIpAddress_city_name": true,
1761 - "data_office365_ActorIpAddress_country_code": true,
1762 - "data_office365_ActorIpAddress_geolocation": true,
1763 - "data_office365_AdditionalActionsAndResults": true,
1764 - "data_office365_AppAccessContext_APIId": true,
1765 - "data_office365_AppAccessContext_ClientAppId": true,
1766 - "data_office365_AppAccessContext_ClientAppName": true,
1767 - "data_office365_AppAccessContext_CorrelationId": true,
1768 - "data_office365_AppId": true,
1769 - "data_office365_ApplicationId": true,
1770 - "data_office365_ArtifactsShared": true,
1771 - "data_office365_AttachmentData": true,
1772 - "data_office365_Attendees": true,
1773 - "data_office365_AuthDetails": true,
1774 - "data_office365_AzureActiveDirectoryEventType": true,
1775 - "data_office365_ChannelGuid": true,
1776 - "data_office365_ChannelName": true,
1777 - "data_office365_ChatName": true,
1778 - "data_office365_ChatThreadId": true,
1779 - "data_office365_ClientAppId": true,
1780 - "data_office365_ClientIP": false,
1781 - "data_office365_ClientIPAddress": true,
1782 - "data_office365_ClientIPAddress_city_name": true,
1783 - "data_office365_ClientIPAddress_country_code": true,
1784 - "data_office365_ClientIPAddress_geolocation": true,
1785 - "data_office365_ClientIP_city_name": true,
1786 - "data_office365_ClientIP_country_code": true,
1787 - "data_office365_ClientIP_geolocation": true,
1788 - "data_office365_ClientInfoString": true,
1789 - "data_office365_ClientProcessName": true,
1790 - "data_office365_ClientRequestId": true,
1791 - "data_office365_ClientVersion": true,
1792 - "data_office365_CommunicationSubType": true,
1793 - "data_office365_CommunicationType": true,
1794 - "data_office365_ContactEmail1DisplayName": true,
1795 - "data_office365_ContactEmail1EmailAddress": true,
1796 - "data_office365_CreationTime": false,
1797 - "data_office365_CrossMailboxOperation": true,
1798 - "data_office365_DeliveryAction": false,
1799 - "data_office365_DestFolder_Id": true,
1800 - "data_office365_DestFolder_Path": true,
1801 - "data_office365_DetectionMethod": false,
1802 - "data_office365_DetectionType": true,
1803 - "data_office365_DeviceId": true,
1804 - "data_office365_DeviceInformation": true,
1805 - "data_office365_DeviceProperties": true,
1806 - "data_office365_Directionality": true,
1807 - "data_office365_EndTime": true,
1808 - "data_office365_ErrorNumber": true,
1809 - "data_office365_EventDeepLink": true,
1810 - "data_office365_ExchangeId": true,
1811 - "data_office365_ExtendedProperties": true,
1812 - "data_office365_ExternalAccess": true,
1813 - "data_office365_ExtraProperties": true,
1814 - "data_office365_Folder_Id": true,
1815 - "data_office365_Folder_Path": true,
1816 - "data_office365_Folders": true,
1817 - "data_office365_HostedContents": true,
1818 - "data_office365_ICalUid": true,
1819 - "data_office365_Id": true,
1820 - "data_office365_InterSystemsId": true,
1821 - "data_office365_InternalLogonType": true,
1822 - "data_office365_InternetMessageId": true,
1823 - "data_office365_IntraSystemId": true,
1824 - "data_office365_ItemName": true,
1825 - "data_office365_Item_Id": true,
1826 - "data_office365_Item_InternetMessageId": true,
1827 - "data_office365_Item_IsRecord": true,
1828 - "data_office365_Item_ParentFolder_Id": true,
1829 - "data_office365_Item_ParentFolder_Name": true,
1830 - "data_office365_Item_SizeInBytes": true,
1831 - "data_office365_JoinTime": true,
1832 - "data_office365_LatestDeliveryLocation": true,
1833 - "data_office365_LeaveTime": true,
1834 - "data_office365_LogonError": true,
1835 - "data_office365_LogonType": true,
1836 - "data_office365_LogonUserSid": true,
1837 - "data_office365_MailboxGuid": true,
1838 - "data_office365_MailboxOwnerMasterAccountSid": true,
1839 - "data_office365_MailboxOwnerSid": true,
1840 - "data_office365_MailboxOwnerUPN": true,
1841 - "data_office365_MeetingDetailId": true,
1842 - "data_office365_MeetingURL": true,
1843 - "data_office365_Members": true,
1844 - "data_office365_MessageId": true,
1845 - "data_office365_MessageSizeInBytes": true,
1846 - "data_office365_MessageTime": true,
1847 - "data_office365_MessageURLs": true,
1848 - "data_office365_MessageVersion": true,
1849 - "data_office365_Modalities": true,
1850 - "data_office365_ModifiedProperties": true,
1851 - "data_office365_Name": true,
1852 - "data_office365_NetworkMessageId": true,
1853 - "data_office365_NewValue": true,
1854 - "data_office365_ObjectId": true,
1855 - "data_office365_Operation": true,
1856 - "data_office365_OperationCount": true,
1857 - "data_office365_OperationProperties": true,
1858 - "data_office365_OperationScope": true,
1859 - "data_office365_OrganizationId": true,
1860 - "data_office365_OrganizationName": true,
1861 - "data_office365_Organizer_OrganizationId": true,
1862 - "data_office365_Organizer_RecipientType": true,
1863 - "data_office365_Organizer_Role": true,
1864 - "data_office365_Organizer_UserObjectId": true,
1865 - "data_office365_OriginalDeliveryLocation": true,
1866 - "data_office365_OriginatingServer": true,
1867 - "data_office365_P1Sender": true,
1868 - "data_office365_P2Sender": true,
1869 - "data_office365_Parameters": true,
1870 - "data_office365_ParentMessageId": true,
1871 - "data_office365_PhishConfidenceLevel": true,
1872 - "data_office365_Policy": true,
1873 - "data_office365_PolicyAction": true,
1874 - "data_office365_ProviderTypes": true,
1875 - "data_office365_Recipients": false,
1876 - "data_office365_RecordType": true,
1877 - "data_office365_ResultStatus": true,
1878 - "data_office365_SendAsUserMailboxGuid": true,
1879 - "data_office365_SendAsUserSmtp": true,
1880 - "data_office365_SenderIp_city_name": true,
1881 - "data_office365_SenderIp_geolocation": true,
1882 - "data_office365_SessionId": true,
1883 - "data_office365_StartTime": true,
1884 - "data_office365_Subject": true,
1885 - "data_office365_Subscription": true,
1886 - "data_office365_SubscriptionId": true,
1887 - "data_office365_SystemOverrides": true,
1888 - "data_office365_Target": true,
1889 - "data_office365_TargetContextId": true,
1890 - "data_office365_TeamGuid": true,
1891 - "data_office365_TeamName": true,
1892 - "data_office365_ThreatsAndDetectionTech": true,
1893 - "data_office365_UserId": false,
1894 - "data_office365_UserKey": true,
1895 - "data_office365_UserType": true,
1896 - "data_office365_Verdict": true,
1897 - "data_office365_Version": true,
1898 - "data_office365_Workload": true,
1899 - "data_osquery_action": true,
1900 - "data_osquery_calendarTime": true,
1901 - "data_osquery_columns_address": true,
1902 - "data_osquery_columns_address_city_name": true,
1903 - "data_osquery_columns_address_country_code": true,
1904 - "data_osquery_columns_address_geolocation": true,
1905 - "data_osquery_columns_cmdline": true,
1906 - "data_osquery_columns_cwd": true,
1907 - "data_osquery_columns_description": true,
1908 - "data_osquery_columns_directory": true,
1909 - "data_osquery_columns_disk_bytes_read": true,
1910 - "data_osquery_columns_disk_bytes_written": true,
1911 - "data_osquery_columns_egid": true,
1912 - "data_osquery_columns_euid": true,
1913 - "data_osquery_columns_family": true,
1914 - "data_osquery_columns_fd": true,
1915 - "data_osquery_columns_gid": true,
1916 - "data_osquery_columns_gid_signed": true,
1917 - "data_osquery_columns_host": true,
1918 - "data_osquery_columns_interface": true,
1919 - "data_osquery_columns_local_address": true,
1920 - "data_osquery_columns_local_address_city_name": true,
1921 - "data_osquery_columns_local_address_country_code": true,
1922 - "data_osquery_columns_local_address_geolocation": true,
1923 - "data_osquery_columns_local_port": true,
1924 - "data_osquery_columns_mac": true,
1925 - "data_osquery_columns_name": true,
1926 - "data_osquery_columns_net_namespace": true,
1927 - "data_osquery_columns_nice": true,
1928 - "data_osquery_columns_on_disk": true,
1929 - "data_osquery_columns_parent": true,
1930 - "data_osquery_columns_path": true,
1931 - "data_osquery_columns_pgroup": true,
1932 - "data_osquery_columns_pid": true,
1933 - "data_osquery_columns_port": true,
1934 - "data_osquery_columns_protocol": true,
1935 - "data_osquery_columns_remote_address": true,
1936 - "data_osquery_columns_remote_address_city_name": true,
1937 - "data_osquery_columns_remote_address_country_code": true,
1938 - "data_osquery_columns_remote_address_geolocation": true,
1939 - "data_osquery_columns_remote_port": true,
1940 - "data_osquery_columns_resident_size": true,
1941 - "data_osquery_columns_root": true,
1942 - "data_osquery_columns_sgid": true,
1943 - "data_osquery_columns_shell": true,
1944 - "data_osquery_columns_socket": true,
1945 - "data_osquery_columns_start_time": true,
1946 - "data_osquery_columns_state": true,
1947 - "data_osquery_columns_suid": true,
1948 - "data_osquery_columns_system_time": true,
1949 - "data_osquery_columns_threads": true,
1950 - "data_osquery_columns_time_utc": true,
1951 - "data_osquery_columns_total_size": true,
1952 - "data_osquery_columns_tty": true,
1953 - "data_osquery_columns_type": true,
1954 - "data_osquery_columns_uid": true,
1955 - "data_osquery_columns_uid_signed": true,
1956 - "data_osquery_columns_user": true,
1957 - "data_osquery_columns_user_time": true,
1958 - "data_osquery_columns_username": true,
1959 - "data_osquery_columns_wired_size": true,
1960 - "data_osquery_counter": true,
1961 - "data_osquery_decorations_host_uuid": true,
1962 - "data_osquery_decorations_hostname": true,
1963 - "data_osquery_epoch": true,
1964 - "data_osquery_hostIdentifier": true,
1965 - "data_osquery_name": true,
1966 - "data_osquery_numerics": true,
1967 - "data_osquery_unixTime": true,
1968 - "data_proto": true,
1969 - "data_sca_check_command": true,
1970 - "data_sca_check_compliance_cis": true,
1971 - "data_sca_check_compliance_cis_csc": true,
1972 - "data_sca_check_compliance_gdpr_IV": true,
1973 - "data_sca_check_compliance_gpg_13": true,
1974 - "data_sca_check_compliance_hipaa": true,
1975 - "data_sca_check_compliance_nist_800_53": true,
1976 - "data_sca_check_compliance_pci_dss": true,
1977 - "data_sca_check_compliance_tsc": true,
1978 - "data_sca_check_description": true,
1979 - "data_sca_check_id": true,
1980 - "data_sca_check_previous_result": true,
1981 - "data_sca_check_rationale": true,
1982 - "data_sca_check_remediation": true,
1983 - "data_sca_check_result": true,
1984 - "data_sca_check_title": true,
1985 - "data_sca_description": true,
1986 - "data_sca_failed": true,
1987 - "data_sca_file": true,
1988 - "data_sca_invalid": true,
1989 - "data_sca_passed": true,
1990 - "data_sca_policy": true,
1991 - "data_sca_policy_id": true,
1992 - "data_sca_scan_id": true,
1993 - "data_sca_score": true,
1994 - "data_sca_total_checks": true,
1995 - "data_sca_type": true,
1996 - "data_script": true,
1997 - "data_src_ip": true,
1998 - "data_src_ip_city_name": true,
1999 - "data_src_ip_country_code": true,
2000 - "data_src_ip_geolocation": true,
2001 - "data_src_port": true,
2002 - "data_srcip": true,
2003 - "data_srcip_city_name": true,
2004 - "data_srcip_country_code": true,
2005 - "data_srcip_geolocation": true,
2006 - "data_srcuser": true,
2007 - "data_timestamp": true,
2008 - "data_title": true,
2009 - "data_tls_session_resumed": true,
2010 - "data_tls_version": true,
2011 - "data_tx_id": true,
2012 - "data_type": true,
2013 - "data_win_eventXML_binaryData": true,
2014 - "data_win_eventXML_binaryDataSize": true,
2015 - "data_win_eventXML_param1": true,
2016 - "data_win_eventdata_authenticationPackageName": true,
2017 - "data_win_eventdata_callTrace": true,
2018 - "data_win_eventdata_commandLine": true,
2019 - "data_win_eventdata_company": true,
2020 - "data_win_eventdata_creationUtcTime": true,
2021 - "data_win_eventdata_currentDirectory": true,
2022 - "data_win_eventdata_description": true,
2023 - "data_win_eventdata_destinationHostname": true,
2024 - "data_win_eventdata_destinationIp": true,
2025 - "data_win_eventdata_destinationIp_city_name": true,
2026 - "data_win_eventdata_destinationIp_country_code": true,
2027 - "data_win_eventdata_destinationIp_geolocation": true,
2028 - "data_win_eventdata_destinationIsIpv6": true,
2029 - "data_win_eventdata_destinationPort": true,
2030 - "data_win_eventdata_destinationPortName": true,
2031 - "data_win_eventdata_details": true,
2032 - "data_win_eventdata_elevatedToken": true,
2033 - "data_win_eventdata_eventType": true,
2034 - "data_win_eventdata_fileVersion": true,
2035 - "data_win_eventdata_fileVersion_city_name": true,
2036 - "data_win_eventdata_fileVersion_country_code": true,
2037 - "data_win_eventdata_fileVersion_geolocation": true,
2038 - "data_win_eventdata_grantedAccess": true,
2039 - "data_win_eventdata_hashes": true,
2040 - "data_win_eventdata_image": true,
2041 - "data_win_eventdata_imageLoaded": true,
2042 - "data_win_eventdata_impersonationLevel": true,
2043 - "data_win_eventdata_initiated": true,
2044 - "data_win_eventdata_integrityLevel": true,
2045 - "data_win_eventdata_ipAddress": true,
2046 - "data_win_eventdata_ipPort": true,
2047 - "data_win_eventdata_keyLength": true,
2048 - "data_win_eventdata_logonGuid": true,
2049 - "data_win_eventdata_logonId": true,
2050 - "data_win_eventdata_logonProcessName": true,
2051 - "data_win_eventdata_logonType": true,
2052 - "data_win_eventdata_originalFileName": true,
2053 - "data_win_eventdata_param1": true,
2054 - "data_win_eventdata_param2": true,
2055 - "data_win_eventdata_param3": true,
2056 - "data_win_eventdata_param4": true,
2057 - "data_win_eventdata_parentCommandLine": true,
2058 - "data_win_eventdata_parentImage": true,
2059 - "data_win_eventdata_parentProcessGuid": true,
2060 - "data_win_eventdata_parentProcessId": true,
2061 - "data_win_eventdata_processGuid": true,
2062 - "data_win_eventdata_processId": true,
2063 - "data_win_eventdata_processName": true,
2064 - "data_win_eventdata_product": true,
2065 - "data_win_eventdata_protocol": true,
2066 - "data_win_eventdata_queryName": true,
2067 - "data_win_eventdata_queryResults": true,
2068 - "data_win_eventdata_queryStatus": true,
2069 - "data_win_eventdata_ruleName": true,
2070 - "data_win_eventdata_serviceName": true,
2071 - "data_win_eventdata_serviceSid": true,
2072 - "data_win_eventdata_signature": true,
2073 - "data_win_eventdata_signatureStatus": true,
2074 - "data_win_eventdata_signed": true,
2075 - "data_win_eventdata_sourceHostname": true,
2076 - "data_win_eventdata_sourceImage": true,
2077 - "data_win_eventdata_sourceIp": true,
2078 - "data_win_eventdata_sourceIp_city_name": true,
2079 - "data_win_eventdata_sourceIp_country_code": true,
2080 - "data_win_eventdata_sourceIp_geolocation": true,
2081 - "data_win_eventdata_sourceIsIpv6": true,
2082 - "data_win_eventdata_sourcePort": true,
2083 - "data_win_eventdata_sourceProcessGUID": true,
2084 - "data_win_eventdata_sourceProcessId": true,
2085 - "data_win_eventdata_sourceThreadId": true,
2086 - "data_win_eventdata_status": true,
2087 - "data_win_eventdata_subjectDomainName": true,
2088 - "data_win_eventdata_subjectLogonId": true,
2089 - "data_win_eventdata_subjectUserName": true,
2090 - "data_win_eventdata_subjectUserSid": true,
2091 - "data_win_eventdata_targetDomainName": true,
2092 - "data_win_eventdata_targetFilename": true,
2093 - "data_win_eventdata_targetImage": true,
2094 - "data_win_eventdata_targetLinkedLogonId": true,
2095 - "data_win_eventdata_targetLogonId": true,
2096 - "data_win_eventdata_targetObject": true,
2097 - "data_win_eventdata_targetProcessGUID": true,
2098 - "data_win_eventdata_targetProcessId": true,
2099 - "data_win_eventdata_targetUserName": true,
2100 - "data_win_eventdata_targetUserSid": true,
2101 - "data_win_eventdata_terminalSessionId": true,
2102 - "data_win_eventdata_ticketEncryptionType": true,
2103 - "data_win_eventdata_ticketOptions": true,
2104 - "data_win_eventdata_user": true,
2105 - "data_win_eventdata_utcTime": true,
2106 - "data_win_eventdata_virtualAccount": true,
2107 - "data_win_system_channel": true,
2108 - "data_win_system_computer": true,
2109 - "data_win_system_eventID": true,
2110 - "data_win_system_eventRecordID": true,
2111 - "data_win_system_eventSourceName": true,
2112 - "data_win_system_keywords": true,
2113 - "data_win_system_level": true,
2114 - "data_win_system_message": true,
2115 - "data_win_system_opcode": true,
2116 - "data_win_system_processID": true,
2117 - "data_win_system_providerGuid": true,
2118 - "data_win_system_providerName": true,
2119 - "data_win_system_severityValue": true,
2120 - "data_win_system_systemTime": true,
2121 - "data_win_system_task": true,
2122 - "data_win_system_threadID": true,
2123 - "data_win_system_version": true,
2124 - "decoder_name": true,
2125 - "decoder_parent": true,
2126 - "dns_query": true,
2127 - "dns_query_threat_indicated": true,
2128 - "dst_ip": true,
2129 - "dst_ip_city_name": true,
2130 - "dst_ip_country_code": true,
2131 - "dst_ip_geolocation": true,
2132 - "dst_ip_threat_indicated": true,
2133 - "dst_port": true,
2134 - "ecs_version": true,
2135 - "error": true,
2136 - "event_hash": true,
2137 - "file_path": true,
2138 - "firewall_rule_name": true,
2139 - "full_log": false,
2140 - "gl2_accounted_message_size": true,
2141 - "gl2_message_id": true,
2142 - "gl2_processing_error": true,
2143 - "gl2_remote_ip": true,
2144 - "gl2_remote_port": true,
2145 - "gl2_source_collector": true,
2146 - "gl2_source_input": true,
2147 - "gl2_source_node": true,
2148 - "hash_md5": true,
2149 - "hash_sha1": true,
2150 - "hash_sha256": true,
2151 - "highlight": true,
2152 - "host_architecture": true,
2153 - "host_containerized": true,
2154 - "host_hostname": true,
2155 - "host_id": true,
2156 - "host_ip": true,
2157 - "host_mac": true,
2158 - "host_name": true,
2159 - "host_os_codename": true,
2160 - "host_os_kernel": true,
2161 - "host_os_name": true,
2162 - "host_os_platform": true,
2163 - "host_os_version": true,
2164 - "hostname": true,
2165 - "id": true,
2166 - "input_type": true,
2167 - "level": true,
2168 - "location": true,
2169 - "log_file_path": true,
2170 - "log_offset": true,
2171 - "manager_name": true,
2172 - "message": true,
2173 - "module": true,
2174 - "msg_timestamp": true,
2175 - "parent_process_cmd_line": true,
2176 - "parent_process_id": true,
2177 - "parent_process_image": true,
2178 - "pid": true,
2179 - "predecoder_hostname": true,
2180 - "predecoder_program_name": true,
2181 - "predecoder_timestamp": true,
2182 - "previous_log": true,
2183 - "previous_output": true,
2184 - "process_cmd_line": true,
2185 - "process_id": true,
2186 - "process_image": true,
2187 - "process_name": true,
2188 - "protocol": true,
2189 - "rule_cis": true,
2190 - "rule_cis_csc": true,
2191 - "rule_firedtimes": true,
2192 - "rule_gdpr": true,
2193 - "rule_gdpr_IV": true,
2194 - "rule_gpg13": true,
2195 - "rule_gpg_13": true,
2196 - "rule_group1": true,
2197 - "rule_group2": true,
2198 - "rule_groups": true,
2199 - "rule_hipaa": true,
2200 - "rule_id": true,
2201 - "rule_info": true,
2202 - "rule_mail": true,
2203 - "rule_mitre_id": true,
2204 - "rule_mitre_tactic": false,
2205 - "rule_nist_800_53": true,
2206 - "rule_pci_dss": true,
2207 - "rule_tsc": true,
2208 - "scanid": true,
2209 - "service": true,
2210 - "software_package": true,
2211 - "software_vendor": true,
2212 - "sort": true,
2213 - "source": true,
2214 - "source_reserved_ip": true,
2215 - "src_ip": true,
2216 - "src_ip_city_name": true,
2217 - "src_ip_country_code": true,
2218 - "src_ip_geolocation": true,
2219 - "src_port": true,
2220 - "streams": true,
2221 - "syscheck_attrs_after": true,
2222 - "syscheck_audit_effective_user_id": true,
2223 - "syscheck_audit_effective_user_name": true,
2224 - "syscheck_audit_group_id": true,
2225 - "syscheck_audit_group_name": true,
2226 - "syscheck_audit_login_user_id": true,
2227 - "syscheck_audit_login_user_name": true,
2228 - "syscheck_audit_process_cwd": true,
2229 - "syscheck_audit_process_id": true,
2230 - "syscheck_audit_process_name": true,
2231 - "syscheck_audit_process_parent_cwd": true,
2232 - "syscheck_audit_process_parent_name": true,
2233 - "syscheck_audit_process_ppid": true,
2234 - "syscheck_audit_user_id": true,
2235 - "syscheck_audit_user_name": true,
2236 - "syscheck_changed_attributes": true,
2237 - "syscheck_event": true,
2238 - "syscheck_gid_after": true,
2239 - "syscheck_gname_after": true,
2240 - "syscheck_hard_links": true,
2241 - "syscheck_inode_after": true,
2242 - "syscheck_inode_before": true,
2243 - "syscheck_md5_after": true,
2244 - "syscheck_md5_before": true,
2245 - "syscheck_mode": true,
2246 - "syscheck_mtime_after": true,
2247 - "syscheck_mtime_before": true,
2248 - "syscheck_path": true,
2249 - "syscheck_perm_after": true,
2250 - "syscheck_perm_before": true,
2251 - "syscheck_sha1_after": true,
2252 - "syscheck_sha1_before": true,
2253 - "syscheck_sha256_after": true,
2254 - "syscheck_sha256_before": true,
2255 - "syscheck_size_after": true,
2256 - "syscheck_size_before": true,
2257 - "syscheck_uid_after": true,
2258 - "syscheck_uname_after": true,
2259 - "syscheck_win_perm_after": true,
2260 - "syscheck_win_perm_after_0_allowed": true,
2261 - "syscheck_win_perm_after_0_name": true,
2262 - "syscheck_win_perm_after_1_allowed": true,
2263 - "syscheck_win_perm_after_1_name": true,
2264 - "syscheck_win_perm_after_2_allowed": true,
2265 - "syscheck_win_perm_after_2_name": true,
2266 - "syscheck_win_perm_after_3_allowed": true,
2267 - "syscheck_win_perm_after_3_name": true,
2268 - "syslog_customer": true,
2269 - "syslog_level": true,
2270 - "syslog_tag": true,
2271 - "syslog_type": true,
2272 - "sysmon_event_description": true,
2273 - "threat_ids": true,
2274 - "threat_indicated": true,
2275 - "threat_names": true,
2276 - "time": true,
2277 - "timestamp": true,
2278 - "timestamp_utc": true,
2279 - "true": true,
2280 - "user_name": true,
2281 - "win_registry_key": true,
2282 - "win_system_eventID": true,
2283 - "windows_auth_package": true,
2284 - "windows_domain": true,
2285 - "windows_event_id": true,
2286 - "windows_event_severity": true,
2287 - "windows_logon_type": true
2288 - },
2289 - "indexByName": {
2290 - "_id": 2,
2291 - "_index": 8,
2292 - "_type": 9,
2293 - "agent_id": 10,
2294 - "agent_name": 4,
2295 - "cluster_name": 11,
2296 - "cluster_node": 12,
2297 - "data_integration": 43,
2298 - "data_office365_AdditionalActionsAndResults": 44,
2299 - "data_office365_AttachmentData": 45,
2300 - "data_office365_AuthDetails": 46,
2301 - "data_office365_CreationTime": 0,
2302 - "data_office365_DeliveryAction": 47,
2303 - "data_office365_DetectionMethod": 48,
2304 - "data_office365_DetectionType": 49,
2305 - "data_office365_Directionality": 50,
2306 - "data_office365_EventDeepLink": 51,
2307 - "data_office365_Id": 13,
2308 - "data_office365_InternetMessageId": 52,
2309 - "data_office365_LatestDeliveryLocation": 53,
2310 - "data_office365_MessageTime": 54,
2311 - "data_office365_NetworkMessageId": 55,
2312 - "data_office365_ObjectId": 14,
2313 - "data_office365_Operation": 20,
2314 - "data_office365_OrganizationId": 15,
2315 - "data_office365_OriginalDeliveryLocation": 56,
2316 - "data_office365_P1Sender": 57,
2317 - "data_office365_P2Sender": 58,
2318 - "data_office365_PhishConfidenceLevel": 59,
2319 - "data_office365_Recipients": 61,
2320 - "data_office365_RecordType": 16,
2321 - "data_office365_SenderIp": 60,
2322 - "data_office365_SenderIp_city_name": 62,
2323 - "data_office365_SenderIp_country_code": 63,
2324 - "data_office365_SenderIp_geolocation": 64,
2325 - "data_office365_Subject": 65,
2326 - "data_office365_Subscription": 66,
2327 - "data_office365_SystemOverrides": 67,
2328 - "data_office365_ThreatsAndDetectionTech": 68,
2329 - "data_office365_UserId": 3,
2330 - "data_office365_UserKey": 17,
2331 - "data_office365_UserType": 18,
2332 - "data_office365_Verdict": 69,
2333 - "data_office365_Version": 19,
2334 - "data_office365_Workload": 42,
2335 - "decoder_name": 21,
2336 - "gl2_accounted_message_size": 22,
2337 - "gl2_message_id": 23,
2338 - "gl2_processing_error": 24,
2339 - "gl2_remote_ip": 25,
2340 - "gl2_remote_port": 26,
2341 - "gl2_source_input": 27,
2342 - "gl2_source_node": 28,
2343 - "id": 29,
2344 - "location": 30,
2345 - "manager_name": 31,
2346 - "message": 32,
2347 - "rule_description": 5,
2348 - "rule_firedtimes": 33,
2349 - "rule_group1": 34,
2350 - "rule_group2": 70,
2351 - "rule_groups": 35,
2352 - "rule_hipaa": 71,
2353 - "rule_id": 7,
2354 - "rule_level": 6,
2355 - "rule_mail": 36,
2356 - "rule_pci_dss": 72,
2357 - "source": 37,
2358 - "source_reserved_ip": 73,
2359 - "streams": 38,
2360 - "syslog_level": 39,
2361 - "syslog_type": 40,
2362 - "timestamp": 1,
2363 - "timestamp_utc": 74,
2364 - "true": 41
2365 - },
2366 - "renameByName": {
2367 - "_id": "EVENT ID",
2368 - "agent_name": "",
2369 - "data_office365_ActorIpAddress": "SRC IP",
2370 - "data_office365_AffectedItems": "ITEMS",
2371 - "data_office365_ClientIP": "CLIENT IP",
2372 - "data_office365_ClientIP_city_name": "",
2373 - "data_office365_CreationTime": "EVENT TIME",
2374 - "data_office365_DeliveryAction": "DELIVERY ACTION",
2375 - "data_office365_DetectionMethod": "DETECTION",
2376 - "data_office365_DetectionType": "",
2377 - "data_office365_Item_Attachments": "ATTACHMENT",
2378 - "data_office365_Item_ParentFolder_Path": "FOLDER",
2379 - "data_office365_Item_Subject": "SUBJECT",
2380 - "data_office365_OperationProperties": "",
2381 - "data_office365_Recipients": "RCPTS",
2382 - "data_office365_ResultStatus": "RESULT",
2383 - "data_office365_SenderIp": "SENDER IP",
2384 - "data_office365_SenderIp_country_code": "COUNTRY",
2385 - "data_office365_Subject": "",
2386 - "data_office365_UserId": "ACCOUNT",
2387 - "rule_description": "DESCRIPTION",
2388 - "rule_id": "RULE ID",
2389 - "rule_level": "",
2390 - "rule_mitre_tactic": "MITRE TACTIC",
2391 - "rule_mitre_technique": "MITRE TECHNIQUE",
2392 - "timestamp": "Date/Time"
2393 - }
2394 - }
2395 - }
2396 - ],
2397 - "transparent": true,
2398 - "type": "table"
2399 - }
2400 - ],
2401 - "refresh": "",
2402 - "schemaVersion": 38,
2403 - "tags": [
2404 - "O365"
2405 - ],
2406 - "templating": {
2407 - "list": [
2408 - {
2409 - "datasource": {
2410 - "type": "elasticsearch",
2411 - "uid": "replace_datasource_uid"
2412 - },
2413 - "filters": [],
2414 - "hide": 0,
2415 - "label": "",
2416 - "name": "Filters",
2417 - "skipUrlSync": false,
2418 - "type": "adhoc"
2419 - },
2420 - {
2421 - "current": {
2422 - "selected": false,
2423 - "text": "All",
2424 - "value": "$__all"
2425 - },
2426 - "datasource": {
2427 - "type": "elasticsearch",
2428 - "uid": "replace_datasource_uid"
2429 - },
2430 - "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:ThreatIntelligence\"}",
2431 - "hide": 0,
2432 - "includeAll": true,
2433 - "label": "Operation",
2434 - "multi": false,
2435 - "name": "operation",
2436 - "options": [],
2437 - "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:ThreatIntelligence\"}",
2438 - "refresh": 2,
2439 - "regex": "",
2440 - "skipUrlSync": false,
2441 - "sort": 1,
2442 - "tagValuesQuery": "",
2443 - "tagsQuery": "",
2444 - "type": "query",
2445 - "useTags": false
2446 - },
2447 - {
2448 - "current": {
2449 - "selected": false,
2450 - "text": "All",
2451 - "value": "$__all"
2452 - },
2453 - "datasource": {
2454 - "type": "elasticsearch",
2455 - "uid": "replace_datasource_uid"
2456 - },
2457 - "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2458 - "hide": 0,
2459 - "includeAll": true,
2460 - "label": "Rule Level",
2461 - "multi": false,
2462 - "name": "rule_level",
2463 - "options": [],
2464 - "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2465 - "refresh": 2,
2466 - "regex": "",
2467 - "skipUrlSync": false,
2468 - "sort": 0,
2469 - "type": "query"
2470 - }
2471 - ]
2472 - },
2473 - "time": {
2474 - "from": "now-6h",
2475 - "to": "now"
2476 - },
2477 - "timepicker": {
2478 - "refresh_intervals": [
2479 - "5s",
2480 - "10s",
2481 - "30s",
2482 - "1m",
2483 - "5m",
2484 - "15m",
2485 - "30m",
2486 - "1h",
2487 - "2h",
2488 - "1d"
2489 - ],
2490 - "time_options": [
2491 - "5m",
2492 - "15m",
2493 - "1h",
2494 - "6h",
2495 - "12h",
2496 - "24h",
2497 - "2d",
2498 - "7d",
2499 - "30d"
2500 - ]
2501 - },
2502 - "timezone": "",
2503 - "title": "O365 - THREAT INTELLIGENCE",
2504 - "version": 5,
2505 - "weekStart": ""
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": ["O365"],
35 + "targetBlank": true,
36 + "title": "",
37 + "type": "dashboards"
38 + }
39 + ],
40 + "liveNow": false,
41 + "panels": [
42 + {
43 + "datasource": {
44 + "type": "elasticsearch",
45 + "uid": "replace_datasource_uid"
46 + },
47 + "fieldConfig": {
48 + "defaults": {
49 + "mappings": [
50 + {
51 + "options": {
52 + "match": "null",
53 + "result": {
54 + "text": "N/A"
55 + }
56 + },
57 + "type": "special"
58 + }
59 + ],
60 + "thresholds": {
61 + "mode": "absolute",
62 + "steps": [
63 + {
64 + "color": "red",
65 + "value": null
66 + }
67 + ]
68 + },
69 + "unit": "locale"
70 + },
71 + "overrides": []
72 + },
73 + "gridPos": {
74 + "h": 7,
75 + "w": 4,
76 + "x": 0,
77 + "y": 0
78 + },
79 + "id": 43,
80 + "links": [],
81 + "options": {
82 + "colorMode": "value",
83 + "graphMode": "area",
84 + "justifyMode": "auto",
85 + "orientation": "horizontal",
86 + "reduceOptions": {
87 + "calcs": ["sum"],
88 + "fields": "",
89 + "values": false
90 + },
91 + "text": {},
92 + "textMode": "auto",
93 + "wideLayout": true
94 + },
95 + "pluginVersion": "10.2.2",
96 + "targets": [
97 + {
98 + "bucketAggs": [
99 + {
100 + "field": "timestamp",
101 + "id": "2",
102 + "settings": {
103 + "interval": "auto",
104 + "min_doc_count": 0,
105 + "trimEdges": 0
106 + },
107 + "type": "date_histogram"
108 + }
109 + ],
110 + "datasource": {
111 + "type": "elasticsearch",
112 + "uid": "replace_datasource_uid"
113 + },
114 + "metrics": [
115 + {
116 + "field": "select field",
117 + "id": "1",
118 + "type": "count"
119 + }
120 + ],
121 + "query": "rule_level:>=12 AND data_office365_Operation:$operation",
122 + "refId": "A",
123 + "timeField": "timestamp"
124 + }
125 + ],
126 + "title": "ALERTS",
127 + "type": "stat"
128 + },
129 + {
130 + "datasource": {
131 + "type": "elasticsearch",
132 + "uid": "replace_datasource_uid"
133 + },
134 + "fieldConfig": {
135 + "defaults": {
136 + "color": {
137 + "mode": "palette-classic"
138 + },
139 + "custom": {
140 + "hideFrom": {
141 + "legend": false,
142 + "tooltip": false,
143 + "viz": false
144 + }
145 + },
146 + "mappings": []
147 + },
148 + "overrides": [
149 + {
150 + "matcher": {
151 + "id": "byName",
152 + "options": "Count"
153 + },
154 + "properties": [
155 + {
156 + "id": "displayName",
157 + "value": "EVENTS"
158 + },
159 + {
160 + "id": "unit",
161 + "value": "short"
162 + },
163 + {
164 + "id": "decimals",
165 + "value": -1
166 + }
167 + ]
168 + }
169 + ]
170 + },
171 + "gridPos": {
172 + "h": 7,
173 + "w": 4,
174 + "x": 4,
175 + "y": 0
176 + },
177 + "id": 53,
178 + "options": {
179 + "legend": {
180 + "displayMode": "list",
181 + "placement": "bottom",
182 + "showLegend": false
183 + },
184 + "pieType": "donut",
185 + "reduceOptions": {
186 + "calcs": ["sum"],
187 + "fields": "",
188 + "values": false
189 + },
190 + "tooltip": {
191 + "mode": "single",
192 + "sort": "none"
193 + }
194 + },
195 + "pluginVersion": "8.5.1",
196 + "targets": [
197 + {
198 + "bucketAggs": [
199 + {
200 + "fake": true,
201 + "field": "data_office365_Operation",
202 + "id": "4",
203 + "settings": {
204 + "min_doc_count": 1,
205 + "order": "desc",
206 + "orderBy": "_count",
207 + "size": "10"
208 + },
209 + "type": "terms"
210 + },
211 + {
212 + "field": "data_office365_CreationTime",
213 + "id": "5",
214 + "settings": {
215 + "interval": "auto",
216 + "min_doc_count": "0",
217 + "timeZone": "utc",
218 + "trimEdges": "0"
219 + },
220 + "type": "date_histogram"
221 + }
222 + ],
223 + "datasource": {
224 + "type": "elasticsearch",
225 + "uid": "replace_datasource_uid"
226 + },
227 + "metrics": [
228 + {
229 + "field": "select field",
230 + "id": "1",
231 + "type": "count"
232 + }
233 + ],
234 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
235 + "refId": "A",
236 + "timeField": "timestamp"
237 + }
238 + ],
239 + "title": "EVENTS BY OPERATION (Top 10)",
240 + "transformations": [],
241 + "type": "piechart"
242 + },
243 + {
244 + "datasource": {
245 + "type": "elasticsearch",
246 + "uid": "replace_datasource_uid"
247 + },
248 + "fieldConfig": {
249 + "defaults": {
250 + "color": {
251 + "mode": "thresholds"
252 + },
253 + "custom": {
254 + "align": "auto",
255 + "cellOptions": {
256 + "type": "auto"
257 + },
258 + "inspect": false
259 + },
260 + "mappings": [],
261 + "thresholds": {
262 + "mode": "absolute",
263 + "steps": [
264 + {
265 + "color": "red",
266 + "value": null
267 + }
268 + ]
269 + }
270 + },
271 + "overrides": [
272 + {
273 + "matcher": {
274 + "id": "byName",
275 + "options": "Count"
276 + },
277 + "properties": [
278 + {
279 + "id": "displayName",
280 + "value": "EVENTS"
281 + },
282 + {
283 + "id": "unit",
284 + "value": "short"
285 + },
286 + {
287 + "id": "decimals",
288 + "value": -1
289 + },
290 + {
291 + "id": "custom.align"
292 + },
293 + {
294 + "id": "thresholds",
295 + "value": {
296 + "mode": "absolute",
297 + "steps": [
298 + {
299 + "color": "red",
300 + "value": null
301 + }
302 + ]
303 + }
304 + }
305 + ]
306 + }
307 + ]
308 + },
309 + "gridPos": {
310 + "h": 7,
311 + "w": 5,
312 + "x": 8,
313 + "y": 0
314 + },
315 + "id": 54,
316 + "options": {
317 + "cellHeight": "sm",
318 + "footer": {
319 + "countRows": false,
320 + "fields": "",
321 + "reducer": ["sum"],
322 + "show": false
323 + },
324 + "showHeader": true
325 + },
326 + "pluginVersion": "10.2.2",
327 + "targets": [
328 + {
329 + "bucketAggs": [
330 + {
331 + "fake": true,
332 + "field": "data_office365_Operation",
333 + "id": "4",
334 + "settings": {
335 + "min_doc_count": 1,
336 + "order": "desc",
337 + "orderBy": "_count",
338 + "size": "0"
339 + },
340 + "type": "terms"
341 + }
342 + ],
343 + "datasource": {
344 + "type": "elasticsearch",
345 + "uid": "replace_datasource_uid"
346 + },
347 + "metrics": [
348 + {
349 + "field": "select field",
350 + "id": "1",
351 + "type": "count"
352 + }
353 + ],
354 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
355 + "refId": "A",
356 + "timeField": "timestamp"
357 + }
358 + ],
359 + "title": "EVENTS BY OPERATION",
360 + "transformations": [
361 + {
362 + "id": "merge",
363 + "options": {
364 + "reducers": []
365 + }
366 + },
367 + {
368 + "id": "organize",
369 + "options": {
370 + "excludeByName": {},
371 + "indexByName": {},
372 + "renameByName": {
373 + "Count": "EVENTS",
374 + "data_office365_Operation": "OPERATION"
375 + }
376 + }
377 + }
378 + ],
379 + "type": "table"
380 + },
381 + {
382 + "datasource": {
383 + "type": "grafana-opensearch-datasource",
384 + "uid": "replace_datasource_uid"
385 + },
386 + "fieldConfig": {
387 + "defaults": {
388 + "color": {
389 + "mode": "thresholds"
390 + },
391 + "custom": {
392 + "align": "auto",
393 + "cellOptions": {
394 + "type": "auto"
395 + },
396 + "inspect": false
397 + },
398 + "mappings": [],
399 + "thresholds": {
400 + "mode": "absolute",
401 + "steps": [
402 + {
403 + "color": "red",
404 + "value": null
405 + }
406 + ]
407 + }
408 + },
409 + "overrides": [
410 + {
411 + "matcher": {
412 + "id": "byName",
413 + "options": "Count"
414 + },
415 + "properties": [
416 + {
417 + "id": "displayName",
418 + "value": "EVENTS"
419 + },
420 + {
421 + "id": "unit",
422 + "value": "short"
423 + },
424 + {
425 + "id": "decimals",
426 + "value": -1
427 + },
428 + {
429 + "id": "custom.align"
430 + },
431 + {
432 + "id": "thresholds",
433 + "value": {
434 + "mode": "absolute",
435 + "steps": [
436 + {
437 + "color": "red",
438 + "value": null
439 + }
440 + ]
441 + }
442 + }
443 + ]
444 + }
445 + ]
446 + },
447 + "gridPos": {
448 + "h": 7,
449 + "w": 6,
450 + "x": 13,
451 + "y": 0
452 + },
453 + "id": 61,
454 + "options": {
455 + "cellHeight": "sm",
456 + "footer": {
457 + "countRows": false,
458 + "fields": "",
459 + "reducer": ["sum"],
460 + "show": false
461 + },
462 + "showHeader": true
463 + },
464 + "pluginVersion": "10.2.2",
465 + "targets": [
466 + {
467 + "bucketAggs": [
468 + {
469 + "fake": true,
470 + "field": "data_office365_DetectionMethod",
471 + "id": "4",
472 + "settings": {
473 + "min_doc_count": 1,
474 + "order": "desc",
475 + "orderBy": "_count",
476 + "size": "0"
477 + },
478 + "type": "terms"
479 + }
480 + ],
481 + "datasource": {
482 + "type": "elasticsearch",
483 + "uid": "replace_datasource_uid"
484 + },
485 + "metrics": [
486 + {
487 + "field": "select field",
488 + "id": "1",
489 + "type": "count"
490 + }
491 + ],
492 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
493 + "queryType": "lucene",
494 + "refId": "A",
495 + "timeField": "timestamp"
496 + }
497 + ],
498 + "title": "EVENTS BY DETECTION",
499 + "transformations": [
500 + {
501 + "id": "organize",
502 + "options": {
503 + "excludeByName": {},
504 + "indexByName": {},
505 + "renameByName": {
506 + "Count": "EVENTS",
507 + "data_office365_DetectionMethod": "DETECTION METHOD",
508 + "data_office365_Operation": "OPERATION"
509 + }
510 + }
511 + }
512 + ],
513 + "type": "table"
514 + },
515 + {
516 + "datasource": {
517 + "type": "grafana-opensearch-datasource",
518 + "uid": "replace_datasource_uid"
519 + },
520 + "fieldConfig": {
521 + "defaults": {
522 + "color": {
523 + "mode": "thresholds"
524 + },
525 + "custom": {
526 + "align": "auto",
527 + "cellOptions": {
528 + "type": "auto"
529 + },
530 + "inspect": false
531 + },
532 + "mappings": [],
533 + "thresholds": {
534 + "mode": "absolute",
535 + "steps": [
536 + {
537 + "color": "red",
538 + "value": null
539 + }
540 + ]
541 + }
542 + },
543 + "overrides": [
544 + {
545 + "matcher": {
546 + "id": "byName",
547 + "options": "Count"
548 + },
549 + "properties": [
550 + {
551 + "id": "displayName",
552 + "value": "EVENTS"
553 + },
554 + {
555 + "id": "unit",
556 + "value": "short"
557 + },
558 + {
559 + "id": "decimals",
560 + "value": -1
561 + },
562 + {
563 + "id": "custom.align"
564 + },
565 + {
566 + "id": "thresholds",
567 + "value": {
568 + "mode": "absolute",
569 + "steps": [
570 + {
571 + "color": "red",
572 + "value": null
573 + }
574 + ]
575 + }
576 + }
577 + ]
578 + },
579 + {
580 + "matcher": {
581 + "id": "byName",
582 + "options": "DELIVERY ACTION"
583 + },
584 + "properties": [
585 + {
586 + "id": "color",
587 + "value": {
588 + "mode": "fixed"
589 + }
590 + },
591 + {
592 + "id": "mappings",
593 + "value": [
594 + {
595 + "options": {
596 + "Blocked": {
597 + "color": "green",
598 + "index": 0
599 + },
600 + "Delivered": {
601 + "color": "light-red",
602 + "index": 1
603 + },
604 + "DeliveredAsSpam": {
605 + "color": "orange",
606 + "index": 2
607 + }
608 + },
609 + "type": "value"
610 + }
611 + ]
612 + },
613 + {
614 + "id": "custom.cellOptions",
615 + "value": {
616 + "type": "color-text"
617 + }
618 + }
619 + ]
620 + }
621 + ]
622 + },
623 + "gridPos": {
624 + "h": 7,
625 + "w": 5,
626 + "x": 19,
627 + "y": 0
628 + },
629 + "id": 62,
630 + "options": {
631 + "cellHeight": "sm",
632 + "footer": {
633 + "countRows": false,
634 + "fields": "",
635 + "reducer": ["sum"],
636 + "show": false
637 + },
638 + "showHeader": true
639 + },
640 + "pluginVersion": "10.2.2",
641 + "targets": [
642 + {
643 + "bucketAggs": [
644 + {
645 + "fake": true,
646 + "field": "data_office365_DeliveryAction",
647 + "id": "4",
648 + "settings": {
649 + "min_doc_count": 1,
650 + "order": "desc",
651 + "orderBy": "_count",
652 + "size": "0"
653 + },
654 + "type": "terms"
655 + }
656 + ],
657 + "datasource": {
658 + "type": "elasticsearch",
659 + "uid": "replace_datasource_uid"
660 + },
661 + "metrics": [
662 + {
663 + "field": "select field",
664 + "id": "1",
665 + "type": "count"
666 + }
667 + ],
668 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
669 + "queryType": "lucene",
670 + "refId": "A",
671 + "timeField": "timestamp"
672 + }
673 + ],
674 + "title": "EVENTS BY ACTION (EXCHANGE)",
675 + "transformations": [
676 + {
677 + "id": "organize",
678 + "options": {
679 + "excludeByName": {},
680 + "indexByName": {},
681 + "renameByName": {
682 + "Count": "EVENTS",
683 + "data_office365_DeliveryAction": "DELIVERY ACTION",
684 + "data_office365_DetectionMethod": "DETECTION METHOD",
685 + "data_office365_Operation": "OPERATION"
686 + }
687 + }
688 + }
689 + ],
690 + "type": "table"
691 + },
692 + {
693 + "datasource": {
694 + "type": "elasticsearch",
695 + "uid": "replace_datasource_uid"
696 + },
697 + "fieldConfig": {
698 + "defaults": {
699 + "color": {
700 + "mode": "thresholds"
701 + },
702 + "mappings": [
703 + {
704 + "options": {
705 + "match": "null",
706 + "result": {
707 + "text": "N/A"
708 + }
709 + },
710 + "type": "special"
711 + }
712 + ],
713 + "max": 15,
714 + "min": 0,
715 + "thresholds": {
716 + "mode": "absolute",
717 + "steps": [
718 + {
719 + "color": "#299c46",
720 + "value": null
721 + },
722 + {
723 + "color": "rgba(237, 129, 40, 0.89)",
724 + "value": 8
725 + },
726 + {
727 + "color": "#d44a3a",
728 + "value": 12
729 + }
730 + ]
731 + },
732 + "unit": "none"
733 + },
734 + "overrides": []
735 + },
736 + "gridPos": {
737 + "h": 7,
738 + "w": 4,
739 + "x": 0,
740 + "y": 7
741 + },
742 + "id": 16,
743 + "links": [],
744 + "options": {
745 + "minVizHeight": 75,
746 + "minVizWidth": 75,
747 + "orientation": "horizontal",
748 + "reduceOptions": {
749 + "calcs": ["max"],
750 + "fields": "",
751 + "values": false
752 + },
753 + "showThresholdLabels": false,
754 + "showThresholdMarkers": true,
755 + "text": {}
756 + },
757 + "pluginVersion": "10.2.2",
758 + "targets": [
759 + {
760 + "bucketAggs": [
761 + {
762 + "field": "timestamp",
763 + "id": "2",
764 + "settings": {
765 + "interval": "auto",
766 + "min_doc_count": 0,
767 + "trimEdges": 0
768 + },
769 + "type": "date_histogram"
770 + }
771 + ],
772 + "datasource": {
773 + "type": "elasticsearch",
774 + "uid": "replace_datasource_uid"
775 + },
776 + "metrics": [
777 + {
778 + "field": "rule_level",
779 + "id": "1",
780 + "meta": {},
781 + "settings": {},
782 + "type": "max"
783 + }
784 + ],
785 + "query": "data_office365_Operation:$operation",
786 + "refId": "A",
787 + "timeField": "timestamp"
788 + }
789 + ],
790 + "title": "MAX SEVERITY (0 - 15)",
791 + "type": "gauge"
792 + },
793 + {
794 + "datasource": {
795 + "type": "elasticsearch",
796 + "uid": "replace_datasource_uid"
797 + },
798 + "fieldConfig": {
799 + "defaults": {
800 + "color": {
801 + "mode": "palette-classic"
802 + },
803 + "custom": {
804 + "axisBorderShow": false,
805 + "axisCenteredZero": false,
806 + "axisColorMode": "text",
807 + "axisLabel": "",
808 + "axisPlacement": "auto",
809 + "barAlignment": 0,
810 + "drawStyle": "bars",
811 + "fillOpacity": 0,
812 + "gradientMode": "none",
813 + "hideFrom": {
814 + "legend": false,
815 + "tooltip": false,
816 + "viz": false
817 + },
818 + "insertNulls": false,
819 + "lineInterpolation": "linear",
820 + "lineWidth": 1,
821 + "pointSize": 5,
822 + "scaleDistribution": {
823 + "type": "linear"
824 + },
825 + "showPoints": "auto",
826 + "spanNulls": false,
827 + "stacking": {
828 + "group": "A",
829 + "mode": "normal"
830 + },
831 + "thresholdsStyle": {
832 + "mode": "off"
833 + }
834 + },
835 + "mappings": [],
836 + "thresholds": {
837 + "mode": "absolute",
838 + "steps": [
839 + {
840 + "color": "green",
841 + "value": null
842 + },
843 + {
844 + "color": "red",
845 + "value": 80
846 + }
847 + ]
848 + }
849 + },
850 + "overrides": []
851 + },
852 + "gridPos": {
853 + "h": 13,
854 + "w": 20,
855 + "x": 4,
856 + "y": 7
857 + },
858 + "id": 60,
859 + "options": {
860 + "legend": {
861 + "calcs": [],
862 + "displayMode": "table",
863 + "placement": "right",
864 + "showLegend": true
865 + },
866 + "tooltip": {
867 + "mode": "single",
868 + "sort": "none"
869 + }
870 + },
871 + "targets": [
872 + {
873 + "alias": "",
874 + "bucketAggs": [
875 + {
876 + "field": "data_office365_Operation",
877 + "id": "3",
878 + "settings": {
879 + "min_doc_count": "1",
880 + "order": "desc",
881 + "orderBy": "_count",
882 + "size": "10"
883 + },
884 + "type": "terms"
885 + },
886 + {
887 + "field": "timestamp",
888 + "id": "2",
889 + "settings": {
890 + "interval": "auto"
891 + },
892 + "type": "date_histogram"
893 + }
894 + ],
895 + "datasource": {
896 + "type": "elasticsearch",
897 + "uid": "replace_datasource_uid"
898 + },
899 + "metrics": [
900 + {
901 + "id": "1",
902 + "type": "count"
903 + }
904 + ],
905 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
906 + "refId": "A",
907 + "timeField": "timestamp"
908 + }
909 + ],
910 + "title": "TOP 10 OPERATIONS - HISTOGRAM",
911 + "transparent": true,
912 + "type": "timeseries"
913 + },
914 + {
915 + "datasource": {
916 + "type": "elasticsearch",
917 + "uid": "replace_datasource_uid"
918 + },
919 + "fieldConfig": {
920 + "defaults": {
921 + "mappings": [
922 + {
923 + "options": {
924 + "match": "null",
925 + "result": {
926 + "text": "N/A"
927 + }
928 + },
929 + "type": "special"
930 + }
931 + ],
932 + "thresholds": {
933 + "mode": "absolute",
934 + "steps": [
935 + {
936 + "color": "orange",
937 + "value": null
938 + }
939 + ]
940 + },
941 + "unit": "locale"
942 + },
943 + "overrides": []
944 + },
945 + "gridPos": {
946 + "h": 6,
947 + "w": 4,
948 + "x": 0,
949 + "y": 14
950 + },
951 + "id": 51,
952 + "links": [],
953 + "options": {
954 + "colorMode": "value",
955 + "graphMode": "area",
956 + "justifyMode": "auto",
957 + "orientation": "horizontal",
958 + "reduceOptions": {
959 + "calcs": ["sum"],
960 + "fields": "",
961 + "values": false
962 + },
963 + "text": {},
964 + "textMode": "auto",
965 + "wideLayout": true
966 + },
967 + "pluginVersion": "10.2.2",
968 + "targets": [
969 + {
970 + "bucketAggs": [
971 + {
972 + "$$hashKey": "object:331",
973 + "field": "timestamp",
974 + "id": "2",
975 + "settings": {
976 + "interval": "auto",
977 + "min_doc_count": 0,
978 + "trimEdges": 0
979 + },
980 + "type": "date_histogram"
981 + }
982 + ],
983 + "datasource": {
984 + "type": "elasticsearch",
985 + "uid": "replace_datasource_uid"
986 + },
987 + "metrics": [
988 + {
989 + "$$hashKey": "object:329",
990 + "field": "select field",
991 + "id": "1",
992 + "type": "count"
993 + }
994 + ],
995 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
996 + "refId": "A",
997 + "timeField": "timestamp"
998 + }
999 + ],
1000 + "title": "EVENTS (Total)",
1001 + "type": "stat"
1002 + },
1003 + {
1004 + "datasource": {
1005 + "type": "grafana-opensearch-datasource",
1006 + "uid": "replace_datasource_uid"
1007 + },
1008 + "fieldConfig": {
1009 + "defaults": {
1010 + "color": {
1011 + "mode": "thresholds"
1012 + },
1013 + "custom": {
1014 + "align": "auto",
1015 + "cellOptions": {
1016 + "type": "auto"
1017 + },
1018 + "inspect": false
1019 + },
1020 + "mappings": [],
1021 + "thresholds": {
1022 + "mode": "absolute",
1023 + "steps": [
1024 + {
1025 + "color": "orange",
1026 + "value": null
1027 + }
1028 + ]
1029 + }
1030 + },
1031 + "overrides": [
1032 + {
1033 + "matcher": {
1034 + "id": "byName",
1035 + "options": "Count"
1036 + },
1037 + "properties": [
1038 + {
1039 + "id": "displayName",
1040 + "value": "EVENTS"
1041 + },
1042 + {
1043 + "id": "unit",
1044 + "value": "short"
1045 + },
1046 + {
1047 + "id": "decimals",
1048 + "value": -1
1049 + },
1050 + {
1051 + "id": "custom.align"
1052 + }
1053 + ]
1054 + },
1055 + {
1056 + "matcher": {
1057 + "id": "byName",
1058 + "options": "AD ACCOUNT"
1059 + },
1060 + "properties": [
1061 + {
1062 + "id": "custom.width",
1063 + "value": 377
1064 + }
1065 + ]
1066 + }
1067 + ]
1068 + },
1069 + "gridPos": {
1070 + "h": 12,
1071 + "w": 7,
1072 + "x": 0,
1073 + "y": 20
1074 + },
1075 + "id": 63,
1076 + "options": {
1077 + "cellHeight": "sm",
1078 + "footer": {
1079 + "countRows": false,
1080 + "fields": "",
1081 + "reducer": ["sum"],
1082 + "show": false
1083 + },
1084 + "showHeader": true,
1085 + "sortBy": []
1086 + },
1087 + "pluginVersion": "10.2.2",
1088 + "targets": [
1089 + {
1090 + "bucketAggs": [
1091 + {
1092 + "fake": true,
1093 + "field": "data_office365_Directionality",
1094 + "id": "4",
1095 + "settings": {
1096 + "min_doc_count": 1,
1097 + "order": "desc",
1098 + "orderBy": "_count",
1099 + "size": "0"
1100 + },
1101 + "type": "terms"
1102 + }
1103 + ],
1104 + "datasource": {
1105 + "type": "elasticsearch",
1106 + "uid": "replace_datasource_uid"
1107 + },
1108 + "metrics": [
1109 + {
1110 + "field": "select field",
1111 + "id": "1",
1112 + "type": "count"
1113 + }
1114 + ],
1115 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1116 + "queryType": "lucene",
1117 + "refId": "A",
1118 + "timeField": "timestamp"
1119 + }
1120 + ],
1121 + "title": "EVENTS BY DIRECTION",
1122 + "transformations": [
1123 + {
1124 + "id": "organize",
1125 + "options": {
1126 + "excludeByName": {},
1127 + "indexByName": {},
1128 + "renameByName": {
1129 + "Count": "EVENTS",
1130 + "data_office365_ClientIP_country_code": "COUNTRY",
1131 + "data_office365_Directionality": "DIRECTION",
1132 + "data_office365_LogonError": "ERROR",
1133 + "data_office365_Operation": "WORKLOAD",
1134 + "data_office365_P1Sender": "SENDER",
1135 + "data_office365_UserId": "AD ACCOUNT"
1136 + }
1137 + }
1138 + }
1139 + ],
1140 + "type": "table"
1141 + },
1142 + {
1143 + "circleMaxSize": 30,
1144 + "circleMinSize": 2,
1145 + "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
1146 + "datasource": {
1147 + "type": "grafana-opensearch-datasource",
1148 + "uid": "replace_datasource_uid"
1149 + },
1150 + "decimals": 0,
1151 + "esMetric": "Count",
1152 + "gridPos": {
1153 + "h": 12,
1154 + "w": 7,
1155 + "x": 7,
1156 + "y": 20
1157 + },
1158 + "hideEmpty": false,
1159 + "hideZero": false,
1160 + "id": 50,
1161 + "initialZoom": 1,
1162 + "locationData": "countries",
1163 + "mapCenter": "(0°, 0°)",
1164 + "mapCenterLatitude": 0,
1165 + "mapCenterLongitude": 0,
1166 + "maxDataPoints": 1,
1167 + "mouseWheelZoom": false,
1168 + "showLegend": true,
1169 + "stickyLabels": false,
1170 + "tableQueryOptions": {
1171 + "geohashField": "geohash",
1172 + "latitudeField": "latitude",
1173 + "longitudeField": "longitude",
1174 + "metricField": "metric",
1175 + "queryType": "geohash"
1176 + },
1177 + "targets": [
1178 + {
1179 + "bucketAggs": [
1180 + {
1181 + "fake": true,
1182 + "field": "data_office365_SenderIp_country_code",
1183 + "id": "3",
1184 + "settings": {
1185 + "min_doc_count": 1,
1186 + "order": "desc",
1187 + "orderBy": "_term",
1188 + "size": "0"
1189 + },
1190 + "type": "terms"
1191 + },
1192 + {
1193 + "field": "timestamp",
1194 + "id": "2",
1195 + "settings": {
1196 + "interval": "auto",
1197 + "min_doc_count": 0,
1198 + "trimEdges": 0
1199 + },
1200 + "type": "date_histogram"
1201 + }
1202 + ],
1203 + "datasource": {
1204 + "type": "elasticsearch",
1205 + "uid": "replace_datasource_uid"
1206 + },
1207 + "metrics": [
1208 + {
1209 + "field": "select field",
1210 + "id": "1",
1211 + "type": "count"
1212 + }
1213 + ],
1214 + "query": "data_office365_Workload:ThreatIntelligence AND rule_level:$rule_level",
1215 + "queryType": "lucene",
1216 + "refId": "A",
1217 + "timeField": "timestamp"
1218 + }
1219 + ],
1220 + "thresholds": "0,10",
1221 + "title": "ALL EVENTS BY SENDER COUNTRY",
1222 + "type": "grafana-worldmap-panel",
1223 + "unitPlural": "",
1224 + "unitSingle": "",
1225 + "valueName": "total"
1226 + },
1227 + {
1228 + "datasource": {
1229 + "type": "grafana-opensearch-datasource",
1230 + "uid": "replace_datasource_uid"
1231 + },
1232 + "fieldConfig": {
1233 + "defaults": {
1234 + "color": {
1235 + "mode": "thresholds"
1236 + },
1237 + "custom": {
1238 + "align": "auto",
1239 + "cellOptions": {
1240 + "type": "auto"
1241 + },
1242 + "inspect": false
1243 + },
1244 + "mappings": [],
1245 + "thresholds": {
1246 + "mode": "absolute",
1247 + "steps": [
1248 + {
1249 + "color": "orange",
1250 + "value": null
1251 + }
1252 + ]
1253 + }
1254 + },
1255 + "overrides": [
1256 + {
1257 + "matcher": {
1258 + "id": "byName",
1259 + "options": "Count"
1260 + },
1261 + "properties": [
1262 + {
1263 + "id": "displayName",
1264 + "value": "EVENTS"
1265 + },
1266 + {
1267 + "id": "unit",
1268 + "value": "short"
1269 + },
1270 + {
1271 + "id": "decimals",
1272 + "value": -1
1273 + },
1274 + {
1275 + "id": "custom.align"
1276 + }
1277 + ]
1278 + },
1279 + {
1280 + "matcher": {
1281 + "id": "byName",
1282 + "options": "AD ACCOUNT"
1283 + },
1284 + "properties": [
1285 + {
1286 + "id": "custom.width",
1287 + "value": 377
1288 + }
1289 + ]
1290 + }
1291 + ]
1292 + },
1293 + "gridPos": {
1294 + "h": 12,
1295 + "w": 10,
1296 + "x": 14,
1297 + "y": 20
1298 + },
1299 + "id": 58,
1300 + "options": {
1301 + "cellHeight": "sm",
1302 + "footer": {
1303 + "countRows": false,
1304 + "fields": "",
1305 + "reducer": ["sum"],
1306 + "show": false
1307 + },
1308 + "showHeader": true,
1309 + "sortBy": []
1310 + },
1311 + "pluginVersion": "10.2.2",
1312 + "targets": [
1313 + {
1314 + "bucketAggs": [
1315 + {
1316 + "fake": true,
1317 + "field": "data_office365_P1Sender",
1318 + "id": "4",
1319 + "settings": {
1320 + "min_doc_count": 1,
1321 + "order": "desc",
1322 + "orderBy": "_count",
1323 + "size": "0"
1324 + },
1325 + "type": "terms"
1326 + }
1327 + ],
1328 + "datasource": {
1329 + "type": "elasticsearch",
1330 + "uid": "replace_datasource_uid"
1331 + },
1332 + "metrics": [
1333 + {
1334 + "field": "select field",
1335 + "id": "1",
1336 + "type": "count"
1337 + }
1338 + ],
1339 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1340 + "queryType": "lucene",
1341 + "refId": "A",
1342 + "timeField": "timestamp"
1343 + }
1344 + ],
1345 + "title": "EVENTS BY SENDER",
1346 + "transformations": [
1347 + {
1348 + "id": "organize",
1349 + "options": {
1350 + "excludeByName": {},
1351 + "indexByName": {},
1352 + "renameByName": {
1353 + "Count": "EVENTS",
1354 + "data_office365_ClientIP_country_code": "COUNTRY",
1355 + "data_office365_LogonError": "ERROR",
1356 + "data_office365_Operation": "WORKLOAD",
1357 + "data_office365_P1Sender": "SENDER",
1358 + "data_office365_UserId": "AD ACCOUNT"
1359 + }
1360 + }
1361 + }
1362 + ],
1363 + "type": "table"
1364 + },
1365 + {
1366 + "datasource": {
1367 + "type": "grafana-opensearch-datasource",
1368 + "uid": "replace_datasource_uid"
1369 + },
1370 + "fieldConfig": {
1371 + "defaults": {
1372 + "color": {
1373 + "mode": "thresholds"
1374 + },
1375 + "custom": {
1376 + "align": "auto",
1377 + "cellOptions": {
1378 + "type": "auto"
1379 + },
1380 + "filterable": true,
1381 + "inspect": false
1382 + },
1383 + "mappings": [],
1384 + "thresholds": {
1385 + "mode": "absolute",
1386 + "steps": [
1387 + {
1388 + "color": "green",
1389 + "value": null
1390 + },
1391 + {
1392 + "color": "red",
1393 + "value": 80
1394 + }
1395 + ]
1396 + }
1397 + },
1398 + "overrides": [
1399 + {
1400 + "matcher": {
1401 + "id": "byName",
1402 + "options": "rule_level"
1403 + },
1404 + "properties": [
1405 + {
1406 + "id": "displayName",
1407 + "value": "RULE LEVEL"
1408 + },
1409 + {
1410 + "id": "unit",
1411 + "value": "short"
1412 + },
1413 + {
1414 + "id": "decimals",
1415 + "value": -1
1416 + },
1417 + {
1418 + "id": "custom.cellOptions",
1419 + "value": {
1420 + "mode": "gradient",
1421 + "type": "color-background"
1422 + }
1423 + },
1424 + {
1425 + "id": "custom.align"
1426 + },
1427 + {
1428 + "id": "thresholds",
1429 + "value": {
1430 + "mode": "absolute",
1431 + "steps": [
1432 + {
1433 + "color": "#37872D",
1434 + "value": null
1435 + },
1436 + {
1437 + "color": "rgba(237, 129, 40, 0.89)",
1438 + "value": 7
1439 + },
1440 + {
1441 + "color": "rgba(245, 54, 54, 0.9)",
1442 + "value": 12
1443 + }
1444 + ]
1445 + }
1446 + }
1447 + ]
1448 + },
1449 + {
1450 + "matcher": {
1451 + "id": "byName",
1452 + "options": "Date/Time"
1453 + },
1454 + "properties": [
1455 + {
1456 + "id": "custom.width",
1457 + "value": 242
1458 + }
1459 + ]
1460 + },
1461 + {
1462 + "matcher": {
1463 + "id": "byName",
1464 + "options": "MITRE TACTIC"
1465 + },
1466 + "properties": [
1467 + {
1468 + "id": "custom.width",
1469 + "value": 332
1470 + }
1471 + ]
1472 + },
1473 + {
1474 + "matcher": {
1475 + "id": "byName",
1476 + "options": "IP ADDRESS"
1477 + },
1478 + "properties": [
1479 + {
1480 + "id": "custom.width",
1481 + "value": 163
1482 + }
1483 + ]
1484 + },
1485 + {
1486 + "matcher": {
1487 + "id": "byName",
1488 + "options": "MITRE TECHNIQUE"
1489 + },
1490 + "properties": [
1491 + {
1492 + "id": "custom.width",
1493 + "value": 312
1494 + }
1495 + ]
1496 + },
1497 + {
1498 + "matcher": {
1499 + "id": "byName",
1500 + "options": "EVENT ID"
1501 + },
1502 + "properties": [
1503 + {
1504 + "id": "links",
1505 + "value": [
1506 + {
1507 + "targetBlank": true,
1508 + "title": "VIEW EVENT DETAILS",
1509 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22O365%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1510 + }
1511 + ]
1512 + },
1513 + {
1514 + "id": "custom.width",
1515 + "value": 265
1516 + }
1517 + ]
1518 + },
1519 + {
1520 + "matcher": {
1521 + "id": "byName",
1522 + "options": "RESULT"
1523 + },
1524 + "properties": [
1525 + {
1526 + "id": "custom.width",
1527 + "value": 118
1528 + },
1529 + {
1530 + "id": "mappings",
1531 + "value": [
1532 + {
1533 + "options": {
1534 + "Failed": {
1535 + "color": "orange",
1536 + "index": 1
1537 + },
1538 + "Success": {
1539 + "color": "green",
1540 + "index": 0
1541 + }
1542 + },
1543 + "type": "value"
1544 + }
1545 + ]
1546 + },
1547 + {
1548 + "id": "custom.cellOptions",
1549 + "value": {
1550 + "type": "color-text"
1551 + }
1552 + }
1553 + ]
1554 + },
1555 + {
1556 + "matcher": {
1557 + "id": "byName",
1558 + "options": "SRC IP"
1559 + },
1560 + "properties": [
1561 + {
1562 + "id": "custom.width",
1563 + "value": 265
1564 + }
1565 + ]
1566 + },
1567 + {
1568 + "matcher": {
1569 + "id": "byName",
1570 + "options": "ACCOUNT"
1571 + },
1572 + "properties": [
1573 + {
1574 + "id": "custom.width",
1575 + "value": 227
1576 + }
1577 + ]
1578 + },
1579 + {
1580 + "matcher": {
1581 + "id": "byName",
1582 + "options": "EVENT TIME"
1583 + },
1584 + "properties": [
1585 + {
1586 + "id": "custom.width",
1587 + "value": 195
1588 + }
1589 + ]
1590 + },
1591 + {
1592 + "matcher": {
1593 + "id": "byName",
1594 + "options": "CLIENT IP"
1595 + },
1596 + "properties": [
1597 + {
1598 + "id": "custom.width",
1599 + "value": 229
1600 + }
1601 + ]
1602 + },
1603 + {
1604 + "matcher": {
1605 + "id": "byName",
1606 + "options": "DESCRIPTION"
1607 + },
1608 + "properties": [
1609 + {
1610 + "id": "custom.width",
1611 + "value": 491
1612 + }
1613 + ]
1614 + }
1615 + ]
1616 + },
1617 + "gridPos": {
1618 + "h": 16,
1619 + "w": 24,
1620 + "x": 0,
1621 + "y": 32
1622 + },
1623 + "id": 27,
1624 + "options": {
1625 + "cellHeight": "sm",
1626 + "footer": {
1627 + "countRows": false,
1628 + "enablePagination": true,
1629 + "fields": "",
1630 + "reducer": ["sum"],
1631 + "show": false
1632 + },
1633 + "showHeader": true,
1634 + "sortBy": []
1635 + },
1636 + "pluginVersion": "10.2.2",
1637 + "targets": [
1638 + {
1639 + "bucketAggs": [],
1640 + "datasource": {
1641 + "type": "elasticsearch",
1642 + "uid": "replace_datasource_uid"
1643 + },
1644 + "metrics": [
1645 + {
1646 + "id": "1",
1647 + "settings": {
1648 + "size": "250"
1649 + },
1650 + "type": "raw_data"
1651 + }
1652 + ],
1653 + "query": "data_office365_Operation:$operation AND rule_level:$rule_level",
1654 + "queryType": "lucene",
1655 + "refId": "A",
1656 + "timeField": "timestamp"
1657 + }
1658 + ],
1659 + "title": "EVENTS",
1660 + "transformations": [
1661 + {
1662 + "id": "organize",
1663 + "options": {
1664 + "excludeByName": {
1665 + "@metadata_beat": true,
1666 + "@metadata_type": true,
1667 + "@metadata_version": true,
1668 + "IMPHASH": true,
1669 + "MD5": true,
1670 + "SHA1": true,
1671 + "SHA256": true,
1672 + "_id": false,
1673 + "_index": true,
1674 + "_type": true,
1675 + "agent_ephemeral_id": true,
1676 + "agent_hostname": true,
1677 + "agent_id": true,
1678 + "agent_ip_city_name": true,
1679 + "agent_ip_country_code": true,
1680 + "agent_ip_geolocation": true,
1681 + "agent_name": true,
1682 + "agent_type": true,
1683 + "agent_version": true,
1684 + "beats_type": true,
1685 + "cluster_name": true,
1686 + "cluster_node": true,
1687 + "collector_node_id": true,
1688 + "data_alert_action": true,
1689 + "data_alert_category": true,
1690 + "data_alert_gid": true,
1691 + "data_alert_rev": true,
1692 + "data_alert_severity": true,
1693 + "data_alert_signature": true,
1694 + "data_alert_signature_id": true,
1695 + "data_app_proto": true,
1696 + "data_audit_auid": true,
1697 + "data_audit_command": true,
1698 + "data_audit_euid": true,
1699 + "data_audit_exe": true,
1700 + "data_audit_gid": true,
1701 + "data_audit_id": true,
1702 + "data_audit_pid": true,
1703 + "data_audit_res": true,
1704 + "data_audit_session": true,
1705 + "data_audit_type": true,
1706 + "data_audit_uid": true,
1707 + "data_dest_ip": true,
1708 + "data_dest_port": true,
1709 + "data_dstuser": true,
1710 + "data_event_type": true,
1711 + "data_extra_data": true,
1712 + "data_file": true,
1713 + "data_flow_bytes_toclient": true,
1714 + "data_flow_bytes_toserver": true,
1715 + "data_flow_id": true,
1716 + "data_flow_pkts_toclient": true,
1717 + "data_flow_pkts_toserver": true,
1718 + "data_flow_start": true,
1719 + "data_http_http_content_type": true,
1720 + "data_http_http_port": true,
1721 + "data_http_length": true,
1722 + "data_http_status": true,
1723 + "data_http_url": true,
1724 + "data_id": true,
1725 + "data_in_iface": true,
1726 + "data_integration": true,
1727 + "data_metadata_flowbits": true,
1728 + "data_metadata_flowints_http_anomaly_count": true,
1729 + "data_metadata_flowints_tcp_retransmission_count": true,
1730 + "data_office365_AADGroupId": true,
1731 + "data_office365_Actor": true,
1732 + "data_office365_ActorContextId": true,
1733 + "data_office365_ActorIpAddress": false,
1734 + "data_office365_ActorIpAddress_city_name": true,
1735 + "data_office365_ActorIpAddress_country_code": true,
1736 + "data_office365_ActorIpAddress_geolocation": true,
1737 + "data_office365_AdditionalActionsAndResults": true,
1738 + "data_office365_AppAccessContext_APIId": true,
1739 + "data_office365_AppAccessContext_ClientAppId": true,
1740 + "data_office365_AppAccessContext_ClientAppName": true,
1741 + "data_office365_AppAccessContext_CorrelationId": true,
1742 + "data_office365_AppId": true,
1743 + "data_office365_ApplicationId": true,
1744 + "data_office365_ArtifactsShared": true,
1745 + "data_office365_AttachmentData": true,
1746 + "data_office365_Attendees": true,
1747 + "data_office365_AuthDetails": true,
1748 + "data_office365_AzureActiveDirectoryEventType": true,
1749 + "data_office365_ChannelGuid": true,
1750 + "data_office365_ChannelName": true,
1751 + "data_office365_ChatName": true,
1752 + "data_office365_ChatThreadId": true,
1753 + "data_office365_ClientAppId": true,
1754 + "data_office365_ClientIP": false,
1755 + "data_office365_ClientIPAddress": true,
1756 + "data_office365_ClientIPAddress_city_name": true,
1757 + "data_office365_ClientIPAddress_country_code": true,
1758 + "data_office365_ClientIPAddress_geolocation": true,
1759 + "data_office365_ClientIP_city_name": true,
1760 + "data_office365_ClientIP_country_code": true,
1761 + "data_office365_ClientIP_geolocation": true,
1762 + "data_office365_ClientInfoString": true,
1763 + "data_office365_ClientProcessName": true,
1764 + "data_office365_ClientRequestId": true,
1765 + "data_office365_ClientVersion": true,
1766 + "data_office365_CommunicationSubType": true,
1767 + "data_office365_CommunicationType": true,
1768 + "data_office365_ContactEmail1DisplayName": true,
1769 + "data_office365_ContactEmail1EmailAddress": true,
1770 + "data_office365_CreationTime": false,
1771 + "data_office365_CrossMailboxOperation": true,
1772 + "data_office365_DeliveryAction": false,
1773 + "data_office365_DestFolder_Id": true,
1774 + "data_office365_DestFolder_Path": true,
1775 + "data_office365_DetectionMethod": false,
1776 + "data_office365_DetectionType": true,
1777 + "data_office365_DeviceId": true,
1778 + "data_office365_DeviceInformation": true,
1779 + "data_office365_DeviceProperties": true,
1780 + "data_office365_Directionality": true,
1781 + "data_office365_EndTime": true,
1782 + "data_office365_ErrorNumber": true,
1783 + "data_office365_EventDeepLink": true,
1784 + "data_office365_ExchangeId": true,
1785 + "data_office365_ExtendedProperties": true,
1786 + "data_office365_ExternalAccess": true,
1787 + "data_office365_ExtraProperties": true,
1788 + "data_office365_Folder_Id": true,
1789 + "data_office365_Folder_Path": true,
1790 + "data_office365_Folders": true,
1791 + "data_office365_HostedContents": true,
1792 + "data_office365_ICalUid": true,
1793 + "data_office365_Id": true,
1794 + "data_office365_InterSystemsId": true,
1795 + "data_office365_InternalLogonType": true,
1796 + "data_office365_InternetMessageId": true,
1797 + "data_office365_IntraSystemId": true,
1798 + "data_office365_ItemName": true,
1799 + "data_office365_Item_Id": true,
1800 + "data_office365_Item_InternetMessageId": true,
1801 + "data_office365_Item_IsRecord": true,
1802 + "data_office365_Item_ParentFolder_Id": true,
1803 + "data_office365_Item_ParentFolder_Name": true,
1804 + "data_office365_Item_SizeInBytes": true,
1805 + "data_office365_JoinTime": true,
1806 + "data_office365_LatestDeliveryLocation": true,
1807 + "data_office365_LeaveTime": true,
1808 + "data_office365_LogonError": true,
1809 + "data_office365_LogonType": true,
1810 + "data_office365_LogonUserSid": true,
1811 + "data_office365_MailboxGuid": true,
1812 + "data_office365_MailboxOwnerMasterAccountSid": true,
1813 + "data_office365_MailboxOwnerSid": true,
1814 + "data_office365_MailboxOwnerUPN": true,
1815 + "data_office365_MeetingDetailId": true,
1816 + "data_office365_MeetingURL": true,
1817 + "data_office365_Members": true,
1818 + "data_office365_MessageId": true,
1819 + "data_office365_MessageSizeInBytes": true,
1820 + "data_office365_MessageTime": true,
1821 + "data_office365_MessageURLs": true,
1822 + "data_office365_MessageVersion": true,
1823 + "data_office365_Modalities": true,
1824 + "data_office365_ModifiedProperties": true,
1825 + "data_office365_Name": true,
1826 + "data_office365_NetworkMessageId": true,
1827 + "data_office365_NewValue": true,
1828 + "data_office365_ObjectId": true,
1829 + "data_office365_Operation": true,
1830 + "data_office365_OperationCount": true,
1831 + "data_office365_OperationProperties": true,
1832 + "data_office365_OperationScope": true,
1833 + "data_office365_OrganizationId": true,
1834 + "data_office365_OrganizationName": true,
1835 + "data_office365_Organizer_OrganizationId": true,
1836 + "data_office365_Organizer_RecipientType": true,
1837 + "data_office365_Organizer_Role": true,
1838 + "data_office365_Organizer_UserObjectId": true,
1839 + "data_office365_OriginalDeliveryLocation": true,
1840 + "data_office365_OriginatingServer": true,
1841 + "data_office365_P1Sender": true,
1842 + "data_office365_P2Sender": true,
1843 + "data_office365_Parameters": true,
1844 + "data_office365_ParentMessageId": true,
1845 + "data_office365_PhishConfidenceLevel": true,
1846 + "data_office365_Policy": true,
1847 + "data_office365_PolicyAction": true,
1848 + "data_office365_ProviderTypes": true,
1849 + "data_office365_Recipients": false,
1850 + "data_office365_RecordType": true,
1851 + "data_office365_ResultStatus": true,
1852 + "data_office365_SendAsUserMailboxGuid": true,
1853 + "data_office365_SendAsUserSmtp": true,
1854 + "data_office365_SenderIp_city_name": true,
1855 + "data_office365_SenderIp_geolocation": true,
1856 + "data_office365_SessionId": true,
1857 + "data_office365_StartTime": true,
1858 + "data_office365_Subject": true,
1859 + "data_office365_Subscription": true,
1860 + "data_office365_SubscriptionId": true,
1861 + "data_office365_SystemOverrides": true,
1862 + "data_office365_Target": true,
1863 + "data_office365_TargetContextId": true,
1864 + "data_office365_TeamGuid": true,
1865 + "data_office365_TeamName": true,
1866 + "data_office365_ThreatsAndDetectionTech": true,
1867 + "data_office365_UserId": false,
1868 + "data_office365_UserKey": true,
1869 + "data_office365_UserType": true,
1870 + "data_office365_Verdict": true,
1871 + "data_office365_Version": true,
1872 + "data_office365_Workload": true,
1873 + "data_osquery_action": true,
1874 + "data_osquery_calendarTime": true,
1875 + "data_osquery_columns_address": true,
1876 + "data_osquery_columns_address_city_name": true,
1877 + "data_osquery_columns_address_country_code": true,
1878 + "data_osquery_columns_address_geolocation": true,
1879 + "data_osquery_columns_cmdline": true,
1880 + "data_osquery_columns_cwd": true,
1881 + "data_osquery_columns_description": true,
1882 + "data_osquery_columns_directory": true,
1883 + "data_osquery_columns_disk_bytes_read": true,
1884 + "data_osquery_columns_disk_bytes_written": true,
1885 + "data_osquery_columns_egid": true,
1886 + "data_osquery_columns_euid": true,
1887 + "data_osquery_columns_family": true,
1888 + "data_osquery_columns_fd": true,
1889 + "data_osquery_columns_gid": true,
1890 + "data_osquery_columns_gid_signed": true,
1891 + "data_osquery_columns_host": true,
1892 + "data_osquery_columns_interface": true,
1893 + "data_osquery_columns_local_address": true,
1894 + "data_osquery_columns_local_address_city_name": true,
1895 + "data_osquery_columns_local_address_country_code": true,
1896 + "data_osquery_columns_local_address_geolocation": true,
1897 + "data_osquery_columns_local_port": true,
1898 + "data_osquery_columns_mac": true,
1899 + "data_osquery_columns_name": true,
1900 + "data_osquery_columns_net_namespace": true,
1901 + "data_osquery_columns_nice": true,
1902 + "data_osquery_columns_on_disk": true,
1903 + "data_osquery_columns_parent": true,
1904 + "data_osquery_columns_path": true,
1905 + "data_osquery_columns_pgroup": true,
1906 + "data_osquery_columns_pid": true,
1907 + "data_osquery_columns_port": true,
1908 + "data_osquery_columns_protocol": true,
1909 + "data_osquery_columns_remote_address": true,
1910 + "data_osquery_columns_remote_address_city_name": true,
1911 + "data_osquery_columns_remote_address_country_code": true,
1912 + "data_osquery_columns_remote_address_geolocation": true,
1913 + "data_osquery_columns_remote_port": true,
1914 + "data_osquery_columns_resident_size": true,
1915 + "data_osquery_columns_root": true,
1916 + "data_osquery_columns_sgid": true,
1917 + "data_osquery_columns_shell": true,
1918 + "data_osquery_columns_socket": true,
1919 + "data_osquery_columns_start_time": true,
1920 + "data_osquery_columns_state": true,
1921 + "data_osquery_columns_suid": true,
1922 + "data_osquery_columns_system_time": true,
1923 + "data_osquery_columns_threads": true,
1924 + "data_osquery_columns_time_utc": true,
1925 + "data_osquery_columns_total_size": true,
1926 + "data_osquery_columns_tty": true,
1927 + "data_osquery_columns_type": true,
1928 + "data_osquery_columns_uid": true,
1929 + "data_osquery_columns_uid_signed": true,
1930 + "data_osquery_columns_user": true,
1931 + "data_osquery_columns_user_time": true,
1932 + "data_osquery_columns_username": true,
1933 + "data_osquery_columns_wired_size": true,
1934 + "data_osquery_counter": true,
1935 + "data_osquery_decorations_host_uuid": true,
1936 + "data_osquery_decorations_hostname": true,
1937 + "data_osquery_epoch": true,
1938 + "data_osquery_hostIdentifier": true,
1939 + "data_osquery_name": true,
1940 + "data_osquery_numerics": true,
1941 + "data_osquery_unixTime": true,
1942 + "data_proto": true,
1943 + "data_sca_check_command": true,
1944 + "data_sca_check_compliance_cis": true,
1945 + "data_sca_check_compliance_cis_csc": true,
1946 + "data_sca_check_compliance_gdpr_IV": true,
1947 + "data_sca_check_compliance_gpg_13": true,
1948 + "data_sca_check_compliance_hipaa": true,
1949 + "data_sca_check_compliance_nist_800_53": true,
1950 + "data_sca_check_compliance_pci_dss": true,
1951 + "data_sca_check_compliance_tsc": true,
1952 + "data_sca_check_description": true,
1953 + "data_sca_check_id": true,
1954 + "data_sca_check_previous_result": true,
1955 + "data_sca_check_rationale": true,
1956 + "data_sca_check_remediation": true,
1957 + "data_sca_check_result": true,
1958 + "data_sca_check_title": true,
1959 + "data_sca_description": true,
1960 + "data_sca_failed": true,
1961 + "data_sca_file": true,
1962 + "data_sca_invalid": true,
1963 + "data_sca_passed": true,
1964 + "data_sca_policy": true,
1965 + "data_sca_policy_id": true,
1966 + "data_sca_scan_id": true,
1967 + "data_sca_score": true,
1968 + "data_sca_total_checks": true,
1969 + "data_sca_type": true,
1970 + "data_script": true,
1971 + "data_src_ip": true,
1972 + "data_src_ip_city_name": true,
1973 + "data_src_ip_country_code": true,
1974 + "data_src_ip_geolocation": true,
1975 + "data_src_port": true,
1976 + "data_srcip": true,
1977 + "data_srcip_city_name": true,
1978 + "data_srcip_country_code": true,
1979 + "data_srcip_geolocation": true,
1980 + "data_srcuser": true,
1981 + "data_timestamp": true,
1982 + "data_title": true,
1983 + "data_tls_session_resumed": true,
1984 + "data_tls_version": true,
1985 + "data_tx_id": true,
1986 + "data_type": true,
1987 + "data_win_eventXML_binaryData": true,
1988 + "data_win_eventXML_binaryDataSize": true,
1989 + "data_win_eventXML_param1": true,
1990 + "data_win_eventdata_authenticationPackageName": true,
1991 + "data_win_eventdata_callTrace": true,
1992 + "data_win_eventdata_commandLine": true,
1993 + "data_win_eventdata_company": true,
1994 + "data_win_eventdata_creationUtcTime": true,
1995 + "data_win_eventdata_currentDirectory": true,
1996 + "data_win_eventdata_description": true,
1997 + "data_win_eventdata_destinationHostname": true,
1998 + "data_win_eventdata_destinationIp": true,
1999 + "data_win_eventdata_destinationIp_city_name": true,
2000 + "data_win_eventdata_destinationIp_country_code": true,
2001 + "data_win_eventdata_destinationIp_geolocation": true,
2002 + "data_win_eventdata_destinationIsIpv6": true,
2003 + "data_win_eventdata_destinationPort": true,
2004 + "data_win_eventdata_destinationPortName": true,
2005 + "data_win_eventdata_details": true,
2006 + "data_win_eventdata_elevatedToken": true,
2007 + "data_win_eventdata_eventType": true,
2008 + "data_win_eventdata_fileVersion": true,
2009 + "data_win_eventdata_fileVersion_city_name": true,
2010 + "data_win_eventdata_fileVersion_country_code": true,
2011 + "data_win_eventdata_fileVersion_geolocation": true,
2012 + "data_win_eventdata_grantedAccess": true,
2013 + "data_win_eventdata_hashes": true,
2014 + "data_win_eventdata_image": true,
2015 + "data_win_eventdata_imageLoaded": true,
2016 + "data_win_eventdata_impersonationLevel": true,
2017 + "data_win_eventdata_initiated": true,
2018 + "data_win_eventdata_integrityLevel": true,
2019 + "data_win_eventdata_ipAddress": true,
2020 + "data_win_eventdata_ipPort": true,
2021 + "data_win_eventdata_keyLength": true,
2022 + "data_win_eventdata_logonGuid": true,
2023 + "data_win_eventdata_logonId": true,
2024 + "data_win_eventdata_logonProcessName": true,
2025 + "data_win_eventdata_logonType": true,
2026 + "data_win_eventdata_originalFileName": true,
2027 + "data_win_eventdata_param1": true,
2028 + "data_win_eventdata_param2": true,
2029 + "data_win_eventdata_param3": true,
2030 + "data_win_eventdata_param4": true,
2031 + "data_win_eventdata_parentCommandLine": true,
2032 + "data_win_eventdata_parentImage": true,
2033 + "data_win_eventdata_parentProcessGuid": true,
2034 + "data_win_eventdata_parentProcessId": true,
2035 + "data_win_eventdata_processGuid": true,
2036 + "data_win_eventdata_processId": true,
2037 + "data_win_eventdata_processName": true,
2038 + "data_win_eventdata_product": true,
2039 + "data_win_eventdata_protocol": true,
2040 + "data_win_eventdata_queryName": true,
2041 + "data_win_eventdata_queryResults": true,
2042 + "data_win_eventdata_queryStatus": true,
2043 + "data_win_eventdata_ruleName": true,
2044 + "data_win_eventdata_serviceName": true,
2045 + "data_win_eventdata_serviceSid": true,
2046 + "data_win_eventdata_signature": true,
2047 + "data_win_eventdata_signatureStatus": true,
2048 + "data_win_eventdata_signed": true,
2049 + "data_win_eventdata_sourceHostname": true,
2050 + "data_win_eventdata_sourceImage": true,
2051 + "data_win_eventdata_sourceIp": true,
2052 + "data_win_eventdata_sourceIp_city_name": true,
2053 + "data_win_eventdata_sourceIp_country_code": true,
2054 + "data_win_eventdata_sourceIp_geolocation": true,
2055 + "data_win_eventdata_sourceIsIpv6": true,
2056 + "data_win_eventdata_sourcePort": true,
2057 + "data_win_eventdata_sourceProcessGUID": true,
2058 + "data_win_eventdata_sourceProcessId": true,
2059 + "data_win_eventdata_sourceThreadId": true,
2060 + "data_win_eventdata_status": true,
2061 + "data_win_eventdata_subjectDomainName": true,
2062 + "data_win_eventdata_subjectLogonId": true,
2063 + "data_win_eventdata_subjectUserName": true,
2064 + "data_win_eventdata_subjectUserSid": true,
2065 + "data_win_eventdata_targetDomainName": true,
2066 + "data_win_eventdata_targetFilename": true,
2067 + "data_win_eventdata_targetImage": true,
2068 + "data_win_eventdata_targetLinkedLogonId": true,
2069 + "data_win_eventdata_targetLogonId": true,
2070 + "data_win_eventdata_targetObject": true,
2071 + "data_win_eventdata_targetProcessGUID": true,
2072 + "data_win_eventdata_targetProcessId": true,
2073 + "data_win_eventdata_targetUserName": true,
2074 + "data_win_eventdata_targetUserSid": true,
2075 + "data_win_eventdata_terminalSessionId": true,
2076 + "data_win_eventdata_ticketEncryptionType": true,
2077 + "data_win_eventdata_ticketOptions": true,
2078 + "data_win_eventdata_user": true,
2079 + "data_win_eventdata_utcTime": true,
2080 + "data_win_eventdata_virtualAccount": true,
2081 + "data_win_system_channel": true,
2082 + "data_win_system_computer": true,
2083 + "data_win_system_eventID": true,
2084 + "data_win_system_eventRecordID": true,
2085 + "data_win_system_eventSourceName": true,
2086 + "data_win_system_keywords": true,
2087 + "data_win_system_level": true,
2088 + "data_win_system_message": true,
2089 + "data_win_system_opcode": true,
2090 + "data_win_system_processID": true,
2091 + "data_win_system_providerGuid": true,
2092 + "data_win_system_providerName": true,
2093 + "data_win_system_severityValue": true,
2094 + "data_win_system_systemTime": true,
2095 + "data_win_system_task": true,
2096 + "data_win_system_threadID": true,
2097 + "data_win_system_version": true,
2098 + "decoder_name": true,
2099 + "decoder_parent": true,
2100 + "dns_query": true,
2101 + "dns_query_threat_indicated": true,
2102 + "dst_ip": true,
2103 + "dst_ip_city_name": true,
2104 + "dst_ip_country_code": true,
2105 + "dst_ip_geolocation": true,
2106 + "dst_ip_threat_indicated": true,
2107 + "dst_port": true,
2108 + "ecs_version": true,
2109 + "error": true,
2110 + "event_hash": true,
2111 + "file_path": true,
2112 + "firewall_rule_name": true,
2113 + "full_log": false,
2114 + "gl2_accounted_message_size": true,
2115 + "gl2_message_id": true,
2116 + "gl2_processing_error": true,
2117 + "gl2_remote_ip": true,
2118 + "gl2_remote_port": true,
2119 + "gl2_source_collector": true,
2120 + "gl2_source_input": true,
2121 + "gl2_source_node": true,
2122 + "hash_md5": true,
2123 + "hash_sha1": true,
2124 + "hash_sha256": true,
2125 + "highlight": true,
2126 + "host_architecture": true,
2127 + "host_containerized": true,
2128 + "host_hostname": true,
2129 + "host_id": true,
2130 + "host_ip": true,
2131 + "host_mac": true,
2132 + "host_name": true,
2133 + "host_os_codename": true,
2134 + "host_os_kernel": true,
2135 + "host_os_name": true,
2136 + "host_os_platform": true,
2137 + "host_os_version": true,
2138 + "hostname": true,
2139 + "id": true,
2140 + "input_type": true,
2141 + "level": true,
2142 + "location": true,
2143 + "log_file_path": true,
2144 + "log_offset": true,
2145 + "manager_name": true,
2146 + "message": true,
2147 + "module": true,
2148 + "msg_timestamp": true,
2149 + "parent_process_cmd_line": true,
2150 + "parent_process_id": true,
2151 + "parent_process_image": true,
2152 + "pid": true,
2153 + "predecoder_hostname": true,
2154 + "predecoder_program_name": true,
2155 + "predecoder_timestamp": true,
2156 + "previous_log": true,
2157 + "previous_output": true,
2158 + "process_cmd_line": true,
2159 + "process_id": true,
2160 + "process_image": true,
2161 + "process_name": true,
2162 + "protocol": true,
2163 + "rule_cis": true,
2164 + "rule_cis_csc": true,
2165 + "rule_firedtimes": true,
2166 + "rule_gdpr": true,
2167 + "rule_gdpr_IV": true,
2168 + "rule_gpg13": true,
2169 + "rule_gpg_13": true,
2170 + "rule_group1": true,
2171 + "rule_group2": true,
2172 + "rule_groups": true,
2173 + "rule_hipaa": true,
2174 + "rule_id": true,
2175 + "rule_info": true,
2176 + "rule_mail": true,
2177 + "rule_mitre_id": true,
2178 + "rule_mitre_tactic": false,
2179 + "rule_nist_800_53": true,
2180 + "rule_pci_dss": true,
2181 + "rule_tsc": true,
2182 + "scanid": true,
2183 + "service": true,
2184 + "software_package": true,
2185 + "software_vendor": true,
2186 + "sort": true,
2187 + "source": true,
2188 + "source_reserved_ip": true,
2189 + "src_ip": true,
2190 + "src_ip_city_name": true,
2191 + "src_ip_country_code": true,
2192 + "src_ip_geolocation": true,
2193 + "src_port": true,
2194 + "streams": true,
2195 + "syscheck_attrs_after": true,
2196 + "syscheck_audit_effective_user_id": true,
2197 + "syscheck_audit_effective_user_name": true,
2198 + "syscheck_audit_group_id": true,
2199 + "syscheck_audit_group_name": true,
2200 + "syscheck_audit_login_user_id": true,
2201 + "syscheck_audit_login_user_name": true,
2202 + "syscheck_audit_process_cwd": true,
2203 + "syscheck_audit_process_id": true,
2204 + "syscheck_audit_process_name": true,
2205 + "syscheck_audit_process_parent_cwd": true,
2206 + "syscheck_audit_process_parent_name": true,
2207 + "syscheck_audit_process_ppid": true,
2208 + "syscheck_audit_user_id": true,
2209 + "syscheck_audit_user_name": true,
2210 + "syscheck_changed_attributes": true,
2211 + "syscheck_event": true,
2212 + "syscheck_gid_after": true,
2213 + "syscheck_gname_after": true,
2214 + "syscheck_hard_links": true,
2215 + "syscheck_inode_after": true,
2216 + "syscheck_inode_before": true,
2217 + "syscheck_md5_after": true,
2218 + "syscheck_md5_before": true,
2219 + "syscheck_mode": true,
2220 + "syscheck_mtime_after": true,
2221 + "syscheck_mtime_before": true,
2222 + "syscheck_path": true,
2223 + "syscheck_perm_after": true,
2224 + "syscheck_perm_before": true,
2225 + "syscheck_sha1_after": true,
2226 + "syscheck_sha1_before": true,
2227 + "syscheck_sha256_after": true,
2228 + "syscheck_sha256_before": true,
2229 + "syscheck_size_after": true,
2230 + "syscheck_size_before": true,
2231 + "syscheck_uid_after": true,
2232 + "syscheck_uname_after": true,
2233 + "syscheck_win_perm_after": true,
2234 + "syscheck_win_perm_after_0_allowed": true,
2235 + "syscheck_win_perm_after_0_name": true,
2236 + "syscheck_win_perm_after_1_allowed": true,
2237 + "syscheck_win_perm_after_1_name": true,
2238 + "syscheck_win_perm_after_2_allowed": true,
2239 + "syscheck_win_perm_after_2_name": true,
2240 + "syscheck_win_perm_after_3_allowed": true,
2241 + "syscheck_win_perm_after_3_name": true,
2242 + "syslog_customer": true,
2243 + "syslog_level": true,
2244 + "syslog_tag": true,
2245 + "syslog_type": true,
2246 + "sysmon_event_description": true,
2247 + "threat_ids": true,
2248 + "threat_indicated": true,
2249 + "threat_names": true,
2250 + "time": true,
2251 + "timestamp": true,
2252 + "timestamp_utc": true,
2253 + "true": true,
2254 + "user_name": true,
2255 + "win_registry_key": true,
2256 + "win_system_eventID": true,
2257 + "windows_auth_package": true,
2258 + "windows_domain": true,
2259 + "windows_event_id": true,
2260 + "windows_event_severity": true,
2261 + "windows_logon_type": true
2262 + },
2263 + "indexByName": {
2264 + "_id": 2,
2265 + "_index": 8,
2266 + "_type": 9,
2267 + "agent_id": 10,
2268 + "agent_name": 4,
2269 + "cluster_name": 11,
2270 + "cluster_node": 12,
2271 + "data_integration": 43,
2272 + "data_office365_AdditionalActionsAndResults": 44,
2273 + "data_office365_AttachmentData": 45,
2274 + "data_office365_AuthDetails": 46,
2275 + "data_office365_CreationTime": 0,
2276 + "data_office365_DeliveryAction": 47,
2277 + "data_office365_DetectionMethod": 48,
2278 + "data_office365_DetectionType": 49,
2279 + "data_office365_Directionality": 50,
2280 + "data_office365_EventDeepLink": 51,
2281 + "data_office365_Id": 13,
2282 + "data_office365_InternetMessageId": 52,
2283 + "data_office365_LatestDeliveryLocation": 53,
2284 + "data_office365_MessageTime": 54,
2285 + "data_office365_NetworkMessageId": 55,
2286 + "data_office365_ObjectId": 14,
2287 + "data_office365_Operation": 20,
2288 + "data_office365_OrganizationId": 15,
2289 + "data_office365_OriginalDeliveryLocation": 56,
2290 + "data_office365_P1Sender": 57,
2291 + "data_office365_P2Sender": 58,
2292 + "data_office365_PhishConfidenceLevel": 59,
2293 + "data_office365_Recipients": 61,
2294 + "data_office365_RecordType": 16,
2295 + "data_office365_SenderIp": 60,
2296 + "data_office365_SenderIp_city_name": 62,
2297 + "data_office365_SenderIp_country_code": 63,
2298 + "data_office365_SenderIp_geolocation": 64,
2299 + "data_office365_Subject": 65,
2300 + "data_office365_Subscription": 66,
2301 + "data_office365_SystemOverrides": 67,
2302 + "data_office365_ThreatsAndDetectionTech": 68,
2303 + "data_office365_UserId": 3,
2304 + "data_office365_UserKey": 17,
2305 + "data_office365_UserType": 18,
2306 + "data_office365_Verdict": 69,
2307 + "data_office365_Version": 19,
2308 + "data_office365_Workload": 42,
2309 + "decoder_name": 21,
2310 + "gl2_accounted_message_size": 22,
2311 + "gl2_message_id": 23,
2312 + "gl2_processing_error": 24,
2313 + "gl2_remote_ip": 25,
2314 + "gl2_remote_port": 26,
2315 + "gl2_source_input": 27,
2316 + "gl2_source_node": 28,
2317 + "id": 29,
2318 + "location": 30,
2319 + "manager_name": 31,
2320 + "message": 32,
2321 + "rule_description": 5,
2322 + "rule_firedtimes": 33,
2323 + "rule_group1": 34,
2324 + "rule_group2": 70,
2325 + "rule_groups": 35,
2326 + "rule_hipaa": 71,
2327 + "rule_id": 7,
2328 + "rule_level": 6,
2329 + "rule_mail": 36,
2330 + "rule_pci_dss": 72,
2331 + "source": 37,
2332 + "source_reserved_ip": 73,
2333 + "streams": 38,
2334 + "syslog_level": 39,
2335 + "syslog_type": 40,
2336 + "timestamp": 1,
2337 + "timestamp_utc": 74,
2338 + "true": 41
2339 + },
2340 + "renameByName": {
2341 + "_id": "EVENT ID",
2342 + "agent_name": "",
2343 + "data_office365_ActorIpAddress": "SRC IP",
2344 + "data_office365_AffectedItems": "ITEMS",
2345 + "data_office365_ClientIP": "CLIENT IP",
2346 + "data_office365_ClientIP_city_name": "",
2347 + "data_office365_CreationTime": "EVENT TIME",
2348 + "data_office365_DeliveryAction": "DELIVERY ACTION",
2349 + "data_office365_DetectionMethod": "DETECTION",
2350 + "data_office365_DetectionType": "",
2351 + "data_office365_Item_Attachments": "ATTACHMENT",
2352 + "data_office365_Item_ParentFolder_Path": "FOLDER",
2353 + "data_office365_Item_Subject": "SUBJECT",
2354 + "data_office365_OperationProperties": "",
2355 + "data_office365_Recipients": "RCPTS",
2356 + "data_office365_ResultStatus": "RESULT",
2357 + "data_office365_SenderIp": "SENDER IP",
2358 + "data_office365_SenderIp_country_code": "COUNTRY",
2359 + "data_office365_Subject": "",
2360 + "data_office365_UserId": "ACCOUNT",
2361 + "rule_description": "DESCRIPTION",
2362 + "rule_id": "RULE ID",
2363 + "rule_level": "",
2364 + "rule_mitre_tactic": "MITRE TACTIC",
2365 + "rule_mitre_technique": "MITRE TECHNIQUE",
2366 + "timestamp": "Date/Time"
2367 + }
2368 + }
2369 + }
2370 + ],
2371 + "transparent": true,
2372 + "type": "table"
2373 + }
2374 + ],
2375 + "refresh": "",
2376 + "schemaVersion": 38,
2377 + "tags": ["O365"],
2378 + "templating": {
2379 + "list": [
2380 + {
2381 + "datasource": {
2382 + "type": "elasticsearch",
2383 + "uid": "replace_datasource_uid"
2384 + },
2385 + "filters": [],
2386 + "hide": 0,
2387 + "label": "",
2388 + "name": "Filters",
2389 + "skipUrlSync": false,
2390 + "type": "adhoc"
2391 + },
2392 + {
2393 + "current": {
2394 + "selected": false,
2395 + "text": "All",
2396 + "value": "$__all"
2397 + },
2398 + "datasource": {
2399 + "type": "elasticsearch",
2400 + "uid": "replace_datasource_uid"
2401 + },
2402 + "definition": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:ThreatIntelligence\"}",
2403 + "hide": 0,
2404 + "includeAll": true,
2405 + "label": "Operation",
2406 + "multi": false,
2407 + "name": "operation",
2408 + "options": [],
2409 + "query": "{ \"find\": \"terms\", \"field\": \"data_office365_Operation\", \"query\": \"data_office365_Workload:ThreatIntelligence\"}",
2410 + "refresh": 2,
2411 + "regex": "",
2412 + "skipUrlSync": false,
2413 + "sort": 1,
2414 + "tagValuesQuery": "",
2415 + "tagsQuery": "",
2416 + "type": "query",
2417 + "useTags": false
2418 + },
2419 + {
2420 + "current": {
2421 + "selected": false,
2422 + "text": "All",
2423 + "value": "$__all"
2424 + },
2425 + "datasource": {
2426 + "type": "elasticsearch",
2427 + "uid": "replace_datasource_uid"
2428 + },
2429 + "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2430 + "hide": 0,
2431 + "includeAll": true,
2432 + "label": "Rule Level",
2433 + "multi": false,
2434 + "name": "rule_level",
2435 + "options": [],
2436 + "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2437 + "refresh": 2,
2438 + "regex": "",
2439 + "skipUrlSync": false,
2440 + "sort": 0,
2441 + "type": "query"
2442 + }
2443 + ]
2444 + },
2445 + "time": {
2446 + "from": "now-6h",
2447 + "to": "now"
2448 + },
2449 + "timepicker": {
2450 + "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2451 + "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2452 + },
2453 + "timezone": "",
2454 + "title": "O365 - THREAT INTELLIGENCE",
2455 + "version": 5,
2456 + "weekStart": ""
2457 }
backend/app/connectors/graylog/schema/pipelines.py
+1
@@ -64,6 +64,7 @@ class CreatePipelineRule(BaseModel):
64 description: str
65 source: str
66
67 +
68 class CreatePipeline(BaseModel):
69 title: str
70 description: str
backend/app/connectors/graylog/services/pipelines.py
+6 -4
@@ -1,17 +1,17 @@
1 from fastapi import HTTPException
2 from loguru import logger
3
4 +from app.connectors.graylog.schema.pipelines import CreatePipeline
5 +from app.connectors.graylog.schema.pipelines import CreatePipelineRule
6 from app.connectors.graylog.schema.pipelines import GraylogPipelinesResponse
7 from app.connectors.graylog.schema.pipelines import Pipeline
8 from app.connectors.graylog.schema.pipelines import PipelineRule
9 from app.connectors.graylog.schema.pipelines import PipelineRulesResponse
8 -from app.connectors.graylog.schema.pipelines import CreatePipelineRule
9 -from app.connectors.graylog.schema.pipelines import CreatePipeline
10 +from app.connectors.graylog.utils.universal import send_get_request
11 +from app.connectors.graylog.utils.universal import send_post_request
12 from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineRequest
13 from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineResponse
14
13 -from app.connectors.graylog.utils.universal import send_get_request
14 -from app.connectors.graylog.utils.universal import send_post_request
15
16 async def get_pipelines() -> GraylogPipelinesResponse:
17 """Get pipelines from Graylog.
@@ -97,6 +97,7 @@ async def create_pipeline_rule(rule: CreatePipelineRule) -> None:
97 }
98 await send_post_request(endpoint=endpoint, data=data)
99
100 +
101 async def create_pipeline_graylog(pipeline: CreatePipeline) -> None:
102 """
103 Creates a pipeline with the given title in Graylog.
@@ -135,6 +136,7 @@ async def get_pipeline_id(subscription: str) -> str:
136 logger.error(f"Failed to get pipelines: {pipelines_response.message}")
137 raise HTTPException(status_code=500, detail=f"Failed to get pipelines: {pipelines_response.message}")
138
139 +
140 async def connect_stream_to_pipeline(stream_and_pipeline: StreamConnectionToPipelineRequest):
141 """
142 Connects a stream to a pipeline.
backend/app/connectors/influxdb/utils/universal.py
+1 -1
@@ -71,7 +71,7 @@ async def create_influxdb_client(connector_name: str) -> InfluxDBClientAsync:
71 return InfluxDBClientAsync(
72 url=attributes["connector_url"],
73 token=attributes["connector_api_key"],
74 - org= await get_influxdb_organization(),
74 + org=await get_influxdb_organization(),
75 )
76 except Exception as e:
77 raise HTTPException(status_code=500, detail=f"Failed to create Elasticsearch client: {e}")
backend/app/connectors/services.py
+14 -5
@@ -26,13 +26,18 @@ from app.connectors.sublime.utils.universal import verify_sublime_connection
26 from app.connectors.velociraptor.utils.universal import verify_velociraptor_connection
27 from app.connectors.wazuh_indexer.utils.universal import verify_wazuh_indexer_connection
28 from app.connectors.wazuh_manager.utils.universal import verify_wazuh_manager_connection
29 -from app.threat_intel.services.socfortress import verifiy_socfortress_threat_intel_connector
30 -from app.integrations.ask_socfortress.services.ask_socfortress import verify_ask_socfortress_connector
29
30 # from app.db.db_session import engine # Import the shared engine
31 from app.db.db_session import get_session
34 -from app.utils import verify_wazuh_worker_provisioning_connection, verify_alert_creation_provisioning_connection
32 +from app.integrations.ask_socfortress.services.ask_socfortress import (
33 + verify_ask_socfortress_connector,
34 +)
35 from app.integrations.utils.event_shipper import verify_event_shipper_connection
36 +from app.threat_intel.services.socfortress import (
37 + verifiy_socfortress_threat_intel_connector,
38 +)
39 +from app.utils import verify_alert_creation_provisioning_connection
40 +from app.utils import verify_wazuh_worker_provisioning_connection
41
42 UPLOAD_FOLDER = "file-store"
43 UPLOAD_FOLDER = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))), UPLOAD_FOLDER)
@@ -110,26 +115,31 @@ class WazuhWorkerProvisioningService(ConnectorServiceInterface):
115 async def verify_authentication(self, connector: ConnectorResponse) -> Optional[ConnectorResponse]:
116 return await verify_wazuh_worker_provisioning_connection(connector.connector_name)
117
118 +
119 # SOCFortress Threat Intel Service
120 class SocfortressThreatIntelService(ConnectorServiceInterface):
121 async def verify_authentication(self, connector: ConnectorResponse) -> Optional[ConnectorResponse]:
122 return await verifiy_socfortress_threat_intel_connector(connector.connector_name)
123
124 +
125 # ASK SOCFortress Service
126 class AskSocfortressService(ConnectorServiceInterface):
127 async def verify_authentication(self, connector: ConnectorResponse) -> Optional[ConnectorResponse]:
128 return await verify_ask_socfortress_connector(connector.connector_name)
129
130 +
131 # Event Shipper Service
132 class EventShipperService(ConnectorServiceInterface):
133 async def verify_authentication(self, connector: ConnectorResponse) -> Optional[ConnectorResponse]:
134 return await verify_event_shipper_connection(connector.connector_name)
135
136 +
137 # Alert Creation Service
138 class AlertCreationService(ConnectorServiceInterface):
139 async def verify_authentication(self, connector: ConnectorResponse) -> Optional[ConnectorResponse]:
140 return await verify_alert_creation_provisioning_connection(connector.connector_name)
141
142 +
143 # Factory function to create a service instance based on connector name
144 def get_connector_service(connector_name: str) -> Type[ConnectorServiceInterface]:
145 """
@@ -237,7 +247,7 @@ class ConnectorServices:
247 # If verify_authentication is an async function, you will need to await it
248 connector_response = await service_instance.verify_authentication(connector_response)
249 # If the connector is verified, update the connector record in the database
240 - if connector_response['connectionSuccessful']:
250 + if connector_response["connectionSuccessful"]:
251 connector.connector_verified = True
252 connector.connector_last_updated = datetime.now()
253 session.add(connector)
@@ -307,7 +317,6 @@ class ConnectorServices:
317 session.rollback()
318 return Exception(f"Failed to update connector: {e}")
319
310 -
320 @staticmethod
321 def allowed_file(filename):
322 """
backend/app/connectors/velociraptor/routes/flows.py
+5 -2
@@ -18,13 +18,15 @@ from app.connectors.velociraptor.schema.artifacts import QuarantineBody
18 from app.connectors.velociraptor.schema.artifacts import QuarantineResponse
19 from app.connectors.velociraptor.schema.artifacts import RunCommandBody
20 from app.connectors.velociraptor.schema.artifacts import RunCommandResponse
21 +from app.connectors.velociraptor.schema.flows import FlowResponse
22 +from app.connectors.velociraptor.schema.flows import RetrieveFlowRequest
23 from app.connectors.velociraptor.services.artifacts import get_artifacts
24 from app.connectors.velociraptor.services.artifacts import quarantine_host
25 from app.connectors.velociraptor.services.artifacts import run_artifact_collection
26 from app.connectors.velociraptor.services.artifacts import run_remote_command
27 +from app.connectors.velociraptor.services.flows import get_flow
28 +from app.connectors.velociraptor.services.flows import get_flows
29 from app.db.db_session import get_db
26 -from app.connectors.velociraptor.schema.flows import FlowResponse, RetrieveFlowRequest
27 -from app.connectors.velociraptor.services.flows import get_flows, get_flow
30 from app.db.universal_models import Agents
31
32 velociraptor_flows_router = APIRouter()
@@ -85,6 +87,7 @@ async def get_all_flows_for_hostname(hostname: str, session: AsyncSession = Depe
87 logger.info(f"velociraptor_id for hostname {hostname} is {velociraptor_id}")
88 return await get_flows(velociraptor_id)
89
90 +
91 @velociraptor_flows_router.post(
92 "/retrieve",
93 response_model=CollectArtifactResponse,
backend/app/connectors/velociraptor/schema/flows.py
+18 -7
@@ -1,17 +1,24 @@
1 -from pydantic import BaseModel, Field, root_validator
2 -from typing import List, Optional
1 +from typing import List
2 +from typing import Optional
3 +
4 from fastapi import HTTPException
5 from loguru import logger
6 +from pydantic import BaseModel
7 +from pydantic import Field
8 +from pydantic import root_validator
9 +
10
11 class FlowSpecParameter(BaseModel):
12 key: str
13 value: str
14 comment: Optional[str]
15
16 +
17 class FlowSpec(BaseModel):
18 artifact: str
19 parameters: Optional[List[FlowSpecParameter]] = Field(None, description="The parameters of the artifact.")
20
21 +
22 class FlowRequest(BaseModel):
23 creator: str
24 user_data: str
@@ -34,18 +41,19 @@ class FlowRequest(BaseModel):
41
42 @root_validator(pre=True)
43 def validate_specs(cls, values):
37 - if 'specs' in values and values['specs'] is not None:
44 + if "specs" in values and values["specs"] is not None:
45 validated_specs = []
39 - for spec in values['specs']:
46 + for spec in values["specs"]:
47 try:
48 validated_spec = FlowSpec(**spec)
49 validated_specs.append(validated_spec)
50 except Exception as e:
44 - #raise HTTPException(status_code=400, detail=f"Failed to validate spec: {e}")
51 + # raise HTTPException(status_code=400, detail=f"Failed to validate spec: {e}")
52 logger.error(f"Failed to validate spec: {e}")
46 - values['specs'] = validated_specs
53 + values["specs"] = validated_specs
54 return values
55
56 +
57 class FlowQueryStat(BaseModel):
58 status: str
59 error_message: str
@@ -63,6 +71,7 @@ class FlowQueryStat(BaseModel):
71 query_id: int
72 total_queries: int
73
74 +
75 class FlowClientSession(BaseModel):
76 client_id: str
77 session_id: str
@@ -90,17 +99,19 @@ class FlowClientSession(BaseModel):
99 dirty: bool
100 total_loads: int
101
102 +
103 class FlowResponse(BaseModel):
104 results: List[FlowClientSession]
105 success: bool
106 message: str
107
108 +
109 class RetrieveFlowRequest(BaseModel):
110 client_id: str
111 session_id: str
112
113 @root_validator(pre=True)
114 def validate_session_id(cls, values):
104 - if 'session_id' in values and values['session_id'] == "":
115 + if "session_id" in values and values["session_id"] == "":
116 raise HTTPException(status_code=400, detail="The session_id cannot be an empty string")
117 return values
backend/app/connectors/velociraptor/services/flows.py
+14 -7
@@ -9,8 +9,10 @@ from app.connectors.velociraptor.schema.artifacts import QuarantineBody
9 from app.connectors.velociraptor.schema.artifacts import QuarantineResponse
10 from app.connectors.velociraptor.schema.artifacts import RunCommandBody
11 from app.connectors.velociraptor.schema.artifacts import RunCommandResponse
12 +from app.connectors.velociraptor.schema.flows import FlowClientSession
13 +from app.connectors.velociraptor.schema.flows import FlowResponse
14 +from app.connectors.velociraptor.schema.flows import RetrieveFlowRequest
15 from app.connectors.velociraptor.utils.universal import UniversalService
13 -from app.connectors.velociraptor.schema.flows import FlowResponse, FlowClientSession, RetrieveFlowRequest
16
17
18 def create_query(query: str) -> str:
@@ -25,6 +27,7 @@ def create_query(query: str) -> str:
27 """
28 return query
29
30 +
31 async def get_flows(velociraptor_id: str) -> FlowResponse:
32 """
33 Get all artifacts from Velociraptor.
@@ -35,8 +38,8 @@ async def get_flows(velociraptor_id: str) -> FlowResponse:
38 logger.info("Fetching artifacts from Velociraptor")
39 velociraptor_service = await UniversalService.create("Velociraptor")
40 query = create_query(
38 - f"SELECT * FROM flows(client_id='{velociraptor_id}')",
39 - )
41 + f"SELECT * FROM flows(client_id='{velociraptor_id}')",
42 + )
43 all_flows = velociraptor_service.execute_query(query)
44 logger.info(f"all_flows: {all_flows}")
45 flows = [FlowClientSession(**flow) for flow in all_flows["results"]]
@@ -52,6 +55,7 @@ async def get_flows(velociraptor_id: str) -> FlowResponse:
55 logger.error(f"Failed to retrieve flows from Velociraptor: {e}")
56 raise HTTPException(status_code=500, detail=f"Failed to retrieve flows from Velociraptor: {e}")
57
58 +
59 async def get_flow(retrieve_flow_request: RetrieveFlowRequest):
60 """
61 Get all artifacts from Velociraptor.
@@ -62,16 +66,19 @@ async def get_flow(retrieve_flow_request: RetrieveFlowRequest):
66 logger.info("Fetching artifacts from Velociraptor")
67 velociraptor_service = await UniversalService.create("Velociraptor")
68 query = create_query(
65 - f"SELECT * FROM flow_results(client_id='{retrieve_flow_request.client_id}', flow_id='{retrieve_flow_request.session_id}')",
66 - )
69 + f"SELECT * FROM flow_results(client_id='{retrieve_flow_request.client_id}', flow_id='{retrieve_flow_request.session_id}')",
70 + )
71 flow_results = velociraptor_service.execute_query(query)
72 logger.info(f"flow_results: {flow_results}")
73 try:
74 if flow_results["success"]:
71 - return CollectArtifactResponse(success=flow_results["success"], message=flow_results["message"], results=flow_results["results"])
75 + return CollectArtifactResponse(
76 + success=flow_results["success"],
77 + message=flow_results["message"],
78 + results=flow_results["results"],
79 + )
80 else:
81 raise HTTPException(status_code=500, detail=f"Failed to retrieve flow results from Velociraptor: {flow_results['message']}")
82 except Exception as e:
83 logger.error(f"Failed to retrieve flow results from Velociraptor: {e}")
84 raise HTTPException(status_code=500, detail=f"Failed to retrieve flow results from Velociraptor: {e}")
77 -
backend/app/connectors/wazuh_manager/routes/rules.py
+5 -2
@@ -13,12 +13,15 @@ from app.connectors.wazuh_manager.schema.rules import AllDisabledRuleResponse
13 from app.connectors.wazuh_manager.schema.rules import RuleDisable
14 from app.connectors.wazuh_manager.schema.rules import RuleDisableResponse
15 from app.connectors.wazuh_manager.schema.rules import RuleEnable
16 -from app.connectors.wazuh_manager.schema.rules import RuleEnableResponse, RuleExclude, RuleExcludeResponse
16 +from app.connectors.wazuh_manager.schema.rules import RuleEnableResponse
17 +from app.connectors.wazuh_manager.schema.rules import RuleExclude
18 +from app.connectors.wazuh_manager.schema.rules import RuleExcludeResponse
19
20 # from app.connectors.wazuh_manager.schema.rules import RuleExclude
21 # from app.connectors.wazuh_manager.schema.rules import RuleExcludeResponse
22 from app.connectors.wazuh_manager.services.rules import disable_rule
21 -from app.connectors.wazuh_manager.services.rules import enable_rule, exclude_rule
23 +from app.connectors.wazuh_manager.services.rules import enable_rule
24 +from app.connectors.wazuh_manager.services.rules import exclude_rule
25
26 # from app.connectors.wazuh_manager.services.rules import exclude_rule
27 from app.db.db_session import get_db
backend/app/connectors/wazuh_manager/schema/rules.py
+3 -1
@@ -2,7 +2,8 @@ from typing import List
2 from typing import Optional
3
4 from pydantic import BaseModel
5 -from pydantic import Field, validator
5 +from pydantic import Field
6 +from pydantic import validator
7
8
9 class RuleDisable(BaseModel):
@@ -50,6 +51,7 @@ class RuleExclude(BaseModel):
51 example="C:\\Windows\\ServiceState\\EventLog\\Data\\lastalive1.dat",
52 )
53
54 +
55 class RuleExcludeResponse(BaseModel):
56 success: bool
57 message: str
backend/app/connectors/wazuh_manager/services/rules.py
+22 -19
@@ -1,12 +1,12 @@
1 +import re
2 +from enum import Enum
3 from typing import Any
4 from typing import Dict
5 from typing import List
6 from typing import Tuple
7 from typing import Union
8
7 -import re
9 import pcre2
9 -from enum import Enum
10 import xmltodict
11 from fastapi import HTTPException
12 from loguru import logger
@@ -242,27 +242,29 @@ def make_pcre2_compatible(input_string: str) -> str:
242
243
244 class RegexSpecialCharacters(Enum):
245 - DOT = ('.', '\.')
246 - CARET = ('^', '\^')
247 - DOLLAR = ('$', '\$')
248 - STAR = ('*', '\*')
249 - PLUS = ('+', '\+')
250 - QUESTION = ('?', '\?')
251 - CURLY_OPEN = ('{', '\{')
252 - CURLY_CLOSE = ('}', '\}')
253 - SQUARE_OPEN = ('[', '\[')
254 - SQUARE_CLOSE = (']', '\]')
255 - SINGLE_BACKSLASH = ('\\', '\\\\')
256 - DOUBLE_BACKSLASH = ('\\\\', '\\\\\\\\')
257 - PIPE = ('|', '\|')
258 - PAREN_OPEN = ('(', '\(')
259 - PAREN_CLOSE = (')', '\)')
260 - COLON = (':', '\:')
261 - DASH = ('-', '\-')
245 + DOT = (".", "\.")
246 + CARET = ("^", "\^")
247 + DOLLAR = ("$", "\$")
248 + STAR = ("*", "\*")
249 + PLUS = ("+", "\+")
250 + QUESTION = ("?", "\?")
251 + CURLY_OPEN = ("{", "\{")
252 + CURLY_CLOSE = ("}", "\}")
253 + SQUARE_OPEN = ("[", "\[")
254 + SQUARE_CLOSE = ("]", "\]")
255 + SINGLE_BACKSLASH = ("\\", "\\\\")
256 + DOUBLE_BACKSLASH = ("\\\\", "\\\\\\\\")
257 + PIPE = ("|", "\|")
258 + PAREN_OPEN = ("(", "\(")
259 + PAREN_CLOSE = (")", "\)")
260 + COLON = (":", "\:")
261 + DASH = ("-", "\-")
262 +
263
264 # Create a dictionary for easy lookup
265 REGEX_REPLACE_DICT = {char.value[0]: char.value[1] for char in RegexSpecialCharacters}
266
267 +
268 async def replace_special_chars(rule: RuleExclude):
269 for char, replacement in REGEX_REPLACE_DICT.items():
270 # Use Python's raw string notation for regular expressions
@@ -271,6 +273,7 @@ async def replace_special_chars(rule: RuleExclude):
273 logger.info(f"Input String: {input_string}")
274 return input_string
275
276 +
277 async def exclude_rule(rule: RuleExclude) -> RuleExcludeResponse:
278 """
279 Exclude a rule based on the provided input value and rule value.
backend/app/customer_provisioning/schema/graylog.py
+5 -1
@@ -131,6 +131,7 @@ class WazuhEventStream(BaseModel):
131 },
132 }
133
134 +
135 class Office365EventStream(BaseModel):
136 title: str = Field(..., description="Title of the stream")
137 description: str = Field(..., description="Description of the stream")
@@ -146,7 +147,10 @@ class Office365EventStream(BaseModel):
147 "title": "Office365 EVENTS - Example Company",
148 "description": "Office365 EVENTS - Example Company",
149 "index_set_id": "12345",
149 - "rules": [{"field": "agent_labels_customer", "type": 1, "inverted": False, "value": "ExampleCode"}, {"field": "agent_labels_integration", "type": 1, "inverted": False, "value": "Office365"}],
150 + "rules": [
151 + {"field": "agent_labels_customer", "type": 1, "inverted": False, "value": "ExampleCode"},
152 + {"field": "agent_labels_integration", "type": 1, "inverted": False, "value": "Office365"},
153 + ],
154 "matching_type": "AND",
155 "remove_matches_from_default_stream": True,
156 "content_pack": None,
backend/app/db/all_models.py
+1 -3
@@ -10,7 +10,5 @@ from app.db.universal_models import LogEntry
10 from app.integrations.alert_creation_settings.models.alert_creation_settings import (
11 AlertCreationSettings,
12 )
13 +from app.integrations.models.customer_integration_settings import CustomerIntegrations
14 from app.schedulers.models.scheduler import JobMetadata
14 -from app.integrations.models.customer_integration_settings import (
15 - CustomerIntegrations,
16 -)
backend/app/db/db_populate.py
+42 -16
@@ -2,13 +2,16 @@ import os
2
3 from dotenv import load_dotenv
4 from loguru import logger
5 +from sqlalchemy import and_
6 from sqlalchemy.ext.asyncio import AsyncSession
7 from sqlalchemy.future import select
7 -from sqlalchemy import and_
8
9 from app.auth.models.users import Role
10 from app.connectors.models import Connectors
11 -from app.integrations.models.customer_integration_settings import AvailableIntegrations, AvailableIntegrationsAuthKeys
11 +from app.integrations.models.customer_integration_settings import AvailableIntegrations
12 +from app.integrations.models.customer_integration_settings import (
13 + AvailableIntegrationsAuthKeys,
14 +)
15
16 load_dotenv()
17
@@ -70,9 +73,25 @@ def get_connectors_list():
73 ("SocfortressThreatIntel", "3", "api_key", "Connection to Socfortress Threat Intel. Make sure you have requested an API key."),
74 ("Cortex", "3", "api_key", "Connection to Cortex. Make sure you have created an API key."),
75 ("Grafana", "3", "username_password", "Connection to Grafana. Make sure to use the an admin role user."),
73 - ("Wazuh Worker Provisioning", "3", "host_only", "Connection to Wazuh Worker Provisioning. Make sure you have deployed the Wazuh Worker Provisioning Application provided by SOCFortress: https://github.com/socfortress/Customer-Provisioning-Worker"),
74 - ("Event Shipper", "3", "host_only", "Connection to Graylog GELF Input to receive events from integrations. Make sure you have created a GELF Input in Graylog.", "GELF_INPUT_PORT"),
75 - ("Alert Creation Provisioning", "3", "host_only", "Connection to Alert Creation Provisioning. Make sure you have deployed the Alert Creation Provisioning Application provided by SOCFortress: https://github.com/socfortress/Customer-Provisioning-Alert"),
76 + (
77 + "Wazuh Worker Provisioning",
78 + "3",
79 + "host_only",
80 + "Connection to Wazuh Worker Provisioning. Make sure you have deployed the Wazuh Worker Provisioning Application provided by SOCFortress: https://github.com/socfortress/Customer-Provisioning-Worker",
81 + ),
82 + (
83 + "Event Shipper",
84 + "3",
85 + "host_only",
86 + "Connection to Graylog GELF Input to receive events from integrations. Make sure you have created a GELF Input in Graylog.",
87 + "GELF_INPUT_PORT",
88 + ),
89 + (
90 + "Alert Creation Provisioning",
91 + "3",
92 + "host_only",
93 + "Connection to Alert Creation Provisioning. Make sure you have deployed the Alert Creation Provisioning Application provided by SOCFortress: https://github.com/socfortress/Customer-Provisioning-Alert",
94 + ),
95 # ... Add more connectors as needed ...
96 ]
97
@@ -135,6 +154,7 @@ async def add_roles_if_not_exist(session: AsyncSession) -> None:
154 await session.commit() # Commit the transaction
155 logger.info("Role check and addition completed.")
156
157 +
158 def load_available_integrations_data(integration_name: str, description: str, integration_details: str):
159 """
160 Load available integrations data from environment variables.
@@ -153,6 +173,7 @@ def load_available_integrations_data(integration_name: str, description: str, in
173 "integration_details": integration_details,
174 }
175
176 +
177 def load_markdown_for_integration(integration_name: str) -> str:
178 """
179 Load markdown content for a given integration from a file.
@@ -163,7 +184,7 @@ def load_markdown_for_integration(integration_name: str) -> str:
184 Returns:
185 str: The content of the markdown file.
186 """
166 - #file_path = os.path.join("integrations_markdown", f"{integration_name.lower()}.md")
187 + # file_path = os.path.join("integrations_markdown", f"{integration_name.lower()}.md")
188 file_path = os.path.join("app", "integrations", "markdown", f"{integration_name.lower()}.md")
189 try:
190 with open(file_path, "r") as file:
@@ -171,6 +192,7 @@ def load_markdown_for_integration(integration_name: str) -> str:
192 except FileNotFoundError:
193 return "No deployment intrusctions available."
194
195 +
196 def get_available_integrations_list():
197 """
198 Get a list of available integrations.
@@ -185,11 +207,8 @@ def get_available_integrations_list():
207 ]
208
209 return [
188 - load_available_integrations_data(
189 - integration_name,
190 - description,
191 - load_markdown_for_integration(integration_name)
192 - ) for integration_name, description in available_integrations
210 + load_available_integrations_data(integration_name, description, load_markdown_for_integration(integration_name))
211 + for integration_name, description in available_integrations
212 ]
213
214
@@ -206,7 +225,9 @@ async def add_available_integrations_if_not_exist(session: AsyncSession):
225 available_integrations_list = get_available_integrations_list()
226
227 for available_integration_data in available_integrations_list:
209 - query = select(AvailableIntegrations).where(AvailableIntegrations.integration_name == available_integration_data["integration_name"])
228 + query = select(AvailableIntegrations).where(
229 + AvailableIntegrations.integration_name == available_integration_data["integration_name"],
230 + )
231 result = await session.execute(query)
232 existing_available_integration = result.scalars().first()
233
@@ -235,6 +256,7 @@ def load_available_integrations_auth_keys(integration_id: int, integration_name:
256 "auth_key_name": auth_key_name,
257 }
258
259 +
260 async def get_available_integrations_auth_keys_list(session: AsyncSession):
261 """
262 Get a list of available integrations auth keys with their corresponding integration IDs.
@@ -283,7 +305,9 @@ async def add_available_integrations_auth_keys_if_not_exist(session: AsyncSessio
305 available_integrations_auth_keys_list = await get_available_integrations_auth_keys_list(session=session)
306
307 for available_integration_auth_keys_data in available_integrations_auth_keys_list:
286 - query = select(AvailableIntegrations).where(AvailableIntegrations.integration_name == available_integration_auth_keys_data["integration_name"])
308 + query = select(AvailableIntegrations).where(
309 + AvailableIntegrations.integration_name == available_integration_auth_keys_data["integration_name"],
310 + )
311 result = await session.execute(query)
312 existing_integration = result.scalars().first()
313
@@ -292,8 +316,8 @@ async def add_available_integrations_auth_keys_if_not_exist(session: AsyncSessio
316 auth_key_query = select(AvailableIntegrationsAuthKeys).where(
317 and_(
318 AvailableIntegrationsAuthKeys.integration_id == existing_integration.id,
295 - AvailableIntegrationsAuthKeys.auth_key_name == available_integration_auth_keys_data["auth_key_name"]
296 - )
319 + AvailableIntegrationsAuthKeys.auth_key_name == available_integration_auth_keys_data["auth_key_name"],
320 + ),
321 )
322 auth_key_result = await session.execute(auth_key_query)
323 existing_auth_key = auth_key_result.scalars().first()
@@ -301,4 +325,6 @@ async def add_available_integrations_auth_keys_if_not_exist(session: AsyncSessio
325 if existing_auth_key is None:
326 new_auth_key = AvailableIntegrationsAuthKeys(**available_integration_auth_keys_data)
327 session.add(new_auth_key)
304 - logger.info(f"Added new available integration auth keys: {available_integration_auth_keys_data['auth_key_name']} for {available_integration_auth_keys_data['integration_name']}")
328 + logger.info(
329 + f"Added new available integration auth keys: {available_integration_auth_keys_data['auth_key_name']} for {available_integration_auth_keys_data['integration_name']}",
330 + )
backend/app/db/db_setup.py
+3 -1
@@ -7,9 +7,10 @@ from sqlmodel import SQLModel
7 from app.auth.services.universal import create_admin_user
8 from app.auth.services.universal import create_scheduler_user
9 from app.auth.services.universal import remove_scheduler_user
10 +from app.db.db_populate import add_available_integrations_auth_keys_if_not_exist
11 +from app.db.db_populate import add_available_integrations_if_not_exist
12 from app.db.db_populate import add_connectors_if_not_exist
13 from app.db.db_populate import add_roles_if_not_exist
12 -from app.db.db_populate import add_available_integrations_if_not_exist, add_available_integrations_auth_keys_if_not_exist
14
15
16 async def create_tables(async_engine):
@@ -47,6 +48,7 @@ async def create_roles(async_engine):
48 async with session.begin(): # Start a transaction
49 await add_roles_if_not_exist(session)
50
51 +
52 async def create_available_integrations(async_engine):
53 """
54 Creates available integrations in the database.
backend/app/integrations/alert_creation/general/services/alert.py
+1 -1
@@ -107,7 +107,7 @@ async def build_asset_payload(agent_data: AgentsResponse, alert_details) -> Iris
107 asset_ip=agent_data.agents[0].ip_address,
108 asset_description=agent_data.agents[0].os,
109 asset_type_id=await get_asset_type_id(agent_data.agents[0].os),
110 - #asset_tags=agent_data.agents[0].agent_id,
110 + # asset_tags=agent_data.agents[0].agent_id,
111 asset_tags=f"agent_id:{agent_data.agents[0].agent_id}",
112 )
113 return IrisAsset()
backend/app/integrations/alert_creation/office365/routes/alert.py
+42 -23
@@ -1,24 +1,44 @@
1 -from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertRequest
2 -from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertResponse
3 -from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertBase
4 -from app.integrations.alert_creation.office365.schema.exchange import ValidOffice365Workloads
5 -from app.integrations.alert_creation.office365.schema.threat_intel import Office365ThreatIntelAlertRequest
6 -from app.integrations.alert_creation.office365.schema.threat_intel import Office365ThreatIntelAlertResponse
7 -from app.integrations.alert_creation.office365.services.exchange import create_exchange_alert
8 -from app.integrations.alert_creation.office365.services.threat_intel import create_threat_intel_alert
9 -from app.integrations.alert_creation_settings.models.alert_creation_settings import AlertCreationSettings
10 -from sqlalchemy import select
11 -#from app.alerts.office365.services.threat_intel import create_threat_intel_alert
1 +# from app.alerts.office365.services.threat_intel import create_threat_intel_alert
2 from fastapi import APIRouter
13 -from app.utils import get_customer_alert_settings_office365
3 +from fastapi import Depends
4 from fastapi import HTTPException
5 from loguru import logger
16 -from fastapi import Depends
17 -from app.db.db_session import get_db
6 +from sqlalchemy import select
7 from sqlalchemy.ext.asyncio import AsyncSession
8
9 +from app.db.db_session import get_db
10 +from app.integrations.alert_creation.office365.schema.exchange import (
11 + Office365ExchangeAlertBase,
12 +)
13 +from app.integrations.alert_creation.office365.schema.exchange import (
14 + Office365ExchangeAlertRequest,
15 +)
16 +from app.integrations.alert_creation.office365.schema.exchange import (
17 + Office365ExchangeAlertResponse,
18 +)
19 +from app.integrations.alert_creation.office365.schema.exchange import (
20 + ValidOffice365Workloads,
21 +)
22 +from app.integrations.alert_creation.office365.schema.threat_intel import (
23 + Office365ThreatIntelAlertRequest,
24 +)
25 +from app.integrations.alert_creation.office365.schema.threat_intel import (
26 + Office365ThreatIntelAlertResponse,
27 +)
28 +from app.integrations.alert_creation.office365.services.exchange import (
29 + create_exchange_alert,
30 +)
31 +from app.integrations.alert_creation.office365.services.threat_intel import (
32 + create_threat_intel_alert,
33 +)
34 +from app.integrations.alert_creation_settings.models.alert_creation_settings import (
35 + AlertCreationSettings,
36 +)
37 +from app.utils import get_customer_alert_settings_office365
38 +
39 office365_alerts_router = APIRouter()
40
41 +
42 async def is_office365_organization_id_valid(create_alert_request: Office365ExchangeAlertBase, session: AsyncSession) -> bool:
43 """
44 Checks if the given organization ID is valid for the specified customer.
@@ -30,10 +50,14 @@ async def is_office365_organization_id_valid(create_alert_request: Office365Exch
50 Returns:
51 bool: True if the organization ID is valid for the customer, False otherwise.
52 """
33 - logger.info(f"Checking if organization_id: {create_alert_request.data_office365_OrganizationId} is valid for customer: {create_alert_request.data_office365_OrganizationId}")
53 + logger.info(
54 + f"Checking if organization_id: {create_alert_request.data_office365_OrganizationId} is valid for customer: {create_alert_request.data_office365_OrganizationId}",
55 + )
56
57 result = await session.execute(
36 - select(AlertCreationSettings).where(AlertCreationSettings.office365_organization_id == create_alert_request.data_office365_OrganizationId),
58 + select(AlertCreationSettings).where(
59 + AlertCreationSettings.office365_organization_id == create_alert_request.data_office365_OrganizationId,
60 + ),
61 )
62 settings = result.scalars().first()
63 if settings is None:
@@ -42,7 +66,6 @@ async def is_office365_organization_id_valid(create_alert_request: Office365Exch
66 return True
67
68
45 -
69 @office365_alerts_router.post(
70 "/exchange",
71 response_model=Office365ExchangeAlertResponse,
@@ -53,9 +76,7 @@ async def create_office365_exchange_alert(
76 session: AsyncSession = Depends(get_db),
77 ):
78 logger.info(f"create_alert_request: {create_alert_request}")
56 - if create_alert_request.data_office365_Workload not in [
57 - workload.value for workload in ValidOffice365Workloads
58 - ]:
79 + if create_alert_request.data_office365_Workload not in [workload.value for workload in ValidOffice365Workloads]:
80 logger.info(f"Invalid workload: {create_alert_request.data_office365_Workload}")
81 raise HTTPException(status_code=400, detail="Invalid workload")
82 logger.info(f"Workload is valid: {create_alert_request.data_office365_Workload}")
@@ -73,9 +94,7 @@ async def create_office365_threat_intel_alert(
94 session: AsyncSession = Depends(get_db),
95 ):
96 logger.info(f"create_alert_request: {create_alert_request}")
76 - if create_alert_request.data_office365_Workload not in [
77 - workload.value for workload in ValidOffice365Workloads
78 - ]:
97 + if create_alert_request.data_office365_Workload not in [workload.value for workload in ValidOffice365Workloads]:
98 logger.info(f"Invalid workload: {create_alert_request.data_office365_Workload}")
99 raise HTTPException(status_code=400, detail="Invalid workload")
100 logger.info(f"Workload is valid: {create_alert_request.data_office365_Workload}")
backend/app/integrations/alert_creation/office365/schema/exchange.py
+1
@@ -128,6 +128,7 @@ class IrisIoc(BaseModel):
128 def to_dict(self):
129 return self.dict(exclude_none=True)
130
131 +
132 class IrisAlertContext(BaseModel):
133 customer_iris_id: int = Field(
134 ...,
backend/app/integrations/alert_creation/office365/services/exchange.py
+48 -17
@@ -1,21 +1,27 @@
1 from typing import Optional
2 from typing import Set
3
4 +from loguru import logger
5 +from sqlalchemy.ext.asyncio import AsyncSession
6 +
7 +from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
8 +from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
9 from app.integrations.alert_creation.general.schema.alert import ValidIocFields
10 from app.integrations.alert_creation.office365.schema.exchange import IrisAlertContext
11 from app.integrations.alert_creation.office365.schema.exchange import IrisAlertPayload
12 from app.integrations.alert_creation.office365.schema.exchange import IrisAsset
13 from app.integrations.alert_creation.office365.schema.exchange import IrisIoc
9 -from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertRequest
10 -from app.integrations.alert_creation.office365.schema.exchange import Office365ExchangeAlertResponse
11 -from app.integrations.utils.schema import ShufflePayload
12 -from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
13 -from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
14 +from app.integrations.alert_creation.office365.schema.exchange import (
15 + Office365ExchangeAlertRequest,
16 +)
17 +from app.integrations.alert_creation.office365.schema.exchange import (
18 + Office365ExchangeAlertResponse,
19 +)
20 from app.integrations.utils.alerts import send_to_shuffle
21 from app.integrations.utils.alerts import validate_ioc_type
16 -from app.utils import get_customer_alert_settings, get_customer_alert_settings_office365
17 -from loguru import logger
18 -from sqlalchemy.ext.asyncio import AsyncSession
22 +from app.integrations.utils.schema import ShufflePayload
23 +from app.utils import get_customer_alert_settings
24 +from app.utils import get_customer_alert_settings_office365
25
26
27 def valid_ioc_fields() -> Set[str]:
@@ -41,7 +47,9 @@ async def construct_alert_source_link(alert_details: Office365ExchangeAlertReque
47 str
48 The alert source link.
49 """
44 - grafana_url = (await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)).grafana_url
50 + grafana_url = (
51 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
52 + ).grafana_url
53
54 return (
55 f"{grafana_url}/explore?left=%5B%22now-6h%22,%22now%22,%22O365%22,%7B%22refId%22"
@@ -103,11 +111,22 @@ async def build_alert_context_payload(
111 """
112 return IrisAlertContext(
113 customer_iris_id=(
106 - await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
114 + await get_customer_alert_settings_office365(
115 + office365_organization_id=alert_details.data_office365_OrganizationId,
116 + session=session,
117 + )
118 ).iris_customer_id,
108 - customer_name=(await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)).customer_name,
119 + customer_name=(
120 + await get_customer_alert_settings_office365(
121 + office365_organization_id=alert_details.data_office365_OrganizationId,
122 + session=session,
123 + )
124 + ).customer_name,
125 customer_cases_index=(
110 - await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
126 + await get_customer_alert_settings_office365(
127 + office365_organization_id=alert_details.data_office365_OrganizationId,
128 + session=session,
129 + )
130 ).iris_index,
131 alert_id=alert_details.id,
132 alert_name=alert_details.rule_description,
@@ -159,7 +178,10 @@ async def build_alert_payload(
178 alert_status_id=3,
179 alert_severity_id=5,
180 alert_customer_id=(
162 - await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
181 + await get_customer_alert_settings_office365(
182 + office365_organization_id=alert_details.data_office365_OrganizationId,
183 + session=session,
184 + )
185 ).iris_customer_id,
186 alert_source_content=alert_details.to_dict(),
187 alert_context=context_payload,
@@ -177,7 +199,10 @@ async def build_alert_payload(
199 alert_status_id=3,
200 alert_severity_id=5,
201 alert_customer_id=(
180 - await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
202 + await get_customer_alert_settings_office365(
203 + office365_organization_id=alert_details.data_office365_OrganizationId,
204 + session=session,
205 + )
206 ).iris_customer_id,
207 alert_source_content=alert_details.to_dict(),
208 alert_context=context_payload,
@@ -230,8 +255,12 @@ async def create_exchange_alert(alert: Office365ExchangeAlertRequest, session: A
255 await send_to_shuffle(
256 ShufflePayload(
257 alert_id=alert_id,
233 - customer= (await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_name,
234 - customer_code= (await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_code,
258 + customer=(
259 + await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)
260 + ).customer_name,
261 + customer_code=(
262 + await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)
263 + ).customer_code,
264 alert_source_link=await construct_alert_source_link(alert, session=session),
265 rule_description=alert.rule_description,
266 hostname=alert.data_office365_UserId,
@@ -240,7 +269,9 @@ async def create_exchange_alert(alert: Office365ExchangeAlertRequest, session: A
269 )
270 return Office365ExchangeAlertResponse(
271 alert_id=alert_id,
243 - customer=(await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_name,
272 + customer=(
273 + await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)
274 + ).customer_name,
275 alert_source_link=await construct_alert_source_link(alert, session=session),
276 success=True,
277 message=f"Successfully created alert {alert_id} in IRIS.",
backend/app/integrations/alert_creation/office365/services/threat_intel.py
+57 -19
@@ -1,21 +1,34 @@
1 from typing import Optional
2 from typing import Set
3
4 +from loguru import logger
5 +from sqlalchemy.ext.asyncio import AsyncSession
6 +
7 +from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
8 +from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
9 from app.integrations.alert_creation.general.schema.alert import ValidIocFields
5 -from app.integrations.alert_creation.office365.schema.threat_intel import IrisAlertContext
6 -from app.integrations.alert_creation.office365.schema.threat_intel import IrisAlertPayload
10 +from app.integrations.alert_creation.office365.schema.threat_intel import (
11 + IrisAlertContext,
12 +)
13 +from app.integrations.alert_creation.office365.schema.threat_intel import (
14 + IrisAlertPayload,
15 +)
16 from app.integrations.alert_creation.office365.schema.threat_intel import IrisAsset
17 from app.integrations.alert_creation.office365.schema.threat_intel import IrisIoc
9 -from app.integrations.alert_creation.office365.schema.threat_intel import Office365ThreatIntelAlertBase
10 -from app.integrations.alert_creation.office365.schema.threat_intel import Office365ThreatIntelAlertResponse, Office365ThreatIntelAlertRequest
11 -from app.integrations.utils.schema import ShufflePayload
12 -from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
13 -from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
18 +from app.integrations.alert_creation.office365.schema.threat_intel import (
19 + Office365ThreatIntelAlertBase,
20 +)
21 +from app.integrations.alert_creation.office365.schema.threat_intel import (
22 + Office365ThreatIntelAlertRequest,
23 +)
24 +from app.integrations.alert_creation.office365.schema.threat_intel import (
25 + Office365ThreatIntelAlertResponse,
26 +)
27 from app.integrations.utils.alerts import send_to_shuffle
28 from app.integrations.utils.alerts import validate_ioc_type
16 -from app.utils import get_customer_alert_settings, get_customer_alert_settings_office365
17 -from loguru import logger
18 -from sqlalchemy.ext.asyncio import AsyncSession
29 +from app.integrations.utils.schema import ShufflePayload
30 +from app.utils import get_customer_alert_settings
31 +from app.utils import get_customer_alert_settings_office365
32
33
34 def valid_ioc_fields() -> Set[str]:
@@ -41,7 +54,9 @@ async def construct_alert_source_link(alert_details: Office365ThreatIntelAlertRe
54 str
55 The alert source link.
56 """
44 - grafana_url = (await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)).grafana_url
57 + grafana_url = (
58 + await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
59 + ).grafana_url
60
61 return (
62 f"{grafana_url}/explore?left=%5B%22now-6h%22,%22now%22,%22O365%22,%7B%22refId%22"
@@ -103,11 +118,22 @@ async def build_alert_context_payload(
118 """
119 return IrisAlertContext(
120 customer_iris_id=(
106 - await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
121 + await get_customer_alert_settings_office365(
122 + office365_organization_id=alert_details.data_office365_OrganizationId,
123 + session=session,
124 + )
125 ).iris_customer_id,
108 - customer_name=(await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)).customer_name,
126 + customer_name=(
127 + await get_customer_alert_settings_office365(
128 + office365_organization_id=alert_details.data_office365_OrganizationId,
129 + session=session,
130 + )
131 + ).customer_name,
132 customer_cases_index=(
110 - await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
133 + await get_customer_alert_settings_office365(
134 + office365_organization_id=alert_details.data_office365_OrganizationId,
135 + session=session,
136 + )
137 ).iris_index,
138 alert_id=alert_details.id,
139 alert_name=alert_details.rule_description,
@@ -159,7 +185,10 @@ async def build_alert_payload(
185 alert_status_id=3,
186 alert_severity_id=5,
187 alert_customer_id=(
162 - await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
188 + await get_customer_alert_settings_office365(
189 + office365_organization_id=alert_details.data_office365_OrganizationId,
190 + session=session,
191 + )
192 ).iris_customer_id,
193 alert_source_content=alert_details.to_dict(),
194 alert_context=context_payload,
@@ -177,7 +206,10 @@ async def build_alert_payload(
206 alert_status_id=3,
207 alert_severity_id=5,
208 alert_customer_id=(
180 - await get_customer_alert_settings_office365(office365_organization_id=alert_details.data_office365_OrganizationId, session=session)
209 + await get_customer_alert_settings_office365(
210 + office365_organization_id=alert_details.data_office365_OrganizationId,
211 + session=session,
212 + )
213 ).iris_customer_id,
214 alert_source_content=alert_details.to_dict(),
215 alert_context=context_payload,
@@ -230,8 +262,12 @@ async def create_threat_intel_alert(alert: Office365ThreatIntelAlertRequest, ses
262 await send_to_shuffle(
263 ShufflePayload(
264 alert_id=alert_id,
233 - customer= (await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_name,
234 - customer_code= (await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_code,
265 + customer=(
266 + await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)
267 + ).customer_name,
268 + customer_code=(
269 + await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)
270 + ).customer_code,
271 alert_source_link=await construct_alert_source_link(alert, session=session),
272 rule_description=alert.rule_description,
273 hostname=alert.data_office365_UserId,
@@ -240,7 +276,9 @@ async def create_threat_intel_alert(alert: Office365ThreatIntelAlertRequest, ses
276 )
277 return Office365ThreatIntelAlertResponse(
278 alert_id=alert_id,
243 - customer=(await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)).customer_name,
279 + customer=(
280 + await get_customer_alert_settings_office365(office365_organization_id=alert.data_office365_OrganizationId, session=session)
281 + ).customer_name,
282 alert_source_link=await construct_alert_source_link(alert, session=session),
283 success=True,
284 message=f"Successfully created alert {alert_id} in IRIS.",
backend/app/integrations/alert_escalation/routes/general_alert.py
+2 -2
@@ -5,7 +5,7 @@ from loguru import logger
5 from sqlalchemy.ext.asyncio import AsyncSession
6
7 from app.auth.utils import AuthHandler
8 -from app.db.db_session import get_session
8 +from app.db.db_session import get_db
9 from app.integrations.alert_escalation.schema.general_alert import CreateAlertRequest
10 from app.integrations.alert_escalation.schema.general_alert import CreateAlertResponse
11 from app.integrations.alert_escalation.services.general_alert import create_alert
@@ -19,7 +19,7 @@ integration_general_alerts_router = APIRouter()
19 description="Manually create an alert in IRIS from Copilot WebUI",
20 dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
21 )
22 -async def create_alert_route(create_alert_request: CreateAlertRequest, session: AsyncSession = Depends(get_session)) -> CreateAlertResponse:
22 +async def create_alert_route(create_alert_request: CreateAlertRequest, session: AsyncSession = Depends(get_db)) -> CreateAlertResponse:
23 """
24 Create an alert in IRIS. Manually create an alert in IRIS from Copilot WebUI.
25
backend/app/integrations/alert_escalation/services/general_alert.py
+1
@@ -47,6 +47,7 @@ async def is_customer_code_valid(customer_code: str, session: AsyncSession) -> b
47 select(AlertCreationSettings).where(AlertCreationSettings.customer_code == customer_code),
48 )
49 settings = result.scalars().first()
50 + logger.info(f"Settings: {settings}")
51
52 if settings:
53 return True
backend/app/integrations/ask_socfortress/services/ask_socfortress.py
+7 -4
@@ -1,13 +1,15 @@
1 -from typing import Optional
2 -from typing import Dict
1 from typing import Any
2 +from typing import Dict
3 +from typing import Optional
4
5 import httpx
6 from fastapi import HTTPException
7 from loguru import logger
8 from sqlalchemy.ext.asyncio import AsyncSession
9
10 +from app.connectors.utils import get_connector_info_from_db
11 from app.connectors.wazuh_indexer.utils.universal import create_wazuh_indexer_client
12 +from app.db.db_session import get_db_session
13 from app.integrations.alert_escalation.schema.general_alert import CreateAlertRequest
14 from app.integrations.alert_escalation.schema.general_alert import GenericAlertModel
15 from app.integrations.alert_escalation.schema.general_alert import GenericSourceModel
@@ -21,8 +23,7 @@ from app.integrations.ask_socfortress.schema.ask_socfortress import (
23 AskSocfortressSigmaResponse,
24 )
25 from app.utils import get_connector_attribute
24 -from app.db.db_session import get_db_session
25 -from app.connectors.utils import get_connector_info_from_db
26 +
27
28 async def get_single_alert_details(alert_details: CreateAlertRequest) -> GenericAlertModel:
29 """
@@ -91,6 +92,7 @@ async def verify_ask_socfortress_credentials(attributes: Dict[str, Any]) -> Dict
92 raise HTTPException(status_code=500, detail="Ask Socfortress credentials not found in the database")
93 return attributes
94
95 +
96 async def verify_ask_socfortress_connector(connector_name: str) -> str:
97 """
98 Verifies the Ask SocFortress connector.
@@ -119,6 +121,7 @@ async def verify_ask_socfortress_connector(connector_name: str) -> str:
121 logger.error("Failed to verify Ask Socfortress connector")
122 return {"connectionSuccessful": False, "message": "Failed to verify ASK SOCFortress connector"}
123
124 +
125 async def invoke_ask_socfortress_api(api_key: str, url: str, request: AskSocfortressSigmaRequest) -> dict:
126 """
127 Invokes the Socfortress Threat Intel API with the provided API key, URL, and request parameters.
backend/app/integrations/log_shipper_test/routes/event_shipper.py
+8 -8
@@ -1,9 +1,10 @@
1 +import json
2 +
3 from fastapi import APIRouter
4 +from fastapi import Depends
5 +from fastapi import HTTPException
6 from loguru import logger
7
4 -from fastapi import HTTPException
5 -from fastapi import Depends
6 -import json
8 from app.integrations.utils.event_shipper import event_shipper
9 from app.integrations.utils.schema import EventShipperPayload
10
@@ -16,14 +17,13 @@ async def event_shipper_test_route():
17 Test the log shipper.
18 """
19 message = EventShipperPayload(
19 - customer_code="test",
20 - integration="test",
21 - version="1.1",
22 - host="example.org",
20 + customer_code="test",
21 + integration="test",
22 + version="1.1",
23 + host="example.org",
24 )
25 try:
26 return await event_shipper(message)
27 except Exception as e:
28 logger.error(f"Failed to send test message to log shipper: {e}")
29 raise HTTPException(status_code=500, detail=f"Failed to send test message to log shipper: {e}")
29 -
backend/app/integrations/markdown/mimecast.md
+10 -2
@@ -2,12 +2,13 @@
2
3 When developing a script of server application integration you will:
4
5 -- Use a single user that has the Mimecast administrator permissions to perform the actions required by your use case.
6 -- Update the Authentication Cache TTL setting in the service user's effective Authentication Profile to "Never Expire."
5 +- Use a single user that has the Mimecast administrator permissions to perform the actions required by your use case.
6 +- Update the Authentication Cache TTL setting in the service user's effective Authentication Profile to "Never Expire."
7
8 This page provides a step-by-step guide to prepare a user for your integration and get the access key and secret key values required to authorize all requests to the API.
9
10 ### Step 1: Create a New User
11 +
12 1. Login to the Administration Console.
13 2. Navigate to the Administration | Directories | Internal Directories menu item to display a list of internal domains.
14 3. Select the internal domain where you would like to create your new user.
@@ -16,6 +17,7 @@ This page provides a step-by-step guide to prepare a user for your integration a
17 6. Keep a note of the password set as you will use this to get your Authentication Token in Step 6.
18
19 ### Step 2: Add the User to an Administrative Role
20 +
21 1. While logged into the Administration Console, navigate to the Administration | Account | Roles menu item to display the Roles page.
22 2. Right-click the Basic Administrator role and select Add users to role.
23 3. Browse or search to find the new user created in Step 1.
@@ -23,6 +25,7 @@ This page provides a step-by-step guide to prepare a user for your integration a
25 5. Select the Add selected users button to add the user to the role.
26
27 ### Step 3: Create a New Group and Add Your New User
28 +
29 1. While logged into the Administration Console, navigate to the Administration | Directories | Profile Groups menu item to display the Profile groups page.
30 2. Create a new group by selecting the plus icon on the parent folder where you would like to create the group. This creates a new group with the Name "New Folder"
31 3. To rename the group, select the newly created "New Folder" group. Then from the Edit group text box type the name you want to give the folder, for example, Splunk Admin and press the Enter key to apply the change.
@@ -31,6 +34,7 @@ This page provides a step-by-step guide to prepare a user for your integration a
34 6. Select Save and Exit to add the new user to the group.
35
36 ### Step 4: Create a New Authentication Profile
37 +
38 1. While logged into the Administration Console, navigate to the Administration | Services | Applications menu item to display the Application Settings page.
39 2. Select the Authentication Profiles button.
40 3. Select the New Authentication Profile button.
@@ -40,6 +44,7 @@ This page provides a step-by-step guide to prepare a user for your integration a
44 7. Select Save and Exit to create the profile.
45
46 ### Step 5: Create a New Application Setting
47 +
48 1. While logged into the Administration Console, navigate to the Administration | Services | Applications menu item to display the Application Settings page.
49 2. Select the New Application Settings button.
50 3. Type a Description.
@@ -49,12 +54,15 @@ This page provides a step-by-step guide to prepare a user for your integration a
54 7. Select Save and Exit to create and apply the Application Settings to your new group and user.
55
56 ### Step 6: Get Your Authentication Token
57 +
58 Now that you have a dedicated user who will receive an Authentication Token that will never expire, the final preparation task is to get the Authentication Token for the user.
59
60 #### Get an Authentication Token Using Windows
61 +
62 NOTE: This process has been tested in Powershell version 4 and 5.
63
64 Copy paste the following script into a Powershell window:
65 +
66 ```powershell
67 $appId = Read-Host -Prompt 'Input your registered application id'
68
backend/app/integrations/markdown/office365.md
+119 -117
@@ -2,8 +2,7 @@ Documentation provided by [Wazuh](https://documentation.wazuh.com/current/cloud-
2
3 Learn how to monitor your organization's Office 365 activity with Wazuh in this section of our documentation.
4
5 -Monitoring Office 365 Activity
6 -==============================
5 +# Monitoring Office 365 Activity
6
7 The `audit log` allows organization admins to quickly review the actions performed by members of your organization. It includes details such as who performed the action, what the action was, and when it was performed.
8 This Wazuh module allows you to collect all the logs from Office 365 using its API. The Office 365 Management Activity API aggregates actions and events into tenant-specific content blobs, which are classified by the type and source of the content they contain.
@@ -20,11 +19,11 @@ To retrieve a content blob, make a GET request against the corresponding content
19
20 GET {content_uri}
21
23 -Office 365 API description can be found in this `link <https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference>`_.
22 +Office 365 API description can be found in this `link <https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference>`\_.
23
24 ### Office 365 API requirements
25
27 -For **Wazuh** to successfully connect to the **Office365 API**, an authentication process is required. To do this, we must provide the ``tenant_id``, ``client_id``, and ``client_secret`` of the application that we authorize in the organization.
26 +For **Wazuh** to successfully connect to the **Office365 API**, an authentication process is required. To do this, we must provide the `tenant_id`, `client_id`, and `client_secret` of the application that we authorize in the organization.
27
28 # Register your app
29
@@ -36,7 +35,7 @@ Fill in the name of your app, choose the desired account type and click on the *
35
36 ![Register your app](/src/assets/images/office365/1-azure-wazuh-app-register-application.png)
37
39 -The app is now registered, and you can see information about it in its **Overview** section, at this point we can get the ``client`` and ``tenant`` IDs:
38 +The app is now registered, and you can see information about it in its **Overview** section, at this point we can get the `client` and `tenant` IDs:
39
40 ![Register your app](/src/assets/images/office365/2-azure-wazuh-app-overview.png)
41
@@ -55,19 +54,19 @@ Make sure you write it down because the UI won’t let you copy it afterward.
54
55 # API permissions
56
58 - The application needs specific API permissions to be able to request the Office 365 activity events. In this case, you are looking for permissions related to the ``https://manage.office.com`` resource.
57 +The application needs specific API permissions to be able to request the Office 365 activity events. In this case, you are looking for permissions related to the `https://manage.office.com` resource.
58
60 - To configure the application permissions, go to the **API permissions** page and choose **Add a permission**. Select the **Office 365 Management APIs** and click on **Application permissions**.
59 +To configure the application permissions, go to the **API permissions** page and choose **Add a permission**. Select the **Office 365 Management APIs** and click on **Application permissions**.
60
62 - You need to add the following permissions under the **ActivityFeed** group:
61 +You need to add the following permissions under the **ActivityFeed** group:
62
64 -- ``ActivityFeed.Read``. Read activity data for your organization.
63 +- `ActivityFeed.Read`. Read activity data for your organization.
64
66 -- ``ActivityFeed.ReadDlp``. Read DLP policy events including detected sensitive data.
65 +- `ActivityFeed.ReadDlp`. Read DLP policy events including detected sensitive data.
66
67 ![API permissions](/src/assets/images/office365/4-azure-wazuh-app-configure-permissions.png)
68
70 - Admin consent is required for API permission changes.
69 +Admin consent is required for API permission changes.
70
71 ![API permissions](/src/assets/images/office365/4-azure-wazuh-app-configure-permissions-admin-consent.png)
72
@@ -75,132 +74,135 @@ Make sure you write it down because the UI won’t let you copy it afterward.
74
75 Next, we will see the options we have to configure for the Wazuh integration.
76
78 -Configure the ``office365`` module either in the Wazuh manager or the Wazuh agent. To do so, modify the :doc:`ossec.conf </user-manual/reference/ossec-conf/index>` configuration file. Through the following configuration, Wazuh is ready to search for logs created by Office 365 audit-log. In this case, we will only search for the ``Audit.SharePoint`` type events within an interval of ``1m``. Those logs will be only those that were created after the module was started:
77 +Configure the `office365` module either in the Wazuh manager or the Wazuh agent. To do so, modify the :doc:`ossec.conf </user-manual/reference/ossec-conf/index>` configuration file. Through the following configuration, Wazuh is ready to search for logs created by Office 365 audit-log. In this case, we will only search for the `Audit.SharePoint` type events within an interval of `1m`. Those logs will be only those that were created after the module was started:
78 +
79 ```html
80 - <office365>
81 - <enabled>yes</enabled>
82 - <interval>1m</interval>
83 - <curl_max_size>1M</curl_max_size>
84 - <only_future_events>yes</only_future_events>
85 - <api_auth>
86 - <tenant_id>your_tenant_id</tenant_id>
87 - <client_id>your_client_id</client_id>
88 - <client_secret>your_client_secret</client_secret>
89 - <api_type>commercial</api_type>
90 - </api_auth>
91 - <subscriptions>
92 - <subscription>Audit.SharePoint</subscription>
93 - </subscriptions>
94 - </office365>
80 +<office365>
81 + <enabled>yes</enabled>
82 + <interval>1m</interval>
83 + <curl_max_size>1M</curl_max_size>
84 + <only_future_events>yes</only_future_events>
85 + <api_auth>
86 + <tenant_id>your_tenant_id</tenant_id>
87 + <client_id>your_client_id</client_id>
88 + <client_secret>your_client_secret</client_secret>
89 + <api_type>commercial</api_type>
90 + </api_auth>
91 + <subscriptions>
92 + <subscription>Audit.SharePoint</subscription>
93 + </subscriptions>
94 +</office365>
95 ```
96 +
97 To learn more, check the :ref:`office365-module` module reference.
98
99 Using the configuration mentioned above, we will see an example of monitoring Office 365 activity.
100
101 ### Generate activity on Office 365
102
102 -For this example, we will start by generating some activity in our Office 365 Organization. In this case, let's modify a ``Communication site`` in ``SharePoint``. If we do that, we can see that Office 365 will generate a new json event, something like this:
103 +For this example, we will start by generating some activity in our Office 365 Organization. In this case, let's modify a `Communication site` in `SharePoint`. If we do that, we can see that Office 365 will generate a new json event, something like this:
104 +
105 ```json
104 - {
105 - "CreationTime":"2021-06-09T22:10:45",
106 - "Id":"xxxx-xxxx-xxxx-xxxx-xxxx",
107 - "Operation":"FileModified",
108 - "OrganizationId":"xxxx-xxxx-xxxx-xxxx-xxxx",
109 - "RecordType":"6",
110 - "UserKey":"i:xx.f|membership|xxxx@live.com",
111 - "UserType":"0",
112 - "Version":"1",
113 - "Workload":"SharePoint",
114 - "ClientIP":"xxx.xx.x.xxx",
115 - "ObjectId":"https://xxxx.sharepoint.com/SitePages/xxxx.aspx",
116 - "UserId":"xxx.xxx@xxx.com",
117 - "CorrelationId":"0b50d09f-e0f2-2000-d9c7-a5b468efc712",
118 - "DoNotDistributeEvent":"true",
119 - "EventSource":"SharePoint",
120 - "ItemType":"File",
121 - "ListId":"xxxx-xxxx-xxxx-xxxx-xxxx",
122 - "ListItemUniqueId":"xxxx-xxxx-xxxx-xxxx-xxxx",
123 - "Site":"xxxx-xxxx-xxxx-xxxx-xxxx",
124 - "UserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36",
125 - "WebId":"xxxx-xxxx-xxxx-xxxx-xxxx",
126 - "SourceFileExtension":"aspx",
127 - "SiteUrl":"https://xxxx.sharepoint.com/",
128 - "SourceFileName":"xxxx.aspx",
129 - "SourceRelativeUrl":"SitePages"
130 - }
106 +{
107 + "CreationTime": "2021-06-09T22:10:45",
108 + "Id": "xxxx-xxxx-xxxx-xxxx-xxxx",
109 + "Operation": "FileModified",
110 + "OrganizationId": "xxxx-xxxx-xxxx-xxxx-xxxx",
111 + "RecordType": "6",
112 + "UserKey": "i:xx.f|membership|xxxx@live.com",
113 + "UserType": "0",
114 + "Version": "1",
115 + "Workload": "SharePoint",
116 + "ClientIP": "xxx.xx.x.xxx",
117 + "ObjectId": "https://xxxx.sharepoint.com/SitePages/xxxx.aspx",
118 + "UserId": "xxx.xxx@xxx.com",
119 + "CorrelationId": "0b50d09f-e0f2-2000-d9c7-a5b468efc712",
120 + "DoNotDistributeEvent": "true",
121 + "EventSource": "SharePoint",
122 + "ItemType": "File",
123 + "ListId": "xxxx-xxxx-xxxx-xxxx-xxxx",
124 + "ListItemUniqueId": "xxxx-xxxx-xxxx-xxxx-xxxx",
125 + "Site": "xxxx-xxxx-xxxx-xxxx-xxxx",
126 + "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36",
127 + "WebId": "xxxx-xxxx-xxxx-xxxx-xxxx",
128 + "SourceFileExtension": "aspx",
129 + "SiteUrl": "https://xxxx.sharepoint.com/",
130 + "SourceFileName": "xxxx.aspx",
131 + "SourceRelativeUrl": "SitePages"
132 +}
133 ```
134
135 ### Wazuh Rules
136
135 -Wazuh provides a series of rules to catch different events on Office365, for this example we will take the rule id ``91537`` which detects a ``Office 365: SharePoint file operation events.`` action.
137 +Wazuh provides a series of rules to catch different events on Office365, for this example we will take the rule id `91537` which detects a `Office 365: SharePoint file operation events.` action.
138
139 ```html
138 - <rule id="91537" level="3">
139 - <if_sid>91532</if_sid>
140 - <field name="office365.RecordType" type="osregex">^6$</field>
141 - <description>Office 365: SharePoint file operation events.</description>
142 - <options>no_full_log</options>
143 - <group>SharePointFileOperation</group>
144 - </rule>
140 +<rule id="91537" level="3">
141 + <if_sid>91532</if_sid>
142 + <field name="office365.RecordType" type="osregex">^6$</field>
143 + <description>Office 365: SharePoint file operation events.</description>
144 + <options>no_full_log</options>
145 + <group>SharePointFileOperation</group>
146 +</rule>
147 ```
148
149 If Wazuh successfully connects to Office 365 API, the events raised above will trigger these rules and cause an alert like this:
150
151 ```json
150 - {
151 - "timestamp":"2021-06-09T22:12:54.301+0000",
152 - "rule":{
153 - "level":3,
154 - "description":"Office 365: SharePoint file operation events.",
155 - "id":"91537",
156 - "firedtimes":2,
157 - "mail":false,
158 - "groups":["office365","SharePointFileOperation"]
159 - },
160 - "agent":{
161 - "id":"001",
162 - "name":"ubuntu-bionic"
163 - },
164 - "manager":{
165 - "name":"ubuntu-bionic"
166 - },
167 - "id":"1623276774.47272",
168 - "decoder":{
169 - "name":"json"
170 - },
171 - "data":{
172 - "integration":"office365",
173 - "office365":{
174 - "CreationTime":"2021-06-09T22:10:45",
175 - "Id":"xxxx-xxxx-xxxx-xxxx-xxxx",
176 - "Operation":"FileModified",
177 - "OrganizationId":"xxxx-xxxx-xxxx-xxxx-xxxx",
178 - "RecordType":"6",
179 - "UserKey":"i:xx.f|membership|xxxx@live.com",
180 - "UserType":"0",
181 - "Version":"1",
182 - "Workload":"SharePoint",
183 - "ClientIP":"xxx.xx.x.xxx",
184 - "ObjectId":"https://xxxx.sharepoint.com/SitePages/xxxx.aspx",
185 - "UserId":"xxx.xxx@xxx.com",
186 - "CorrelationId":"0b50d09f-e0f2-2000-d9c7-a5b468efc712",
187 - "DoNotDistributeEvent":"true",
188 - "EventSource":"SharePoint",
189 - "ItemType":"File",
190 - "ListId":"xxxx-xxxx-xxxx-xxxx-xxxx",
191 - "ListItemUniqueId":"xxxx-xxxx-xxxx-xxxx-xxxx",
192 - "Site":"xxxx-xxxx-xxxx-xxxx-xxxx",
193 - "UserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36",
194 - "WebId":"xxxx-xxxx-xxxx-xxxx-xxxx",
195 - "SourceFileExtension":"aspx",
196 - "SiteUrl":"https://xxxx.sharepoint.com/",
197 - "SourceFileName":"xxxx.aspx",
198 - "SourceRelativeUrl":"SitePages",
199 - "Subscription":"Audit.SharePoint"
200 - }
201 - },
202 - "location":"office365"
203 - }
152 +{
153 + "timestamp": "2021-06-09T22:12:54.301+0000",
154 + "rule": {
155 + "level": 3,
156 + "description": "Office 365: SharePoint file operation events.",
157 + "id": "91537",
158 + "firedtimes": 2,
159 + "mail": false,
160 + "groups": ["office365", "SharePointFileOperation"]
161 + },
162 + "agent": {
163 + "id": "001",
164 + "name": "ubuntu-bionic"
165 + },
166 + "manager": {
167 + "name": "ubuntu-bionic"
168 + },
169 + "id": "1623276774.47272",
170 + "decoder": {
171 + "name": "json"
172 + },
173 + "data": {
174 + "integration": "office365",
175 + "office365": {
176 + "CreationTime": "2021-06-09T22:10:45",
177 + "Id": "xxxx-xxxx-xxxx-xxxx-xxxx",
178 + "Operation": "FileModified",
179 + "OrganizationId": "xxxx-xxxx-xxxx-xxxx-xxxx",
180 + "RecordType": "6",
181 + "UserKey": "i:xx.f|membership|xxxx@live.com",
182 + "UserType": "0",
183 + "Version": "1",
184 + "Workload": "SharePoint",
185 + "ClientIP": "xxx.xx.x.xxx",
186 + "ObjectId": "https://xxxx.sharepoint.com/SitePages/xxxx.aspx",
187 + "UserId": "xxx.xxx@xxx.com",
188 + "CorrelationId": "0b50d09f-e0f2-2000-d9c7-a5b468efc712",
189 + "DoNotDistributeEvent": "true",
190 + "EventSource": "SharePoint",
191 + "ItemType": "File",
192 + "ListId": "xxxx-xxxx-xxxx-xxxx-xxxx",
193 + "ListItemUniqueId": "xxxx-xxxx-xxxx-xxxx-xxxx",
194 + "Site": "xxxx-xxxx-xxxx-xxxx-xxxx",
195 + "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36",
196 + "WebId": "xxxx-xxxx-xxxx-xxxx-xxxx",
197 + "SourceFileExtension": "aspx",
198 + "SiteUrl": "https://xxxx.sharepoint.com/",
199 + "SourceFileName": "xxxx.aspx",
200 + "SourceRelativeUrl": "SitePages",
201 + "Subscription": "Audit.SharePoint"
202 + }
203 + },
204 + "location": "office365"
205 +}
206 ```
207
208 For further information, please refer to the [Modules](https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/settings.html#modules)
backend/app/integrations/mimecast/checkpoint/mimecast_00002.checkpoint
+1 -1
@@ -1 +1 @@
1 -eNo9js1SgzAURt_lbmUBmJDaGReBVgacjrVQge4wXGj4CTRQa3V8d9FF19_5zpxvGFGcNcoClhCHW4Wmv_WS1YZw3qU8O-Vl5NzF7lE0nNmLz01Tr8Jsty7SRrf76Fq1dTAE9Did3gqmeHpZuOo5jHd-fgj892ztvHgX4iVCvn4Nk4ta8SqonxLyCAb0ZTniBEvLgFFi1_bVX8UDtYlFmW0aIDTmE8aywxliJnUYJeye2fR2mK7DvM3oB-pR9upflgvRn9UsBm8fcctinJrw8wvUhUmz
\ No newline at end of file
1 +eNo9jstSgzAYRt_l38IigYZgZ1wErAxlOo5c7GWHIaUBGjCkxdrx3UUXrr9zznx3GAW_aCErWAJJD2khu40up8hYPNFWEqXXzLPy4MRbRh3_c9M2T-t9uqp2re6K7FZ3TTzE5GQ-3iqq2G7yA5Ws8zQqD3H0vl95L-G0CLdcvn4NJhBasTpunreLR7ChPx5HYWCJbRilOHd9_fvigbiu7zrYs4FrURqRy7OYIYoIpQR7PkLOv2Buw7whG65Cj7JXf7GS8_6i5jCERcYwpowg-P4BPsVKLQ
backend/app/integrations/mimecast/routes/mimecast.py
+25 -14
@@ -1,21 +1,27 @@
1 +from typing import Dict
2 +
3 from fastapi import APIRouter
4 from fastapi import Depends
5 +from fastapi import HTTPException
6 from fastapi import Security
7 from loguru import logger
8 from sqlalchemy.ext.asyncio import AsyncSession
6 -from fastapi import HTTPException
9
10 from app.auth.utils import AuthHandler
11 from app.db.db_session import get_db
10 -from app.integrations.mimecast.schema.mimecast import MimecastRequest, MimecastResponse, MimecastAuthKeys
12 from app.integrations.alert_escalation.services.general_alert import create_alert
12 -from app.integrations.routes import get_customer_integrations_by_customer_code, find_customer_integration
13 -from app.integrations.schema import CustomerIntegrationsResponse, CustomerIntegrations
13 +from app.integrations.mimecast.schema.mimecast import MimecastAuthKeys
14 +from app.integrations.mimecast.schema.mimecast import MimecastRequest
15 +from app.integrations.mimecast.schema.mimecast import MimecastResponse
16 from app.integrations.mimecast.services.mimecast import invoke_mimecast
15 -from typing import Dict
17 +from app.integrations.routes import find_customer_integration
18 +from app.integrations.routes import get_customer_integrations_by_customer_code
19 +from app.integrations.schema import CustomerIntegrations
20 +from app.integrations.schema import CustomerIntegrationsResponse
21
22 integration_mimecast_router = APIRouter()
23
24 +
25 async def get_customer_integration_response(customer_code: str, session: AsyncSession) -> CustomerIntegrationsResponse:
26 """
27 Retrieves the integration response for a customer.
@@ -35,6 +41,7 @@ async def get_customer_integration_response(customer_code: str, session: AsyncSe
41 raise HTTPException(status_code=404, detail="Customer integration settings not found.")
42 return customer_integration_response
43
44 +
45 def extract_mimecast_auth_keys(customer_integration: CustomerIntegrations) -> Dict[str, str]:
46 """
47 Extracts the authentication keys for Office365 integration from the given customer integration.
@@ -55,9 +62,15 @@ def extract_mimecast_auth_keys(customer_integration: CustomerIntegrations) -> Di
62 for auth_key in subscription.integration_auth_keys:
63 mimecast_auth_keys[auth_key.auth_key_name] = auth_key.auth_value
64 if not mimecast_auth_keys:
58 - raise HTTPException(status_code=404, detail="No auth keys found for Mimecast integration. Please create auth keys for Mimecast integration.")
65 + raise HTTPException(
66 + status_code=404,
67 + detail="No auth keys found for Mimecast integration. Please create auth keys for Mimecast integration.",
68 + )
69 except Exception as e:
60 - raise HTTPException(status_code=404, detail="No auth keys found for Mimecast integration. Please create auth keys for Mimecast integration.")
70 + raise HTTPException(
71 + status_code=404,
72 + detail="No auth keys found for Mimecast integration. Please create auth keys for Mimecast integration.",
73 + )
74 return mimecast_auth_keys
75
76
@@ -80,16 +93,14 @@ async def invoke_mimecast_route(mimecast_request: MimecastRequest, session: Asyn
93 """
94 customer_integration_response = await get_customer_integration_response(mimecast_request.customer_code, session)
95
83 - customer_integration = await find_customer_integration(mimecast_request.customer_code, mimecast_request.integration_name, customer_integration_response)
96 + customer_integration = await find_customer_integration(
97 + mimecast_request.customer_code,
98 + mimecast_request.integration_name,
99 + customer_integration_response,
100 + )
101
102 mimecast_auth_keys = extract_mimecast_auth_keys(customer_integration)
103
104 auth_keys = MimecastAuthKeys(**mimecast_auth_keys)
105
106 return await invoke_mimecast(mimecast_request, auth_keys)
90 -
91 -
92 -
93 -
94 -
95 -
backend/app/integrations/mimecast/routes/provision.py
+12 -8
@@ -1,15 +1,17 @@
1 from fastapi import APIRouter
2 from fastapi import Depends
3 +from fastapi import HTTPException
4 from fastapi import Security
5 from loguru import logger
6 from sqlalchemy.ext.asyncio import AsyncSession
6 -from fastapi import HTTPException
7 -from app.schedulers.models.scheduler import JobMetadata, CreateSchedulerRequest
7 +
8 from app.auth.utils import AuthHandler
9 from app.db.db_session import get_db
10 -from app.schedulers.services.invoke_mimecast import invoke_mimecast_integration
10 from app.integrations.mimecast.schema.mimecast import MimecastScheduledResponse
11 +from app.schedulers.models.scheduler import CreateSchedulerRequest
12 +from app.schedulers.models.scheduler import JobMetadata
13 from app.schedulers.scheduler import add_scheduler_jobs
14 +from app.schedulers.services.invoke_mimecast import invoke_mimecast_integration
15
16 integration_mimecast_scheduler_router = APIRouter()
17
@@ -29,9 +31,11 @@ async def invoke_mimecast_schedule_create(time_interval: int) -> MimecastSchedul
31 Returns:
32 ProvisionOffice365Response: The response object containing the result of the provisioning.
33 """
32 - await add_scheduler_jobs(CreateSchedulerRequest(function_name="invoke_mimecast_integration", time_interval=time_interval, job_id="invoke_mimecast_integration"))
34 + await add_scheduler_jobs(
35 + CreateSchedulerRequest(
36 + function_name="invoke_mimecast_integration",
37 + time_interval=time_interval,
38 + job_id="invoke_mimecast_integration",
39 + ),
40 + )
41 return MimecastScheduledResponse(success=True, message="Mimecast integration scheduled.")
34 -
35 -
36 -
37 -
backend/app/integrations/mimecast/schema/mimecast.py
+13 -4
@@ -5,10 +5,11 @@ from typing import List
5 from typing import Optional
6
7 from pydantic import BaseModel
8 -from pydantic import Extra, HttpUrl
9 -from pydantic import Field, root_validator
8 +from pydantic import Extra
9 +from pydantic import Field
10 +from pydantic import HttpUrl
11 +from pydantic import root_validator
12
11 -from enum import Enum
13
14 class PipelineRuleTitles(Enum):
15 WAZUH_INFO = "WAZUH CREATE FIELD SYSLOG LEVEL - INFO"
@@ -17,9 +18,11 @@ class PipelineRuleTitles(Enum):
18 WAZUH_ALERT = "WAZUH CREATE FIELD SYSLOG LEVEL - ALERT"
19 OFFICE365_TIMESTAMP = "Office365 Timestamp - UTC"
20
21 +
22 class PipelineTitles(Enum):
23 OFFICE365 = "OFFICE365 PROCESSING PIPELINE"
24
25 +
26 class MimecastRequest(BaseModel):
27 customer_code: str = Field(
28 ...,
@@ -43,6 +46,7 @@ class MimecastResponse(BaseModel):
46 success: bool
47 message: str
48
49 +
50 class MimecastAuthKeys(BaseModel):
51 APP_ID: str = Field(
52 ...,
@@ -70,11 +74,12 @@ class MimecastAuthKeys(BaseModel):
74 examples=["00002"],
75 )
76 URI = str = Field(
73 - '/api/audit/get-siem-logs',
77 + "/api/audit/get-siem-logs",
78 description="URI FOR YOUR API Endpoint",
79 examples=["/api/audit/get-siem-logs"],
80 )
81
82 +
83 class APIEndpointRegion(BaseModel):
84 code: str
85 api: HttpUrl
@@ -82,20 +87,24 @@ class APIEndpointRegion(BaseModel):
87 adminConsole: HttpUrl
88 name: str
89
90 +
91 class APIEndpointDataItem(BaseModel):
92 emailAddress: str
93 emailToken: str
94 authenticate: List
95 region: APIEndpointRegion
96
97 +
98 class APIEndpointMeta(BaseModel):
99 status: int
100
101 +
102 class APIEndpointData(BaseModel):
103 meta: APIEndpointMeta
104 data: List[APIEndpointDataItem]
105 fail: List
106
107 +
108 class MimecastAPIEndpointResponse(BaseModel):
109 data: APIEndpointData
110 success: bool
backend/app/integrations/mimecast/services/mimecast.py
+42 -27
@@ -1,34 +1,41 @@
1 -from fastapi import APIRouter
2 -from fastapi import Depends
3 -from fastapi import Security
1 +import base64
2 import datetime
5 -import os
6 -import json
7 -import hashlib
3 import hashlib
4 +import hmac
5 import io
10 -from zipfile import ZipFile
6 +import json
7 +import os
8 import shutil
12 -import hmac
13 -import requests
9 import time
15 -import base64
10 +import uuid
11 +from typing import Dict
12 +from zipfile import ZipFile
13 +
14 import aiofiles
15 +import requests
16 +from fastapi import APIRouter
17 +from fastapi import Depends
18 +from fastapi import HTTPException
19 +from fastapi import Security
20 from loguru import logger
21 from sqlalchemy.ext.asyncio import AsyncSession
19 -from fastapi import HTTPException
20 -from app.integrations.utils.event_shipper import event_shipper
21 -from app.integrations.utils.schema import EventShipperPayload
22 -import uuid
22
23 from app.auth.utils import AuthHandler
24 from app.db.db_session import get_db
26 -from app.integrations.mimecast.schema.mimecast import MimecastRequest, MimecastResponse, MimecastAuthKeys, MimecastAPIEndpointResponse
25 from app.integrations.alert_escalation.services.general_alert import create_alert
28 -from app.integrations.routes import get_customer_integrations_by_customer_code, find_customer_integration
29 -from app.integrations.schema import CustomerIntegrationsResponse, CustomerIntegrations
30 -from typing import Dict
31 -from app.integrations.utils.collection import send_get_request, send_post_request
26 +from app.integrations.mimecast.schema.mimecast import MimecastAPIEndpointResponse
27 +from app.integrations.mimecast.schema.mimecast import MimecastAuthKeys
28 +from app.integrations.mimecast.schema.mimecast import MimecastRequest
29 +from app.integrations.mimecast.schema.mimecast import MimecastResponse
30 +from app.integrations.routes import find_customer_integration
31 +from app.integrations.routes import get_customer_integrations_by_customer_code
32 +from app.integrations.schema import CustomerIntegrations
33 +from app.integrations.schema import CustomerIntegrationsResponse
34 +from app.integrations.utils.collection import send_get_request
35 +from app.integrations.utils.collection import send_post_request
36 +from app.integrations.utils.event_shipper import event_shipper
37 +from app.integrations.utils.schema import EventShipperPayload
38 +
39
40 async def get_checkpoint_filename(customer_code: str):
41 """
@@ -36,7 +43,7 @@ async def get_checkpoint_filename(customer_code: str):
43 If the checkpoint file does not exist, it will be created asynchronously.
44 """
45 # Relative path from the current script to the checkpoint directory
39 - checkpoint_directory = os.path.join(os.path.dirname(__file__), '..', 'checkpoint')
46 + checkpoint_directory = os.path.join(os.path.dirname(__file__), "..", "checkpoint")
47 checkpoint_filename = os.path.join(checkpoint_directory, f"mimecast_{customer_code}.checkpoint")
48
49 # Normalize the path to remove relative path components
@@ -53,6 +60,7 @@ async def get_checkpoint_filename(customer_code: str):
60
61 return checkpoint_filename
62
63 +
64 async def get_log_file_path(customer_code: str):
65 """
66 Retrieves the log file path for the Mimecast integration and customer.
@@ -64,7 +72,7 @@ async def get_log_file_path(customer_code: str):
72 str: The log file path for the Mimecast integration and customer.
73 """
74 # Relative path from the current script to the log directory
67 - log_directory = os.path.join(os.path.dirname(__file__), '..', 'logs')
75 + log_directory = os.path.join(os.path.dirname(__file__), "..", "logs")
76 # Normalize the path to remove relative path components
77 log_directory = os.path.abspath(log_directory)
78
@@ -84,9 +92,11 @@ async def read_file(filename: str):
92 async with aiofiles.open(filename, "r") as f:
93 return await f.read()
94
95 +
96 async def get_hdr_date():
97 return datetime.datetime.utcnow().strftime("%a, %d %b %Y %H:%M:%S UTC")
98
99 +
100 async def get_base_url(mimecast_auth_keys: MimecastAuthKeys) -> MimecastAPIEndpointResponse:
101 """
102 Retrieves the base URL for the Mimecast integration.
@@ -109,7 +119,7 @@ async def get_base_url(mimecast_auth_keys: MimecastAuthKeys) -> MimecastAPIEndpo
119 headers=headers,
120 data=post_body,
121 )
112 - if response['success'] == True:
122 + if response["success"] == True:
123 logger.info(f"Successfully retrieved base URL for Mimecast integration. Response: {response}")
124 return MimecastAPIEndpointResponse(**response)
125 else:
@@ -119,6 +129,7 @@ async def get_base_url(mimecast_auth_keys: MimecastAuthKeys) -> MimecastAPIEndpo
129 logger.error(f"Unable to retrieve base URL for Mimecast integration. Exception: {e}")
130 raise HTTPException(status_code=400, detail="Unable to retrieve base URL for Mimecast integration.")
131
132 +
133 async def get_mta_siem_logs(checkpoint_filename: str, base_url: str, auth_keys: MimecastAuthKeys):
134 """
135 Retrieves the MTA SIEM logs from the Mimecast integration.
@@ -130,7 +141,6 @@ async def get_mta_siem_logs(checkpoint_filename: str, base_url: str, auth_keys:
141 post_body["data"][0]["compress"] = True
142 post_body["data"][0]["token"] = await read_file(checkpoint_filename)
143
133 -
144 # Create variables required for request headers
145 request_id = str(uuid.uuid4())
146 request_date = await get_hdr_date()
@@ -165,6 +175,7 @@ async def get_mta_siem_logs(checkpoint_filename: str, base_url: str, auth_keys:
175 logger.error(f"Unable to retrieve MTA SIEM logs from Mimecast integration. Exception: {e}")
176 raise HTTPException(status_code=400, detail="Unable to retrieve MTA SIEM logs from Mimecast integration.")
177
178 +
179 async def process_response(response, checkpoint_filename: str, log_file_path: str):
180 """
181 Processes the response body from the Mimecast integration.
@@ -190,6 +201,7 @@ async def process_response(response, checkpoint_filename: str, log_file_path: st
201 await write_log_file(log_filename, resp_body)
202 return None
203
204 +
205 async def write_checkpoint_file(filename: str, data: str):
206 """
207 Writes the given data to the given file.
@@ -197,6 +209,7 @@ async def write_checkpoint_file(filename: str, data: str):
209 async with aiofiles.open(filename, "w") as f:
210 await f.write(data)
211
212 +
213 async def write_log_file(filename: str, resp_body):
214 """
215 Writes the given data to the given file.
@@ -213,6 +226,7 @@ async def write_log_file(filename: str, resp_body):
226 async with aiofiles.open(filename, "w") as f:
227 await f.write(resp_body)
228
229 +
230 async def process_log_file(filename: str, filename2: str, log_file_path: str, customer_code: str):
231 """
232 Process a log file by reading its contents and shipping events.
@@ -243,7 +257,7 @@ async def read_and_ship_log_file(file_path: str, customer_code: str):
257 """
258 Reads a log file line by line, converts each line to JSON, and ships the event.
259 """
246 - with open(file_path, 'r', encoding='utf-8') as file:
260 + with open(file_path, "r", encoding="utf-8") as file:
261 for line in file:
262 log_entry = convert_to_json(line)
263 message = EventShipperPayload(
@@ -271,9 +285,9 @@ def convert_to_json(log_line: str) -> dict:
285 Converts a log line to a JSON object.
286 """
287 log_dict = {}
274 - for pair in log_line.split('|'):
275 - if '=' in pair:
276 - key, value = pair.split('=', 1)
288 + for pair in log_line.split("|"):
289 + if "=" in pair:
290 + key, value = pair.split("=", 1)
291 log_dict[key.strip()] = value.strip()
292 return log_dict
293
@@ -288,6 +302,7 @@ async def delete_log_directory(log_file_path: str):
302 except OSError as e:
303 raise HTTPException(status_code=400, detail=f"Error: {e.strerror}. Directory: {log_file_path}")
304
305 +
306 async def invoke_mimecast(mimecast_request: MimecastRequest, auth_keys: MimecastAuthKeys) -> MimecastResponse:
307 """
308 Invokes the Mimecast integration.
backend/app/integrations/models/customer_integration_settings.py
+13 -3
@@ -1,6 +1,11 @@
1 -from typing import List, Optional
2 -from sqlmodel import Field, Relationship, SQLModel
1 +from typing import List
2 +from typing import Optional
3 +
4 from sqlalchemy import Text
5 +from sqlmodel import Field
6 +from sqlmodel import Relationship
7 +from sqlmodel import SQLModel
8 +
9
10 class AvailableIntegrations(SQLModel, table=True):
11 __tablename__ = "available_integrations"
@@ -11,6 +16,7 @@ class AvailableIntegrations(SQLModel, table=True):
16 # Relationships
17 auth_keys: List["AvailableIntegrationsAuthKeys"] = Relationship(back_populates="integration")
18
19 +
20 class AvailableIntegrationsAuthKeys(SQLModel, table=True):
21 __tablename__ = "available_integrations_auth_keys"
22 id: Optional[int] = Field(default=None, primary_key=True)
@@ -20,6 +26,7 @@ class AvailableIntegrationsAuthKeys(SQLModel, table=True):
26 # Relationships
27 integration: "AvailableIntegrations" = Relationship(back_populates="auth_keys")
28
29 +
30 class CustomerIntegrations(SQLModel, table=True):
31 __tablename__ = "customer_integrations"
32 id: Optional[int] = Field(default=None, primary_key=True)
@@ -31,6 +38,7 @@ class CustomerIntegrations(SQLModel, table=True):
38 # Relationships
39 integration_subscriptions: List["IntegrationSubscription"] = Relationship(back_populates="customer_integrations")
40
41 +
42 class IntegrationService(SQLModel, table=True):
43 __tablename__ = "integration_services"
44 id: Optional[int] = Field(default=None, primary_key=True)
@@ -40,6 +48,7 @@ class IntegrationService(SQLModel, table=True):
48 integration_subscriptions: List["IntegrationSubscription"] = Relationship(back_populates="integration_service")
49 configs: List["IntegrationConfig"] = Relationship(back_populates="integration_service")
50
51 +
52 class IntegrationSubscription(SQLModel, table=True):
53 __tablename__ = "integration_subscriptions"
54 id: Optional[int] = Field(default=None, primary_key=True)
@@ -50,6 +59,7 @@ class IntegrationSubscription(SQLModel, table=True):
59 integration_service: "IntegrationService" = Relationship(back_populates="integration_subscriptions")
60 integration_auth_keys: List["IntegrationAuthKeys"] = Relationship(back_populates="integration_subscription") # Moved here
61
62 +
63 class IntegrationConfig(SQLModel, table=True):
64 __tablename__ = "integration_configs"
65 id: Optional[int] = Field(default=None, primary_key=True)
@@ -59,6 +69,7 @@ class IntegrationConfig(SQLModel, table=True):
69 # Relationships
70 integration_service: "IntegrationService" = Relationship(back_populates="configs")
71
72 +
73 class IntegrationAuthKeys(SQLModel, table=True):
74 __tablename__ = "integration_auth_keys"
75 id: Optional[int] = Field(default=None, primary_key=True)
@@ -67,4 +78,3 @@ class IntegrationAuthKeys(SQLModel, table=True):
78 auth_value: str = Field(max_length=1024) # e.g., JSON/encrypted credentials
79 # Relationships
80 integration_subscription: "IntegrationSubscription" = Relationship(back_populates="integration_auth_keys") # Adjusted relationship
70 -
backend/app/integrations/office365/routes/provision.py
+25 -13
@@ -1,22 +1,27 @@
1 +from typing import Dict
2 +
3 from fastapi import APIRouter
4 from fastapi import Depends
5 +from fastapi import HTTPException
6 from fastapi import Security
7 from loguru import logger
8 from sqlalchemy.ext.asyncio import AsyncSession
6 -from fastapi import HTTPException
9
10 from app.auth.utils import AuthHandler
11 from app.db.db_session import get_db
10 -from app.integrations.office365.schema.provision import ProvisionOffice365Request
11 -from app.integrations.office365.schema.provision import ProvisionOffice365Response, ProvisionOffice365AuthKeys
12 from app.integrations.alert_escalation.services.general_alert import create_alert
13 -from app.integrations.routes import get_customer_integrations_by_customer_code, find_customer_integration
14 -from app.integrations.schema import CustomerIntegrationsResponse, CustomerIntegrations
13 +from app.integrations.office365.schema.provision import ProvisionOffice365AuthKeys
14 +from app.integrations.office365.schema.provision import ProvisionOffice365Request
15 +from app.integrations.office365.schema.provision import ProvisionOffice365Response
16 from app.integrations.office365.services.provision import provision_office365
16 -from typing import Dict
17 +from app.integrations.routes import find_customer_integration
18 +from app.integrations.routes import get_customer_integrations_by_customer_code
19 +from app.integrations.schema import CustomerIntegrations
20 +from app.integrations.schema import CustomerIntegrationsResponse
21
22 integration_office365_router = APIRouter()
23
24 +
25 async def get_customer_integration_response(customer_code: str, session: AsyncSession) -> CustomerIntegrationsResponse:
26 """
27 Retrieves the integration response for a customer.
@@ -36,6 +41,7 @@ async def get_customer_integration_response(customer_code: str, session: AsyncSe
41 raise HTTPException(status_code=404, detail="Customer integration settings not found.")
42 return customer_integration_response
43
44 +
45 def extract_office365_auth_keys(customer_integration: CustomerIntegrations) -> Dict[str, str]:
46 """
47 Extracts the authentication keys for Office365 integration from the given customer integration.
@@ -55,7 +61,10 @@ def extract_office365_auth_keys(customer_integration: CustomerIntegrations) -> D
61 for auth_key in subscription.integration_auth_keys:
62 office365_auth_keys[auth_key.auth_key_name] = auth_key.auth_value
63 if not office365_auth_keys:
58 - raise HTTPException(status_code=404, detail="No auth keys found for Office365 integration. Please create auth keys for Office365 integration.")
64 + raise HTTPException(
65 + status_code=404,
66 + detail="No auth keys found for Office365 integration. Please create auth keys for Office365 integration.",
67 + )
68 return office365_auth_keys
69
70
@@ -65,7 +74,10 @@ def extract_office365_auth_keys(customer_integration: CustomerIntegrations) -> D
74 description="Provision Office365 integration for a customer.",
75 dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
76 )
68 -async def provision_office365_route(provision_office365_request: ProvisionOffice365Request, session: AsyncSession = Depends(get_db)) -> ProvisionOffice365Response:
77 +async def provision_office365_route(
78 + provision_office365_request: ProvisionOffice365Request,
79 + session: AsyncSession = Depends(get_db),
80 +) -> ProvisionOffice365Response:
81 """
82 Provisions Office365 integration for a customer.
83
@@ -78,14 +90,14 @@ async def provision_office365_route(provision_office365_request: ProvisionOffice
90 """
91 customer_integration_response = await get_customer_integration_response(provision_office365_request.customer_code, session)
92
81 - customer_integration = await find_customer_integration(provision_office365_request.customer_code, provision_office365_request.integration_name, customer_integration_response)
93 + customer_integration = await find_customer_integration(
94 + provision_office365_request.customer_code,
95 + provision_office365_request.integration_name,
96 + customer_integration_response,
97 + )
98
99 office365_auth_keys = extract_office365_auth_keys(customer_integration)
100
101 auth_keys = ProvisionOffice365AuthKeys(**office365_auth_keys)
102
103 return await provision_office365(provision_office365_request.customer_code, auth_keys, session)
88 -
89 -
90 -
91 -
backend/app/integrations/office365/schema/provision.py
+5 -2
@@ -6,9 +6,9 @@ from typing import Optional
6
7 from pydantic import BaseModel
8 from pydantic import Extra
9 -from pydantic import Field, root_validator
9 +from pydantic import Field
10 +from pydantic import root_validator
11
11 -from enum import Enum
12
13 class PipelineRuleTitles(Enum):
14 WAZUH_INFO = "WAZUH CREATE FIELD SYSLOG LEVEL - INFO"
@@ -17,9 +17,11 @@ class PipelineRuleTitles(Enum):
17 WAZUH_ALERT = "WAZUH CREATE FIELD SYSLOG LEVEL - ALERT"
18 OFFICE365_TIMESTAMP = "Office365 Timestamp - UTC"
19
20 +
21 class PipelineTitles(Enum):
22 OFFICE365 = "OFFICE365 PROCESSING PIPELINE"
23
24 +
25 class ProvisionOffice365Request(BaseModel):
26 customer_code: str = Field(
27 ...,
@@ -43,6 +45,7 @@ class ProvisionOffice365Response(BaseModel):
45 success: bool
46 message: str
47
48 +
49 class ProvisionOffice365AuthKeys(BaseModel):
50 TENANT_ID: str = Field(
51 ...,
backend/app/integrations/office365/services/provision.py
+106 -71
@@ -1,52 +1,59 @@
1 -from loguru import logger
2 -from datetime import datetime
3 -from sqlalchemy.ext.asyncio import AsyncSession
4 -import requests
1 +import json
2 import os
6 -from sqlalchemy import update, and_
7 -
3 +from datetime import datetime
4 +from typing import List
5
6 +import requests
7 from dotenv import load_dotenv
10 -from app.integrations.models.customer_integration_settings import (
11 - CustomerIntegrations,
12 -)
13 -from app.customer_provisioning.services.grafana import get_opensearch_version
14 -import json
15 -from app.integrations.utils.schema import PraecoAlertConfig, PraecoProvisionAlertResponse
16 -from app.connectors.grafana.utils.universal import create_grafana_client
17 -from app.connectors.wazuh_indexer.utils.universal import create_wazuh_indexer_client
18 -from app.customer_provisioning.schema.grafana import GrafanaDatasource
19 -from app.utils import get_connector_attribute
20 -from app.customer_provisioning.schema.grafana import GrafanaDataSourceCreationResponse
21 -from app.connectors.grafana.services.dashboards import provision_dashboards
8 from fastapi import HTTPException
23 -from app.customer_provisioning.schema.graylog import StreamCreationResponse
9 +from loguru import logger
10 +from sqlalchemy import and_
11 +from sqlalchemy import update
12 +from sqlalchemy.ext.asyncio import AsyncSession
13 +
14 +from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
15 +from app.connectors.grafana.schema.dashboards import Office365Dashboard
16 +from app.connectors.grafana.services.dashboards import provision_dashboards
17 +from app.connectors.grafana.utils.universal import create_grafana_client
18 +from app.connectors.graylog.schema.pipelines import CreatePipeline
19 +from app.connectors.graylog.schema.pipelines import CreatePipelineRule
20 +from app.connectors.graylog.schema.pipelines import GraylogPipelinesResponse
21 from app.connectors.graylog.schema.pipelines import PipelineRulesResponse
25 -from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineRequest
22 from app.connectors.graylog.services.management import start_stream
27 -from app.customer_provisioning.schema.graylog import GraylogIndexSetCreationResponse
28 -from app.integrations.office365.schema.provision import ProvisionOffice365Response, ProvisionOffice365AuthKeys, PipelineRuleTitles, PipelineTitles
29 -from app.integrations.alert_escalation.services.general_alert import create_alert
23 +from app.connectors.graylog.services.pipelines import connect_stream_to_pipeline
24 +from app.connectors.graylog.services.pipelines import create_pipeline_graylog
25 +from app.connectors.graylog.services.pipelines import create_pipeline_rule
26 +from app.connectors.graylog.services.pipelines import get_pipeline_id
27 +from app.connectors.graylog.services.pipelines import get_pipeline_rules
28 from app.connectors.graylog.services.pipelines import get_pipelines
29 from app.connectors.graylog.utils.universal import send_post_request
32 -from typing import List
33 -from app.connectors.grafana.schema.dashboards import Office365Dashboard
34 -from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
35 -from app.customer_provisioning.schema.graylog import Office365EventStream
30 +from app.connectors.wazuh_indexer.utils.universal import create_wazuh_indexer_client
31 from app.connectors.wazuh_manager.utils.universal import send_get_request
32 from app.connectors.wazuh_manager.utils.universal import send_put_request
33 +from app.customer_provisioning.schema.grafana import GrafanaDatasource
34 +from app.customer_provisioning.schema.grafana import GrafanaDataSourceCreationResponse
35 +from app.customer_provisioning.schema.graylog import GraylogIndexSetCreationResponse
36 +from app.customer_provisioning.schema.graylog import Office365EventStream
37 +from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineRequest
38 +from app.customer_provisioning.schema.graylog import StreamCreationResponse
39 from app.customer_provisioning.schema.graylog import TimeBasedIndexSet
40 +from app.customer_provisioning.services.grafana import create_grafana_folder
41 +from app.customer_provisioning.services.grafana import get_opensearch_version
42 from app.customers.routes.customers import get_customer
40 -from app.connectors.graylog.schema.pipelines import GraylogPipelinesResponse
41 -from app.connectors.graylog.services.pipelines import get_pipeline_rules
42 -from app.connectors.graylog.services.pipelines import create_pipeline_rule, create_pipeline_graylog, get_pipeline_id, connect_stream_to_pipeline
43 -from app.connectors.graylog.schema.pipelines import CreatePipelineRule
44 -from app.connectors.graylog.schema.pipelines import CreatePipeline
43 from app.customers.routes.customers import get_customer_meta
46 -from app.customer_provisioning.services.grafana import create_grafana_folder
44 +from app.integrations.alert_escalation.services.general_alert import create_alert
45 +from app.integrations.models.customer_integration_settings import CustomerIntegrations
46 +from app.integrations.office365.schema.provision import PipelineRuleTitles
47 +from app.integrations.office365.schema.provision import PipelineTitles
48 +from app.integrations.office365.schema.provision import ProvisionOffice365AuthKeys
49 +from app.integrations.office365.schema.provision import ProvisionOffice365Response
50 +from app.integrations.utils.schema import PraecoAlertConfig
51 +from app.integrations.utils.schema import PraecoProvisionAlertResponse
52 +from app.utils import get_connector_attribute
53
54 load_dotenv()
55
56 +
57 ############ ! WAZUH MANAGER ! ############
58 async def get_wazuh_configuration() -> str:
59 """
@@ -58,7 +65,8 @@ async def get_wazuh_configuration() -> str:
65 endpoint = "manager/configuration"
66 params = {"raw": True}
67 response = await send_get_request(endpoint=endpoint, params=params)
61 - return response['data']
68 + return response["data"]
69 +
70
71 async def office365_template_with_api_type(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys) -> str:
72 """
@@ -102,6 +110,7 @@ async def office365_template_with_api_type(customer_code: str, provision_office3
110
111 return template
112
113 +
114 async def office365_template(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys) -> str:
115 """
116 Returns a configured Office365 template for Wazuh.
@@ -143,6 +152,7 @@ async def office365_template(customer_code: str, provision_office365_auth_keys:
152
153 return template
154
155 +
156 async def append_office365_template(wazuh_config: str, office365_template: str) -> str:
157 """
158 Appends the Office365 template to the Wazuh configuration.
@@ -157,6 +167,7 @@ async def append_office365_template(wazuh_config: str, office365_template: str)
167
168 return wazuh_config + office365_template
169
170 +
171 async def update_wazuh_configuration(wazuh_config: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys) -> None:
172 """
173 Updates the Wazuh configuration. If it fails, remove the <api_type> tag and retry.
@@ -166,12 +177,12 @@ async def update_wazuh_configuration(wazuh_config: str, provision_office365_auth
177 provision_office365_auth_keys (ProvisionOffice365AuthKeys): The Office365 authentication keys.
178 """
179 endpoint = "manager/configuration"
169 - data = wazuh_config.encode('utf-8')
180 + data = wazuh_config.encode("utf-8")
181
182 try:
183 # First attempt to update configuration
184 response = await send_put_request(endpoint=endpoint, data=data, binary_data=True)
174 - if response.get('success') and response['data'].get('error') == 0:
185 + if response.get("success") and response["data"].get("error") == 0:
186 logger.info("Wazuh configuration updated successfully.")
187 return
188 else:
@@ -183,11 +194,11 @@ async def update_wazuh_configuration(wazuh_config: str, provision_office365_auth
194 # Remove <api_type> tag and retry
195 api_type_tag = f"<api_type>{provision_office365_auth_keys.API_TYPE}</api_type>"
196 modified_wazuh_config = wazuh_config.replace(api_type_tag, "")
186 - data = modified_wazuh_config.encode('utf-8')
197 + data = modified_wazuh_config.encode("utf-8")
198
199 try:
200 response = await send_put_request(endpoint=endpoint, data=data, binary_data=True)
190 - if response.get('success') and response['data'].get('error') == 0:
201 + if response.get("success") and response["data"].get("error") == 0:
202 logger.info("Wazuh configuration updated successfully after removing <api_type> tag.")
203 else:
204 logger.error("Failed to update Wazuh configuration after removing <api_type> tag. Error: {}".format(response))
@@ -222,6 +233,7 @@ async def restart_wazuh_manager() -> None:
233
234 ################## ! GRAYLOG ! ##################
235
236 +
237 async def build_index_set_config(customer_code: str, session: AsyncSession) -> TimeBasedIndexSet:
238 """
239 Build the configuration for a time-based index set.
@@ -258,6 +270,7 @@ async def build_index_set_config(customer_code: str, session: AsyncSession) -> T
270 field_type_refresh_interval=5000,
271 )
272
273 +
274 # Function to send the POST request and handle the response
275 async def send_index_set_creation_request(index_set: TimeBasedIndexSet) -> GraylogIndexSetCreationResponse:
276 """
@@ -304,9 +317,15 @@ def extract_index_set_id(response: GraylogIndexSetCreationResponse) -> str:
317 """
318 return response.data.id
319
320 +
321 # ! Event STREAMS ! #
322 # Function to create event stream configuration
309 -async def build_event_stream_config(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys, index_set_id: str, session: AsyncSession) -> Office365EventStream:
323 +async def build_event_stream_config(
324 + customer_code: str,
325 + provision_office365_auth_keys: ProvisionOffice365AuthKeys,
326 + index_set_id: str,
327 + session: AsyncSession,
328 +) -> Office365EventStream:
329 """
330 Build the configuration for a Wazuh event stream.
331
@@ -333,7 +352,7 @@ async def build_event_stream_config(customer_code: str, provision_office365_auth
352 "type": 1,
353 "inverted": False,
354 "value": f"{provision_office365_auth_keys.TENANT_ID}",
336 - }
355 + },
356 ],
357 matching_type="AND",
358 remove_matches_from_default_stream=True,
@@ -357,7 +376,12 @@ async def send_event_stream_creation_request(event_stream: Office365EventStream)
376 return StreamCreationResponse(**response_json)
377
378
360 -async def create_event_stream(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys, index_set_id: str, session: AsyncSession) -> StreamCreationResponse:
379 +async def create_event_stream(
380 + customer_code: str,
381 + provision_office365_auth_keys: ProvisionOffice365AuthKeys,
382 + index_set_id: str,
383 + session: AsyncSession,
384 +) -> StreamCreationResponse:
385 """
386 Creates an event stream for a customer.
387
@@ -374,6 +398,7 @@ async def create_event_stream(customer_code: str, provision_office365_auth_keys:
398
399 ############### ! PIPELINES AND RULES ! ################
400
401 +
402 # ! PIPELINE RULES ! #
403 async def check_pipeline_rules() -> None:
404 """
@@ -385,6 +410,7 @@ async def check_pipeline_rules() -> None:
410 logger.info(f"Creating pipeline rules: {non_existing_rules}")
411 await create_pipeline_rules(non_existing_rules)
412
413 +
414 async def pipeline_rules_exists(pipeline_rules: PipelineRulesResponse) -> List[str]:
415 """
416 Checks if the pipeline rules exist in Graylog and returns a list of non-existing pipeline rules.
@@ -395,6 +421,7 @@ async def pipeline_rules_exists(pipeline_rules: PipelineRulesResponse) -> List[s
421 if not any(rule.title == rule_title.value for rule in pipeline_rules.pipeline_rules)
422 ]
423
424 +
425 async def create_pipeline_rules(non_existing_rules: List[str]) -> None:
426 """
427 Creates the given pipeline rules.
@@ -411,77 +438,78 @@ async def create_pipeline_rules(non_existing_rules: List[str]) -> None:
438 logger.info(f"Creating pipeline rule {rule_title}.")
439 await rule_creators[rule_title](rule_title)
440
441 +
442 async def create_office365_utc_rule(rule_title: str) -> None:
443 """
444 Creates the 'Office365 Timestamp - UTC' pipeline rule.
445 """
446 rule_source = (
419 - f"rule \"{rule_title}\"\n"
447 + f'rule "{rule_title}"\n'
448 "when\n"
421 - " has_field(\"data_office_365_CreationTime\")\n"
449 + ' has_field("data_office_365_CreationTime")\n'
450 "then\n"
451 " let creation_time = $message.data_office_365_CreationTime;\n"
424 - " set_field(\"timestamp_utc\", creation_time);\n"
452 + ' set_field("timestamp_utc", creation_time);\n'
453 "end"
454 )
455 await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
456
457 +
458 async def create_wazuh_info_rule(rule_title: str) -> None:
459 """
460 Creates the 'WAZUH CREATE FIELD SYSLOG LEVEL - INFO' pipeline rule.
461 """
462 rule_source = (
434 - f"rule \"{rule_title}\"\n"
463 + f'rule "{rule_title}"\n'
464 "when\n"
465 " to_long($message.rule_level) > 0 AND to_long($message.rule_level) < 4\n"
466 "then\n"
438 - " set_field(\"syslog_level\", \"INFO\");\n"
467 + ' set_field("syslog_level", "INFO");\n'
468 "end"
469 )
470 await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
471
472 +
473 async def create_wazuh_warning_rule(rule_title: str) -> None:
474 """
475 Creates the 'WAZUH CREATE FIELD SYSLOG LEVEL - WARNING' pipeline rule.
476 """
477 rule_source = (
448 - f"rule \"{rule_title}\"\n"
478 + f'rule "{rule_title}"\n'
479 "when\n"
480 " to_long($message.rule_level) > 7 AND to_long($message.rule_level) < 12\n"
481 "then\n"
452 - " set_field(\"syslog_level\", \"WARNING\");\n"
482 + ' set_field("syslog_level", "WARNING");\n'
483 "end"
484 )
485 await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
486
487 +
488 async def create_wazuh_notice_rule(rule_title: str) -> None:
489 """
490 Creates the 'WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE' pipeline rule.
491 """
492 rule_source = (
462 - f"rule \"{rule_title}\"\n"
493 + f'rule "{rule_title}"\n'
494 "when\n"
495 " to_long($message.rule_level) > 3 AND to_long($message.rule_level) < 8\n"
496 "then\n"
466 - " set_field(\"syslog_level\", \"NOTICE\");\n"
497 + ' set_field("syslog_level", "NOTICE");\n'
498 "end"
499 )
500 await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
501
502 +
503 async def create_wazuh_alert_rule(rule_title: str) -> None:
504 """
505 Creates the 'WAZUH CREATE FIELD SYSLOG LEVEL - ALERT' pipeline rule.
506 """
507 rule_source = (
476 - f"rule \"{rule_title}\"\n"
477 - "when\n"
478 - " to_long($message.rule_level) > 11\n"
479 - "then\n"
480 - " set_field(\"syslog_level\", \"ALERT\");\n"
481 - "end"
508 + f'rule "{rule_title}"\n' "when\n" " to_long($message.rule_level) > 11\n" "then\n" ' set_field("syslog_level", "ALERT");\n' "end"
509 )
510 await create_pipeline_rule(CreatePipelineRule(title=rule_title, description=rule_title, source=rule_source))
511
512 +
513 # ! PIPELINE ! #
514 async def check_pipeline() -> None:
515 """
@@ -493,6 +521,7 @@ async def check_pipeline() -> None:
521 logger.info(f"Creating pipelines: {non_existing_pipelines}")
522 await create_pipeline(non_existing_pipelines)
523
524 +
525 async def pipeline_exists(pipelines: GraylogPipelinesResponse) -> List[str]:
526 """
527 Checks if the pipeline exists in Graylog and returns a list of non-existing pipelines.
@@ -503,6 +532,7 @@ async def pipeline_exists(pipelines: GraylogPipelinesResponse) -> List[str]:
532 if not any(pipeline.title == pipeline_title.value for pipeline in pipelines.pipelines)
533 ]
534
535 +
536 async def create_pipeline(non_existing_pipelines: List[str]) -> None:
537 """
538 Creates the given pipeline.
@@ -515,14 +545,13 @@ async def create_pipeline(non_existing_pipelines: List[str]) -> None:
545 logger.info(f"Creating pipeline {pipeline_title}.")
546 await pipeline_creators[pipeline_title](pipeline_title)
547
548 +
549 async def create_office365_pipeline(pipeline_title: str) -> None:
550 """
551 Creates the 'OFFICE365 PROCESSING PIPELINE' pipeline.
552 """
553 pipeline_description = "OFFICE365 PROCESSING PIPELINE"
523 - pipeline_source = (
524 - "pipeline \"OFFICE365 PROCESSING PIPELINE\"\nstage 0 match either\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - ALERT\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - INFO\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - WARNING\"\nrule \"Office365 Timestamp - UTC\"\nend"
525 - )
554 + pipeline_source = 'pipeline "OFFICE365 PROCESSING PIPELINE"\nstage 0 match either\nrule "WAZUH CREATE FIELD SYSLOG LEVEL - ALERT"\nrule "WAZUH CREATE FIELD SYSLOG LEVEL - INFO"\nrule "WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE"\nrule "WAZUH CREATE FIELD SYSLOG LEVEL - WARNING"\nrule "Office365 Timestamp - UTC"\nend'
555 await create_pipeline_graylog(CreatePipeline(title=pipeline_title, description=pipeline_description, source=pipeline_source))
556
557
@@ -545,7 +574,9 @@ async def create_grafana_datasource(
574 logger.info("Creating Grafana datasource")
575 grafana_client = await create_grafana_client("Grafana")
576 # Switch to the newly created organization
548 - grafana_client.user.switch_actual_user_organisation((await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id)
577 + grafana_client.user.switch_actual_user_organisation(
578 + (await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id,
579 + )
580 datasource_payload = GrafanaDatasource(
581 name="O365",
582 type="grafana-opensearch-datasource",
@@ -579,11 +610,14 @@ async def create_grafana_datasource(
610 return GrafanaDataSourceCreationResponse(**results)
611
612
582 -
583 -
613 ################## ! MAIN FUNCTION ! ##################
614
586 -async def provision_office365(customer_code: str, provision_office365_auth_keys: ProvisionOffice365AuthKeys, session: AsyncSession) -> ProvisionOffice365Response:
615 +
616 +async def provision_office365(
617 + customer_code: str,
618 + provision_office365_auth_keys: ProvisionOffice365AuthKeys,
619 + session: AsyncSession,
620 +) -> ProvisionOffice365Response:
621 logger.info(f"Provisioning Office365 integration for customer {customer_code}.")
622
623 # Get Wazuh configuration
@@ -624,14 +658,19 @@ async def provision_office365(customer_code: str, provision_office365_auth_keys:
658
659 # Grafana Deployment
660 office365_datasource_uid = (await create_grafana_datasource(customer_code=customer_code, session=session)).datasource.uid
627 - grafana_o365_folder_id = (await create_grafana_folder(organization_id=(await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id, folder_title="OFFICE 365")).id
661 + grafana_o365_folder_id = (
662 + await create_grafana_folder(
663 + organization_id=(await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id,
664 + folder_title="OFFICE 365",
665 + )
666 + ).id
667 await provision_dashboards(
668 DashboardProvisionRequest(
669 dashboards=[dashboard.name for dashboard in Office365Dashboard],
670 organizationId=(await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id,
671 folderId=grafana_o365_folder_id,
672 datasourceUid=office365_datasource_uid,
634 - )
673 + ),
674 )
675
676 # Create alert in Praeco
@@ -731,14 +770,10 @@ async def update_customer_integration_table(customer_code: str, session: AsyncSe
770 and_(
771 CustomerIntegrations.customer_code == customer_code,
772 CustomerIntegrations.integration_service_name == "Office365",
734 - )
773 + ),
774 )
736 - .values(deployed=True)
775 + .values(deployed=True),
776 )
777 await session.commit()
778
779 return None
741 -
742 -
743 -
744 -
backend/app/integrations/routes.py
+176 -94
@@ -1,42 +1,49 @@
1 from typing import List
2 +from typing import Optional
3
4 from fastapi import APIRouter
5 from fastapi import Depends
6 from fastapi import HTTPException
7 +from fastapi import Security
8 from loguru import logger
9 +from pydantic import ValidationError
10 +from sqlalchemy import delete
11 +from sqlalchemy import update
12 +from sqlalchemy.exc import NoResultFound
13 from sqlalchemy.ext.asyncio import AsyncSession
14 from sqlalchemy.future import select
15 from sqlalchemy.orm import joinedload
10 -from sqlalchemy.exc import NoResultFound
11 -from sqlalchemy import delete
12 -from fastapi import Security
13 -from app.auth.utils import AuthHandler
14 -from pydantic import ValidationError
15 -from sqlalchemy import update
16 -from typing import Optional
16
17 +from app.auth.utils import AuthHandler
18 from app.db.db_session import get_db
19 -from app.integrations.models.customer_integration_settings import (
20 - CustomerIntegrations,
21 -)
22 -from app.integrations.models.customer_integration_settings import (
23 - IntegrationService,
19 +from app.db.universal_models import Customers
20 +from app.db.universal_models import CustomersMeta
21 +from app.integrations.alert_creation_settings.models.alert_creation_settings import (
22 + AlertCreationSettings,
23 )
24 +from app.integrations.models.customer_integration_settings import AvailableIntegrations
25 +from app.integrations.models.customer_integration_settings import CustomerIntegrations
26 +from app.integrations.models.customer_integration_settings import IntegrationAuthKeys
27 +from app.integrations.models.customer_integration_settings import IntegrationConfig
28 +from app.integrations.models.customer_integration_settings import IntegrationService
29 from app.integrations.models.customer_integration_settings import (
30 IntegrationSubscription,
31 )
28 -from app.integrations.models.customer_integration_settings import (
29 - IntegrationConfig,
30 -)
31 -from app.integrations.models.customer_integration_settings import (
32 - IntegrationAuthKeys, AvailableIntegrations
33 -)
34 -from app.db.universal_models import Customers, CustomersMeta
35 -from app.integrations.schema import AvailableIntegrationsResponse, CustomerIntegrationCreate, CreateIntegrationService, CreateIntegrationAuthKeys, CustomerIntegrationCreateResponse, CustomerIntegrationsResponse, DeleteCustomerIntegration, CustomerIntegrationDeleteResponse, AuthKey, IntegrationWithAuthKeys, UpdateCustomerIntegration
36 -from app.integrations.alert_creation_settings.models.alert_creation_settings import AlertCreationSettings
32 +from app.integrations.schema import AuthKey
33 +from app.integrations.schema import AvailableIntegrationsResponse
34 +from app.integrations.schema import CreateIntegrationAuthKeys
35 +from app.integrations.schema import CreateIntegrationService
36 +from app.integrations.schema import CustomerIntegrationCreate
37 +from app.integrations.schema import CustomerIntegrationCreateResponse
38 +from app.integrations.schema import CustomerIntegrationDeleteResponse
39 +from app.integrations.schema import CustomerIntegrationsResponse
40 +from app.integrations.schema import DeleteCustomerIntegration
41 +from app.integrations.schema import IntegrationWithAuthKeys
42 +from app.integrations.schema import UpdateCustomerIntegration
43
44 integration_settings_router = APIRouter()
45
46 +
47 async def fetch_available_integrations(session: AsyncSession):
48 """
49 Fetches available integrations and their auth keys from the database.
@@ -61,7 +68,7 @@ async def fetch_available_integrations(session: AsyncSession):
68 integration_name=integration.integration_name,
69 description=integration.description,
70 integration_details=integration.integration_details,
64 - auth_keys=auth_keys
71 + auth_keys=auth_keys,
72 )
73 integrations_with_auth_keys.append(integration_data)
74
@@ -76,6 +83,7 @@ async def validate_integration_name(integration_name: str, session: AsyncSession
83 if integration_name not in [ai.integration_name for ai in available_integrations]:
84 raise HTTPException(status_code=400, detail=f"Integration {integration_name} is not a valid integration.")
85
86 +
87 async def validate_integration_auth_keys(integration_name: str, integration_auth_keys: List[AuthKey], session: AsyncSession):
88 """
89 Validate if the integration auth keys are valid.
@@ -88,6 +96,7 @@ async def validate_integration_auth_keys(integration_name: str, integration_auth
96 if auth_key not in [iak.auth_key_name for iak in integration_auth_keys]:
97 raise HTTPException(status_code=400, detail=f"Integration auth key {auth_key} does not exist.")
98
99 +
100 async def validate_integration_auth_key_update(integration_name: str, integration_auth_key: List[AuthKey], session: AsyncSession):
101 """
102 Validate if the integration auth key is valid.
@@ -100,6 +109,7 @@ async def validate_integration_auth_key_update(integration_name: str, integratio
109 if auth_key.auth_key_name not in available_auth_keys:
110 raise HTTPException(status_code=400, detail=f"Integration auth key {auth_key.auth_key_name} does not exist.")
111
112 +
113 async def validate_customer_code(customer_code: str, session: AsyncSession):
114 """
115 Validate if the customer code exists in the customers table.
@@ -109,6 +119,7 @@ async def validate_customer_code(customer_code: str, session: AsyncSession):
119 if result.scalars().first() is None:
120 raise HTTPException(status_code=400, detail=f"Customer {customer_code} does not exist.")
121
122 +
123 async def validate_customer_meta(customer_code: str, session: AsyncSession):
124 """
125 Validate if the customer code exists in the customers_meta table.
@@ -116,35 +127,53 @@ async def validate_customer_meta(customer_code: str, session: AsyncSession):
127 stmt = select(CustomersMeta).where(CustomersMeta.customer_code == customer_code)
128 result = await session.execute(stmt)
129 if result.scalars().first() is None:
119 - raise HTTPException(status_code=400, detail=f"Customer {customer_code} meta does not exist. Please provision the customer before creating an integration.")
130 + raise HTTPException(
131 + status_code=400,
132 + detail=f"Customer {customer_code} meta does not exist. Please provision the customer before creating an integration.",
133 + )
134 +
135
136 async def check_existing_customer_integration(customer_code: str, integration_name: str, session: AsyncSession):
137 """
138 Check if the customer integration already exists.
139 """
140 # Assuming IntegrationService has an 'integration_name' field or similar
126 - stmt = select(CustomerIntegrations).join(CustomerIntegrations.integration_subscriptions).join(IntegrationSubscription.integration_service).where(
127 - CustomerIntegrations.customer_code == customer_code,
128 - IntegrationService.service_name == integration_name
141 + stmt = (
142 + select(CustomerIntegrations)
143 + .join(CustomerIntegrations.integration_subscriptions)
144 + .join(IntegrationSubscription.integration_service)
145 + .where(CustomerIntegrations.customer_code == customer_code, IntegrationService.service_name == integration_name)
146 )
147 result = await session.execute(stmt)
148 if result.scalars().first() is not None:
149 raise HTTPException(status_code=400, detail=f"Customer integration {customer_code} {integration_name} already exists.")
150
134 -async def create_integration_service(integration_name: str, settings: CreateIntegrationService, session: AsyncSession) -> IntegrationService:
151 +
152 +async def create_integration_service(
153 + integration_name: str,
154 + settings: CreateIntegrationService,
155 + session: AsyncSession,
156 +) -> IntegrationService:
157 """
158 Create or fetch IntegrationService instance with custom configuration.
159 """
160 integration_service = IntegrationService(
161 service_name=integration_name,
162 auth_type=settings.auth_type,
141 - configs=[IntegrationConfig(config_key=settings.config_key, config_value=settings.config_value)]
163 + configs=[IntegrationConfig(config_key=settings.config_key, config_value=settings.config_value)],
164 )
165 session.add(integration_service)
166 await session.flush()
167 return integration_service
168
147 -async def create_customer_integrations(customer_code: str, customer_name: str, integration_service_id: int, integration_service_name: str, session: AsyncSession) -> CustomerIntegrations:
169 +
170 +async def create_customer_integrations(
171 + customer_code: str,
172 + customer_name: str,
173 + integration_service_id: int,
174 + integration_service_name: str,
175 + session: AsyncSession,
176 +) -> CustomerIntegrations:
177 """
178 Create CustomerIntegrations instance.
179 """
@@ -159,7 +188,13 @@ async def create_customer_integrations(customer_code: str, customer_name: str, i
188 await session.flush()
189 return customer_integrations
190
162 -async def create_integration_subscription(customer_integrations: CustomerIntegrations, integration_service: IntegrationService, integration_auth_keys: List[CreateIntegrationAuthKeys], session: AsyncSession):
191 +
192 +async def create_integration_subscription(
193 + customer_integrations: CustomerIntegrations,
194 + integration_service: IntegrationService,
195 + integration_auth_keys: List[CreateIntegrationAuthKeys],
196 + session: AsyncSession,
197 +):
198 """
199 Create IntegrationSubscription instance.
200 """
@@ -168,29 +203,31 @@ async def create_integration_subscription(customer_integrations: CustomerIntegra
203 new_integration_subscription = IntegrationSubscription(
204 customer_integrations=customer_integrations,
205 integration_service=integration_service,
171 - integration_auth_keys=[IntegrationAuthKeys(auth_key_name=auth_key.auth_key_name, auth_value=auth_key.auth_value)]
206 + integration_auth_keys=[IntegrationAuthKeys(auth_key_name=auth_key.auth_key_name, auth_value=auth_key.auth_value)],
207 )
208 session.add(new_integration_subscription)
209 await session.commit()
210
211 +
212 async def get_customer_and_service_ids(session, customer_code, integration_name):
213 try:
214 result = await session.execute(
215 select(CustomerIntegrations.id, IntegrationService.id)
216 .join(IntegrationSubscription, CustomerIntegrations.id == IntegrationSubscription.customer_id)
217 .join(IntegrationService, IntegrationSubscription.integration_service_id == IntegrationService.id)
182 - .where(CustomerIntegrations.customer_code == customer_code,
183 - IntegrationService.service_name == integration_name)
218 + .where(CustomerIntegrations.customer_code == customer_code, IntegrationService.service_name == integration_name),
219 )
220 return result.one()
221 except NoResultFound:
222 raise HTTPException(status_code=404, detail="Customer integration not found")
223
224 +
225 async def get_subscription_ids(session, customer_id, integration_service_id):
226 result = await session.execute(
191 - select(IntegrationSubscription.id)
192 - .where(IntegrationSubscription.customer_id == customer_id,
193 - IntegrationSubscription.integration_service_id == integration_service_id)
227 + select(IntegrationSubscription.id).where(
228 + IntegrationSubscription.customer_id == customer_id,
229 + IntegrationSubscription.integration_service_id == integration_service_id,
230 + ),
231 )
232 # Fetch all results
233 subscription_ids_raw = result.scalars().all()
@@ -206,43 +243,39 @@ async def get_subscription_ids(session, customer_id, integration_service_id):
243 else:
244 return []
245
246 +
247 async def delete_metadata(session, subscription_ids):
210 - await session.execute(
211 - delete(IntegrationAuthKeys)
212 - .where(IntegrationAuthKeys.subscription_id.in_(subscription_ids))
213 - )
248 + await session.execute(delete(IntegrationAuthKeys).where(IntegrationAuthKeys.subscription_id.in_(subscription_ids)))
249 +
250
251 async def delete_subscriptions(session, subscription_ids):
216 - await session.execute(
217 - delete(IntegrationSubscription)
218 - .where(IntegrationSubscription.id.in_(subscription_ids))
219 - )
252 + await session.execute(delete(IntegrationSubscription).where(IntegrationSubscription.id.in_(subscription_ids)))
253 +
254
255 async def delete_configs(session, integration_service_id):
222 - await session.execute(
223 - delete(IntegrationConfig)
224 - .where(IntegrationConfig.integration_service_id == integration_service_id)
225 - )
256 + await session.execute(delete(IntegrationConfig).where(IntegrationConfig.integration_service_id == integration_service_id))
257 +
258
259 async def delete_integration_service(session, integration_service_id):
228 - await session.execute(
229 - delete(IntegrationService)
230 - .where(IntegrationService.id == integration_service_id)
231 - )
260 + await session.execute(delete(IntegrationService).where(IntegrationService.id == integration_service_id))
261 +
262
263 async def delete_customer_integration_record(session, customer_id):
234 - await session.execute(
235 - delete(CustomerIntegrations)
236 - .where(CustomerIntegrations.id == customer_id)
237 - )
264 + await session.execute(delete(CustomerIntegrations).where(CustomerIntegrations.id == customer_id))
265 +
266
239 -async def find_customer_integration(customer_code: str, integration_name: str, customer_integration_response) -> Optional[CustomerIntegrations]:
267 +async def find_customer_integration(
268 + customer_code: str,
269 + integration_name: str,
270 + customer_integration_response,
271 +) -> Optional[CustomerIntegrations]:
272 for ci in customer_integration_response.available_integrations:
273 for subscription in ci.integration_subscriptions:
274 if subscription.integration_service.service_name == integration_name:
275 return ci
276 return None
277
278 +
279 def get_subscription_id(customer_integration, integration_name: str, auth_key_name: str) -> Optional[int]:
280 for subscription in customer_integration.integration_subscriptions:
281 if subscription.integration_service.service_name == integration_name:
@@ -251,12 +284,23 @@ def get_subscription_id(customer_integration, integration_name: str, auth_key_na
284 return subscription.id
285 return None
286
287 +
288 async def get_tenant_id(customer_integration: CustomerIntegrationCreate, session: AsyncSession) -> str:
289 """
290 Retrieves the Tenant ID for a given customer integration. This is the Office365 organization ID and
291 is used to create alerts for the customer in DFIR-IRIS.
292 """
259 - stmt = select(IntegrationAuthKeys).join(IntegrationSubscription, IntegrationAuthKeys.subscription_id == IntegrationSubscription.id).join(CustomerIntegrations, IntegrationSubscription.customer_id == CustomerIntegrations.id).join(IntegrationService, IntegrationSubscription.integration_service_id == IntegrationService.id).where(CustomerIntegrations.customer_code == customer_integration.customer_code, IntegrationService.service_name == customer_integration.integration_name, IntegrationAuthKeys.auth_key_name == "TENANT_ID")
293 + stmt = (
294 + select(IntegrationAuthKeys)
295 + .join(IntegrationSubscription, IntegrationAuthKeys.subscription_id == IntegrationSubscription.id)
296 + .join(CustomerIntegrations, IntegrationSubscription.customer_id == CustomerIntegrations.id)
297 + .join(IntegrationService, IntegrationSubscription.integration_service_id == IntegrationService.id)
298 + .where(
299 + CustomerIntegrations.customer_code == customer_integration.customer_code,
300 + IntegrationService.service_name == customer_integration.integration_name,
301 + IntegrationAuthKeys.auth_key_name == "TENANT_ID",
302 + )
303 + )
304
305 result = await session.execute(stmt)
306 tenant_id = result.scalars().first()
@@ -265,14 +309,20 @@ async def get_tenant_id(customer_integration: CustomerIntegrationCreate, session
309 logger.info(f"tenant_id: {tenant_id.auth_value}")
310 return tenant_id.auth_value
311
312 +
313 async def update_office365_organization_id(customer_code: str, tenant_id: str, session: AsyncSession):
314 """
315 Updates the Office365 organization ID in the alert_creation_settings table.
316 """
272 - stmt = update(AlertCreationSettings).where(AlertCreationSettings.customer_code == customer_code).values(office365_organization_id=tenant_id)
317 + stmt = (
318 + update(AlertCreationSettings)
319 + .where(AlertCreationSettings.customer_code == customer_code)
320 + .values(office365_organization_id=tenant_id)
321 + )
322 await session.execute(stmt)
323 await session.commit()
324
325 +
326 async def get_integration_service_id(integration_name: str, session: AsyncSession) -> int:
327 """
328 Retrieves the AvailableIntegrations ID for a given integration name.
@@ -284,6 +334,7 @@ async def get_integration_service_id(integration_name: str, session: AsyncSessio
334 raise HTTPException(status_code=404, detail=f"Integration service {integration_name} not found.")
335 return integration_service.id
336
337 +
338 async def get_integration_service_name(integration_name: str, session: AsyncSession) -> str:
339 """
340 Retrieves the AvailableIntegrations ID for a given integration name.
@@ -295,22 +346,19 @@ async def get_integration_service_name(integration_name: str, session: AsyncSess
346 raise HTTPException(status_code=404, detail=f"Integration service {integration_name} not found.")
347 return integration_service.integration_name
348
349 +
350 async def fetch_customer_integrations_data(session: AsyncSession):
351 """
352 Fetches customer integrations data from the database.
353 """
302 - stmt = (
303 - select(CustomerIntegrations)
304 - .options(
305 - joinedload(CustomerIntegrations.integration_subscriptions)
306 - .joinedload(IntegrationSubscription.integration_service),
307 - joinedload(CustomerIntegrations.integration_subscriptions)
308 - .subqueryload(IntegrationSubscription.integration_auth_keys)
309 - )
354 + stmt = select(CustomerIntegrations).options(
355 + joinedload(CustomerIntegrations.integration_subscriptions).joinedload(IntegrationSubscription.integration_service),
356 + joinedload(CustomerIntegrations.integration_subscriptions).subqueryload(IntegrationSubscription.integration_auth_keys),
357 )
358 result = await session.execute(stmt)
359 return result.scalars().unique().all()
360
361 +
362 def process_customer_integrations(customer_integrations_data):
363 """
364 Processes customer integrations data and returns a list of CustomerIntegrations objects.
@@ -324,14 +372,15 @@ def process_customer_integrations(customer_integrations_data):
372 customer_name=ci.customer_name,
373 integration_subscriptions=ci.integration_subscriptions,
374 integration_service_id=first_service_id,
327 - integration_service_name=ci.integration_subscriptions[0].integration_service.service_name if ci.integration_subscriptions else None,
375 + integration_service_name=ci.integration_subscriptions[0].integration_service.service_name
376 + if ci.integration_subscriptions
377 + else None,
378 deployed=ci.deployed,
379 )
380 processed_customer_integrations.append(customer_integration_obj)
381 return processed_customer_integrations
382
383
334 -
384 @integration_settings_router.get(
385 "/available_integrations",
386 response_model=AvailableIntegrationsResponse,
@@ -352,7 +401,6 @@ async def get_available_integrations(
401 )
402
403
355 -
404 @integration_settings_router.get(
405 "/customer_integrations",
406 response_model=CustomerIntegrationsResponse,
@@ -373,6 +421,7 @@ async def get_customer_integrations(session: AsyncSession = Depends(get_db)):
421 success=True,
422 )
423
424 +
425 @integration_settings_router.get(
426 "/customer_integrations/{customer_code}",
427 response_model=CustomerIntegrationsResponse,
@@ -389,10 +438,10 @@ async def get_customer_integrations_by_customer_code(
438 stmt = (
439 select(CustomerIntegrations)
440 .options(
392 - joinedload(CustomerIntegrations.integration_subscriptions)
393 - .joinedload(IntegrationSubscription.integration_service),
394 - joinedload(CustomerIntegrations.integration_subscriptions)
395 - .subqueryload(IntegrationSubscription.integration_auth_keys) # Load IntegrationAuthKeys
441 + joinedload(CustomerIntegrations.integration_subscriptions).joinedload(IntegrationSubscription.integration_service),
442 + joinedload(CustomerIntegrations.integration_subscriptions).subqueryload(
443 + IntegrationSubscription.integration_auth_keys,
444 + ), # Load IntegrationAuthKeys
445 )
446 .where(CustomerIntegrations.customer_code == customer_code)
447 )
@@ -405,11 +454,12 @@ async def get_customer_integrations_by_customer_code(
454 success=True,
455 )
456
457 +
458 @integration_settings_router.post(
459 "/create_integration",
460 response_model=CustomerIntegrationCreateResponse,
461 description="Create a new customer integration.",
412 - #dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
462 + # dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
463 )
464 async def create_integration(
465 customer_integration_create: CustomerIntegrationCreate,
@@ -419,28 +469,51 @@ async def create_integration(
469 Endpoint to create a new customer integration.
470 """
471 await validate_integration_name(customer_integration_create.integration_name, session)
422 - await validate_integration_auth_keys(customer_integration_create.integration_name, customer_integration_create.integration_auth_keys, session)
472 + await validate_integration_auth_keys(
473 + customer_integration_create.integration_name,
474 + customer_integration_create.integration_auth_keys,
475 + session,
476 + )
477 await validate_customer_code(customer_integration_create.customer_code, session)
478 await validate_customer_meta(customer_integration_create.customer_code, session)
425 - await check_existing_customer_integration(customer_integration_create.customer_code, customer_integration_create.integration_name, session)
479 + await check_existing_customer_integration(
480 + customer_integration_create.customer_code,
481 + customer_integration_create.integration_name,
482 + session,
483 + )
484 integration_service_id = await get_integration_service_id(customer_integration_create.integration_name, session)
485 integration_service_name = await get_integration_service_name(customer_integration_create.integration_name, session)
486
429 - integration_service = await create_integration_service(customer_integration_create.integration_name, settings=customer_integration_create.integration_config, session=session)
430 - customer_integrations = await create_customer_integrations(customer_integration_create.customer_code, customer_integration_create.customer_name, integration_service_id=integration_service_id, integration_service_name=integration_service_name, session=session)
431 - await create_integration_subscription(customer_integrations, integration_service, integration_auth_keys=customer_integration_create.integration_auth_keys, session=session)
487 + integration_service = await create_integration_service(
488 + customer_integration_create.integration_name,
489 + settings=customer_integration_create.integration_config,
490 + session=session,
491 + )
492 + customer_integrations = await create_customer_integrations(
493 + customer_integration_create.customer_code,
494 + customer_integration_create.customer_name,
495 + integration_service_id=integration_service_id,
496 + integration_service_name=integration_service_name,
497 + session=session,
498 + )
499 + await create_integration_subscription(
500 + customer_integrations,
501 + integration_service,
502 + integration_auth_keys=customer_integration_create.integration_auth_keys,
503 + session=session,
504 + )
505
506 # Office365 specific integration handling
507 if customer_integration_create.integration_name == "Office365":
508 tenant_id = await get_tenant_id(customer_integration_create, session)
509 await update_office365_organization_id(customer_integration_create.customer_code, tenant_id, session)
510
438 -
511 return CustomerIntegrationCreateResponse(
512 message=f"Customer integration {customer_integration_create.customer_code} {customer_integration_create.integration_name} successfully created.",
513 success=True,
514 )
515
516 +
517 @integration_settings_router.put(
518 "/update_integration/{customer_code}",
519 response_model=CustomerIntegrationCreateResponse,
@@ -458,22 +531,37 @@ async def update_integration(
531 if not customer_integration_response:
532 raise HTTPException(status_code=404, detail="Customer integrations not found")
533
461 - customer_integration = await find_customer_integration(customer_code, customer_integration_update.integration_name, customer_integration_response)
534 + customer_integration = await find_customer_integration(
535 + customer_code,
536 + customer_integration_update.integration_name,
537 + customer_integration_response,
538 + )
539
540 if not customer_integration:
541 raise HTTPException(status_code=404, detail="Customer integration with specified service name not found.")
542
466 - await validate_integration_auth_key_update(customer_integration_update.integration_name, customer_integration_update.integration_auth_keys, session)
543 + await validate_integration_auth_key_update(
544 + customer_integration_update.integration_name,
545 + customer_integration_update.integration_auth_keys,
546 + session,
547 + )
548
468 - subscription_id = get_subscription_id(customer_integration, customer_integration_update.integration_name, customer_integration_update.integration_auth_keys[0].auth_key_name)
549 + subscription_id = get_subscription_id(
550 + customer_integration,
551 + customer_integration_update.integration_name,
552 + customer_integration_update.integration_auth_keys[0].auth_key_name,
553 + )
554
555 if not subscription_id:
471 - raise HTTPException(status_code=404, detail=f"Integration auth key {customer_integration_update.integration_auth_keys[0].auth_key_name} not found.")
556 + raise HTTPException(
557 + status_code=404,
558 + detail=f"Integration auth key {customer_integration_update.integration_auth_keys[0].auth_key_name} not found.",
559 + )
560
561 await session.execute(
562 update(IntegrationAuthKeys)
563 .where(IntegrationAuthKeys.subscription_id == subscription_id)
476 - .values(auth_value=customer_integration_update.integration_auth_keys[0].auth_value)
564 + .values(auth_value=customer_integration_update.integration_auth_keys[0].auth_value),
565 )
566
567 await session.commit()
@@ -498,10 +586,7 @@ async def update_available_integrations(
586 Endpoint to update an available integration.
587 """
588 for integration in available_integrations:
501 - stmt = (
502 - select(AvailableIntegrations)
503 - .where(AvailableIntegrations.integration_name == integration.integration_name)
504 - )
589 + stmt = select(AvailableIntegrations).where(AvailableIntegrations.integration_name == integration.integration_name)
590 result = await session.execute(stmt)
591 existing_integration = result.scalars().first()
592
@@ -533,9 +618,7 @@ async def delete_integration(
618 customer_code = delete_customer_integration.customer_code
619 integration_name = delete_customer_integration.integration_name
620
536 - customer_id, integration_service_id = await get_customer_and_service_ids(
537 - session, customer_code, integration_name
538 - )
621 + customer_id, integration_service_id = await get_customer_and_service_ids(session, customer_code, integration_name)
622
623 subscription_ids = await get_subscription_ids(session, customer_id, integration_service_id)
624 if not subscription_ids:
@@ -553,4 +636,3 @@ async def delete_integration(
636 message=f"Customer integration {customer_code} {integration_name} successfully deleted.",
637 success=True,
638 )
556 -
backend/app/integrations/schema.py
+23 -3
@@ -1,13 +1,19 @@
1 +from typing import Dict
2 +from typing import List
3 +from typing import Optional
4 +from typing import Type
5 +from typing import Union
6 +
7 from pydantic import BaseModel
8 from pydantic import Field
9 +
10 from app.integrations.models.customer_integration_settings import AvailableIntegrations
4 -from typing import List, Optional, Union
5 -from typing import Dict
6 -from typing import Type
11 +
12
13 class AuthKey(BaseModel):
14 auth_key_name: str
15
16 +
17 class IntegrationWithAuthKeys(BaseModel):
18 id: int
19 integration_name: str
@@ -15,11 +21,13 @@ class IntegrationWithAuthKeys(BaseModel):
21 integration_details: str
22 auth_keys: List[AuthKey]
23
24 +
25 class AvailableIntegrationsResponse(BaseModel):
26 available_integrations: List[IntegrationWithAuthKeys]
27 message: str
28 success: bool
29
30 +
31 class CreateIntegrationService(BaseModel):
32 auth_type: str = Field(
33 ...,
@@ -37,6 +45,7 @@ class CreateIntegrationService(BaseModel):
45 examples=["https://api.mimecast.com"],
46 )
47
48 +
49 class CreateIntegrationAuthKeys(BaseModel):
50 auth_key_name: str = Field(
51 ...,
@@ -49,6 +58,7 @@ class CreateIntegrationAuthKeys(BaseModel):
58 examples=["test-user"],
59 )
60
61 +
62 class CustomerIntegrationCreate(BaseModel):
63 customer_code: str = Field(
64 ...,
@@ -78,6 +88,7 @@ class CustomerIntegrationCreate(BaseModel):
88 description="The integration auth keys.",
89 )
90
91 +
92 class CustomerIntegrationCreateResponse(BaseModel):
93 message: str = Field(
94 ...,
@@ -88,6 +99,7 @@ class CustomerIntegrationCreateResponse(BaseModel):
99 description="The success status.",
100 )
101
102 +
103 class CustomerIntegrationDeleteResponse(BaseModel):
104 message: str = Field(
105 ...,
@@ -98,6 +110,7 @@ class CustomerIntegrationDeleteResponse(BaseModel):
110 description="The success status.",
111 )
112
113 +
114 # class IntegrationConfig(BaseModel):
115 # config_id: int
116 # config_value: str
@@ -126,17 +139,20 @@ class CustomerIntegrationDeleteResponse(BaseModel):
139 # message: str
140 # success: bool
141
142 +
143 class IntegrationAuthKeys(BaseModel):
144 id: int
145 auth_key_name: str
146 auth_value: str
147 subscription_id: int
148
149 +
150 class IntegrationService(BaseModel):
151 auth_type: str
152 service_name: str
153 id: int
154
155 +
156 class IntegrationSubscription(BaseModel):
157 id: int
158 customer_id: int
@@ -144,6 +160,7 @@ class IntegrationSubscription(BaseModel):
160 integration_service: IntegrationService
161 integration_auth_keys: List[IntegrationAuthKeys] # Changed from IntegrationConfig
162
163 +
164 class CustomerIntegrations(BaseModel):
165 customer_code: str
166 id: int
@@ -165,11 +182,13 @@ class CustomerIntegrations(BaseModel):
182 examples=[True],
183 )
184
185 +
186 class CustomerIntegrationsResponse(BaseModel):
187 available_integrations: List[CustomerIntegrations]
188 message: str
189 success: bool
190
191 +
192 class DeleteCustomerIntegration(BaseModel):
193 customer_code: str = Field(
194 ...,
@@ -182,6 +201,7 @@ class DeleteCustomerIntegration(BaseModel):
201 examples=["Mimecast"],
202 )
203
204 +
205 class UpdateCustomerIntegration(BaseModel):
206 integration_name: str = Field(
207 ...,
backend/app/integrations/utils/collection.py
+18 -9
@@ -1,11 +1,20 @@
1 -import httpx
2 -from typing import Any, Dict, Optional
3 -from loguru import logger
4 -import time
1 +import asyncio
2 import json
3 +import time
4 import traceback
7 -import asyncio
8 -async def send_get_request(endpoint: str, headers: Optional[Dict[str, Any]] = None, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
5 +from typing import Any
6 +from typing import Dict
7 +from typing import Optional
8 +
9 +import httpx
10 +from loguru import logger
11 +
12 +
13 +async def send_get_request(
14 + endpoint: str,
15 + headers: Optional[Dict[str, Any]] = None,
16 + params: Optional[Dict[str, Any]] = None,
17 +) -> Dict[str, Any]:
18 """Send a GET request to the given endpoint.
19
20 Args:
@@ -23,6 +32,7 @@ async def send_get_request(endpoint: str, headers: Optional[Dict[str, Any]] = No
32 except httpx.HTTPError as e:
33 return {"success": False, "message": f"Failed to retrieve data: {e}"}
34
35 +
36 async def send_post_request(endpoint: str, data: Dict[str, Any], headers: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
37 """
38 Send a POST request to the given endpoint.
@@ -43,10 +53,10 @@ async def send_post_request(endpoint: str, data: Dict[str, Any], headers: Option
53 logger.error(error_message)
54 return {"success": False, "message": error_message}
55
46 - content_type = response.headers.get('Content-Type', '')
56 + content_type = response.headers.get("Content-Type", "")
57 logger.info(f"Content-Type: {content_type}")
58
49 - if 'application/json' in content_type:
59 + if "application/json" in content_type:
60 logger.info(f"Successfully retrieved data from {endpoint} with data: {data} and headers: {headers}")
61 return {"data": response.json(), "success": True, "message": "Successfully retrieved data"}
62 else:
@@ -57,4 +67,3 @@ async def send_post_request(endpoint: str, data: Dict[str, Any], headers: Option
67 error_message = f"Failed to send POST request: {str(e)}"
68 logger.error(error_message)
69 return {"success": False, "message": error_message}
60 -
backend/app/integrations/utils/event_shipper.py
+11 -5
@@ -1,12 +1,15 @@
1 +import asyncio
2 +from typing import Any
3 +from typing import Dict
4 +
5 +from fastapi import HTTPException
6 from loguru import logger
2 -from app.integrations.utils.schema import EventShipperPayload, EventShipperPayloadResponse
7
8 from app.connectors.event_shipper.utils.universal import create_gelf_logger
5 -from fastapi import HTTPException
6 -from app.db.db_session import get_db_session
9 from app.connectors.utils import get_connector_info_from_db
8 -from typing import Any, Dict
9 -import asyncio
10 +from app.db.db_session import get_db_session
11 +from app.integrations.utils.schema import EventShipperPayload
12 +from app.integrations.utils.schema import EventShipperPayloadResponse
13
14
15 async def get_gelf_logger():
@@ -17,6 +20,7 @@ async def get_gelf_logger():
20 logger.error(f"Failed to initialize GelfLogger: {e}")
21 raise HTTPException(status_code=500, detail=f"Failed to initialize GelfLogger: {e}")
22
23 +
24 async def event_shipper(message: EventShipperPayload) -> EventShipperPayloadResponse:
25 """
26 Test the log shipper.
@@ -31,6 +35,7 @@ async def event_shipper(message: EventShipperPayload) -> EventShipperPayloadResp
35
36 return EventShipperPayloadResponse(success=True, message="Successfully sent test message to log shipper.")
37
38 +
39 async def verify_event_shipper_healtcheck(attributes: Dict[str, Any]) -> Dict[str, Any]:
40 """
41 Verifies the connection to Graylog Input via a telnet connection.
@@ -50,6 +55,7 @@ async def verify_event_shipper_healtcheck(attributes: Dict[str, Any]) -> Dict[st
55 logger.error(f"Connection to {attributes['connector_url']} failed with error: {e}")
56 return {"connectionSuccessful": False, "message": f"Connection to {attributes['connector_url']} failed"}
57
58 +
59 async def verify_event_shipper_connection(connector_name: str) -> str:
60 """
61 Returns the status of the connection to Graylog Input.
backend/app/integrations/utils/schema.py
+4
@@ -209,12 +209,14 @@ class EventShipperPayload(BaseModel):
209 description="The customer code.",
210 examples="socfortress",
211 )
212 +
213 class Config:
214 extra = Extra.allow
215
216 def to_dict(self):
217 return self.dict(exclude_none=True)
218
219 +
220 class EventShipperPayloadResponse(BaseModel):
221 message: str
222 success: bool
@@ -223,10 +225,12 @@ class EventShipperPayloadResponse(BaseModel):
225 description="The Event Shipper response data.",
226 )
227
228 +
229 ######### ! SEND TO ALERT CREATION ! #########
230 class QueryString(BaseModel):
231 query: str
232
233 +
234 class Query(BaseModel):
235 query_string: QueryString
236
backend/app/routers/alert_creation.py
+3 -1
@@ -1,7 +1,9 @@
1 from fastapi import APIRouter
2
3 from app.integrations.alert_creation.general.routes.alert import general_alerts_router
4 -from app.integrations.alert_creation.office365.routes.alert import office365_alerts_router
4 +from app.integrations.alert_creation.office365.routes.alert import (
5 + office365_alerts_router,
6 +)
7
8 # Instantiate the APIRouter
9 router = APIRouter()
backend/app/routers/integrations.py
-1
@@ -2,7 +2,6 @@ from fastapi import APIRouter
2
3 from app.integrations.routes import integration_settings_router
4
5 -
5 # Instantiate the APIRouter
6 router = APIRouter()
7
backend/app/routers/log_shipper_test.py
+3 -1
@@ -1,6 +1,8 @@
1 from fastapi import APIRouter
2
3 -from app.integrations.log_shipper_test.routes.event_shipper import log_shipper_test_router
3 +from app.integrations.log_shipper_test.routes.event_shipper import (
4 + log_shipper_test_router,
5 +)
6
7 # Instantiate the APIRouter
8 router = APIRouter()
backend/app/routers/mimecast.py
+3 -1
@@ -1,7 +1,9 @@
1 from fastapi import APIRouter
2
3 from app.integrations.mimecast.routes.mimecast import integration_mimecast_router
4 -from app.integrations.mimecast.routes.provision import integration_mimecast_scheduler_router
4 +from app.integrations.mimecast.routes.provision import (
5 + integration_mimecast_scheduler_router,
6 +)
7
8 # Instantiate the APIRouter
9 router = APIRouter()
backend/app/routers/office365.py
-1
@@ -2,7 +2,6 @@ from fastapi import APIRouter
2
3 from app.integrations.office365.routes.provision import integration_office365_router
4
5 -
5 # Instantiate the APIRouter
6 router = APIRouter()
7
backend/app/routers/scheduler.py
-1
@@ -2,7 +2,6 @@ from fastapi import APIRouter
2
3 from app.schedulers.routes.scheduler import scheduler_router
4
5 -
5 # Instantiate the APIRouter
6 router = APIRouter()
7
backend/app/schedulers/models/scheduler.py
+1
@@ -1,5 +1,6 @@
1 from datetime import datetime
2 from typing import Optional
3 +
4 from pydantic import BaseModel
5 from sqlmodel import Field
6 from sqlmodel import SQLModel
backend/app/schedulers/routes/scheduler.py
+15 -11
@@ -1,19 +1,21 @@
1 -from app.schedulers.scheduler import init_scheduler
1 from fastapi import APIRouter
2 from fastapi import Depends
3 +from fastapi import HTTPException
4 from fastapi import Security
5 from loguru import logger
6 from sqlalchemy.ext.asyncio import AsyncSession
7 -from fastapi import HTTPException
7 from sqlalchemy.future import select
8 from sqlmodel import select
10 -from app.schedulers.schema.scheduler import JobsResponse
11 -from app.schedulers.models.scheduler import JobMetadata, CreateSchedulerRequest
12 -from app.db.db_session import get_db
9
10 +from app.db.db_session import get_db
11 +from app.schedulers.models.scheduler import CreateSchedulerRequest
12 +from app.schedulers.models.scheduler import JobMetadata
13 +from app.schedulers.scheduler import init_scheduler
14 +from app.schedulers.schema.scheduler import JobsResponse
15
16 scheduler_router = APIRouter()
17
18 +
19 @scheduler_router.get(
20 "",
21 response_model=JobsResponse,
@@ -38,13 +40,12 @@ async def get_all_jobs(session: AsyncSession = Depends(get_db)) -> JobsResponse:
40 for job in jobs:
41 job_metadata = await session.execute(select(JobMetadata).filter_by(job_id=job.id))
42 job_metadata = job_metadata.scalars().first()
41 - apscheduler_jobs.append({"id": job.id, "name": job.name, "time_interval": job_metadata.time_interval, "enabled": job_metadata.enabled})
43 + apscheduler_jobs.append(
44 + {"id": job.id, "name": job.name, "time_interval": job_metadata.time_interval, "enabled": job_metadata.enabled},
45 + )
46 logger.info(f"apscheduler_jobs: {apscheduler_jobs}")
43 - return JobsResponse(
44 - jobs=[{"id": job.id, "name": job.name} for job in jobs],
45 - success=True,
46 - message="Jobs successfully retrieved."
47 - )
47 + return JobsResponse(jobs=[{"id": job.id, "name": job.name} for job in jobs], success=True, message="Jobs successfully retrieved.")
48 +
49
50 @scheduler_router.post(
51 "/start/{job_id}",
@@ -70,6 +71,7 @@ async def start_job(job_id: str):
71 return {"success": True, "message": "Job started successfully"}
72 return {"success": False, "message": "Job not found"}
73
74 +
75 @scheduler_router.post(
76 "/pause/{job_id}",
77 description="Pause a job",
@@ -94,6 +96,7 @@ async def pause_job(job_id: str):
96 return {"success": True, "message": "Job paused successfully"}
97 return {"success": False, "message": "Job not found"}
98
99 +
100 @scheduler_router.put(
101 "/update/{job_id}",
102 description="Update a job",
@@ -122,6 +125,7 @@ async def update_job(job_id: str, time_interval: int, session: AsyncSession = De
125 return {"success": True, "message": "Job updated successfully"}
126 return {"success": False, "message": "Job not found"}
127
128 +
129 @scheduler_router.delete(
130 "/{job_id}",
131 description="Delete a job",
backend/app/schedulers/scheduler.py
+16 -5
@@ -1,12 +1,13 @@
1 from apscheduler.jobstores.sqlalchemy import SQLAlchemyJobStore
2 from apscheduler.schedulers.asyncio import AsyncIOScheduler
3 +from loguru import logger
4
5 from app.db.db_session import SyncSessionLocal
6 from app.db.db_session import sync_engine
6 -from app.schedulers.models.scheduler import JobMetadata, CreateSchedulerRequest
7 +from app.schedulers.models.scheduler import CreateSchedulerRequest
8 +from app.schedulers.models.scheduler import JobMetadata
9 from app.schedulers.services.agent_sync import agent_sync
10 from app.schedulers.services.invoke_mimecast import invoke_mimecast_integration
9 -from loguru import logger
11
12 # def init_scheduler():
13 # """
@@ -84,6 +85,7 @@ from loguru import logger
85 # else:
86 # raise ValueError(f"Function {function_name} not found")
87
88 +
89 def init_scheduler():
90 """
91 Initializes and configures the scheduler.
@@ -100,6 +102,7 @@ def init_scheduler():
102
103 return scheduler
104
105 +
106 def initialize_job_metadata():
107 """
108 Initializes job metadata from the database.
@@ -109,7 +112,7 @@ def initialize_job_metadata():
112 # Example: Check and add metadata for each known job
113 known_jobs = [
114 {"job_id": "agent_sync", "time_interval": 60, "function": agent_sync},
112 - #{"job_id": "invoke_mimecast_integration", "time_interval": 5, "function": invoke_mimecast_integration}
115 + # {"job_id": "invoke_mimecast_integration", "time_interval": 5, "function": invoke_mimecast_integration}
116 ]
117 for job in known_jobs:
118 job_metadata = session.query(JobMetadata).filter_by(job_id=job["job_id"]).one_or_none()
@@ -121,6 +124,7 @@ def initialize_job_metadata():
124 job_metadata.enabled = True
125 session.commit()
126
127 +
128 def schedule_enabled_jobs(scheduler):
129 """
130 Schedules jobs that are enabled in the database.
@@ -140,6 +144,7 @@ def schedule_enabled_jobs(scheduler):
144 except ValueError as e:
145 logger.error(f"Error scheduling job: {e}")
146
147 +
148 def get_function_by_name(function_name: str):
149 """
150 Returns a function object based on its name.
@@ -151,6 +156,7 @@ def get_function_by_name(function_name: str):
156 }
157 return function_map.get(function_name, lambda: ValueError(f"Function {function_name} not found"))
158
159 +
160 async def add_scheduler_jobs(create_scheduler_request: CreateSchedulerRequest):
161 """
162 Adds a job to the scheduler.
@@ -176,6 +182,7 @@ async def add_scheduler_jobs(create_scheduler_request: CreateSchedulerRequest):
182 if not scheduler.running:
183 scheduler.start()
184
185 +
186 async def add_job_metadata(create_scheduler_request: CreateSchedulerRequest):
187 """
188 Adds a job to the scheduler.
@@ -186,10 +193,14 @@ async def add_job_metadata(create_scheduler_request: CreateSchedulerRequest):
193 with SyncSessionLocal() as session:
194 job_metadata = session.query(JobMetadata).filter_by(job_id=create_scheduler_request.job_id).one_or_none()
195 if not job_metadata:
189 - job_metadata = JobMetadata(job_id=create_scheduler_request.job_id, last_success=None, time_interval=create_scheduler_request.time_interval, enabled=True)
196 + job_metadata = JobMetadata(
197 + job_id=create_scheduler_request.job_id,
198 + last_success=None,
199 + time_interval=create_scheduler_request.time_interval,
200 + enabled=True,
201 + )
202 session.add(job_metadata)
203 else:
204 job_metadata.time_interval = create_scheduler_request.time_interval
205 job_metadata.enabled = True
206 session.commit()
195 -
backend/app/schedulers/schema/scheduler.py
+3
@@ -1,10 +1,13 @@
1 from typing import List
2 +
3 from pydantic import BaseModel
4
5 +
6 class Job(BaseModel):
7 id: str
8 name: str
9
10 +
11 class JobsResponse(BaseModel):
12 jobs: List[Job]
13 success: bool
backend/app/schedulers/services/agent_sync.py
+6 -7
@@ -1,13 +1,14 @@
1 +import os
2 from datetime import datetime
3
4 import requests
5 from dotenv import load_dotenv
5 -import os
6 +
7 from app.db.db_session import get_sync_db_session
7 -from app.schedulers.models.scheduler import JobMetadata
8 -from app.schedulers.utils.universal import scheduler_login
8 from app.integrations.mimecast.routes.mimecast import invoke_mimecast_route
9 from app.integrations.mimecast.schema.mimecast import MimecastRequest
10 +from app.schedulers.models.scheduler import JobMetadata
11 +from app.schedulers.utils.universal import scheduler_login
12
13 load_dotenv()
14
@@ -47,6 +48,7 @@ def agent_sync():
48 # Handle the case where job_metadata does not exist
49 print("JobMetadata for 'agent_sync' not found.")
50
51 +
52 async def invoke_mimecast_integration():
53 """
54 Invokes the Mimecast integration.
@@ -64,9 +66,6 @@ async def invoke_mimecast_integration():
66 print("JobMetadata for 'invoke_mimecast_integration' not found.")
67 # Invoke the Mimecast integration
68 await invoke_mimecast_route(
67 - MimecastRequest(
68 - customer_code="",
69 - integration_name="Mimecast"
70 - ),
69 + MimecastRequest(customer_code="", integration_name="Mimecast"),
70 session,
71 )
backend/app/schedulers/services/invoke_mimecast.py
+12 -13
@@ -1,19 +1,21 @@
1 +import os
2 from datetime import datetime
3
4 import requests
5 from dotenv import load_dotenv
5 -import os
6 -from app.db.db_session import get_db_session, get_sync_db_session
7 -from app.schedulers.models.scheduler import JobMetadata
8 -from app.integrations.models.customer_integration_settings import CustomerIntegrations
9 -from app.schedulers.utils.universal import scheduler_login
10 -from app.integrations.mimecast.routes.mimecast import invoke_mimecast_route
11 -from app.integrations.mimecast.schema.mimecast import MimecastRequest, MimecastResponse
12 -from app.db.db_session import AsyncSession
13 -from app.schedulers.models.scheduler import JobMetadata
6 from loguru import logger
7 from sqlalchemy import select
8
9 +from app.db.db_session import AsyncSession
10 +from app.db.db_session import get_db_session
11 +from app.db.db_session import get_sync_db_session
12 +from app.integrations.mimecast.routes.mimecast import invoke_mimecast_route
13 +from app.integrations.mimecast.schema.mimecast import MimecastRequest
14 +from app.integrations.mimecast.schema.mimecast import MimecastResponse
15 +from app.integrations.models.customer_integration_settings import CustomerIntegrations
16 +from app.schedulers.models.scheduler import JobMetadata
17 +from app.schedulers.utils.universal import scheduler_login
18 +
19 load_dotenv()
20
21
@@ -29,10 +31,7 @@ async def invoke_mimecast_integration() -> MimecastResponse:
31 logger.info(f"customer_codes: {customer_codes}")
32 for customer_code in customer_codes:
33 await invoke_mimecast_route(
32 - MimecastRequest(
33 - customer_code=customer_code,
34 - integration_name="Mimecast"
35 - ),
34 + MimecastRequest(customer_code=customer_code, integration_name="Mimecast"),
35 session,
36 )
37 # Close the session
backend/app/threat_intel/services/socfortress.py
+9 -6
@@ -1,17 +1,18 @@
1 -import httpx
2 -from fastapi import HTTPException
3 -from loguru import logger
1 from typing import Any
2 from typing import Dict
3 from typing import Optional
4 +
5 +import httpx
6 +from fastapi import HTTPException
7 +from loguru import logger
8 from sqlalchemy.ext.asyncio import AsyncSession
9
10 +from app.connectors.utils import get_connector_info_from_db
11 +from app.db.db_session import get_db_session
12 from app.threat_intel.schema.socfortress import IoCMapping
13 from app.threat_intel.schema.socfortress import IoCResponse
14 from app.threat_intel.schema.socfortress import SocfortressThreatIntelRequest
12 -from app.connectors.utils import get_connector_info_from_db
15 from app.utils import get_connector_attribute
14 -from app.db.db_session import get_db_session
16
17
18 async def get_socfortress_threat_intel_attributes(column_name: str, session: AsyncSession) -> str:
@@ -36,6 +37,7 @@ async def get_socfortress_threat_intel_attributes(column_name: str, session: Asy
37 raise HTTPException(status_code=500, detail="SocFortress Threat Intel attributes not found in the database.")
38 return attribute_value
39
40 +
41 async def verify_socfortress_threat_intel_credentials(attributes: Dict[str, Any]) -> Dict[str, Any]:
42 """
43 Verifies the SOCFortress Threat Intel credentials.
@@ -56,6 +58,7 @@ async def verify_socfortress_threat_intel_credentials(attributes: Dict[str, Any]
58 raise HTTPException(status_code=500, detail="SOCFortress Threat Intel credentials not found in the database")
59 return attributes
60
61 +
62 async def verifiy_socfortress_threat_intel_connector(connector_name: str) -> str:
63 """
64 Verifies the SOCFortress Threat Intel connector.
@@ -77,7 +80,7 @@ async def verifiy_socfortress_threat_intel_connector(connector_name: str) -> str
80 return None
81 request = SocfortressThreatIntelRequest(ioc_value="evil.socfortress.co", customer_code="00001")
82 response = await invoke_socfortress_threat_intel_api(attributes["connector_api_key"], attributes["connector_url"], request)
80 - if 'data' in response and response['data'].get('comment') == 'This is a test IoC':
83 + if "data" in response and response["data"].get("comment") == "This is a test IoC":
84 logger.info("Verified SOCFortress Threat Intel connector")
85 return {"connectionSuccessful": True, "message": "Successfully verified SOCFortress Threat Intel connector"}
86 else:
backend/app/utils.py
+4 -2
@@ -523,7 +523,6 @@ async def purge_logs_by_time_range(time_range: TimeRangeModel, session: AsyncSes
523 raise HTTPException(status_code=404, detail="No logs found")
524
525
526 -
526 ################## ! ALLOWED FILES ! ##################
527 def allowed_file(filename):
528 """
@@ -578,6 +577,7 @@ async def get_customer_alert_settings(customer_code: str, session: AsyncSession)
577 return settings
578 return None
579
580 +
581 async def get_customer_alert_settings_office365(office365_organization_id: str, session: AsyncSession) -> Optional[AlertCreationSettings]:
582 """
583 Retrieve the alert creation settings for a specific customer.
@@ -589,7 +589,9 @@ async def get_customer_alert_settings_office365(office365_organization_id: str,
589 Returns:
590 Optional[AlertCreationSettings]: The alert creation settings for the customer, or None if not found.
591 """
592 - result = await session.execute(select(AlertCreationSettings).filter(AlertCreationSettings.office365_organization_id == office365_organization_id))
592 + result = await session.execute(
593 + select(AlertCreationSettings).filter(AlertCreationSettings.office365_organization_id == office365_organization_id),
594 + )
595 settings = result.scalars().first()
596
597 if settings:
backend/copilot.py
+10 -8
@@ -1,17 +1,18 @@
1 +import os
2 +
3 import uvicorn
4 +from dotenv import load_dotenv
5 from fastapi import FastAPI
6 from fastapi import HTTPException
7 from fastapi.exceptions import RequestValidationError
8 from fastapi.middleware.cors import CORSMiddleware
9 from loguru import logger
7 -import os
8 -from dotenv import load_dotenv
10
11 from app.auth.utils import AuthHandler
12 from app.db.db_session import async_engine
13 +from app.db.db_setup import create_available_integrations
14 from app.db.db_setup import create_roles
15 from app.db.db_setup import create_tables
14 -from app.db.db_setup import create_available_integrations
16 from app.db.db_setup import ensure_admin_user
17 from app.db.db_setup import ensure_scheduler_user
18 from app.db.db_setup import ensure_scheduler_user_removed
@@ -34,7 +35,12 @@ from app.routers import grafana
35 from app.routers import graylog
36 from app.routers import healthcheck
37 from app.routers import influxdb
38 +from app.routers import integrations
39 +from app.routers import log_shipper_test
40 from app.routers import logs
41 +from app.routers import mimecast
42 +from app.routers import office365
43 +from app.routers import scheduler
44 from app.routers import shuffle
45 from app.routers import smtp
46 from app.routers import sublime
@@ -42,11 +48,6 @@ from app.routers import threat_intel
48 from app.routers import velociraptor
49 from app.routers import wazuh_indexer
50 from app.routers import wazuh_manager
45 -from app.routers import log_shipper_test
46 -from app.routers import integrations
47 -from app.routers import mimecast
48 -from app.routers import office365
49 -from app.routers import scheduler
51 from app.schedulers.scheduler import init_scheduler
52
53 auth_handler = AuthHandler()
@@ -107,6 +108,7 @@ app.include_router(office365.router)
108 app.include_router(mimecast.router)
109 app.include_router(scheduler.router)
110
111 +
112 @app.on_event("startup")
113 async def init_db():
114 # create_tables(engine)
backend/requirements.in
+9 -9
@@ -1,6 +1,6 @@
1 -apscheduler
1 aiofiles
2 aiosqlite
3 +apscheduler
4 bcrypt
5 blueprint
6 cortex4py
@@ -18,22 +18,22 @@ marshmallow-sqlalchemy
18 matplotlib
19 mitreattack-python
20 openai
21 +passlib
22 passlib[bcrypt]
23 pcre2
24 pika
25 psycopg2-binary
25 -python-multipart
26 -pytest
27 -python-magic
28 -passlib
29 -PyJWT
26 pydantic[email]
27 +PyJWT
28 +pytest
29 python-jose[cryptography]
30 +python-magic
31 +python-multipart
32 pyvelociraptor~=0.1
33 regex
34 -uvicorn
35 -sqlmodel
34 reportlab
35 requests
38 -xmltodict
36 +sqlmodel
37 +uvicorn
38 werkzeug
39 +xmltodict
backend/requirements.txt
+1 -1
@@ -11,8 +11,8 @@ appdirs==1.4.4
11 APScheduler==3.10.4
12 arrow==1.3.0
13 async-timeout==4.0.3
14 -attrs==23.1.0
14 asyncgelf==1.1.0
15 +attrs==23.1.0
16 bcrypt==4.0.1
17 billiard==4.1.0
18 blueprint==3.4.2
docker-compose.yml
+45 -45
@@ -1,46 +1,46 @@
1 -version: '3.8'
1 +version: "3.8"
2 services:
3 - app:
4 - image: ghcr.io/socfortress/copilot:latest
5 - volumes:
6 - - ./backend/data:/opt/copilot/backend/data
7 - network_mode: "host"
8 - environment:
9 - SERVER_IP: ${SERVER_IP}
10 - VITE_API_URL: ${VITE_API_URL}
11 - VITE_TOKEN_DEBOUNCE_TIME: ${VITE_TOKEN_DEBOUNCE_TIME}
12 - VITE_UNCOMMITTED_JOURNAL_ENTRIES_THRESHOLD: ${VITE_UNCOMMITTED_JOURNAL_ENTRIES_THRESHOLD}
13 - VITE_HEALTHCHECKS_INTERVAL: ${VITE_HEALTHCHECKS_INTERVAL}
14 - WAZUH_INDEXER_URL: ${WAZUH_INDEXER_URL}
15 - WAZUH_INDEXER_USERNAME: ${WAZUH_INDEXER_USERNAME}
16 - WAZUH_INDEXER_PASSWORD: ${WAZUH_INDEXER_PASSWORD}
17 - WAZUH_MANAGER_URL: ${WAZUH_MANAGER_URL}
18 - WAZUH_MANAGER_USERNAME: ${WAZUH_MANAGER_USERNAME}
19 - WAZUH_MANAGER_PASSWORD: ${WAZUH_MANAGER_PASSWORD}
20 - GRAYLOG_URL: ${GRAYLOG_URL}
21 - GRAYLOG_USERNAME: ${GRAYLOG_USERNAME}
22 - GRAYLOG_PASSWORD: ${GRAYLOG_PASSWORD}
23 - SHUFFLE_URL: ${SHUFFLE_URL}
24 - SHUFFLER_API_KEY: ${SHUFFLER_API_KEY}
25 - DFIR_IRIS_URL: ${DFIR_IRIS_URL}
26 - DFIR_IRIS_API_KEY: ${DFIR_IRIS_API_KEY}
27 - VELOCIRAPTOR_URL: ${VELOCIRAPTOR_URL}
28 - VELOCIRAPTOR_API_KEY_PATH: ${VELOCIRAPTOR_API_KEY_PATH}
29 - SUBLIME_URL: ${SUBLIME_URL}
30 - SUBLIME_API_KEY: ${SUBLIME_API_KEY}
31 - INFLUXDB_URL: ${INFLUXDB_URL}
32 - INFLUXDB_API_KEY: ${INFLUXDB_API_KEY}
33 - INFLUXDB_ORG_AND_BUCKET: ${INFLUXDB_ORG_AND_BUCKET}
34 - ASK_SOCFORTRESS_URL: ${ASK_SOCFORTRESS_URL}
35 - ASK_SOCFORTRESS_API_KEY: ${ASK_SOCFORTRESS_API_KEY}
36 - SOCFORTRESS_THREAT_INTEL_URL: ${SOCFORTRESS_THREAT_INTEL_URL}
37 - SOCFORTRESS_THREAT_INTEL_API_KEY: ${SOCFORTRESS_THREAT_INTEL_API_KEY}
38 - CORTEX_URL: ${CORTEX_URL}
39 - CORTEX_API_KEY: ${CORTEX_API_KEY}
40 - GRAFANA_URL: ${GRAFANA_URL}
41 - GRAFANA_USERNAME: ${GRAFANA_USERNAME}
42 - GRAFANA_PASSWORD: ${GRAFANA_PASSWORD}
43 - WAZUH_WORKER_PROVISIONING_URL: ${WAZUH_WORKER_PROVISIONING_URL}
44 - ports:
45 - - "5000:5000"
46 - - "5173:5173"
3 + app:
4 + image: ghcr.io/socfortress/copilot:latest
5 + volumes:
6 + - ./backend/data:/opt/copilot/backend/data
7 + network_mode: "host"
8 + environment:
9 + SERVER_IP: ${SERVER_IP}
10 + VITE_API_URL: ${VITE_API_URL}
11 + VITE_TOKEN_DEBOUNCE_TIME: ${VITE_TOKEN_DEBOUNCE_TIME}
12 + VITE_UNCOMMITTED_JOURNAL_ENTRIES_THRESHOLD: ${VITE_UNCOMMITTED_JOURNAL_ENTRIES_THRESHOLD}
13 + VITE_HEALTHCHECKS_INTERVAL: ${VITE_HEALTHCHECKS_INTERVAL}
14 + WAZUH_INDEXER_URL: ${WAZUH_INDEXER_URL}
15 + WAZUH_INDEXER_USERNAME: ${WAZUH_INDEXER_USERNAME}
16 + WAZUH_INDEXER_PASSWORD: ${WAZUH_INDEXER_PASSWORD}
17 + WAZUH_MANAGER_URL: ${WAZUH_MANAGER_URL}
18 + WAZUH_MANAGER_USERNAME: ${WAZUH_MANAGER_USERNAME}
19 + WAZUH_MANAGER_PASSWORD: ${WAZUH_MANAGER_PASSWORD}
20 + GRAYLOG_URL: ${GRAYLOG_URL}
21 + GRAYLOG_USERNAME: ${GRAYLOG_USERNAME}
22 + GRAYLOG_PASSWORD: ${GRAYLOG_PASSWORD}
23 + SHUFFLE_URL: ${SHUFFLE_URL}
24 + SHUFFLER_API_KEY: ${SHUFFLER_API_KEY}
25 + DFIR_IRIS_URL: ${DFIR_IRIS_URL}
26 + DFIR_IRIS_API_KEY: ${DFIR_IRIS_API_KEY}
27 + VELOCIRAPTOR_URL: ${VELOCIRAPTOR_URL}
28 + VELOCIRAPTOR_API_KEY_PATH: ${VELOCIRAPTOR_API_KEY_PATH}
29 + SUBLIME_URL: ${SUBLIME_URL}
30 + SUBLIME_API_KEY: ${SUBLIME_API_KEY}
31 + INFLUXDB_URL: ${INFLUXDB_URL}
32 + INFLUXDB_API_KEY: ${INFLUXDB_API_KEY}
33 + INFLUXDB_ORG_AND_BUCKET: ${INFLUXDB_ORG_AND_BUCKET}
34 + ASK_SOCFORTRESS_URL: ${ASK_SOCFORTRESS_URL}
35 + ASK_SOCFORTRESS_API_KEY: ${ASK_SOCFORTRESS_API_KEY}
36 + SOCFORTRESS_THREAT_INTEL_URL: ${SOCFORTRESS_THREAT_INTEL_URL}
37 + SOCFORTRESS_THREAT_INTEL_API_KEY: ${SOCFORTRESS_THREAT_INTEL_API_KEY}
38 + CORTEX_URL: ${CORTEX_URL}
39 + CORTEX_API_KEY: ${CORTEX_API_KEY}
40 + GRAFANA_URL: ${GRAFANA_URL}
41 + GRAFANA_USERNAME: ${GRAFANA_USERNAME}
42 + GRAFANA_PASSWORD: ${GRAFANA_PASSWORD}
43 + WAZUH_WORKER_PROVISIONING_URL: ${WAZUH_WORKER_PROVISIONING_URL}
44 + ports:
45 + - "5000:5000"
46 + - "5173:5173"
src/api/soc.ts
+1 -1
@@ -93,7 +93,7 @@ export default {
93 older_than: payload?.olderThan || 1,
94 time_unit: payload?.unit || "days"
95 }
96 - }
96 + }
97 : undefined
98 )
99 },
src/assets/images/copilot_gif.gif
Binary files /dev/null and b/src/assets/images/copilot_gif.gif differ
src/components/AuthForm/index.vue
+2 -2
@@ -54,8 +54,8 @@ const title = computed<string>(() =>
54 typeRef.value === "signin"
55 ? "SOCFortress CoPilot"
56 : typeRef.value === "signup"
57 - ? "SOCFortress CoPilot"
58 - : "Forgot Password"
57 + ? "SOCFortress CoPilot"
58 + : "Forgot Password"
59 )
60
61 function gotoSignIn() {
src/design-tokens.json
+1 -1
@@ -162,4 +162,4 @@
162 "hover050": "rgba(255, 255, 255, 0.5)"
163 }
164 }
165 -}
\ No newline at end of file
165 +}