@cryptotaxi247 / CoPilot / commits / c16de016

precommit fixes

Taylor committed Jan 29, 2024 at 16:51 UTC c16de0167f33c33d33592bf45a6cd6914dc23a69
15 files changed +5679 -5766
backend/app/connectors/dfir_iris/routes/alerts.py
+1 -1
@@ -6,7 +6,6 @@ from loguru import logger
6 from sqlalchemy.ext.asyncio import AsyncSession
7
8 from app.auth.utils import AuthHandler
9 -from app.db.db_session import get_db
9 from app.connectors.dfir_iris.schema.alerts import AlertResponse
10 from app.connectors.dfir_iris.schema.alerts import AlertsResponse
11 from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse
@@ -21,6 +20,7 @@ from app.connectors.dfir_iris.services.alerts import get_alert
20 from app.connectors.dfir_iris.services.alerts import get_alerts
21 from app.connectors.dfir_iris.services.alerts import get_bookmarked_alerts
22 from app.connectors.dfir_iris.utils.universal import check_alert_exists
23 +from app.db.db_session import get_db
24
25 # App specific imports
26
backend/app/connectors/dfir_iris/services/alerts.py
+6 -5
@@ -1,12 +1,9 @@
1 from fastapi import HTTPException
2 from loguru import logger
3 -
4 -from app.connectors.dfir_iris.schema.alerts import AlertResponse
3 from sqlalchemy.ext.asyncio import AsyncSession
4 from sqlalchemy.future import select
7 -from app.integrations.alert_creation_settings.models.alert_creation_settings import (
8 - AlertCreationSettings,
9 -)
5 +
6 +from app.connectors.dfir_iris.schema.alerts import AlertResponse
7 from app.connectors.dfir_iris.schema.alerts import AlertsResponse
8 from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse
9 from app.connectors.dfir_iris.schema.alerts import CaseCreationResponse
@@ -14,6 +11,9 @@ from app.connectors.dfir_iris.schema.alerts import DeleteAlertResponse
11 from app.connectors.dfir_iris.schema.alerts import FilterAlertsRequest
12 from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
13 from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
14 +from app.integrations.alert_creation_settings.models.alert_creation_settings import (
15 + AlertCreationSettings,
16 +)
17
18
19 async def get_customer_code(session: AsyncSession, customer_id: int) -> str:
@@ -40,6 +40,7 @@ async def get_customer_code(session: AsyncSession, customer_id: int) -> str:
40 logger.error(f"Error retrieving customer code for customer ID {customer_id}: {e}")
41 return "Customer Not Found"
42
43 +
44 async def get_alerts(request: FilterAlertsRequest) -> AlertsResponse:
45 """
46 Retrieves alerts from the DFIR-IRIS service.
backend/app/connectors/grafana/dashboards/Mimecast/summary.json
+5577 -5690
@@ -1,5692 +1,5579 @@
1 {
2 - "annotations": {
3 - "list": [
4 - {
5 - "builtIn": 1,
6 - "datasource": {
7 - "type": "datasource",
8 - "uid": "grafana"
9 - },
10 - "enable": true,
11 - "hide": true,
12 - "iconColor": "rgba(0, 211, 255, 1)",
13 - "name": "Annotations & Alerts",
14 - "target": {
15 - "limit": 100,
16 - "matchAny": false,
17 - "tags": [],
18 - "type": "dashboard"
19 - },
20 - "type": "dashboard"
21 - }
22 - ]
23 - },
24 - "editable": false,
25 - "fiscalYearStartMonth": 0,
26 - "graphTooltip": 0,
27 - "id": null,
28 - "links": [
29 - {
30 - "asDropdown": true,
31 - "icon": "external link",
32 - "includeVars": true,
33 - "keepTime": true,
34 - "tags": [
35 - "EDR"
36 - ],
37 - "targetBlank": true,
38 - "title": "",
39 - "type": "dashboards"
40 - }
41 - ],
42 - "liveNow": false,
43 - "panels": [
44 - {
45 - "collapsed": true,
46 - "gridPos": {
47 - "h": 1,
48 - "w": 24,
49 - "x": 0,
50 - "y": 0
51 - },
52 - "id": 75,
53 - "panels": [
54 - {
55 - "datasource": {
56 - "type": "elasticsearch",
57 - "uid": "replace_datasource_uid"
58 - },
59 - "fieldConfig": {
60 - "defaults": {
61 - "mappings": [
62 - {
63 - "options": {
64 - "match": "null",
65 - "result": {
66 - "text": "N/A"
67 - }
68 - },
69 - "type": "special"
70 - }
71 - ],
72 - "thresholds": {
73 - "mode": "absolute",
74 - "steps": [
75 - {
76 - "color": "blue"
77 - }
78 - ]
79 - },
80 - "unit": "short"
81 - },
82 - "overrides": []
83 - },
84 - "gridPos": {
85 - "h": 7,
86 - "w": 4,
87 - "x": 0,
88 - "y": 1
89 - },
90 - "id": 43,
91 - "links": [],
92 - "options": {
93 - "colorMode": "value",
94 - "graphMode": "area",
95 - "justifyMode": "auto",
96 - "orientation": "horizontal",
97 - "reduceOptions": {
98 - "calcs": [
99 - "sum"
100 - ],
101 - "fields": "",
102 - "values": false
103 - },
104 - "text": {},
105 - "textMode": "auto",
106 - "wideLayout": true
107 - },
108 - "pluginVersion": "10.2.3",
109 - "targets": [
110 - {
111 - "bucketAggs": [
112 - {
113 - "$$hashKey": "object:135",
114 - "field": "timestamp",
115 - "id": "2",
116 - "settings": {
117 - "interval": "auto",
118 - "min_doc_count": 0,
119 - "trimEdges": 0
120 - },
121 - "type": "date_histogram"
122 - }
123 - ],
124 - "datasource": {
125 - "type": "elasticsearch",
126 - "uid": "replace_datasource_uid"
127 - },
128 - "metrics": [
129 - {
130 - "$$hashKey": "object:133",
131 - "field": "select field",
132 - "id": "1",
133 - "type": "count"
134 - }
135 - ],
136 - "query": "",
137 - "refId": "A",
138 - "timeField": "datetime"
139 - }
140 - ],
141 - "title": "EVENTS",
142 - "type": "stat"
143 - },
144 - {
145 - "datasource": {
146 - "type": "elasticsearch",
147 - "uid": "replace_datasource_uid"
148 - },
149 - "fieldConfig": {
150 - "defaults": {
151 - "color": {
152 - "mode": "thresholds"
153 - },
154 - "custom": {
155 - "align": "auto",
156 - "cellOptions": {
157 - "type": "auto"
158 - },
159 - "inspect": false
160 - },
161 - "mappings": [],
162 - "thresholds": {
163 - "mode": "absolute",
164 - "steps": [
165 - {
166 - "color": "green"
167 - },
168 - {
169 - "color": "red",
170 - "value": 80
171 - }
172 - ]
173 - }
174 - },
175 - "overrides": [
176 - {
177 - "matcher": {
178 - "id": "byName",
179 - "options": "Time"
180 - },
181 - "properties": [
182 - {
183 - "id": "displayName",
184 - "value": "Time"
185 - },
186 - {
187 - "id": "unit",
188 - "value": "time: YYYY-MM-DD HH:mm:ss"
189 - },
190 - {
191 - "id": "custom.align"
192 - }
193 - ]
194 - },
195 - {
196 - "matcher": {
197 - "id": "byName",
198 - "options": ""
199 - },
200 - "properties": [
201 - {
202 - "id": "unit",
203 - "value": "short"
204 - },
205 - {
206 - "id": "decimals",
207 - "value": 2
208 - },
209 - {
210 - "id": "custom.align"
211 - }
212 - ]
213 - },
214 - {
215 - "matcher": {
216 - "id": "byName",
217 - "options": "agent_name"
218 - },
219 - "properties": [
220 - {
221 - "id": "displayName",
222 - "value": "AGENT"
223 - },
224 - {
225 - "id": "unit",
226 - "value": "short"
227 - },
228 - {
229 - "id": "decimals",
230 - "value": 2
231 - },
232 - {
233 - "id": "custom.align"
234 - }
235 - ]
236 - },
237 - {
238 - "matcher": {
239 - "id": "byName",
240 - "options": "AGENT"
241 - },
242 - "properties": [
243 - {
244 - "id": "custom.width",
245 - "value": 299
246 - }
247 - ]
248 - }
249 - ]
250 - },
251 - "gridPos": {
252 - "h": 7,
253 - "w": 8,
254 - "x": 4,
255 - "y": 1
256 - },
257 - "id": 31,
258 - "options": {
259 - "cellHeight": "sm",
260 - "footer": {
261 - "countRows": false,
262 - "fields": "",
263 - "reducer": [
264 - "sum"
265 - ],
266 - "show": false
267 - },
268 - "showHeader": true,
269 - "sortBy": []
270 - },
271 - "pluginVersion": "10.2.3",
272 - "targets": [
273 - {
274 - "bucketAggs": [
275 - {
276 - "$$hashKey": "object:89",
277 - "fake": true,
278 - "field": "Sender",
279 - "id": "4",
280 - "settings": {
281 - "min_doc_count": 1,
282 - "order": "desc",
283 - "orderBy": "_count",
284 - "size": "10"
285 - },
286 - "type": "terms"
287 - }
288 - ],
289 - "datasource": {
290 - "type": "elasticsearch",
291 - "uid": "replace_datasource_uid"
292 - },
293 - "metrics": [
294 - {
295 - "$$hashKey": "object:87",
296 - "field": "select field",
297 - "id": "1",
298 - "type": "count"
299 - }
300 - ],
301 - "query": "",
302 - "refId": "A",
303 - "timeField": "datetime"
304 - }
305 - ],
306 - "title": "TOP 10 SENDERS",
307 - "transformations": [
308 - {
309 - "id": "merge",
310 - "options": {
311 - "reducers": []
312 - }
313 - }
314 - ],
315 - "type": "table"
316 - },
317 - {
318 - "datasource": {
319 - "type": "elasticsearch",
320 - "uid": "replace_datasource_uid"
321 - },
322 - "fieldConfig": {
323 - "defaults": {
324 - "color": {
325 - "mode": "palette-classic"
326 - },
327 - "custom": {
328 - "hideFrom": {
329 - "legend": false,
330 - "tooltip": false,
331 - "viz": false
332 - }
333 - },
334 - "decimals": 0,
335 - "mappings": [],
336 - "unit": "short"
337 - },
338 - "overrides": []
339 - },
340 - "gridPos": {
341 - "h": 7,
342 - "w": 5,
343 - "x": 12,
344 - "y": 1
345 - },
346 - "id": 59,
347 - "links": [],
348 - "options": {
349 - "displayLabels": [],
350 - "legend": {
351 - "calcs": [],
352 - "displayMode": "list",
353 - "placement": "bottom",
354 - "showLegend": false,
355 - "values": [
356 - "value"
357 - ]
358 - },
359 - "pieType": "pie",
360 - "reduceOptions": {
361 - "calcs": [
362 - "sum"
363 - ],
364 - "fields": "",
365 - "values": false
366 - },
367 - "text": {},
368 - "tooltip": {
369 - "mode": "single",
370 - "sort": "none"
371 - }
372 - },
373 - "pluginVersion": "7.3.4",
374 - "targets": [
375 - {
376 - "bucketAggs": [
377 - {
378 - "$$hashKey": "object:211",
379 - "fake": true,
380 - "field": "Rcpt",
381 - "id": "3",
382 - "settings": {
383 - "min_doc_count": "1",
384 - "missing": "Unknown",
385 - "order": "desc",
386 - "orderBy": "_count",
387 - "size": "10"
388 - },
389 - "type": "terms"
390 - },
391 - {
392 - "$$hashKey": "object:117",
393 - "field": "timestamp",
394 - "id": "2",
395 - "settings": {
396 - "interval": "auto",
397 - "min_doc_count": 0,
398 - "trimEdges": 0
399 - },
400 - "type": "date_histogram"
401 - }
402 - ],
403 - "datasource": {
404 - "type": "elasticsearch",
405 - "uid": "replace_datasource_uid"
406 - },
407 - "metrics": [
408 - {
409 - "$$hashKey": "object:115",
410 - "field": "select field",
411 - "id": "1",
412 - "type": "count"
413 - }
414 - ],
415 - "query": "",
416 - "queryType": "randomWalk",
417 - "refId": "A",
418 - "timeField": "datetime"
419 - }
420 - ],
421 - "title": "TOP 10 RECEIVERS",
422 - "type": "piechart"
423 - },
424 - {
425 - "datasource": {
426 - "type": "elasticsearch",
427 - "uid": "replace_datasource_uid"
428 - },
429 - "fieldConfig": {
430 - "defaults": {
431 - "custom": {
432 - "align": "auto",
433 - "cellOptions": {
434 - "type": "auto"
435 - },
436 - "filterable": false,
437 - "inspect": false
438 - },
439 - "mappings": [],
440 - "thresholds": {
441 - "mode": "absolute",
442 - "steps": [
443 - {
444 - "color": "green"
445 - },
446 - {
447 - "color": "red",
448 - "value": 80
449 - }
450 - ]
451 - }
452 - },
453 - "overrides": []
454 - },
455 - "gridPos": {
456 - "h": 7,
457 - "w": 7,
458 - "x": 17,
459 - "y": 1
460 - },
461 - "id": 61,
462 - "links": [],
463 - "options": {
464 - "cellHeight": "sm",
465 - "footer": {
466 - "countRows": false,
467 - "fields": "",
468 - "reducer": [
469 - "sum"
470 - ],
471 - "show": false
472 - },
473 - "showHeader": true
474 - },
475 - "pluginVersion": "10.2.3",
476 - "targets": [
477 - {
478 - "bucketAggs": [
479 - {
480 - "$$hashKey": "object:211",
481 - "fake": true,
482 - "field": "Rcpt",
483 - "id": "3",
484 - "settings": {
485 - "min_doc_count": "1",
486 - "missing": "Unknown",
487 - "order": "desc",
488 - "orderBy": "_count",
489 - "size": "10"
490 - },
491 - "type": "terms"
492 - }
493 - ],
494 - "datasource": {
495 - "type": "elasticsearch",
496 - "uid": "replace_datasource_uid"
497 - },
498 - "metrics": [
499 - {
500 - "$$hashKey": "object:115",
501 - "field": "select field",
502 - "id": "1",
503 - "type": "count"
504 - }
505 - ],
506 - "query": "",
507 - "queryType": "randomWalk",
508 - "refId": "A",
509 - "timeField": "datetime"
510 - }
511 - ],
512 - "title": "TOP 10 RECEIVERS",
513 - "transformations": [
514 - {
515 - "id": "organize",
516 - "options": {
517 - "excludeByName": {},
518 - "indexByName": {},
519 - "renameByName": {
520 - "software_vendor": "SOFTWARE VENDOR"
521 - }
522 - }
523 - }
524 - ],
525 - "type": "table"
526 - },
527 - {
528 - "datasource": {
529 - "type": "elasticsearch",
530 - "uid": "replace_datasource_uid"
531 - },
532 - "fieldConfig": {
533 - "defaults": {
534 - "mappings": [],
535 - "thresholds": {
536 - "mode": "absolute",
537 - "steps": [
538 - {
539 - "color": "green"
540 - },
541 - {
542 - "color": "red",
543 - "value": 80
544 - }
545 - ]
546 - }
547 - },
548 - "overrides": []
549 - },
550 - "gridPos": {
551 - "h": 19,
552 - "w": 24,
553 - "x": 0,
554 - "y": 8
555 - },
556 - "id": 66,
557 - "options": {
558 - "color": "blue",
559 - "iteration": 20,
560 - "monochrome": false,
561 - "nodeColor": "super-light-purple",
562 - "nodePadding": 20,
563 - "nodeWidth": 30
564 - },
565 - "targets": [
566 - {
567 - "alias": "",
568 - "bucketAggs": [
569 - {
570 - "field": "Sender",
571 - "id": "2",
572 - "settings": {
573 - "min_doc_count": "1",
574 - "order": "desc",
575 - "orderBy": "_term",
576 - "size": "10"
577 - },
578 - "type": "terms"
579 - },
580 - {
581 - "field": "Rcpt",
582 - "id": "3",
583 - "settings": {
584 - "min_doc_count": "1",
585 - "order": "desc",
586 - "orderBy": "_term",
587 - "size": "1"
588 - },
589 - "type": "terms"
590 - }
591 - ],
592 - "datasource": {
593 - "type": "elasticsearch",
594 - "uid": "replace_datasource_uid"
595 - },
596 - "metrics": [
597 - {
598 - "id": "1",
599 - "type": "count"
600 - }
601 - ],
602 - "query": "",
603 - "refId": "A",
604 - "timeField": "datetime"
605 - }
606 - ],
607 - "title": "MAIL FLOWS",
608 - "transformations": [
609 - {
610 - "id": "organize",
611 - "options": {
612 - "excludeByName": {},
613 - "indexByName": {},
614 - "renameByName": {
615 - "Count": "Count",
616 - "parent_process_image": "PARENT PROCESS",
617 - "process_image": "PROCESS"
618 - }
619 - }
620 - }
621 - ],
622 - "transparent": true,
623 - "type": "netsage-sankey-panel"
624 - },
625 - {
626 - "datasource": {
627 - "type": "elasticsearch",
628 - "uid": "replace_datasource_uid"
629 - },
630 - "fieldConfig": {
631 - "defaults": {
632 - "color": {
633 - "mode": "thresholds"
634 - },
635 - "custom": {
636 - "align": "auto",
637 - "cellOptions": {
638 - "type": "auto"
639 - },
640 - "inspect": false
641 - },
642 - "mappings": [],
643 - "thresholds": {
644 - "mode": "absolute",
645 - "steps": [
646 - {
647 - "color": "green"
648 - },
649 - {
650 - "color": "red",
651 - "value": 80
652 - }
653 - ]
654 - }
655 - },
656 - "overrides": [
657 - {
658 - "matcher": {
659 - "id": "byName",
660 - "options": "Time"
661 - },
662 - "properties": [
663 - {
664 - "id": "displayName",
665 - "value": "Time"
666 - },
667 - {
668 - "id": "unit",
669 - "value": "time: YYYY-MM-DD HH:mm:ss"
670 - },
671 - {
672 - "id": "custom.align"
673 - }
674 - ]
675 - },
676 - {
677 - "matcher": {
678 - "id": "byName",
679 - "options": ""
680 - },
681 - "properties": [
682 - {
683 - "id": "unit",
684 - "value": "short"
685 - },
686 - {
687 - "id": "decimals",
688 - "value": 2
689 - },
690 - {
691 - "id": "custom.align"
692 - }
693 - ]
694 - },
695 - {
696 - "matcher": {
697 - "id": "byName",
698 - "options": "agent_name"
699 - },
700 - "properties": [
701 - {
702 - "id": "displayName",
703 - "value": "AGENT"
704 - },
705 - {
706 - "id": "unit",
707 - "value": "short"
708 - },
709 - {
710 - "id": "decimals",
711 - "value": 2
712 - },
713 - {
714 - "id": "custom.align"
715 - }
716 - ]
717 - },
718 - {
719 - "matcher": {
720 - "id": "byName",
721 - "options": "AGENT"
722 - },
723 - "properties": [
724 - {
725 - "id": "custom.width",
726 - "value": 299
727 - }
728 - ]
729 - }
730 - ]
731 - },
732 - "gridPos": {
733 - "h": 10,
734 - "w": 8,
735 - "x": 0,
736 - "y": 27
737 - },
738 - "id": 71,
739 - "options": {
740 - "cellHeight": "sm",
741 - "footer": {
742 - "countRows": false,
743 - "fields": "",
744 - "reducer": [
745 - "sum"
746 - ],
747 - "show": false
748 - },
749 - "showHeader": true,
750 - "sortBy": []
751 - },
752 - "pluginVersion": "10.2.3",
753 - "targets": [
754 - {
755 - "bucketAggs": [
756 - {
757 - "$$hashKey": "object:89",
758 - "fake": true,
759 - "field": "IP",
760 - "id": "4",
761 - "settings": {
762 - "min_doc_count": 1,
763 - "order": "desc",
764 - "orderBy": "_count",
765 - "size": "10"
766 - },
767 - "type": "terms"
768 - },
769 - {
770 - "field": "IP_country_code",
771 - "id": "5",
772 - "settings": {
773 - "min_doc_count": "1",
774 - "order": "desc",
775 - "orderBy": "_count",
776 - "size": "10"
777 - },
778 - "type": "terms"
779 - }
780 - ],
781 - "datasource": {
782 - "type": "elasticsearch",
783 - "uid": "replace_datasource_uid"
784 - },
785 - "metrics": [
786 - {
787 - "$$hashKey": "object:87",
788 - "field": "select field",
789 - "id": "1",
790 - "type": "count"
791 - }
792 - ],
793 - "query": "",
794 - "refId": "A",
795 - "timeField": "datetime"
796 - }
797 - ],
798 - "title": "TOP 10 IPs",
799 - "transformations": [
800 - {
801 - "id": "merge",
802 - "options": {
803 - "reducers": []
804 - }
805 - }
806 - ],
807 - "type": "table"
808 - },
809 - {
810 - "circleMaxSize": 30,
811 - "circleMinSize": 2,
812 - "colors": [
813 - "rgba(245, 54, 54, 0.9)",
814 - "rgba(237, 129, 40, 0.89)",
815 - "rgba(50, 172, 45, 0.97)"
816 - ],
817 - "datasource": {
818 - "type": "elasticsearch",
819 - "uid": "replace_datasource_uid"
820 - },
821 - "decimals": 0,
822 - "esMetric": "Count",
823 - "gridPos": {
824 - "h": 10,
825 - "w": 7,
826 - "x": 8,
827 - "y": 27
828 - },
829 - "hideEmpty": false,
830 - "hideZero": false,
831 - "id": 70,
832 - "initialZoom": 1,
833 - "locationData": "countries",
834 - "mapCenter": "(0°, 0°)",
835 - "mapCenterLatitude": 0,
836 - "mapCenterLongitude": 0,
837 - "maxDataPoints": 1,
838 - "mouseWheelZoom": false,
839 - "showLegend": true,
840 - "stickyLabels": false,
841 - "tableQueryOptions": {
842 - "geohashField": "geohash",
843 - "latitudeField": "latitude",
844 - "longitudeField": "longitude",
845 - "metricField": "metric",
846 - "queryType": "geohash"
847 - },
848 - "targets": [
849 - {
850 - "alias": "",
851 - "bucketAggs": [
852 - {
853 - "field": "IP_country_code",
854 - "id": "3",
855 - "settings": {
856 - "min_doc_count": "1",
857 - "order": "desc",
858 - "orderBy": "_term",
859 - "size": "10"
860 - },
861 - "type": "terms"
862 - },
863 - {
864 - "field": "timestamp",
865 - "id": "2",
866 - "settings": {
867 - "interval": "auto"
868 - },
869 - "type": "date_histogram"
870 - }
871 - ],
872 - "datasource": {
873 - "type": "elasticsearch",
874 - "uid": "replace_datasource_uid"
875 - },
876 - "metrics": [
877 - {
878 - "id": "1",
879 - "type": "count"
880 - }
881 - ],
882 - "query": "",
883 - "refId": "A",
884 - "timeField": "datetime"
885 - }
886 - ],
887 - "thresholds": "0,10",
888 - "title": "TOP 10 GEO IPs",
889 - "type": "grafana-worldmap-panel",
890 - "unitPlural": "",
891 - "unitSingle": "",
892 - "valueName": "total"
893 - },
894 - {
895 - "datasource": {
896 - "type": "elasticsearch",
897 - "uid": "replace_datasource_uid"
898 - },
899 - "fieldConfig": {
900 - "defaults": {
901 - "color": {
902 - "mode": "thresholds"
903 - },
904 - "custom": {
905 - "align": "auto",
906 - "cellOptions": {
907 - "type": "auto"
908 - },
909 - "inspect": false
910 - },
911 - "mappings": [],
912 - "thresholds": {
913 - "mode": "absolute",
914 - "steps": [
915 - {
916 - "color": "green"
917 - },
918 - {
919 - "color": "red",
920 - "value": 80
921 - }
922 - ]
923 - }
924 - },
925 - "overrides": [
926 - {
927 - "matcher": {
928 - "id": "byName",
929 - "options": "Time"
930 - },
931 - "properties": [
932 - {
933 - "id": "displayName",
934 - "value": "Time"
935 - },
936 - {
937 - "id": "unit",
938 - "value": "time: YYYY-MM-DD HH:mm:ss"
939 - },
940 - {
941 - "id": "custom.align"
942 - }
943 - ]
944 - },
945 - {
946 - "matcher": {
947 - "id": "byName",
948 - "options": ""
949 - },
950 - "properties": [
951 - {
952 - "id": "unit",
953 - "value": "short"
954 - },
955 - {
956 - "id": "decimals",
957 - "value": 2
958 - },
959 - {
960 - "id": "custom.align"
961 - }
962 - ]
963 - },
964 - {
965 - "matcher": {
966 - "id": "byName",
967 - "options": "agent_name"
968 - },
969 - "properties": [
970 - {
971 - "id": "displayName",
972 - "value": "AGENT"
973 - },
974 - {
975 - "id": "unit",
976 - "value": "short"
977 - },
978 - {
979 - "id": "decimals",
980 - "value": 2
981 - },
982 - {
983 - "id": "custom.align"
984 - }
985 - ]
986 - },
987 - {
988 - "matcher": {
989 - "id": "byName",
990 - "options": "AGENT"
991 - },
992 - "properties": [
993 - {
994 - "id": "custom.width",
995 - "value": 299
996 - }
997 - ]
998 - }
999 - ]
1000 - },
1001 - "gridPos": {
1002 - "h": 10,
1003 - "w": 9,
1004 - "x": 15,
1005 - "y": 27
1006 - },
1007 - "id": 72,
1008 - "options": {
1009 - "cellHeight": "sm",
1010 - "footer": {
1011 - "countRows": false,
1012 - "fields": "",
1013 - "reducer": [
1014 - "sum"
1015 - ],
1016 - "show": false
1017 - },
1018 - "showHeader": true,
1019 - "sortBy": []
1020 - },
1021 - "pluginVersion": "10.2.3",
1022 - "targets": [
1023 - {
1024 - "bucketAggs": [
1025 - {
1026 - "$$hashKey": "object:89",
1027 - "fake": true,
1028 - "field": "SpamScore",
1029 - "id": "4",
1030 - "settings": {
1031 - "min_doc_count": 1,
1032 - "order": "desc",
1033 - "orderBy": "_count",
1034 - "size": "10"
1035 - },
1036 - "type": "terms"
1037 - }
1038 - ],
1039 - "datasource": {
1040 - "type": "elasticsearch",
1041 - "uid": "replace_datasource_uid"
1042 - },
1043 - "metrics": [
1044 - {
1045 - "$$hashKey": "object:87",
1046 - "field": "select field",
1047 - "id": "1",
1048 - "type": "count"
1049 - }
1050 - ],
1051 - "query": "",
1052 - "refId": "A",
1053 - "timeField": "datetime"
1054 - }
1055 - ],
1056 - "title": "TOP 10 SPAM SCORES",
1057 - "transformations": [
1058 - {
1059 - "id": "merge",
1060 - "options": {
1061 - "reducers": []
1062 - }
1063 - }
1064 - ],
1065 - "type": "table"
1066 - },
1067 - {
1068 - "datasource": {
1069 - "type": "elasticsearch",
1070 - "uid": "replace_datasource_uid"
1071 - },
1072 - "fieldConfig": {
1073 - "defaults": {
1074 - "mappings": [],
1075 - "thresholds": {
1076 - "mode": "absolute",
1077 - "steps": [
1078 - {
1079 - "color": "green"
1080 - },
1081 - {
1082 - "color": "red",
1083 - "value": 80
1084 - }
1085 - ]
1086 - }
1087 - },
1088 - "overrides": []
1089 - },
1090 - "gridPos": {
1091 - "h": 8,
1092 - "w": 12,
1093 - "x": 0,
1094 - "y": 37
1095 - },
1096 - "id": 37,
1097 - "options": {
1098 - "displayMode": "gradient",
1099 - "maxVizHeight": 300,
1100 - "minVizHeight": 10,
1101 - "minVizWidth": 0,
1102 - "namePlacement": "auto",
1103 - "orientation": "horizontal",
1104 - "reduceOptions": {
1105 - "calcs": [
1106 - "sum"
1107 - ],
1108 - "fields": "",
1109 - "values": false
1110 - },
1111 - "showUnfilled": true,
1112 - "sizing": "auto",
1113 - "text": {},
1114 - "valueMode": "color"
1115 - },
1116 - "pluginVersion": "10.2.3",
1117 - "targets": [
1118 - {
1119 - "bucketAggs": [
1120 - {
1121 - "fake": true,
1122 - "field": "Dir",
1123 - "id": "6",
1124 - "settings": {
1125 - "min_doc_count": 1,
1126 - "order": "desc",
1127 - "orderBy": "_count",
1128 - "size": "10"
1129 - },
1130 - "type": "terms"
1131 - },
1132 - {
1133 - "fake": true,
1134 - "field": "timestamp",
1135 - "id": "5",
1136 - "settings": {
1137 - "interval": "auto",
1138 - "min_doc_count": 0,
1139 - "trimEdges": 0
1140 - },
1141 - "type": "date_histogram"
1142 - }
1143 - ],
1144 - "datasource": {
1145 - "type": "elasticsearch",
1146 - "uid": "replace_datasource_uid"
1147 - },
1148 - "metrics": [
1149 - {
1150 - "field": "type",
1151 - "id": "1",
1152 - "meta": {},
1153 - "settings": {},
1154 - "type": "count"
1155 - }
1156 - ],
1157 - "query": "",
1158 - "refId": "A",
1159 - "timeField": "datetime"
1160 - }
1161 - ],
1162 - "title": "MAIL DIRECTION",
1163 - "type": "bargauge"
1164 - },
1165 - {
1166 - "datasource": {
1167 - "type": "elasticsearch",
1168 - "uid": "replace_datasource_uid"
1169 - },
1170 - "fieldConfig": {
1171 - "defaults": {
1172 - "mappings": [],
1173 - "thresholds": {
1174 - "mode": "absolute",
1175 - "steps": [
1176 - {
1177 - "color": "green"
1178 - },
1179 - {
1180 - "color": "red",
1181 - "value": 80
1182 - }
1183 - ]
1184 - }
1185 - },
1186 - "overrides": []
1187 - },
1188 - "gridPos": {
1189 - "h": 8,
1190 - "w": 12,
1191 - "x": 12,
1192 - "y": 37
1193 - },
1194 - "id": 73,
1195 - "options": {
1196 - "displayMode": "gradient",
1197 - "maxVizHeight": 300,
1198 - "minVizHeight": 10,
1199 - "minVizWidth": 0,
1200 - "namePlacement": "auto",
1201 - "orientation": "horizontal",
1202 - "reduceOptions": {
1203 - "calcs": [
1204 - "sum"
1205 - ],
1206 - "fields": "",
1207 - "values": false
1208 - },
1209 - "showUnfilled": true,
1210 - "sizing": "auto",
1211 - "text": {},
1212 - "valueMode": "color"
1213 - },
1214 - "pluginVersion": "10.2.3",
1215 - "targets": [
1216 - {
1217 - "bucketAggs": [
1218 - {
1219 - "fake": true,
1220 - "field": "SpamProcessingDetail",
1221 - "id": "6",
1222 - "settings": {
1223 - "min_doc_count": 1,
1224 - "order": "desc",
1225 - "orderBy": "_count",
1226 - "size": "10"
1227 - },
1228 - "type": "terms"
1229 - },
1230 - {
1231 - "fake": true,
1232 - "field": "timestamp",
1233 - "id": "5",
1234 - "settings": {
1235 - "interval": "auto",
1236 - "min_doc_count": 0,
1237 - "trimEdges": 0
1238 - },
1239 - "type": "date_histogram"
1240 - }
1241 - ],
1242 - "datasource": {
1243 - "type": "elasticsearch",
1244 - "uid": "replace_datasource_uid"
1245 - },
1246 - "metrics": [
1247 - {
1248 - "field": "type",
1249 - "id": "1",
1250 - "meta": {},
1251 - "settings": {},
1252 - "type": "count"
1253 - }
1254 - ],
1255 - "query": "",
1256 - "refId": "A",
1257 - "timeField": "datetime"
1258 - }
1259 - ],
1260 - "title": "SPAM PROC INFO",
1261 - "type": "bargauge"
1262 - },
1263 - {
1264 - "datasource": {
1265 - "type": "elasticsearch",
1266 - "uid": "replace_datasource_uid"
1267 - },
1268 - "fieldConfig": {
1269 - "defaults": {
1270 - "color": {
1271 - "mode": "thresholds"
1272 - },
1273 - "custom": {
1274 - "align": "auto",
1275 - "cellOptions": {
1276 - "type": "auto"
1277 - },
1278 - "filterable": true,
1279 - "inspect": false
1280 - },
1281 - "mappings": [],
1282 - "thresholds": {
1283 - "mode": "absolute",
1284 - "steps": [
1285 - {
1286 - "color": "green"
1287 - },
1288 - {
1289 - "color": "red",
1290 - "value": 80
1291 - }
1292 - ]
1293 - }
1294 - },
1295 - "overrides": [
1296 - {
1297 - "matcher": {
1298 - "id": "byName",
1299 - "options": "timestamp"
1300 - },
1301 - "properties": [
1302 - {
1303 - "id": "displayName",
1304 - "value": "DATE/TIME"
1305 - },
1306 - {
1307 - "id": "unit",
1308 - "value": "time: YYYY-MM-DD HH:mm:ss"
1309 - },
1310 - {
1311 - "id": "custom.align"
1312 - }
1313 - ]
1314 - },
1315 - {
1316 - "matcher": {
1317 - "id": "byName",
1318 - "options": "process_name"
1319 - },
1320 - "properties": [
1321 - {
1322 - "id": "displayName",
1323 - "value": "PROCESS"
1324 - },
1325 - {
1326 - "id": "unit",
1327 - "value": "short"
1328 - },
1329 - {
1330 - "id": "decimals",
1331 - "value": -1
1332 - },
1333 - {
1334 - "id": "custom.align"
1335 - }
1336 - ]
1337 - },
1338 - {
1339 - "matcher": {
1340 - "id": "byName",
1341 - "options": "process_id"
1342 - },
1343 - "properties": [
1344 - {
1345 - "id": "displayName",
1346 - "value": "PID"
1347 - },
1348 - {
1349 - "id": "unit",
1350 - "value": "none"
1351 - },
1352 - {
1353 - "id": "decimals",
1354 - "value": -2
1355 - },
1356 - {
1357 - "id": "custom.align"
1358 - }
1359 - ]
1360 - },
1361 - {
1362 - "matcher": {
1363 - "id": "byName",
1364 - "options": "process_image"
1365 - },
1366 - "properties": [
1367 - {
1368 - "id": "displayName",
1369 - "value": "PROCESS IMAGE"
1370 - },
1371 - {
1372 - "id": "unit",
1373 - "value": "short"
1374 - },
1375 - {
1376 - "id": "decimals",
1377 - "value": 2
1378 - },
1379 - {
1380 - "id": "custom.align"
1381 - }
1382 - ]
1383 - },
1384 - {
1385 - "matcher": {
1386 - "id": "byName",
1387 - "options": "user_name"
1388 - },
1389 - "properties": [
1390 - {
1391 - "id": "displayName",
1392 - "value": "USER/ACCOUNT"
1393 - },
1394 - {
1395 - "id": "unit",
1396 - "value": "short"
1397 - },
1398 - {
1399 - "id": "decimals",
1400 - "value": 2
1401 - },
1402 - {
1403 - "id": "custom.align"
1404 - }
1405 - ]
1406 - },
1407 - {
1408 - "matcher": {
1409 - "id": "byName",
1410 - "options": "agent_name"
1411 - },
1412 - "properties": [
1413 - {
1414 - "id": "displayName",
1415 - "value": "AGENT"
1416 - },
1417 - {
1418 - "id": "unit",
1419 - "value": "short"
1420 - },
1421 - {
1422 - "id": "decimals",
1423 - "value": 2
1424 - },
1425 - {
1426 - "id": "custom.align"
1427 - }
1428 - ]
1429 - },
1430 - {
1431 - "matcher": {
1432 - "id": "byName",
1433 - "options": "parent_process_image"
1434 - },
1435 - "properties": [
1436 - {
1437 - "id": "displayName",
1438 - "value": "PARENT PROCESS"
1439 - },
1440 - {
1441 - "id": "unit",
1442 - "value": "short"
1443 - },
1444 - {
1445 - "id": "decimals",
1446 - "value": 2
1447 - },
1448 - {
1449 - "id": "custom.align"
1450 - }
1451 - ]
1452 - },
1453 - {
1454 - "matcher": {
1455 - "id": "byName",
1456 - "options": "process_cmd_line"
1457 - },
1458 - "properties": [
1459 - {
1460 - "id": "displayName",
1461 - "value": "PROCESS CMD LINE"
1462 - },
1463 - {
1464 - "id": "unit",
1465 - "value": "short"
1466 - },
1467 - {
1468 - "id": "decimals",
1469 - "value": 2
1470 - },
1471 - {
1472 - "id": "custom.align"
1473 - }
1474 - ]
1475 - },
1476 - {
1477 - "matcher": {
1478 - "id": "byName",
1479 - "options": "EVENT ID"
1480 - },
1481 - "properties": [
1482 - {
1483 - "id": "links",
1484 - "value": [
1485 - {
1486 - "targetBlank": true,
1487 - "title": "VIEW EVENT DETAILS",
1488 - "url": "https://dashboard.dnsoverwatch.com/explore?left=%5B%22now-6h%22,%22now%22,%22WF_Mimecast%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
1489 - }
1490 - ]
1491 - }
1492 - ]
1493 - }
1494 - ]
1495 - },
1496 - "gridPos": {
1497 - "h": 18,
1498 - "w": 24,
1499 - "x": 0,
1500 - "y": 45
1501 - },
1502 - "id": 51,
1503 - "options": {
1504 - "cellHeight": "sm",
1505 - "footer": {
1506 - "countRows": false,
1507 - "enablePagination": true,
1508 - "fields": "",
1509 - "reducer": [
1510 - "sum"
1511 - ],
1512 - "show": false
1513 - },
1514 - "showHeader": true
1515 - },
1516 - "pluginVersion": "10.2.3",
1517 - "targets": [
1518 - {
1519 - "bucketAggs": [],
1520 - "datasource": {
1521 - "type": "elasticsearch",
1522 - "uid": "replace_datasource_uid"
1523 - },
1524 - "metrics": [
1525 - {
1526 - "id": "1",
1527 - "settings": {
1528 - "size": "250"
1529 - },
1530 - "type": "raw_data"
1531 - }
1532 - ],
1533 - "query": "",
1534 - "refId": "A",
1535 - "timeField": "datetime"
1536 - }
1537 - ],
1538 - "title": "MIMECAST LOGS",
1539 - "transformations": [
1540 - {
1541 - "id": "filterFieldsByName",
1542 - "options": {
1543 - "include": {
1544 - "names": [
1545 - "Dir",
1546 - "IP",
1547 - "IP_country_code",
1548 - "Sender",
1549 - "SourceIP",
1550 - "SourceIP_country_code",
1551 - "Subject",
1552 - "_id",
1553 - "timestamp",
1554 - "SpamScore",
1555 - "Rcpt"
1556 - ]
1557 - }
1558 - }
1559 - },
1560 - {
1561 - "id": "organize",
1562 - "options": {
1563 - "excludeByName": {},
1564 - "indexByName": {
1565 - "Dir": 5,
1566 - "IP": 7,
1567 - "IP_country_code": 8,
1568 - "Rcpt": 6,
1569 - "Sender": 2,
1570 - "SourceIP": 3,
1571 - "SourceIP_country_code": 4,
1572 - "SpamScore": 10,
1573 - "Subject": 9,
1574 - "_id": 1,
1575 - "timestamp": 0
1576 - },
1577 - "renameByName": {
1578 - "Dir": "",
1579 - "IP_country_code": "COUNTRY",
1580 - "SourceIP": "SRC IP",
1581 - "SourceIP_country_code": "SRC COUNTRY",
1582 - "SpamScore": "",
1583 - "Subject": "",
1584 - "_id": "EVENT ID",
1585 - "agent_name": "",
1586 - "parent_cmd_line": "PARENT CMD",
1587 - "parent_process_id": "PARENT PID",
1588 - "parent_process_user": "PARENT USER",
1589 - "syslog_level": "LEVEL"
1590 - }
1591 - }
1592 - }
1593 - ],
1594 - "transparent": true,
1595 - "type": "table"
1596 - }
1597 - ],
1598 - "title": "SUMMARY",
1599 - "type": "row"
1600 - },
1601 - {
1602 - "collapsed": true,
1603 - "gridPos": {
1604 - "h": 1,
1605 - "w": 24,
1606 - "x": 0,
1607 - "y": 1
1608 - },
1609 - "id": 77,
1610 - "panels": [
1611 - {
1612 - "datasource": {
1613 - "type": "elasticsearch",
1614 - "uid": "replace_datasource_uid"
1615 - },
1616 - "fieldConfig": {
1617 - "defaults": {
1618 - "mappings": [
1619 - {
1620 - "options": {
1621 - "match": "null",
1622 - "result": {
1623 - "text": "N/A"
1624 - }
1625 - },
1626 - "type": "special"
1627 - }
1628 - ],
1629 - "thresholds": {
1630 - "mode": "absolute",
1631 - "steps": [
1632 - {
1633 - "color": "blue"
1634 - }
1635 - ]
1636 - },
1637 - "unit": "short"
1638 - },
1639 - "overrides": []
1640 - },
1641 - "gridPos": {
1642 - "h": 7,
1643 - "w": 4,
1644 - "x": 0,
1645 - "y": 2
1646 - },
1647 - "id": 78,
1648 - "links": [],
1649 - "options": {
1650 - "colorMode": "value",
1651 - "graphMode": "area",
1652 - "justifyMode": "auto",
1653 - "orientation": "horizontal",
1654 - "reduceOptions": {
1655 - "calcs": [
1656 - "sum"
1657 - ],
1658 - "fields": "",
1659 - "values": false
1660 - },
1661 - "text": {},
1662 - "textMode": "auto",
1663 - "wideLayout": true
1664 - },
1665 - "pluginVersion": "10.2.3",
1666 - "targets": [
1667 - {
1668 - "bucketAggs": [
1669 - {
1670 - "$$hashKey": "object:135",
1671 - "field": "timestamp",
1672 - "id": "2",
1673 - "settings": {
1674 - "interval": "auto",
1675 - "min_doc_count": 0,
1676 - "trimEdges": 0
1677 - },
1678 - "type": "date_histogram"
1679 - }
1680 - ],
1681 - "datasource": {
1682 - "type": "elasticsearch",
1683 - "uid": "replace_datasource_uid"
1684 - },
1685 - "metrics": [
1686 - {
1687 - "$$hashKey": "object:133",
1688 - "field": "select field",
1689 - "id": "1",
1690 - "type": "count"
1691 - }
1692 - ],
1693 - "query": "Virus:*",
1694 - "refId": "A",
1695 - "timeField": "datetime"
1696 - }
1697 - ],
1698 - "title": "VIRUS EVENTS",
1699 - "type": "stat"
1700 - },
1701 - {
1702 - "datasource": {
1703 - "type": "elasticsearch",
1704 - "uid": "replace_datasource_uid"
1705 - },
1706 - "fieldConfig": {
1707 - "defaults": {
1708 - "color": {
1709 - "mode": "thresholds"
1710 - },
1711 - "custom": {
1712 - "align": "auto",
1713 - "cellOptions": {
1714 - "type": "auto"
1715 - },
1716 - "inspect": false
1717 - },
1718 - "mappings": [],
1719 - "thresholds": {
1720 - "mode": "absolute",
1721 - "steps": [
1722 - {
1723 - "color": "green"
1724 - },
1725 - {
1726 - "color": "red",
1727 - "value": 80
1728 - }
1729 - ]
1730 - }
1731 - },
1732 - "overrides": [
1733 - {
1734 - "matcher": {
1735 - "id": "byName",
1736 - "options": "Time"
1737 - },
1738 - "properties": [
1739 - {
1740 - "id": "displayName",
1741 - "value": "Time"
1742 - },
1743 - {
1744 - "id": "unit",
1745 - "value": "time: YYYY-MM-DD HH:mm:ss"
1746 - },
1747 - {
1748 - "id": "custom.align"
1749 - }
1750 - ]
1751 - },
1752 - {
1753 - "matcher": {
1754 - "id": "byName",
1755 - "options": ""
1756 - },
1757 - "properties": [
1758 - {
1759 - "id": "unit",
1760 - "value": "short"
1761 - },
1762 - {
1763 - "id": "decimals",
1764 - "value": 2
1765 - },
1766 - {
1767 - "id": "custom.align"
1768 - }
1769 - ]
1770 - },
1771 - {
1772 - "matcher": {
1773 - "id": "byName",
1774 - "options": "agent_name"
1775 - },
1776 - "properties": [
1777 - {
1778 - "id": "displayName",
1779 - "value": "AGENT"
1780 - },
1781 - {
1782 - "id": "unit",
1783 - "value": "short"
1784 - },
1785 - {
1786 - "id": "decimals",
1787 - "value": 2
1788 - },
1789 - {
1790 - "id": "custom.align"
1791 - }
1792 - ]
1793 - },
1794 - {
1795 - "matcher": {
1796 - "id": "byName",
1797 - "options": "AGENT"
1798 - },
1799 - "properties": [
1800 - {
1801 - "id": "custom.width",
1802 - "value": 299
1803 - }
1804 - ]
1805 - }
1806 - ]
1807 - },
1808 - "gridPos": {
1809 - "h": 7,
1810 - "w": 8,
1811 - "x": 4,
1812 - "y": 2
1813 - },
1814 - "id": 79,
1815 - "options": {
1816 - "cellHeight": "sm",
1817 - "footer": {
1818 - "countRows": false,
1819 - "fields": "",
1820 - "reducer": [
1821 - "sum"
1822 - ],
1823 - "show": false
1824 - },
1825 - "showHeader": true,
1826 - "sortBy": []
1827 - },
1828 - "pluginVersion": "10.2.3",
1829 - "targets": [
1830 - {
1831 - "bucketAggs": [
1832 - {
1833 - "$$hashKey": "object:89",
1834 - "fake": true,
1835 - "field": "Sender",
1836 - "id": "4",
1837 - "settings": {
1838 - "min_doc_count": 1,
1839 - "order": "desc",
1840 - "orderBy": "_count",
1841 - "size": "10"
1842 - },
1843 - "type": "terms"
1844 - }
1845 - ],
1846 - "datasource": {
1847 - "type": "elasticsearch",
1848 - "uid": "replace_datasource_uid"
1849 - },
1850 - "metrics": [
1851 - {
1852 - "$$hashKey": "object:87",
1853 - "field": "select field",
1854 - "id": "1",
1855 - "type": "count"
1856 - }
1857 - ],
1858 - "query": "Virus:*",
1859 - "refId": "A",
1860 - "timeField": "datetime"
1861 - }
1862 - ],
1863 - "title": "TOP 10 SENDERS",
1864 - "transformations": [
1865 - {
1866 - "id": "merge",
1867 - "options": {
1868 - "reducers": []
1869 - }
1870 - }
1871 - ],
1872 - "type": "table"
1873 - },
1874 - {
1875 - "datasource": {
1876 - "type": "elasticsearch",
1877 - "uid": "replace_datasource_uid"
1878 - },
1879 - "fieldConfig": {
1880 - "defaults": {
1881 - "color": {
1882 - "mode": "palette-classic"
1883 - },
1884 - "custom": {
1885 - "hideFrom": {
1886 - "legend": false,
1887 - "tooltip": false,
1888 - "viz": false
1889 - }
1890 - },
1891 - "decimals": 0,
1892 - "mappings": [],
1893 - "unit": "short"
1894 - },
1895 - "overrides": []
1896 - },
1897 - "gridPos": {
1898 - "h": 7,
1899 - "w": 5,
1900 - "x": 12,
1901 - "y": 2
1902 - },
1903 - "id": 80,
1904 - "links": [],
1905 - "options": {
1906 - "displayLabels": [],
1907 - "legend": {
1908 - "calcs": [],
1909 - "displayMode": "list",
1910 - "placement": "bottom",
1911 - "showLegend": false,
1912 - "values": [
1913 - "value"
1914 - ]
1915 - },
1916 - "pieType": "pie",
1917 - "reduceOptions": {
1918 - "calcs": [
1919 - "sum"
1920 - ],
1921 - "fields": "",
1922 - "values": false
1923 - },
1924 - "text": {},
1925 - "tooltip": {
1926 - "mode": "single",
1927 - "sort": "none"
1928 - }
1929 - },
1930 - "pluginVersion": "7.3.4",
1931 - "targets": [
1932 - {
1933 - "bucketAggs": [
1934 - {
1935 - "$$hashKey": "object:211",
1936 - "fake": true,
1937 - "field": "Rcpt",
1938 - "id": "3",
1939 - "settings": {
1940 - "min_doc_count": "1",
1941 - "missing": "Unknown",
1942 - "order": "desc",
1943 - "orderBy": "_count",
1944 - "size": "10"
1945 - },
1946 - "type": "terms"
1947 - },
1948 - {
1949 - "$$hashKey": "object:117",
1950 - "field": "timestamp",
1951 - "id": "2",
1952 - "settings": {
1953 - "interval": "auto",
1954 - "min_doc_count": 0,
1955 - "trimEdges": 0
1956 - },
1957 - "type": "date_histogram"
1958 - }
1959 - ],
1960 - "datasource": {
1961 - "type": "elasticsearch",
1962 - "uid": "replace_datasource_uid"
1963 - },
1964 - "metrics": [
1965 - {
1966 - "$$hashKey": "object:115",
1967 - "field": "select field",
1968 - "id": "1",
1969 - "type": "count"
1970 - }
1971 - ],
1972 - "query": "",
1973 - "queryType": "randomWalk",
1974 - "refId": "A",
1975 - "timeField": "datetime"
1976 - }
1977 - ],
1978 - "title": "TOP 10 RECEIVERS",
1979 - "type": "piechart"
1980 - },
1981 - {
1982 - "datasource": {
1983 - "type": "elasticsearch",
1984 - "uid": "replace_datasource_uid"
1985 - },
1986 - "fieldConfig": {
1987 - "defaults": {
1988 - "custom": {
1989 - "align": "auto",
1990 - "cellOptions": {
1991 - "type": "auto"
1992 - },
1993 - "filterable": false,
1994 - "inspect": false
1995 - },
1996 - "mappings": [],
1997 - "thresholds": {
1998 - "mode": "absolute",
1999 - "steps": [
2000 - {
2001 - "color": "green"
2002 - },
2003 - {
2004 - "color": "red",
2005 - "value": 80
2006 - }
2007 - ]
2008 - }
2009 - },
2010 - "overrides": []
2011 - },
2012 - "gridPos": {
2013 - "h": 7,
2014 - "w": 7,
2015 - "x": 17,
2016 - "y": 2
2017 - },
2018 - "id": 81,
2019 - "links": [],
2020 - "options": {
2021 - "cellHeight": "sm",
2022 - "footer": {
2023 - "countRows": false,
2024 - "fields": "",
2025 - "reducer": [
2026 - "sum"
2027 - ],
2028 - "show": false
2029 - },
2030 - "showHeader": true
2031 - },
2032 - "pluginVersion": "10.2.3",
2033 - "targets": [
2034 - {
2035 - "bucketAggs": [
2036 - {
2037 - "$$hashKey": "object:211",
2038 - "fake": true,
2039 - "field": "Recipient",
2040 - "id": "3",
2041 - "settings": {
2042 - "min_doc_count": "1",
2043 - "missing": "Unknown",
2044 - "order": "desc",
2045 - "orderBy": "_count",
2046 - "size": "10"
2047 - },
2048 - "type": "terms"
2049 - }
2050 - ],
2051 - "datasource": {
2052 - "type": "elasticsearch",
2053 - "uid": "replace_datasource_uid"
2054 - },
2055 - "metrics": [
2056 - {
2057 - "$$hashKey": "object:115",
2058 - "field": "select field",
2059 - "id": "1",
2060 - "type": "count"
2061 - }
2062 - ],
2063 - "query": "Virus:*",
2064 - "queryType": "randomWalk",
2065 - "refId": "A",
2066 - "timeField": "datetime"
2067 - }
2068 - ],
2069 - "title": "TOP 10 RECEIVERS",
2070 - "transformations": [
2071 - {
2072 - "id": "organize",
2073 - "options": {
2074 - "excludeByName": {},
2075 - "indexByName": {},
2076 - "renameByName": {
2077 - "software_vendor": "SOFTWARE VENDOR"
2078 - }
2079 - }
2080 - }
2081 - ],
2082 - "type": "table"
2083 - },
2084 - {
2085 - "datasource": {
2086 - "type": "elasticsearch",
2087 - "uid": "replace_datasource_uid"
2088 - },
2089 - "fieldConfig": {
2090 - "defaults": {
2091 - "color": {
2092 - "mode": "thresholds"
2093 - },
2094 - "custom": {
2095 - "align": "auto",
2096 - "cellOptions": {
2097 - "type": "auto"
2098 - },
2099 - "inspect": false
2100 - },
2101 - "mappings": [],
2102 - "thresholds": {
2103 - "mode": "absolute",
2104 - "steps": [
2105 - {
2106 - "color": "green"
2107 - },
2108 - {
2109 - "color": "red",
2110 - "value": 80
2111 - }
2112 - ]
2113 - }
2114 - },
2115 - "overrides": [
2116 - {
2117 - "matcher": {
2118 - "id": "byName",
2119 - "options": "Time"
2120 - },
2121 - "properties": [
2122 - {
2123 - "id": "displayName",
2124 - "value": "Time"
2125 - },
2126 - {
2127 - "id": "unit",
2128 - "value": "time: YYYY-MM-DD HH:mm:ss"
2129 - },
2130 - {
2131 - "id": "custom.align"
2132 - }
2133 - ]
2134 - },
2135 - {
2136 - "matcher": {
2137 - "id": "byName",
2138 - "options": ""
2139 - },
2140 - "properties": [
2141 - {
2142 - "id": "unit",
2143 - "value": "short"
2144 - },
2145 - {
2146 - "id": "decimals",
2147 - "value": 2
2148 - },
2149 - {
2150 - "id": "custom.align"
2151 - }
2152 - ]
2153 - },
2154 - {
2155 - "matcher": {
2156 - "id": "byName",
2157 - "options": "agent_name"
2158 - },
2159 - "properties": [
2160 - {
2161 - "id": "displayName",
2162 - "value": "AGENT"
2163 - },
2164 - {
2165 - "id": "unit",
2166 - "value": "short"
2167 - },
2168 - {
2169 - "id": "decimals",
2170 - "value": 2
2171 - },
2172 - {
2173 - "id": "custom.align"
2174 - }
2175 - ]
2176 - },
2177 - {
2178 - "matcher": {
2179 - "id": "byName",
2180 - "options": "AGENT"
2181 - },
2182 - "properties": [
2183 - {
2184 - "id": "custom.width",
2185 - "value": 299
2186 - }
2187 - ]
2188 - }
2189 - ]
2190 - },
2191 - "gridPos": {
2192 - "h": 10,
2193 - "w": 8,
2194 - "x": 0,
2195 - "y": 9
2196 - },
2197 - "id": 82,
2198 - "options": {
2199 - "cellHeight": "sm",
2200 - "footer": {
2201 - "countRows": false,
2202 - "fields": "",
2203 - "reducer": [
2204 - "sum"
2205 - ],
2206 - "show": false
2207 - },
2208 - "showHeader": true,
2209 - "sortBy": []
2210 - },
2211 - "pluginVersion": "10.2.3",
2212 - "targets": [
2213 - {
2214 - "bucketAggs": [
2215 - {
2216 - "$$hashKey": "object:89",
2217 - "fake": true,
2218 - "field": "SenderDomain",
2219 - "id": "4",
2220 - "settings": {
2221 - "min_doc_count": 1,
2222 - "order": "desc",
2223 - "orderBy": "_count",
2224 - "size": "10"
2225 - },
2226 - "type": "terms"
2227 - }
2228 - ],
2229 - "datasource": {
2230 - "type": "elasticsearch",
2231 - "uid": "replace_datasource_uid"
2232 - },
2233 - "metrics": [
2234 - {
2235 - "$$hashKey": "object:87",
2236 - "field": "select field",
2237 - "id": "1",
2238 - "type": "count"
2239 - }
2240 - ],
2241 - "query": "Virus:*",
2242 - "refId": "A",
2243 - "timeField": "datetime"
2244 - }
2245 - ],
2246 - "title": "TOP 10 DOMAIN SENDERS",
2247 - "transformations": [
2248 - {
2249 - "id": "merge",
2250 - "options": {
2251 - "reducers": []
2252 - }
2253 - }
2254 - ],
2255 - "type": "table"
2256 - },
2257 - {
2258 - "datasource": {
2259 - "type": "elasticsearch",
2260 - "uid": "replace_datasource_uid"
2261 - },
2262 - "fieldConfig": {
2263 - "defaults": {
2264 - "color": {
2265 - "mode": "thresholds"
2266 - },
2267 - "custom": {
2268 - "align": "auto",
2269 - "cellOptions": {
2270 - "type": "auto"
2271 - },
2272 - "inspect": false
2273 - },
2274 - "mappings": [],
2275 - "thresholds": {
2276 - "mode": "absolute",
2277 - "steps": [
2278 - {
2279 - "color": "green"
2280 - },
2281 - {
2282 - "color": "red",
2283 - "value": 80
2284 - }
2285 - ]
2286 - }
2287 - },
2288 - "overrides": [
2289 - {
2290 - "matcher": {
2291 - "id": "byName",
2292 - "options": "Time"
2293 - },
2294 - "properties": [
2295 - {
2296 - "id": "displayName",
2297 - "value": "Time"
2298 - },
2299 - {
2300 - "id": "unit",
2301 - "value": "time: YYYY-MM-DD HH:mm:ss"
2302 - },
2303 - {
2304 - "id": "custom.align"
2305 - }
2306 - ]
2307 - },
2308 - {
2309 - "matcher": {
2310 - "id": "byName",
2311 - "options": ""
2312 - },
2313 - "properties": [
2314 - {
2315 - "id": "unit",
2316 - "value": "short"
2317 - },
2318 - {
2319 - "id": "decimals",
2320 - "value": 2
2321 - },
2322 - {
2323 - "id": "custom.align"
2324 - }
2325 - ]
2326 - },
2327 - {
2328 - "matcher": {
2329 - "id": "byName",
2330 - "options": "agent_name"
2331 - },
2332 - "properties": [
2333 - {
2334 - "id": "displayName",
2335 - "value": "AGENT"
2336 - },
2337 - {
2338 - "id": "unit",
2339 - "value": "short"
2340 - },
2341 - {
2342 - "id": "decimals",
2343 - "value": 2
2344 - },
2345 - {
2346 - "id": "custom.align"
2347 - }
2348 - ]
2349 - },
2350 - {
2351 - "matcher": {
2352 - "id": "byName",
2353 - "options": "AGENT"
2354 - },
2355 - "properties": [
2356 - {
2357 - "id": "custom.width",
2358 - "value": 299
2359 - }
2360 - ]
2361 - }
2362 - ]
2363 - },
2364 - "gridPos": {
2365 - "h": 10,
2366 - "w": 8,
2367 - "x": 8,
2368 - "y": 9
2369 - },
2370 - "id": 83,
2371 - "options": {
2372 - "cellHeight": "sm",
2373 - "footer": {
2374 - "countRows": false,
2375 - "fields": "",
2376 - "reducer": [
2377 - "sum"
2378 - ],
2379 - "show": false
2380 - },
2381 - "showHeader": true,
2382 - "sortBy": []
2383 - },
2384 - "pluginVersion": "10.2.3",
2385 - "targets": [
2386 - {
2387 - "bucketAggs": [
2388 - {
2389 - "$$hashKey": "object:89",
2390 - "fake": true,
2391 - "field": "IP",
2392 - "id": "4",
2393 - "settings": {
2394 - "min_doc_count": 1,
2395 - "order": "desc",
2396 - "orderBy": "_count",
2397 - "size": "10"
2398 - },
2399 - "type": "terms"
2400 - },
2401 - {
2402 - "field": "IP_country_code",
2403 - "id": "5",
2404 - "settings": {
2405 - "min_doc_count": "1",
2406 - "order": "desc",
2407 - "orderBy": "_count",
2408 - "size": "10"
2409 - },
2410 - "type": "terms"
2411 - }
2412 - ],
2413 - "datasource": {
2414 - "type": "elasticsearch",
2415 - "uid": "replace_datasource_uid"
2416 - },
2417 - "metrics": [
2418 - {
2419 - "$$hashKey": "object:87",
2420 - "field": "select field",
2421 - "id": "1",
2422 - "type": "count"
2423 - }
2424 - ],
2425 - "query": "Virus:*",
2426 - "refId": "A",
2427 - "timeField": "datetime"
2428 - }
2429 - ],
2430 - "title": "TOP 10 IPs",
2431 - "transformations": [
2432 - {
2433 - "id": "merge",
2434 - "options": {
2435 - "reducers": []
2436 - }
2437 - }
2438 - ],
2439 - "type": "table"
2440 - },
2441 - {
2442 - "circleMaxSize": 30,
2443 - "circleMinSize": 2,
2444 - "colors": [
2445 - "rgba(245, 54, 54, 0.9)",
2446 - "rgba(237, 129, 40, 0.89)",
2447 - "rgba(50, 172, 45, 0.97)"
2448 - ],
2449 - "datasource": {
2450 - "type": "elasticsearch",
2451 - "uid": "replace_datasource_uid"
2452 - },
2453 - "decimals": 0,
2454 - "esMetric": "Count",
2455 - "gridPos": {
2456 - "h": 10,
2457 - "w": 8,
2458 - "x": 16,
2459 - "y": 9
2460 - },
2461 - "hideEmpty": false,
2462 - "hideZero": false,
2463 - "id": 84,
2464 - "initialZoom": 1,
2465 - "locationData": "countries",
2466 - "mapCenter": "(0°, 0°)",
2467 - "mapCenterLatitude": 0,
2468 - "mapCenterLongitude": 0,
2469 - "maxDataPoints": 1,
2470 - "mouseWheelZoom": false,
2471 - "showLegend": true,
2472 - "stickyLabels": false,
2473 - "tableQueryOptions": {
2474 - "geohashField": "geohash",
2475 - "latitudeField": "latitude",
2476 - "longitudeField": "longitude",
2477 - "metricField": "metric",
2478 - "queryType": "geohash"
2479 - },
2480 - "targets": [
2481 - {
2482 - "alias": "",
2483 - "bucketAggs": [
2484 - {
2485 - "field": "IP_country_code",
2486 - "id": "3",
2487 - "settings": {
2488 - "min_doc_count": "1",
2489 - "order": "desc",
2490 - "orderBy": "_term",
2491 - "size": "10"
2492 - },
2493 - "type": "terms"
2494 - },
2495 - {
2496 - "field": "timestamp",
2497 - "id": "2",
2498 - "settings": {
2499 - "interval": "auto"
2500 - },
2501 - "type": "date_histogram"
2502 - }
2503 - ],
2504 - "datasource": {
2505 - "type": "elasticsearch",
2506 - "uid": "replace_datasource_uid"
2507 - },
2508 - "metrics": [
2509 - {
2510 - "id": "1",
2511 - "type": "count"
2512 - }
2513 - ],
2514 - "query": "Virus:*",
2515 - "refId": "A",
2516 - "timeField": "datetime"
2517 - }
2518 - ],
2519 - "thresholds": "0,10",
2520 - "title": "TOP 10 GEO IPs",
2521 - "type": "grafana-worldmap-panel",
2522 - "unitPlural": "",
2523 - "unitSingle": "",
2524 - "valueName": "total"
2525 - },
2526 - {
2527 - "datasource": {
2528 - "type": "grafana-opensearch-datasource",
2529 - "uid": "replace_datasource_uid"
2530 - },
2531 - "fieldConfig": {
2532 - "defaults": {
2533 - "mappings": [],
2534 - "thresholds": {
2535 - "mode": "absolute",
2536 - "steps": [
2537 - {
2538 - "color": "green"
2539 - },
2540 - {
2541 - "color": "red",
2542 - "value": 80
2543 - }
2544 - ]
2545 - }
2546 - },
2547 - "overrides": []
2548 - },
2549 - "gridPos": {
2550 - "h": 19,
2551 - "w": 24,
2552 - "x": 0,
2553 - "y": 19
2554 - },
2555 - "id": 85,
2556 - "options": {
2557 - "color": "blue",
2558 - "iteration": 20,
2559 - "monochrome": false,
2560 - "nodeColor": "super-light-purple",
2561 - "nodePadding": 20,
2562 - "nodeWidth": 30
2563 - },
2564 - "targets": [
2565 - {
2566 - "alias": "",
2567 - "bucketAggs": [
2568 - {
2569 - "field": "Virus",
2570 - "id": "2",
2571 - "settings": {
2572 - "min_doc_count": "1",
2573 - "order": "desc",
2574 - "orderBy": "_term",
2575 - "size": "10"
2576 - },
2577 - "type": "terms"
2578 - },
2579 - {
2580 - "field": "Sender",
2581 - "id": "3",
2582 - "settings": {
2583 - "min_doc_count": "1",
2584 - "order": "desc",
2585 - "orderBy": "_term",
2586 - "size": "1"
2587 - },
2588 - "type": "terms"
2589 - }
2590 - ],
2591 - "datasource": {
2592 - "type": "elasticsearch",
2593 - "uid": "replace_datasource_uid"
2594 - },
2595 - "metrics": [
2596 - {
2597 - "id": "1",
2598 - "type": "count"
2599 - }
2600 - ],
2601 - "query": "Virus:*",
2602 - "refId": "A",
2603 - "timeField": "timestamp"
2604 - }
2605 - ],
2606 - "title": "VIRUS FILE NAMES",
2607 - "transformations": [
2608 - {
2609 - "id": "organize",
2610 - "options": {
2611 - "excludeByName": {},
2612 - "indexByName": {},
2613 - "renameByName": {
2614 - "Count": "Count",
2615 - "parent_process_image": "PARENT PROCESS",
2616 - "process_image": "PROCESS"
2617 - }
2618 - }
2619 - }
2620 - ],
2621 - "transparent": true,
2622 - "type": "netsage-sankey-panel"
2623 - },
2624 - {
2625 - "datasource": {
2626 - "type": "elasticsearch",
2627 - "uid": "replace_datasource_uid"
2628 - },
2629 - "fieldConfig": {
2630 - "defaults": {
2631 - "color": {
2632 - "mode": "thresholds"
2633 - },
2634 - "custom": {
2635 - "align": "auto",
2636 - "cellOptions": {
2637 - "type": "auto"
2638 - },
2639 - "filterable": true,
2640 - "inspect": false
2641 - },
2642 - "mappings": [],
2643 - "thresholds": {
2644 - "mode": "absolute",
2645 - "steps": [
2646 - {
2647 - "color": "green"
2648 - },
2649 - {
2650 - "color": "red",
2651 - "value": 80
2652 - }
2653 - ]
2654 - }
2655 - },
2656 - "overrides": [
2657 - {
2658 - "matcher": {
2659 - "id": "byName",
2660 - "options": "timestamp"
2661 - },
2662 - "properties": [
2663 - {
2664 - "id": "displayName",
2665 - "value": "DATE/TIME"
2666 - },
2667 - {
2668 - "id": "unit",
2669 - "value": "time: YYYY-MM-DD HH:mm:ss"
2670 - },
2671 - {
2672 - "id": "custom.align"
2673 - }
2674 - ]
2675 - },
2676 - {
2677 - "matcher": {
2678 - "id": "byName",
2679 - "options": "process_name"
2680 - },
2681 - "properties": [
2682 - {
2683 - "id": "displayName",
2684 - "value": "PROCESS"
2685 - },
2686 - {
2687 - "id": "unit",
2688 - "value": "short"
2689 - },
2690 - {
2691 - "id": "decimals",
2692 - "value": -1
2693 - },
2694 - {
2695 - "id": "custom.align"
2696 - }
2697 - ]
2698 - },
2699 - {
2700 - "matcher": {
2701 - "id": "byName",
2702 - "options": "process_id"
2703 - },
2704 - "properties": [
2705 - {
2706 - "id": "displayName",
2707 - "value": "PID"
2708 - },
2709 - {
2710 - "id": "unit",
2711 - "value": "none"
2712 - },
2713 - {
2714 - "id": "decimals",
2715 - "value": -2
2716 - },
2717 - {
2718 - "id": "custom.align"
2719 - }
2720 - ]
2721 - },
2722 - {
2723 - "matcher": {
2724 - "id": "byName",
2725 - "options": "process_image"
2726 - },
2727 - "properties": [
2728 - {
2729 - "id": "displayName",
2730 - "value": "PROCESS IMAGE"
2731 - },
2732 - {
2733 - "id": "unit",
2734 - "value": "short"
2735 - },
2736 - {
2737 - "id": "decimals",
2738 - "value": 2
2739 - },
2740 - {
2741 - "id": "custom.align"
2742 - }
2743 - ]
2744 - },
2745 - {
2746 - "matcher": {
2747 - "id": "byName",
2748 - "options": "user_name"
2749 - },
2750 - "properties": [
2751 - {
2752 - "id": "displayName",
2753 - "value": "USER/ACCOUNT"
2754 - },
2755 - {
2756 - "id": "unit",
2757 - "value": "short"
2758 - },
2759 - {
2760 - "id": "decimals",
2761 - "value": 2
2762 - },
2763 - {
2764 - "id": "custom.align"
2765 - }
2766 - ]
2767 - },
2768 - {
2769 - "matcher": {
2770 - "id": "byName",
2771 - "options": "agent_name"
2772 - },
2773 - "properties": [
2774 - {
2775 - "id": "displayName",
2776 - "value": "AGENT"
2777 - },
2778 - {
2779 - "id": "unit",
2780 - "value": "short"
2781 - },
2782 - {
2783 - "id": "decimals",
2784 - "value": 2
2785 - },
2786 - {
2787 - "id": "custom.align"
2788 - }
2789 - ]
2790 - },
2791 - {
2792 - "matcher": {
2793 - "id": "byName",
2794 - "options": "parent_process_image"
2795 - },
2796 - "properties": [
2797 - {
2798 - "id": "displayName",
2799 - "value": "PARENT PROCESS"
2800 - },
2801 - {
2802 - "id": "unit",
2803 - "value": "short"
2804 - },
2805 - {
2806 - "id": "decimals",
2807 - "value": 2
2808 - },
2809 - {
2810 - "id": "custom.align"
2811 - }
2812 - ]
2813 - },
2814 - {
2815 - "matcher": {
2816 - "id": "byName",
2817 - "options": "process_cmd_line"
2818 - },
2819 - "properties": [
2820 - {
2821 - "id": "displayName",
2822 - "value": "PROCESS CMD LINE"
2823 - },
2824 - {
2825 - "id": "unit",
2826 - "value": "short"
2827 - },
2828 - {
2829 - "id": "decimals",
2830 - "value": 2
2831 - },
2832 - {
2833 - "id": "custom.align"
2834 - }
2835 - ]
2836 - },
2837 - {
2838 - "matcher": {
2839 - "id": "byName",
2840 - "options": "EVENT ID"
2841 - },
2842 - "properties": [
2843 - {
2844 - "id": "links",
2845 - "value": [
2846 - {
2847 - "targetBlank": true,
2848 - "title": "VIEW EVENT DETAILS",
2849 - "url": "https://dashboard.dnsoverwatch.com/explore?left=%5B%22now-6h%22,%22now%22,%22WF_Mimecast%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
2850 - }
2851 - ]
2852 - }
2853 - ]
2854 - }
2855 - ]
2856 - },
2857 - "gridPos": {
2858 - "h": 18,
2859 - "w": 24,
2860 - "x": 0,
2861 - "y": 38
2862 - },
2863 - "id": 86,
2864 - "options": {
2865 - "cellHeight": "sm",
2866 - "footer": {
2867 - "countRows": false,
2868 - "enablePagination": true,
2869 - "fields": "",
2870 - "reducer": [
2871 - "sum"
2872 - ],
2873 - "show": false
2874 - },
2875 - "showHeader": true
2876 - },
2877 - "pluginVersion": "10.2.3",
2878 - "targets": [
2879 - {
2880 - "bucketAggs": [],
2881 - "datasource": {
2882 - "type": "elasticsearch",
2883 - "uid": "replace_datasource_uid"
2884 - },
2885 - "metrics": [
2886 - {
2887 - "id": "1",
2888 - "settings": {
2889 - "size": "250"
2890 - },
2891 - "type": "raw_data"
2892 - }
2893 - ],
2894 - "query": "Virus:*",
2895 - "refId": "A",
2896 - "timeField": "datetime"
2897 - }
2898 - ],
2899 - "title": "VIRUS LOGS",
2900 - "transformations": [
2901 - {
2902 - "id": "filterFieldsByName",
2903 - "options": {
2904 - "include": {
2905 - "names": [
2906 - "Dir",
2907 - "IP",
2908 - "IP_country_code",
2909 - "Sender",
2910 - "SourceIP",
2911 - "SourceIP_country_code",
2912 - "Subject",
2913 - "_id",
2914 - "timestamp",
2915 - "SpamScore",
2916 - "Rcpt"
2917 - ]
2918 - }
2919 - }
2920 - },
2921 - {
2922 - "id": "organize",
2923 - "options": {
2924 - "excludeByName": {},
2925 - "indexByName": {
2926 - "Dir": 5,
2927 - "IP": 7,
2928 - "IP_country_code": 8,
2929 - "Rcpt": 6,
2930 - "Sender": 2,
2931 - "SourceIP": 3,
2932 - "SourceIP_country_code": 4,
2933 - "SpamScore": 10,
2934 - "Subject": 9,
2935 - "_id": 1,
2936 - "timestamp": 0
2937 - },
2938 - "renameByName": {
2939 - "Dir": "",
2940 - "IP_country_code": "COUNTRY",
2941 - "SourceIP": "SRC IP",
2942 - "SourceIP_country_code": "SRC COUNTRY",
2943 - "SpamScore": "",
2944 - "Subject": "",
2945 - "_id": "EVENT ID",
2946 - "agent_name": "",
2947 - "parent_cmd_line": "PARENT CMD",
2948 - "parent_process_id": "PARENT PID",
2949 - "parent_process_user": "PARENT USER",
2950 - "syslog_level": "LEVEL"
2951 - }
2952 - }
2953 - }
2954 - ],
2955 - "transparent": true,
2956 - "type": "table"
2957 - }
2958 - ],
2959 - "title": "VIRUS",
2960 - "type": "row"
2961 - },
2962 - {
2963 - "collapsed": true,
2964 - "gridPos": {
2965 - "h": 1,
2966 - "w": 24,
2967 - "x": 0,
2968 - "y": 2
2969 - },
2970 - "id": 88,
2971 - "panels": [
2972 - {
2973 - "datasource": {
2974 - "type": "elasticsearch",
2975 - "uid": "replace_datasource_uid"
2976 - },
2977 - "fieldConfig": {
2978 - "defaults": {
2979 - "mappings": [
2980 - {
2981 - "options": {
2982 - "match": "null",
2983 - "result": {
2984 - "text": "N/A"
2985 - }
2986 - },
2987 - "type": "special"
2988 - }
2989 - ],
2990 - "thresholds": {
2991 - "mode": "absolute",
2992 - "steps": [
2993 - {
2994 - "color": "blue",
2995 - "value": null
2996 - }
2997 - ]
2998 - },
2999 - "unit": "short"
3000 - },
3001 - "overrides": []
3002 - },
3003 - "gridPos": {
3004 - "h": 7,
3005 - "w": 4,
3006 - "x": 0,
3007 - "y": 3
3008 - },
3009 - "id": 89,
3010 - "links": [],
3011 - "options": {
3012 - "colorMode": "value",
3013 - "graphMode": "area",
3014 - "justifyMode": "auto",
3015 - "orientation": "horizontal",
3016 - "reduceOptions": {
3017 - "calcs": [
3018 - "sum"
3019 - ],
3020 - "fields": "",
3021 - "values": false
3022 - },
3023 - "text": {},
3024 - "textMode": "auto",
3025 - "wideLayout": true
3026 - },
3027 - "pluginVersion": "10.2.3",
3028 - "targets": [
3029 - {
3030 - "bucketAggs": [
3031 - {
3032 - "$$hashKey": "object:135",
3033 - "field": "timestamp",
3034 - "id": "2",
3035 - "settings": {
3036 - "interval": "auto",
3037 - "min_doc_count": 0,
3038 - "trimEdges": 0
3039 - },
3040 - "type": "date_histogram"
3041 - }
3042 - ],
3043 - "datasource": {
3044 - "type": "elasticsearch",
3045 - "uid": "replace_datasource_uid"
3046 - },
3047 - "metrics": [
3048 - {
3049 - "$$hashKey": "object:133",
3050 - "field": "select field",
3051 - "id": "1",
3052 - "type": "count"
3053 - }
3054 - ],
3055 - "query": "SpamScore:*",
3056 - "refId": "A",
3057 - "timeField": "datetime"
3058 - }
3059 - ],
3060 - "title": "SPAM EVENTS",
3061 - "type": "stat"
3062 - },
3063 - {
3064 - "datasource": {
3065 - "type": "elasticsearch",
3066 - "uid": "replace_datasource_uid"
3067 - },
3068 - "fieldConfig": {
3069 - "defaults": {
3070 - "color": {
3071 - "mode": "thresholds"
3072 - },
3073 - "custom": {
3074 - "align": "auto",
3075 - "cellOptions": {
3076 - "type": "auto"
3077 - },
3078 - "inspect": false
3079 - },
3080 - "mappings": [],
3081 - "thresholds": {
3082 - "mode": "absolute",
3083 - "steps": [
3084 - {
3085 - "color": "green",
3086 - "value": null
3087 - },
3088 - {
3089 - "color": "red",
3090 - "value": 80
3091 - }
3092 - ]
3093 - }
3094 - },
3095 - "overrides": [
3096 - {
3097 - "matcher": {
3098 - "id": "byName",
3099 - "options": "Time"
3100 - },
3101 - "properties": [
3102 - {
3103 - "id": "displayName",
3104 - "value": "Time"
3105 - },
3106 - {
3107 - "id": "unit",
3108 - "value": "time: YYYY-MM-DD HH:mm:ss"
3109 - },
3110 - {
3111 - "id": "custom.align"
3112 - }
3113 - ]
3114 - },
3115 - {
3116 - "matcher": {
3117 - "id": "byName",
3118 - "options": ""
3119 - },
3120 - "properties": [
3121 - {
3122 - "id": "unit",
3123 - "value": "short"
3124 - },
3125 - {
3126 - "id": "decimals",
3127 - "value": 2
3128 - },
3129 - {
3130 - "id": "custom.align"
3131 - }
3132 - ]
3133 - },
3134 - {
3135 - "matcher": {
3136 - "id": "byName",
3137 - "options": "agent_name"
3138 - },
3139 - "properties": [
3140 - {
3141 - "id": "displayName",
3142 - "value": "AGENT"
3143 - },
3144 - {
3145 - "id": "unit",
3146 - "value": "short"
3147 - },
3148 - {
3149 - "id": "decimals",
3150 - "value": 2
3151 - },
3152 - {
3153 - "id": "custom.align"
3154 - }
3155 - ]
3156 - },
3157 - {
3158 - "matcher": {
3159 - "id": "byName",
3160 - "options": "AGENT"
3161 - },
3162 - "properties": [
3163 - {
3164 - "id": "custom.width",
3165 - "value": 299
3166 - }
3167 - ]
3168 - }
3169 - ]
3170 - },
3171 - "gridPos": {
3172 - "h": 7,
3173 - "w": 8,
3174 - "x": 4,
3175 - "y": 3
3176 - },
3177 - "id": 90,
3178 - "options": {
3179 - "cellHeight": "sm",
3180 - "footer": {
3181 - "countRows": false,
3182 - "fields": "",
3183 - "reducer": [
3184 - "sum"
3185 - ],
3186 - "show": false
3187 - },
3188 - "showHeader": true,
3189 - "sortBy": []
3190 - },
3191 - "pluginVersion": "10.2.3",
3192 - "targets": [
3193 - {
3194 - "bucketAggs": [
3195 - {
3196 - "$$hashKey": "object:89",
3197 - "fake": true,
3198 - "field": "Sender",
3199 - "id": "4",
3200 - "settings": {
3201 - "min_doc_count": 1,
3202 - "order": "desc",
3203 - "orderBy": "_count",
3204 - "size": "10"
3205 - },
3206 - "type": "terms"
3207 - }
3208 - ],
3209 - "datasource": {
3210 - "type": "elasticsearch",
3211 - "uid": "replace_datasource_uid"
3212 - },
3213 - "metrics": [
3214 - {
3215 - "$$hashKey": "object:87",
3216 - "field": "select field",
3217 - "id": "1",
3218 - "type": "count"
3219 - }
3220 - ],
3221 - "query": "SpamScore:*",
3222 - "refId": "A",
3223 - "timeField": "datetime"
3224 - }
3225 - ],
3226 - "title": "TOP 10 SENDERS",
3227 - "transformations": [
3228 - {
3229 - "id": "merge",
3230 - "options": {
3231 - "reducers": []
3232 - }
3233 - }
3234 - ],
3235 - "type": "table"
3236 - },
3237 - {
3238 - "datasource": {
3239 - "type": "elasticsearch",
3240 - "uid": "replace_datasource_uid"
3241 - },
3242 - "fieldConfig": {
3243 - "defaults": {
3244 - "color": {
3245 - "mode": "palette-classic"
3246 - },
3247 - "custom": {
3248 - "hideFrom": {
3249 - "legend": false,
3250 - "tooltip": false,
3251 - "viz": false
3252 - }
3253 - },
3254 - "decimals": 0,
3255 - "mappings": [],
3256 - "unit": "short"
3257 - },
3258 - "overrides": []
3259 - },
3260 - "gridPos": {
3261 - "h": 7,
3262 - "w": 5,
3263 - "x": 12,
3264 - "y": 3
3265 - },
3266 - "id": 91,
3267 - "links": [],
3268 - "options": {
3269 - "displayLabels": [],
3270 - "legend": {
3271 - "calcs": [],
3272 - "displayMode": "list",
3273 - "placement": "bottom",
3274 - "showLegend": false,
3275 - "values": [
3276 - "value"
3277 - ]
3278 - },
3279 - "pieType": "pie",
3280 - "reduceOptions": {
3281 - "calcs": [
3282 - "sum"
3283 - ],
3284 - "fields": "",
3285 - "values": false
3286 - },
3287 - "text": {},
3288 - "tooltip": {
3289 - "mode": "single",
3290 - "sort": "none"
3291 - }
3292 - },
3293 - "pluginVersion": "7.3.4",
3294 - "targets": [
3295 - {
3296 - "bucketAggs": [
3297 - {
3298 - "$$hashKey": "object:211",
3299 - "fake": true,
3300 - "field": "Rcpt",
3301 - "id": "3",
3302 - "settings": {
3303 - "min_doc_count": "1",
3304 - "missing": "Unknown",
3305 - "order": "desc",
3306 - "orderBy": "_count",
3307 - "size": "10"
3308 - },
3309 - "type": "terms"
3310 - },
3311 - {
3312 - "$$hashKey": "object:117",
3313 - "field": "timestamp",
3314 - "id": "2",
3315 - "settings": {
3316 - "interval": "auto",
3317 - "min_doc_count": 0,
3318 - "trimEdges": 0
3319 - },
3320 - "type": "date_histogram"
3321 - }
3322 - ],
3323 - "datasource": {
3324 - "type": "elasticsearch",
3325 - "uid": "replace_datasource_uid"
3326 - },
3327 - "metrics": [
3328 - {
3329 - "$$hashKey": "object:115",
3330 - "field": "select field",
3331 - "id": "1",
3332 - "type": "count"
3333 - }
3334 - ],
3335 - "query": "SpamScore:*",
3336 - "queryType": "randomWalk",
3337 - "refId": "A",
3338 - "timeField": "datetime"
3339 - }
3340 - ],
3341 - "title": "TOP 10 RECEIVERS",
3342 - "type": "piechart"
3343 - },
3344 - {
3345 - "datasource": {
3346 - "type": "elasticsearch",
3347 - "uid": "replace_datasource_uid"
3348 - },
3349 - "fieldConfig": {
3350 - "defaults": {
3351 - "custom": {
3352 - "align": "auto",
3353 - "cellOptions": {
3354 - "type": "auto"
3355 - },
3356 - "filterable": false,
3357 - "inspect": false
3358 - },
3359 - "mappings": [],
3360 - "thresholds": {
3361 - "mode": "absolute",
3362 - "steps": [
3363 - {
3364 - "color": "green",
3365 - "value": null
3366 - },
3367 - {
3368 - "color": "red",
3369 - "value": 80
3370 - }
3371 - ]
3372 - }
3373 - },
3374 - "overrides": []
3375 - },
3376 - "gridPos": {
3377 - "h": 7,
3378 - "w": 7,
3379 - "x": 17,
3380 - "y": 3
3381 - },
3382 - "id": 92,
3383 - "links": [],
3384 - "options": {
3385 - "cellHeight": "sm",
3386 - "footer": {
3387 - "countRows": false,
3388 - "fields": "",
3389 - "reducer": [
3390 - "sum"
3391 - ],
3392 - "show": false
3393 - },
3394 - "showHeader": true
3395 - },
3396 - "pluginVersion": "10.2.3",
3397 - "targets": [
3398 - {
3399 - "bucketAggs": [
3400 - {
3401 - "$$hashKey": "object:211",
3402 - "fake": true,
3403 - "field": "Rcpt",
3404 - "id": "3",
3405 - "settings": {
3406 - "min_doc_count": "1",
3407 - "missing": "Unknown",
3408 - "order": "desc",
3409 - "orderBy": "_count",
3410 - "size": "10"
3411 - },
3412 - "type": "terms"
3413 - }
3414 - ],
3415 - "datasource": {
3416 - "type": "elasticsearch",
3417 - "uid": "replace_datasource_uid"
3418 - },
3419 - "metrics": [
3420 - {
3421 - "$$hashKey": "object:115",
3422 - "field": "select field",
3423 - "id": "1",
3424 - "type": "count"
3425 - }
3426 - ],
3427 - "query": "SpamScore:*",
3428 - "queryType": "randomWalk",
3429 - "refId": "A",
3430 - "timeField": "datetime"
3431 - }
3432 - ],
3433 - "title": "TOP 10 RECEIVERS",
3434 - "transformations": [
3435 - {
3436 - "id": "organize",
3437 - "options": {
3438 - "excludeByName": {},
3439 - "indexByName": {},
3440 - "renameByName": {
3441 - "software_vendor": "SOFTWARE VENDOR"
3442 - }
3443 - }
3444 - }
3445 - ],
3446 - "type": "table"
3447 - },
3448 - {
3449 - "datasource": {
3450 - "type": "elasticsearch",
3451 - "uid": "replace_datasource_uid"
3452 - },
3453 - "fieldConfig": {
3454 - "defaults": {
3455 - "color": {
3456 - "mode": "thresholds"
3457 - },
3458 - "custom": {
3459 - "align": "auto",
3460 - "cellOptions": {
3461 - "type": "auto"
3462 - },
3463 - "inspect": false
3464 - },
3465 - "mappings": [],
3466 - "thresholds": {
3467 - "mode": "absolute",
3468 - "steps": [
3469 - {
3470 - "color": "green",
3471 - "value": null
3472 - },
3473 - {
3474 - "color": "red",
3475 - "value": 80
3476 - }
3477 - ]
3478 - }
3479 - },
3480 - "overrides": [
3481 - {
3482 - "matcher": {
3483 - "id": "byName",
3484 - "options": "Time"
3485 - },
3486 - "properties": [
3487 - {
3488 - "id": "displayName",
3489 - "value": "Time"
3490 - },
3491 - {
3492 - "id": "unit",
3493 - "value": "time: YYYY-MM-DD HH:mm:ss"
3494 - },
3495 - {
3496 - "id": "custom.align"
3497 - }
3498 - ]
3499 - },
3500 - {
3501 - "matcher": {
3502 - "id": "byName",
3503 - "options": ""
3504 - },
3505 - "properties": [
3506 - {
3507 - "id": "unit",
3508 - "value": "short"
3509 - },
3510 - {
3511 - "id": "decimals",
3512 - "value": 2
3513 - },
3514 - {
3515 - "id": "custom.align"
3516 - }
3517 - ]
3518 - },
3519 - {
3520 - "matcher": {
3521 - "id": "byName",
3522 - "options": "agent_name"
3523 - },
3524 - "properties": [
3525 - {
3526 - "id": "displayName",
3527 - "value": "AGENT"
3528 - },
3529 - {
3530 - "id": "unit",
3531 - "value": "short"
3532 - },
3533 - {
3534 - "id": "decimals",
3535 - "value": 2
3536 - },
3537 - {
3538 - "id": "custom.align"
3539 - }
3540 - ]
3541 - },
3542 - {
3543 - "matcher": {
3544 - "id": "byName",
3545 - "options": "AGENT"
3546 - },
3547 - "properties": [
3548 - {
3549 - "id": "custom.width",
3550 - "value": 299
3551 - }
3552 - ]
3553 - }
3554 - ]
3555 - },
3556 - "gridPos": {
3557 - "h": 10,
3558 - "w": 8,
3559 - "x": 0,
3560 - "y": 10
3561 - },
3562 - "id": 93,
3563 - "options": {
3564 - "cellHeight": "sm",
3565 - "footer": {
3566 - "countRows": false,
3567 - "fields": "",
3568 - "reducer": [
3569 - "sum"
3570 - ],
3571 - "show": false
3572 - },
3573 - "showHeader": true,
3574 - "sortBy": []
3575 - },
3576 - "pluginVersion": "10.2.3",
3577 - "targets": [
3578 - {
3579 - "bucketAggs": [
3580 - {
3581 - "$$hashKey": "object:89",
3582 - "fake": true,
3583 - "field": "Subject",
3584 - "id": "4",
3585 - "settings": {
3586 - "min_doc_count": 1,
3587 - "order": "desc",
3588 - "orderBy": "_count",
3589 - "size": "10"
3590 - },
3591 - "type": "terms"
3592 - }
3593 - ],
3594 - "datasource": {
3595 - "type": "elasticsearch",
3596 - "uid": "replace_datasource_uid"
3597 - },
3598 - "metrics": [
3599 - {
3600 - "$$hashKey": "object:87",
3601 - "field": "select field",
3602 - "id": "1",
3603 - "type": "count"
3604 - }
3605 - ],
3606 - "query": "SpamScore:*",
3607 - "refId": "A",
3608 - "timeField": "datetime"
3609 - }
3610 - ],
3611 - "title": "TOP 10 SUBJECTS",
3612 - "transformations": [
3613 - {
3614 - "id": "merge",
3615 - "options": {
3616 - "reducers": []
3617 - }
3618 - }
3619 - ],
3620 - "type": "table"
3621 - },
3622 - {
3623 - "datasource": {
3624 - "type": "elasticsearch",
3625 - "uid": "replace_datasource_uid"
3626 - },
3627 - "fieldConfig": {
3628 - "defaults": {
3629 - "color": {
3630 - "mode": "thresholds"
3631 - },
3632 - "custom": {
3633 - "align": "auto",
3634 - "cellOptions": {
3635 - "type": "auto"
3636 - },
3637 - "inspect": false
3638 - },
3639 - "mappings": [],
3640 - "thresholds": {
3641 - "mode": "absolute",
3642 - "steps": [
3643 - {
3644 - "color": "green",
3645 - "value": null
3646 - },
3647 - {
3648 - "color": "red",
3649 - "value": 80
3650 - }
3651 - ]
3652 - }
3653 - },
3654 - "overrides": [
3655 - {
3656 - "matcher": {
3657 - "id": "byName",
3658 - "options": "Time"
3659 - },
3660 - "properties": [
3661 - {
3662 - "id": "displayName",
3663 - "value": "Time"
3664 - },
3665 - {
3666 - "id": "unit",
3667 - "value": "time: YYYY-MM-DD HH:mm:ss"
3668 - },
3669 - {
3670 - "id": "custom.align"
3671 - }
3672 - ]
3673 - },
3674 - {
3675 - "matcher": {
3676 - "id": "byName",
3677 - "options": ""
3678 - },
3679 - "properties": [
3680 - {
3681 - "id": "unit",
3682 - "value": "short"
3683 - },
3684 - {
3685 - "id": "decimals",
3686 - "value": 2
3687 - },
3688 - {
3689 - "id": "custom.align"
3690 - }
3691 - ]
3692 - },
3693 - {
3694 - "matcher": {
3695 - "id": "byName",
3696 - "options": "agent_name"
3697 - },
3698 - "properties": [
3699 - {
3700 - "id": "displayName",
3701 - "value": "AGENT"
3702 - },
3703 - {
3704 - "id": "unit",
3705 - "value": "short"
3706 - },
3707 - {
3708 - "id": "decimals",
3709 - "value": 2
3710 - },
3711 - {
3712 - "id": "custom.align"
3713 - }
3714 - ]
3715 - },
3716 - {
3717 - "matcher": {
3718 - "id": "byName",
3719 - "options": "AGENT"
3720 - },
3721 - "properties": [
3722 - {
3723 - "id": "custom.width",
3724 - "value": 299
3725 - }
3726 - ]
3727 - }
3728 - ]
3729 - },
3730 - "gridPos": {
3731 - "h": 10,
3732 - "w": 8,
3733 - "x": 8,
3734 - "y": 10
3735 - },
3736 - "id": 94,
3737 - "options": {
3738 - "cellHeight": "sm",
3739 - "footer": {
3740 - "countRows": false,
3741 - "fields": "",
3742 - "reducer": [
3743 - "sum"
3744 - ],
3745 - "show": false
3746 - },
3747 - "showHeader": true,
3748 - "sortBy": []
3749 - },
3750 - "pluginVersion": "10.2.3",
3751 - "targets": [
3752 - {
3753 - "bucketAggs": [
3754 - {
3755 - "$$hashKey": "object:89",
3756 - "fake": true,
3757 - "field": "IP",
3758 - "id": "4",
3759 - "settings": {
3760 - "min_doc_count": 1,
3761 - "order": "desc",
3762 - "orderBy": "_count",
3763 - "size": "10"
3764 - },
3765 - "type": "terms"
3766 - },
3767 - {
3768 - "field": "IP_country_code",
3769 - "id": "5",
3770 - "settings": {
3771 - "min_doc_count": "1",
3772 - "order": "desc",
3773 - "orderBy": "_count",
3774 - "size": "10"
3775 - },
3776 - "type": "terms"
3777 - }
3778 - ],
3779 - "datasource": {
3780 - "type": "elasticsearch",
3781 - "uid": "replace_datasource_uid"
3782 - },
3783 - "metrics": [
3784 - {
3785 - "$$hashKey": "object:87",
3786 - "field": "select field",
3787 - "id": "1",
3788 - "type": "count"
3789 - }
3790 - ],
3791 - "query": "SpamScore:*",
3792 - "refId": "A",
3793 - "timeField": "datetime"
3794 - }
3795 - ],
3796 - "title": "TOP 10 IPs",
3797 - "transformations": [
3798 - {
3799 - "id": "merge",
3800 - "options": {
3801 - "reducers": []
3802 - }
3803 - }
3804 - ],
3805 - "type": "table"
3806 - },
3807 - {
3808 - "circleMaxSize": 30,
3809 - "circleMinSize": 2,
3810 - "colors": [
3811 - "rgba(245, 54, 54, 0.9)",
3812 - "rgba(237, 129, 40, 0.89)",
3813 - "rgba(50, 172, 45, 0.97)"
3814 - ],
3815 - "datasource": {
3816 - "type": "elasticsearch",
3817 - "uid": "replace_datasource_uid"
3818 - },
3819 - "decimals": 0,
3820 - "esMetric": "Count",
3821 - "gridPos": {
3822 - "h": 10,
3823 - "w": 8,
3824 - "x": 16,
3825 - "y": 10
3826 - },
3827 - "hideEmpty": false,
3828 - "hideZero": false,
3829 - "id": 95,
3830 - "initialZoom": 1,
3831 - "locationData": "countries",
3832 - "mapCenter": "(0°, 0°)",
3833 - "mapCenterLatitude": 0,
3834 - "mapCenterLongitude": 0,
3835 - "maxDataPoints": 1,
3836 - "mouseWheelZoom": false,
3837 - "showLegend": true,
3838 - "stickyLabels": false,
3839 - "tableQueryOptions": {
3840 - "geohashField": "geohash",
3841 - "latitudeField": "latitude",
3842 - "longitudeField": "longitude",
3843 - "metricField": "metric",
3844 - "queryType": "geohash"
3845 - },
3846 - "targets": [
3847 - {
3848 - "alias": "",
3849 - "bucketAggs": [
3850 - {
3851 - "field": "IP_country_code",
3852 - "id": "3",
3853 - "settings": {
3854 - "min_doc_count": "1",
3855 - "order": "desc",
3856 - "orderBy": "_term",
3857 - "size": "10"
3858 - },
3859 - "type": "terms"
3860 - },
3861 - {
3862 - "field": "timestamp",
3863 - "id": "2",
3864 - "settings": {
3865 - "interval": "auto"
3866 - },
3867 - "type": "date_histogram"
3868 - }
3869 - ],
3870 - "datasource": {
3871 - "type": "elasticsearch",
3872 - "uid": "replace_datasource_uid"
3873 - },
3874 - "metrics": [
3875 - {
3876 - "id": "1",
3877 - "type": "count"
3878 - }
3879 - ],
3880 - "query": "SpamScore:*",
3881 - "refId": "A",
3882 - "timeField": "datetime"
3883 - }
3884 - ],
3885 - "thresholds": "0,10",
3886 - "title": "TOP 10 GEO IPs",
3887 - "type": "grafana-worldmap-panel",
3888 - "unitPlural": "",
3889 - "unitSingle": "",
3890 - "valueName": "total"
3891 - },
3892 - {
3893 - "datasource": {
3894 - "type": "elasticsearch",
3895 - "uid": "replace_datasource_uid"
3896 - },
3897 - "fieldConfig": {
3898 - "defaults": {
3899 - "mappings": [],
3900 - "thresholds": {
3901 - "mode": "absolute",
3902 - "steps": [
3903 - {
3904 - "color": "green",
3905 - "value": null
3906 - },
3907 - {
3908 - "color": "red",
3909 - "value": 80
3910 - }
3911 - ]
3912 - }
3913 - },
3914 - "overrides": []
3915 - },
3916 - "gridPos": {
3917 - "h": 19,
3918 - "w": 24,
3919 - "x": 0,
3920 - "y": 20
3921 - },
3922 - "id": 96,
3923 - "options": {
3924 - "color": "blue",
3925 - "iteration": 20,
3926 - "monochrome": false,
3927 - "nodeColor": "super-light-purple",
3928 - "nodePadding": 20,
3929 - "nodeWidth": 30
3930 - },
3931 - "targets": [
3932 - {
3933 - "alias": "",
3934 - "bucketAggs": [
3935 - {
3936 - "field": "Sender",
3937 - "id": "2",
3938 - "settings": {
3939 - "min_doc_count": "1",
3940 - "order": "desc",
3941 - "orderBy": "_term",
3942 - "size": "10"
3943 - },
3944 - "type": "terms"
3945 - },
3946 - {
3947 - "field": "Subject",
3948 - "id": "3",
3949 - "settings": {
3950 - "min_doc_count": "1",
3951 - "order": "desc",
3952 - "orderBy": "_term",
3953 - "size": "1"
3954 - },
3955 - "type": "terms"
3956 - }
3957 - ],
3958 - "datasource": {
3959 - "type": "elasticsearch",
3960 - "uid": "replace_datasource_uid"
3961 - },
3962 - "metrics": [
3963 - {
3964 - "id": "1",
3965 - "type": "count"
3966 - }
3967 - ],
3968 - "query": "SpamScore:*",
3969 - "refId": "A",
3970 - "timeField": "datetime"
3971 - }
3972 - ],
3973 - "title": "SPAM SUBJECTS",
3974 - "transformations": [
3975 - {
3976 - "id": "organize",
3977 - "options": {
3978 - "excludeByName": {},
3979 - "indexByName": {},
3980 - "renameByName": {
3981 - "Count": "Count",
3982 - "parent_process_image": "PARENT PROCESS",
3983 - "process_image": "PROCESS"
3984 - }
3985 - }
3986 - }
3987 - ],
3988 - "transparent": true,
3989 - "type": "netsage-sankey-panel"
3990 - },
3991 - {
3992 - "datasource": {
3993 - "type": "elasticsearch",
3994 - "uid": "replace_datasource_uid"
3995 - },
3996 - "fieldConfig": {
3997 - "defaults": {
3998 - "color": {
3999 - "mode": "thresholds"
4000 - },
4001 - "custom": {
4002 - "align": "auto",
4003 - "cellOptions": {
4004 - "type": "auto"
4005 - },
4006 - "filterable": true,
4007 - "inspect": false
4008 - },
4009 - "mappings": [],
4010 - "thresholds": {
4011 - "mode": "absolute",
4012 - "steps": [
4013 - {
4014 - "color": "green"
4015 - },
4016 - {
4017 - "color": "red",
4018 - "value": 80
4019 - }
4020 - ]
4021 - }
4022 - },
4023 - "overrides": [
4024 - {
4025 - "matcher": {
4026 - "id": "byName",
4027 - "options": "timestamp"
4028 - },
4029 - "properties": [
4030 - {
4031 - "id": "displayName",
4032 - "value": "DATE/TIME"
4033 - },
4034 - {
4035 - "id": "unit",
4036 - "value": "time: YYYY-MM-DD HH:mm:ss"
4037 - },
4038 - {
4039 - "id": "custom.align"
4040 - }
4041 - ]
4042 - },
4043 - {
4044 - "matcher": {
4045 - "id": "byName",
4046 - "options": "process_name"
4047 - },
4048 - "properties": [
4049 - {
4050 - "id": "displayName",
4051 - "value": "PROCESS"
4052 - },
4053 - {
4054 - "id": "unit",
4055 - "value": "short"
4056 - },
4057 - {
4058 - "id": "decimals",
4059 - "value": -1
4060 - },
4061 - {
4062 - "id": "custom.align"
4063 - }
4064 - ]
4065 - },
4066 - {
4067 - "matcher": {
4068 - "id": "byName",
4069 - "options": "process_id"
4070 - },
4071 - "properties": [
4072 - {
4073 - "id": "displayName",
4074 - "value": "PID"
4075 - },
4076 - {
4077 - "id": "unit",
4078 - "value": "none"
4079 - },
4080 - {
4081 - "id": "decimals",
4082 - "value": -2
4083 - },
4084 - {
4085 - "id": "custom.align"
4086 - }
4087 - ]
4088 - },
4089 - {
4090 - "matcher": {
4091 - "id": "byName",
4092 - "options": "process_image"
4093 - },
4094 - "properties": [
4095 - {
4096 - "id": "displayName",
4097 - "value": "PROCESS IMAGE"
4098 - },
4099 - {
4100 - "id": "unit",
4101 - "value": "short"
4102 - },
4103 - {
4104 - "id": "decimals",
4105 - "value": 2
4106 - },
4107 - {
4108 - "id": "custom.align"
4109 - }
4110 - ]
4111 - },
4112 - {
4113 - "matcher": {
4114 - "id": "byName",
4115 - "options": "user_name"
4116 - },
4117 - "properties": [
4118 - {
4119 - "id": "displayName",
4120 - "value": "USER/ACCOUNT"
4121 - },
4122 - {
4123 - "id": "unit",
4124 - "value": "short"
4125 - },
4126 - {
4127 - "id": "decimals",
4128 - "value": 2
4129 - },
4130 - {
4131 - "id": "custom.align"
4132 - }
4133 - ]
4134 - },
4135 - {
4136 - "matcher": {
4137 - "id": "byName",
4138 - "options": "agent_name"
4139 - },
4140 - "properties": [
4141 - {
4142 - "id": "displayName",
4143 - "value": "AGENT"
4144 - },
4145 - {
4146 - "id": "unit",
4147 - "value": "short"
4148 - },
4149 - {
4150 - "id": "decimals",
4151 - "value": 2
4152 - },
4153 - {
4154 - "id": "custom.align"
4155 - }
4156 - ]
4157 - },
4158 - {
4159 - "matcher": {
4160 - "id": "byName",
4161 - "options": "parent_process_image"
4162 - },
4163 - "properties": [
4164 - {
4165 - "id": "displayName",
4166 - "value": "PARENT PROCESS"
4167 - },
4168 - {
4169 - "id": "unit",
4170 - "value": "short"
4171 - },
4172 - {
4173 - "id": "decimals",
4174 - "value": 2
4175 - },
4176 - {
4177 - "id": "custom.align"
4178 - }
4179 - ]
4180 - },
4181 - {
4182 - "matcher": {
4183 - "id": "byName",
4184 - "options": "process_cmd_line"
4185 - },
4186 - "properties": [
4187 - {
4188 - "id": "displayName",
4189 - "value": "PROCESS CMD LINE"
4190 - },
4191 - {
4192 - "id": "unit",
4193 - "value": "short"
4194 - },
4195 - {
4196 - "id": "decimals",
4197 - "value": 2
4198 - },
4199 - {
4200 - "id": "custom.align"
4201 - }
4202 - ]
4203 - },
4204 - {
4205 - "matcher": {
4206 - "id": "byName",
4207 - "options": "EVENT ID"
4208 - },
4209 - "properties": [
4210 - {
4211 - "id": "links",
4212 - "value": [
4213 - {
4214 - "targetBlank": true,
4215 - "title": "VIEW EVENT DETAILS",
4216 - "url": "https://dashboard.dnsoverwatch.com/explore?left=%5B%22now-6h%22,%22now%22,%22WF_Mimecast%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
4217 - }
4218 - ]
4219 - }
4220 - ]
4221 - }
4222 - ]
4223 - },
4224 - "gridPos": {
4225 - "h": 18,
4226 - "w": 24,
4227 - "x": 0,
4228 - "y": 39
4229 - },
4230 - "id": 97,
4231 - "options": {
4232 - "cellHeight": "sm",
4233 - "footer": {
4234 - "countRows": false,
4235 - "enablePagination": true,
4236 - "fields": "",
4237 - "reducer": [
4238 - "sum"
4239 - ],
4240 - "show": false
4241 - },
4242 - "showHeader": true
4243 - },
4244 - "pluginVersion": "10.2.3",
4245 - "targets": [
4246 - {
4247 - "bucketAggs": [],
4248 - "datasource": {
4249 - "type": "elasticsearch",
4250 - "uid": "replace_datasource_uid"
4251 - },
4252 - "metrics": [
4253 - {
4254 - "id": "1",
4255 - "settings": {
4256 - "size": "250"
4257 - },
4258 - "type": "raw_data"
4259 - }
4260 - ],
4261 - "query": "SpamScore:*",
4262 - "refId": "A",
4263 - "timeField": "datetime"
4264 - }
4265 - ],
4266 - "title": "SPAM LOGS",
4267 - "transformations": [
4268 - {
4269 - "id": "filterFieldsByName",
4270 - "options": {
4271 - "include": {
4272 - "names": [
4273 - "Dir",
4274 - "IP",
4275 - "IP_country_code",
4276 - "Sender",
4277 - "SourceIP",
4278 - "SourceIP_country_code",
4279 - "Subject",
4280 - "_id",
4281 - "timestamp",
4282 - "SpamScore",
4283 - "Rcpt"
4284 - ]
4285 - }
4286 - }
4287 - },
4288 - {
4289 - "id": "organize",
4290 - "options": {
4291 - "excludeByName": {},
4292 - "indexByName": {
4293 - "Dir": 5,
4294 - "IP": 7,
4295 - "IP_country_code": 8,
4296 - "Rcpt": 6,
4297 - "Sender": 2,
4298 - "SourceIP": 3,
4299 - "SourceIP_country_code": 4,
4300 - "SpamScore": 10,
4301 - "Subject": 9,
4302 - "_id": 1,
4303 - "timestamp": 0
4304 - },
4305 - "renameByName": {
4306 - "Dir": "",
4307 - "IP_country_code": "COUNTRY",
4308 - "SourceIP": "SRC IP",
4309 - "SourceIP_country_code": "SRC COUNTRY",
4310 - "SpamScore": "",
4311 - "Subject": "",
4312 - "_id": "EVENT ID",
4313 - "agent_name": "",
4314 - "parent_cmd_line": "PARENT CMD",
4315 - "parent_process_id": "PARENT PID",
4316 - "parent_process_user": "PARENT USER",
4317 - "syslog_level": "LEVEL"
4318 - }
4319 - }
4320 - }
4321 - ],
4322 - "transparent": true,
4323 - "type": "table"
4324 - }
4325 - ],
4326 - "title": "SPAM",
4327 - "type": "row"
4328 - },
4329 - {
4330 - "collapsed": false,
4331 - "gridPos": {
4332 - "h": 1,
4333 - "w": 24,
4334 - "x": 0,
4335 - "y": 3
4336 - },
4337 - "id": 99,
4338 - "panels": [],
4339 - "title": "URL SCANNING",
4340 - "type": "row"
4341 - },
4342 - {
4343 - "datasource": {
4344 - "type": "grafana-opensearch-datasource",
4345 - "uid": "replace_datasource_uid"
4346 - },
4347 - "fieldConfig": {
4348 - "defaults": {
4349 - "mappings": [
4350 - {
4351 - "options": {
4352 - "match": "null",
4353 - "result": {
4354 - "text": "N/A"
4355 - }
4356 - },
4357 - "type": "special"
4358 - }
4359 - ],
4360 - "thresholds": {
4361 - "mode": "absolute",
4362 - "steps": [
4363 - {
4364 - "color": "blue",
4365 - "value": null
4366 - }
4367 - ]
4368 - },
4369 - "unit": "short"
4370 - },
4371 - "overrides": []
4372 - },
4373 - "gridPos": {
4374 - "h": 7,
4375 - "w": 4,
4376 - "x": 0,
4377 - "y": 4
4378 - },
4379 - "id": 100,
4380 - "links": [],
4381 - "options": {
4382 - "colorMode": "value",
4383 - "graphMode": "area",
4384 - "justifyMode": "auto",
4385 - "orientation": "horizontal",
4386 - "reduceOptions": {
4387 - "calcs": [
4388 - "sum"
4389 - ],
4390 - "fields": "",
4391 - "values": false
4392 - },
4393 - "text": {},
4394 - "textMode": "auto",
4395 - "wideLayout": true
4396 - },
4397 - "pluginVersion": "10.2.3",
4398 - "targets": [
4399 - {
4400 - "bucketAggs": [
4401 - {
4402 - "$$hashKey": "object:135",
4403 - "field": "timestamp",
4404 - "id": "2",
4405 - "settings": {
4406 - "interval": "auto",
4407 - "min_doc_count": 0,
4408 - "trimEdges": 0
4409 - },
4410 - "type": "date_histogram"
4411 - }
4412 - ],
4413 - "datasource": {
4414 - "type": "grafana-opensearch-datasource",
4415 - "uid": "replace_datasource_uid"
4416 - },
4417 - "metrics": [
4418 - {
4419 - "$$hashKey": "object:133",
4420 - "field": "select field",
4421 - "id": "1",
4422 - "type": "count"
4423 - }
4424 - ],
4425 - "query": "scanResult:*",
4426 - "refId": "A",
4427 - "timeField": "timestamp"
4428 - }
4429 - ],
4430 - "title": "URL SCAN EVENTS",
4431 - "type": "stat"
4432 - },
4433 - {
4434 - "datasource": {
4435 - "type": "grafana-opensearch-datasource",
4436 - "uid": "replace_datasource_uid"
4437 - },
4438 - "fieldConfig": {
4439 - "defaults": {
4440 - "color": {
4441 - "mode": "thresholds"
4442 - },
4443 - "custom": {
4444 - "align": "auto",
4445 - "cellOptions": {
4446 - "type": "auto"
4447 - },
4448 - "inspect": false
4449 - },
4450 - "mappings": [],
4451 - "thresholds": {
4452 - "mode": "absolute",
4453 - "steps": [
4454 - {
4455 - "color": "green",
4456 - "value": null
4457 - },
4458 - {
4459 - "color": "red",
4460 - "value": 80
4461 - }
4462 - ]
4463 - }
4464 - },
4465 - "overrides": [
4466 - {
4467 - "matcher": {
4468 - "id": "byName",
4469 - "options": "Time"
4470 - },
4471 - "properties": [
4472 - {
4473 - "id": "displayName",
4474 - "value": "Time"
4475 - },
4476 - {
4477 - "id": "unit",
4478 - "value": "time: YYYY-MM-DD HH:mm:ss"
4479 - },
4480 - {
4481 - "id": "custom.align"
4482 - }
4483 - ]
4484 - },
4485 - {
4486 - "matcher": {
4487 - "id": "byName",
4488 - "options": ""
4489 - },
4490 - "properties": [
4491 - {
4492 - "id": "unit",
4493 - "value": "short"
4494 - },
4495 - {
4496 - "id": "decimals",
4497 - "value": 2
4498 - },
4499 - {
4500 - "id": "custom.align"
4501 - }
4502 - ]
4503 - },
4504 - {
4505 - "matcher": {
4506 - "id": "byName",
4507 - "options": "data_fromUserEmailAddress"
4508 - },
4509 - "properties": [
4510 - {
4511 - "id": "displayName",
4512 - "value": "SENDER"
4513 - },
4514 - {
4515 - "id": "unit",
4516 - "value": "short"
4517 - },
4518 - {
4519 - "id": "decimals",
4520 - "value": 2
4521 - },
4522 - {
4523 - "id": "custom.align"
4524 - }
4525 - ]
4526 - },
4527 - {
4528 - "matcher": {
4529 - "id": "byName",
4530 - "options": "AGENT"
4531 - },
4532 - "properties": [
4533 - {
4534 - "id": "custom.width",
4535 - "value": 299
4536 - }
4537 - ]
4538 - }
4539 - ]
4540 - },
4541 - "gridPos": {
4542 - "h": 7,
4543 - "w": 8,
4544 - "x": 4,
4545 - "y": 4
4546 - },
4547 - "id": 101,
4548 - "options": {
4549 - "cellHeight": "sm",
4550 - "footer": {
4551 - "countRows": false,
4552 - "fields": "",
4553 - "reducer": [
4554 - "sum"
4555 - ],
4556 - "show": false
4557 - },
4558 - "showHeader": true,
4559 - "sortBy": []
4560 - },
4561 - "pluginVersion": "10.2.3",
4562 - "targets": [
4563 - {
4564 - "bucketAggs": [
4565 - {
4566 - "$$hashKey": "object:89",
4567 - "fake": true,
4568 - "field": "fromUserEmailAddress",
4569 - "id": "4",
4570 - "settings": {
4571 - "min_doc_count": 1,
4572 - "order": "desc",
4573 - "orderBy": "_count",
4574 - "size": "10"
4575 - },
4576 - "type": "terms"
4577 - }
4578 - ],
4579 - "datasource": {
4580 - "type": "grafana-opensearch-datasource",
4581 - "uid": "replace_datasource_uid"
4582 - },
4583 - "metrics": [
4584 - {
4585 - "$$hashKey": "object:87",
4586 - "field": "select field",
4587 - "id": "1",
4588 - "type": "count"
4589 - }
4590 - ],
4591 - "query": "fromUserEmailAddress:*",
4592 - "refId": "A",
4593 - "timeField": "timestamp"
4594 - }
4595 - ],
4596 - "title": "TOP 10 SENDERS",
4597 - "transformations": [
4598 - {
4599 - "id": "merge",
4600 - "options": {
4601 - "reducers": []
4602 - }
4603 - }
4604 - ],
4605 - "type": "table"
4606 - },
4607 - {
4608 - "datasource": {
4609 - "type": "grafana-opensearch-datasource",
4610 - "uid": "replace_datasource_uid"
4611 - },
4612 - "fieldConfig": {
4613 - "defaults": {
4614 - "color": {
4615 - "mode": "palette-classic"
4616 - },
4617 - "custom": {
4618 - "hideFrom": {
4619 - "legend": false,
4620 - "tooltip": false,
4621 - "viz": false
4622 - }
4623 - },
4624 - "decimals": 0,
4625 - "mappings": [],
4626 - "unit": "short"
4627 - },
4628 - "overrides": []
4629 - },
4630 - "gridPos": {
4631 - "h": 7,
4632 - "w": 5,
4633 - "x": 12,
4634 - "y": 4
4635 - },
4636 - "id": 102,
4637 - "links": [],
4638 - "options": {
4639 - "displayLabels": [],
4640 - "legend": {
4641 - "calcs": [],
4642 - "displayMode": "list",
4643 - "placement": "bottom",
4644 - "showLegend": false,
4645 - "values": [
4646 - "value"
4647 - ]
4648 - },
4649 - "pieType": "pie",
4650 - "reduceOptions": {
4651 - "calcs": [
4652 - "sum"
4653 - ],
4654 - "fields": "",
4655 - "values": false
4656 - },
4657 - "text": {},
4658 - "tooltip": {
4659 - "mode": "single",
4660 - "sort": "none"
4661 - }
4662 - },
4663 - "pluginVersion": "7.3.4",
4664 - "targets": [
4665 - {
4666 - "bucketAggs": [
4667 - {
4668 - "$$hashKey": "object:211",
4669 - "fake": true,
4670 - "field": "userEmailAddress",
4671 - "id": "3",
4672 - "settings": {
4673 - "min_doc_count": "1",
4674 - "missing": "Unknown",
4675 - "order": "desc",
4676 - "orderBy": "_count",
4677 - "size": "10"
4678 - },
4679 - "type": "terms"
4680 - },
4681 - {
4682 - "$$hashKey": "object:117",
4683 - "field": "timestamp",
4684 - "id": "2",
4685 - "settings": {
4686 - "interval": "auto",
4687 - "min_doc_count": 0,
4688 - "trimEdges": 0
4689 - },
4690 - "type": "date_histogram"
4691 - }
4692 - ],
4693 - "datasource": {
4694 - "type": "grafana-opensearch-datasource",
4695 - "uid": "replace_datasource_uid"
4696 - },
4697 - "metrics": [
4698 - {
4699 - "$$hashKey": "object:115",
4700 - "field": "select field",
4701 - "id": "1",
4702 - "type": "count"
4703 - }
4704 - ],
4705 - "query": "scanResult:*",
4706 - "queryType": "randomWalk",
4707 - "refId": "A",
4708 - "timeField": "timestamp"
4709 - }
4710 - ],
4711 - "title": "TOP 10 RECEIVERS",
4712 - "type": "piechart"
4713 - },
4714 - {
4715 - "datasource": {
4716 - "type": "grafana-opensearch-datasource",
4717 - "uid": "replace_datasource_uid"
4718 - },
4719 - "fieldConfig": {
4720 - "defaults": {
4721 - "custom": {
4722 - "align": "auto",
4723 - "cellOptions": {
4724 - "type": "auto"
4725 - },
4726 - "filterable": false,
4727 - "inspect": false
4728 - },
4729 - "mappings": [],
4730 - "thresholds": {
4731 - "mode": "absolute",
4732 - "steps": [
4733 - {
4734 - "color": "green",
4735 - "value": null
4736 - },
4737 - {
4738 - "color": "red",
4739 - "value": 80
4740 - }
4741 - ]
4742 - }
4743 - },
4744 - "overrides": []
4745 - },
4746 - "gridPos": {
4747 - "h": 7,
4748 - "w": 7,
4749 - "x": 17,
4750 - "y": 4
4751 - },
4752 - "id": 103,
4753 - "links": [],
4754 - "options": {
4755 - "cellHeight": "sm",
4756 - "footer": {
4757 - "countRows": false,
4758 - "fields": "",
4759 - "reducer": [
4760 - "sum"
4761 - ],
4762 - "show": false
4763 - },
4764 - "showHeader": true
4765 - },
4766 - "pluginVersion": "10.2.3",
4767 - "targets": [
4768 - {
4769 - "bucketAggs": [
4770 - {
4771 - "$$hashKey": "object:211",
4772 - "fake": true,
4773 - "field": "userEmailAddress",
4774 - "id": "3",
4775 - "settings": {
4776 - "min_doc_count": "1",
4777 - "missing": "Unknown",
4778 - "order": "desc",
4779 - "orderBy": "_count",
4780 - "size": "10"
4781 - },
4782 - "type": "terms"
4783 - }
4784 - ],
4785 - "datasource": {
4786 - "type": "grafana-opensearch-datasource",
4787 - "uid": "replace_datasource_uid"
4788 - },
4789 - "metrics": [
4790 - {
4791 - "$$hashKey": "object:115",
4792 - "field": "select field",
4793 - "id": "1",
4794 - "type": "count"
4795 - }
4796 - ],
4797 - "query": "scanResult:*",
4798 - "queryType": "randomWalk",
4799 - "refId": "A",
4800 - "timeField": "timestamp"
4801 - }
4802 - ],
4803 - "title": "TOP 10 RECEIVERS",
4804 - "transformations": [
4805 - {
4806 - "id": "organize",
4807 - "options": {
4808 - "excludeByName": {},
4809 - "indexByName": {},
4810 - "renameByName": {
4811 - "data_userEmailAddress": "RECEIVER",
4812 - "software_vendor": "SOFTWARE VENDOR"
4813 - }
4814 - }
4815 - }
4816 - ],
4817 - "type": "table"
4818 - },
4819 - {
4820 - "datasource": {
4821 - "type": "grafana-opensearch-datasource",
4822 - "uid": "replace_datasource_uid"
4823 - },
4824 - "fieldConfig": {
4825 - "defaults": {
4826 - "color": {
4827 - "mode": "thresholds"
4828 - },
4829 - "custom": {
4830 - "align": "auto",
4831 - "cellOptions": {
4832 - "type": "auto"
4833 - },
4834 - "inspect": false
4835 - },
4836 - "mappings": [
4837 - {
4838 - "options": {
4839 - "clean": {
4840 - "color": "green",
4841 - "index": 0,
4842 - "text": "clean"
4843 - },
4844 - "malicious": {
4845 - "color": "red",
4846 - "index": 1
4847 - }
4848 - },
4849 - "type": "value"
4850 - }
4851 - ],
4852 - "thresholds": {
4853 - "mode": "absolute",
4854 - "steps": [
4855 - {
4856 - "color": "green",
4857 - "value": null
4858 - },
4859 - {
4860 - "color": "red",
4861 - "value": 80
4862 - }
4863 - ]
4864 - }
4865 - },
4866 - "overrides": [
4867 - {
4868 - "matcher": {
4869 - "id": "byName",
4870 - "options": "data_scanResult"
4871 - },
4872 - "properties": [
4873 - {
4874 - "id": "displayName",
4875 - "value": "SCAN RESULT"
4876 - },
4877 - {
4878 - "id": "unit",
4879 - "value": "short"
4880 - },
4881 - {
4882 - "id": "decimals",
4883 - "value": 2
4884 - },
4885 - {
4886 - "id": "custom.align"
4887 - },
4888 - {
4889 - "id": "custom.cellOptions",
4890 - "value": {
4891 - "mode": "gradient",
4892 - "type": "color-background"
4893 - }
4894 - }
4895 - ]
4896 - },
4897 - {
4898 - "matcher": {
4899 - "id": "byName",
4900 - "options": "data_subject"
4901 - },
4902 - "properties": [
4903 - {
4904 - "id": "displayName",
4905 - "value": "SUBJECT"
4906 - }
4907 - ]
4908 - }
4909 - ]
4910 - },
4911 - "gridPos": {
4912 - "h": 10,
4913 - "w": 8,
4914 - "x": 0,
4915 - "y": 11
4916 - },
4917 - "id": 104,
4918 - "options": {
4919 - "cellHeight": "sm",
4920 - "footer": {
4921 - "countRows": false,
4922 - "fields": "",
4923 - "reducer": [
4924 - "sum"
4925 - ],
4926 - "show": false
4927 - },
4928 - "showHeader": true,
4929 - "sortBy": []
4930 - },
4931 - "pluginVersion": "10.2.3",
4932 - "targets": [
4933 - {
4934 - "bucketAggs": [
4935 - {
4936 - "$$hashKey": "object:89",
4937 - "fake": true,
4938 - "field": "subject",
4939 - "id": "4",
4940 - "settings": {
4941 - "min_doc_count": 1,
4942 - "order": "desc",
4943 - "orderBy": "_count",
4944 - "size": "10"
4945 - },
4946 - "type": "terms"
4947 - },
4948 - {
4949 - "field": "scanResult",
4950 - "id": "5",
4951 - "settings": {
4952 - "min_doc_count": "1",
4953 - "order": "desc",
4954 - "orderBy": "_term",
4955 - "size": "10"
4956 - },
4957 - "type": "terms"
4958 - }
4959 - ],
4960 - "datasource": {
4961 - "type": "grafana-opensearch-datasource",
4962 - "uid": "replace_datasource_uid"
4963 - },
4964 - "metrics": [
4965 - {
4966 - "$$hashKey": "object:87",
4967 - "field": "select field",
4968 - "id": "1",
4969 - "type": "count"
4970 - }
4971 - ],
4972 - "query": "scanResult:*",
4973 - "refId": "A",
4974 - "timeField": "timestamp"
4975 - }
4976 - ],
4977 - "title": "TOP 10 SUBJECTS",
4978 - "transformations": [
4979 - {
4980 - "id": "merge",
4981 - "options": {
4982 - "reducers": []
4983 - }
4984 - }
4985 - ],
4986 - "type": "table"
4987 - },
4988 - {
4989 - "datasource": {
4990 - "type": "grafana-opensearch-datasource",
4991 - "uid": "replace_datasource_uid"
4992 - },
4993 - "fieldConfig": {
4994 - "defaults": {
4995 - "color": {
4996 - "mode": "thresholds"
4997 - },
4998 - "custom": {
4999 - "align": "auto",

This file is too large to show in full.

backend/app/connectors/grafana/schema/dashboards.py
+1
@@ -61,6 +61,7 @@ class Office365Dashboard(Enum):
61 TEAMS = ("Office365", "teams.json")
62 THREAT_INTELLIGENCE = ("Office365", "threat_intelligence.json")
63
64 +
65 class MimecastDashboard(Enum):
66 SUMMARY = ("Mimecast", "summary.json")
67
backend/app/connectors/grafana/services/dashboards.py
+1 -1
@@ -7,8 +7,8 @@ from loguru import logger
7 from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
8 from app.connectors.grafana.schema.dashboards import GrafanaDashboard
9 from app.connectors.grafana.schema.dashboards import GrafanaDashboardResponse
10 -from app.connectors.grafana.schema.dashboards import Office365Dashboard
10 from app.connectors.grafana.schema.dashboards import MimecastDashboard
11 +from app.connectors.grafana.schema.dashboards import Office365Dashboard
12 from app.connectors.grafana.schema.dashboards import WazuhDashboard
13 from app.connectors.grafana.utils.universal import create_grafana_client
14
backend/app/integrations/mimecast/checkpoint/mimecast_00002.checkpoint
+1 -1
@@ -1 +1 @@
1 -eNo9js1SwjAURt_lrjtjSolpmHHRCuqUH0GqDoybEm7SaGmwCcXG8d2tLlh_55z5vsGiODWo9zCCl1Qvn-pEEWk-dZ5uku2jyJbGvxZu3qlMCrJatNPp-e3Kefa-cdtCf3VjlpYya0WYzrlY51pU1U7tBscZ8mjG_b6Ui3hypz_uJ9fK-gccn3Ovy9UNBGCktOhgFAZgNR4qo_5ucDrkNIoiGoBosHCY6wP2ECOUU07iQczii-C6Y7-RAFpsrDb1f6wQwpzqPgy3z-skDFlCCfz8AnB4S9w
\ No newline at end of file
1 +eNo9js1SwjAURt_lrjtjSolpmHHRCuqUH0GqDoybEm7SaGmwCcXG8d2tLlh_55z5vsGiODWo9zCCl1Qvn-pEEWk-dZ5uku2jyJbGvxZu3qlMCrJatNPp-e3Kefa-cdtCf3VjlpYya0WYzrlY51pU1U7tBscZ8mjG_b6Ui3hypz_uJ9fK-gccn3Ovy9UNBGCktOhgFAZgNR4qo_5ucDrkNIoiGoBosHCY6wP2ECOUU07iQczii-C6Y7-RAFpsrDb1f6wQwpzqPgy3z-skDFlCCfz8AnB4S9w
backend/app/integrations/mimecast/routes/mimecast.py
+6 -3
@@ -11,8 +11,10 @@ from app.auth.utils import AuthHandler
11 from app.db.db_session import get_db
12 from app.integrations.mimecast.schema.mimecast import MimecastAuthKeys
13 from app.integrations.mimecast.schema.mimecast import MimecastRequest
14 -from app.integrations.mimecast.schema.mimecast import MimecastResponse, MimecastTTPURLSRequest, MimecastHeaders
15 -from app.integrations.mimecast.services.mimecast import invoke_mimecast, get_ttp_urls
14 +from app.integrations.mimecast.schema.mimecast import MimecastResponse
15 +from app.integrations.mimecast.schema.mimecast import MimecastTTPURLSRequest
16 +from app.integrations.mimecast.services.mimecast import get_ttp_urls
17 +from app.integrations.mimecast.services.mimecast import invoke_mimecast
18 from app.integrations.routes import find_customer_integration
19 from app.integrations.routes import get_customer_integrations_by_customer_code
20 from app.integrations.schema import CustomerIntegrations
@@ -105,6 +107,7 @@ async def invoke_mimecast_route(mimecast_request: MimecastRequest, session: Asyn
107
108 return await invoke_mimecast(mimecast_request, auth_keys)
109
110 +
111 @integration_mimecast_router.post(
112 "/ttp/urls",
113 response_model=MimecastResponse,
@@ -113,7 +116,7 @@ async def invoke_mimecast_route(mimecast_request: MimecastRequest, session: Asyn
116 )
117 async def mimecast_ttp_url_route(mimecast_request: MimecastRequest, session: AsyncSession = Depends(get_db)):
118 logger.info("Mimecast TTP URL request received")
116 - customer_code=mimecast_request.customer_code
119 + customer_code = mimecast_request.customer_code
120 customer_integration_response = await get_customer_integration_response(mimecast_request.customer_code, session)
121
122 customer_integration = await find_customer_integration(
backend/app/integrations/mimecast/routes/provision.py
+11 -8
@@ -1,23 +1,27 @@
1 from fastapi import APIRouter
2 +from fastapi import Depends
3 +from sqlalchemy.ext.asyncio import AsyncSession
4
5 +from app.db.db_session import get_db
6 from app.integrations.mimecast.schema.mimecast import MimecastScheduledResponse
4 -from app.schedulers.models.scheduler import CreateSchedulerRequest
7 from app.integrations.mimecast.schema.provision import ProvisionMimecastRequest
8 from app.integrations.mimecast.schema.provision import ProvisionMimecastResponse
7 -from app.schedulers.scheduler import add_scheduler_jobs
8 -from app.db.db_session import get_db
9 -from sqlalchemy.ext.asyncio import AsyncSession
10 -from fastapi import Depends
9 from app.integrations.mimecast.services.provision import provision_mimecast
10 +from app.schedulers.models.scheduler import CreateSchedulerRequest
11 +from app.schedulers.scheduler import add_scheduler_jobs
12
13 integration_mimecast_scheduler_router = APIRouter()
14
15 +
16 @integration_mimecast_scheduler_router.post(
17 "/provision",
18 response_model=ProvisionMimecastResponse,
19 description="Provision a mimecast integration.",
20 )
20 -async def provision_mimecast_route(provision_mimecast_request: ProvisionMimecastRequest, session: AsyncSession = Depends(get_db)) -> ProvisionMimecastResponse:
21 +async def provision_mimecast_route(
22 + provision_mimecast_request: ProvisionMimecastRequest,
23 + session: AsyncSession = Depends(get_db),
24 +) -> ProvisionMimecastResponse:
25 """
26 Provisions Office365 integration for a customer.
27
@@ -39,8 +43,6 @@ async def provision_mimecast_route(provision_mimecast_request: ProvisionMimecast
43 return ProvisionMimecastResponse(success=True, message="Mimecast integration provisioned.")
44
45
42 -
43 -
46 @integration_mimecast_scheduler_router.post(
47 "/invoke/scheduler/siem",
48 description="Invoke a mimecast integration.",
@@ -64,6 +66,7 @@ async def invoke_mimecast_siem_schedule_create(time_interval: int) -> MimecastSc
66 )
67 return MimecastScheduledResponse(success=True, message="Mimecast integration scheduled.")
68
69 +
70 @integration_mimecast_scheduler_router.post(
71 "/invoke/scheduler/ttp",
72 description="Invoke a mimecast integration.",
backend/app/integrations/mimecast/schema/mimecast.py
+17 -20
@@ -1,18 +1,18 @@
1 -from enum import Enum
2 -from typing import List
1 +import base64
2 +import hashlib
3 +import hmac
4 +import uuid
5 from datetime import datetime
6 from datetime import timedelta
7 +from enum import Enum
8 +from typing import Dict
9 +from typing import List
10 +from typing import Optional
11
12 from pydantic import BaseModel
7 -from typing import Dict
13 from pydantic import Field
14 from pydantic import HttpUrl
10 -import base64
11 -import hashlib
12 -import hmac
13 -import uuid
15 from pydantic import root_validator
15 -from typing import Optional
16
17
18 class PipelineRuleTitles(Enum):
@@ -124,6 +124,7 @@ class MimecastScheduledResponse(BaseModel):
124 success: bool
125 message: str
126
127 +
128 # ! MIMECAST TTP URLS ! #
129 class MimecastHeaders(BaseModel):
130 Authorization: str = Field(
@@ -152,9 +153,7 @@ class MimecastHeaders(BaseModel):
153 )
154
155 class Config:
155 - allow_population_by_field_name = (
156 - True # This allows field population by both alias and field name
157 - )
156 + allow_population_by_field_name = True # This allows field population by both alias and field name
157
158
159 class MimecastTTPURLSRequest(BaseModel):
@@ -207,9 +206,7 @@ class MimecastTTPURLSRequest(BaseModel):
206 elif unit == "w":
207 lower_bound = now - timedelta(weeks=amount)
208
210 - values["lower_bound"] = (
211 - lower_bound.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
212 - )
209 + values["lower_bound"] = lower_bound.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
210 values["upper_bound"] = now.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
211 return values
212
@@ -236,11 +233,11 @@ class MimecastTTPURLSRequest(BaseModel):
233 "Content-Type": "application/json",
234 }
235
239 - self.headers = MimecastHeaders(
240 - **headers_dict
241 - ) # Create a new instance of MimecastHeaders and assign
236 + self.headers = MimecastHeaders(**headers_dict) # Create a new instance of MimecastHeaders and assign
237
238 return headers_dict
239 +
240 +
241 ##### ! SENDING REQUEST TO MIMECAST ! #####
242 class DataItem(BaseModel):
243 oldestFirst: bool = Field(..., description="Ordering flag, oldest first if true.")
@@ -254,14 +251,14 @@ class DataItem(BaseModel):
251 scanResult: str = Field(..., description="Scan result.")
252
253 class Config:
257 - allow_population_by_field_name = (
258 - True # This allows field population by both alias and field name
259 - )
254 + allow_population_by_field_name = True # This allows field population by both alias and field name
255 +
256
257 class RequestBody(BaseModel):
258 meta: Dict = Field({}, description="Meta information.")
259 data: List[DataItem] = Field(..., description="List of data items.")
260
261 +
262 class TTPResponseClickLogs(BaseModel):
263 userEmailAddress: str
264 fromUserEmailAddress: str
backend/app/integrations/mimecast/schema/provision.py
+4 -2
@@ -1,11 +1,11 @@
1 -from enum import Enum
1 from typing import Any
2 from typing import Dict
3 +from typing import List
4 +from typing import Optional
5
6 from pydantic import BaseModel
7 from pydantic import Field
8 from pydantic import root_validator
8 -from typing import List, Optional
9
10
11 class ProvisionMimecastRequest(BaseModel):
@@ -31,6 +31,7 @@ class ProvisionMimecastResponse(BaseModel):
31 success: bool
32 message: str
33
34 +
35 # ! STREAMS ! #
36 class StreamRule(BaseModel):
37 field: str
@@ -38,6 +39,7 @@ class StreamRule(BaseModel):
39 inverted: bool
40 value: str
41
42 +
43 class MimecastEventStream(BaseModel):
44 title: str = Field(..., description="Title of the stream")
45 description: str = Field(..., description="Description of the stream")
backend/app/integrations/mimecast/services/mimecast.py
+17 -9
@@ -15,10 +15,14 @@ import requests
15 from fastapi import HTTPException
16 from loguru import logger
17
18 +from app.integrations.mimecast.schema.mimecast import DataItem
19 from app.integrations.mimecast.schema.mimecast import MimecastAPIEndpointResponse
20 from app.integrations.mimecast.schema.mimecast import MimecastAuthKeys
21 from app.integrations.mimecast.schema.mimecast import MimecastRequest
21 -from app.integrations.mimecast.schema.mimecast import MimecastResponse, MimecastTTPURLSRequest, TtpURLResponseBody, RequestBody, DataItem
22 +from app.integrations.mimecast.schema.mimecast import MimecastResponse
23 +from app.integrations.mimecast.schema.mimecast import MimecastTTPURLSRequest
24 +from app.integrations.mimecast.schema.mimecast import RequestBody
25 +from app.integrations.mimecast.schema.mimecast import TtpURLResponseBody
26 from app.integrations.utils.collection import send_post_request
27 from app.integrations.utils.event_shipper import event_shipper
28 from app.integrations.utils.schema import EventShipperPayload
@@ -322,6 +326,7 @@ async def custom_datetime_format(dt: datetime.datetime) -> str:
326 """Format a datetime object to a custom ISO-like string."""
327 return dt.strftime("%Y-%m-%dT%H:%M:%S%z").replace("+00:00", "+0000")
328
329 +
330 async def create_ttp_request_body(
331 mimecast_request: MimecastTTPURLSRequest,
332 ) -> RequestBody:
@@ -342,6 +347,7 @@ async def create_ttp_request_body(
347 ],
348 )
349
350 +
351 async def invoke_mimecast_api_ttp_urls(
352 mimecast_request: MimecastTTPURLSRequest,
353 ) -> TtpURLResponseBody:
@@ -360,17 +366,19 @@ async def invoke_mimecast_api_ttp_urls(
366 )
367 return TtpURLResponseBody(**response.json())
368
369 +
370 async def get_ttp_urls(mimecast_request: MimecastTTPURLSRequest, customer_code: str) -> MimecastResponse:
371 logger.info("Mimecast TTP URL request received")
372 # Get the BaseURL for the Mimecast integration
366 - mimecast_base_url = await get_base_url(MimecastAuthKeys(
367 - APP_ID=mimecast_request.ApplicationID,
368 - APP_KEY=mimecast_request.ApplicationKey,
369 - ACCESS_KEY=mimecast_request.AccessKey,
370 - SECRET_KEY=mimecast_request.SecretKey,
371 - EMAIL_ADDRESS=mimecast_request.EmailAddress,
372 - URI="/api/login/discover-authentication",
373 - )
373 + mimecast_base_url = await get_base_url(
374 + MimecastAuthKeys(
375 + APP_ID=mimecast_request.ApplicationID,
376 + APP_KEY=mimecast_request.ApplicationKey,
377 + ACCESS_KEY=mimecast_request.AccessKey,
378 + SECRET_KEY=mimecast_request.SecretKey,
379 + EMAIL_ADDRESS=mimecast_request.EmailAddress,
380 + URI="/api/login/discover-authentication",
381 + ),
382 )
383 # Add it to the request object
384 mimecast_request.BaseURL = mimecast_base_url.data.data[0].region.api
backend/app/integrations/mimecast/services/provision.py
+31 -23
@@ -1,31 +1,29 @@
1 -from app.integrations.mimecast.schema.provision import ProvisionMimecastRequest
2 -from app.integrations.mimecast.schema.provision import ProvisionMimecastResponse, MimecastEventStream
3 -from app.schedulers.scheduler import add_scheduler_jobs
1 import json
5 -import os
2 from datetime import datetime
7 -from typing import List
3 +
4 +from loguru import logger
5 from sqlalchemy.ext.asyncio import AsyncSession
6 +
7 +from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
8 +from app.connectors.grafana.schema.dashboards import MimecastDashboard
9 from app.connectors.grafana.services.dashboards import provision_dashboards
10 from app.connectors.grafana.utils.universal import create_grafana_client
11 -from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineRequest
12 -from app.utils import get_connector_attribute
13 -from app.connectors.grafana.schema.dashboards import MimecastDashboard
14 -from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
11 +from app.connectors.graylog.services.management import start_stream
12 +from app.connectors.graylog.utils.universal import send_post_request
13 +from app.customer_provisioning.schema.grafana import GrafanaDatasource
14 +from app.customer_provisioning.schema.grafana import GrafanaDataSourceCreationResponse
15 +from app.customer_provisioning.schema.graylog import GraylogIndexSetCreationResponse
16 from app.customer_provisioning.schema.graylog import StreamCreationResponse
17 +from app.customer_provisioning.schema.graylog import TimeBasedIndexSet
18 from app.customer_provisioning.services.grafana import create_grafana_folder
19 from app.customer_provisioning.services.grafana import get_opensearch_version
18 -from app.customer_provisioning.schema.graylog import TimeBasedIndexSet
20 from app.customers.routes.customers import get_customer
20 -from app.customer_provisioning.schema.grafana import GrafanaDatasource
21 -from app.customer_provisioning.schema.grafana import GrafanaDataSourceCreationResponse
22 -from app.connectors.graylog.services.management import start_stream
21 from app.customers.routes.customers import get_customer_meta
24 -from app.connectors.graylog.utils.universal import send_post_request
25 -from app.connectors.wazuh_manager.utils.universal import send_get_request
26 -from app.connectors.wazuh_manager.utils.universal import send_put_request
27 -from app.customer_provisioning.schema.graylog import GraylogIndexSetCreationResponse
28 -from loguru import logger
22 +from app.integrations.mimecast.schema.provision import MimecastEventStream
23 +from app.integrations.mimecast.schema.provision import ProvisionMimecastRequest
24 +from app.integrations.mimecast.schema.provision import ProvisionMimecastResponse
25 +from app.utils import get_connector_attribute
26 +
27
28 ################## ! GRAYLOG ! ##################
29 async def build_index_set_config(customer_code: str, session: AsyncSession) -> TimeBasedIndexSet:
@@ -64,6 +62,7 @@ async def build_index_set_config(customer_code: str, session: AsyncSession) -> T
62 field_type_refresh_interval=5000,
63 )
64
65 +
66 # Function to send the POST request and handle the response
67 async def send_index_set_creation_request(index_set: TimeBasedIndexSet) -> GraylogIndexSetCreationResponse:
68 """
@@ -80,6 +79,7 @@ async def send_index_set_creation_request(index_set: TimeBasedIndexSet) -> Grayl
79 response_json = await send_post_request(endpoint="/api/system/indices/index_sets", data=index_set.dict())
80 return GraylogIndexSetCreationResponse(**response_json)
81
82 +
83 async def create_index_set(customer_code: str, session: AsyncSession) -> GraylogIndexSetCreationResponse:
84 """
85 Creates an index set for a new customer.
@@ -94,6 +94,7 @@ async def create_index_set(customer_code: str, session: AsyncSession) -> Graylog
94 index_set_config = await build_index_set_config(customer_code, session)
95 return await send_index_set_creation_request(index_set_config)
96
97 +
98 # ! Event STREAMS ! #
99 # Function to create event stream configuration
100 async def build_event_stream_config(
@@ -151,6 +152,7 @@ async def send_event_stream_creation_request(event_stream: MimecastEventStream)
152 response_json = await send_post_request(endpoint="/api/streams", data=event_stream.dict())
153 return StreamCreationResponse(**response_json)
154
155 +
156 async def create_event_stream(
157 customer_code: str,
158 index_set_id: str,
@@ -169,6 +171,7 @@ async def create_event_stream(
171 event_stream_config = await build_event_stream_config(customer_code, index_set_id, session)
172 return await send_event_stream_creation_request(event_stream_config)
173
174 +
175 #### ! GRAFANA ! ####
176 async def create_grafana_datasource(
177 customer_code: str,
@@ -222,6 +225,7 @@ async def create_grafana_datasource(
225 )
226 return GrafanaDataSourceCreationResponse(**results)
227
228 +
229 async def provision_mimecast(provision_mimecast_request: ProvisionMimecastRequest, session: AsyncSession) -> ProvisionMimecastResponse:
230 """
231 Provisions Mimecast integration for a customer.
@@ -244,22 +248,26 @@ async def provision_mimecast(provision_mimecast_request: ProvisionMimecastReques
248 await start_stream(stream_id=stream_id)
249
250 # Grafana Deployment
247 - mimecast_datasource_uid = (await create_grafana_datasource(customer_code=provision_mimecast_request.customer_code, session=session)).datasource.uid
251 + mimecast_datasource_uid = (
252 + await create_grafana_datasource(customer_code=provision_mimecast_request.customer_code, session=session)
253 + ).datasource.uid
254 grafana_mimecast_folder_id = (
255 await create_grafana_folder(
250 - organization_id=(await get_customer_meta(provision_mimecast_request.customer_code, session)).customer_meta.customer_meta_grafana_org_id,
256 + organization_id=(
257 + await get_customer_meta(provision_mimecast_request.customer_code, session)
258 + ).customer_meta.customer_meta_grafana_org_id,
259 folder_title="MIMECAST",
260 )
261 ).id
262 await provision_dashboards(
263 DashboardProvisionRequest(
264 dashboards=[dashboard.name for dashboard in MimecastDashboard],
257 - organizationId=(await get_customer_meta(provision_mimecast_request.customer_code, session)).customer_meta.customer_meta_grafana_org_id,
265 + organizationId=(
266 + await get_customer_meta(provision_mimecast_request.customer_code, session)
267 + ).customer_meta.customer_meta_grafana_org_id,
268 folderId=grafana_mimecast_folder_id,
269 datasourceUid=mimecast_datasource_uid,
270 ),
271 )
272
263 -
273 return ProvisionMimecastResponse(success=True, message="Mimecast integration provisioned.")
265 -
backend/app/schedulers/scheduler.py
+2 -1
@@ -7,7 +7,8 @@ from app.db.db_session import sync_engine
7 from app.schedulers.models.scheduler import CreateSchedulerRequest
8 from app.schedulers.models.scheduler import JobMetadata
9 from app.schedulers.services.agent_sync import agent_sync
10 -from app.schedulers.services.invoke_mimecast import invoke_mimecast_integration, invoke_mimecast_integration_ttp
10 +from app.schedulers.services.invoke_mimecast import invoke_mimecast_integration
11 +from app.schedulers.services.invoke_mimecast import invoke_mimecast_integration_ttp
12
13
14 def init_scheduler():
backend/app/schedulers/services/invoke_mimecast.py
+3 -1
@@ -6,7 +6,8 @@ from sqlalchemy import select
6
7 from app.db.db_session import get_db_session
8 from app.db.db_session import get_sync_db_session
9 -from app.integrations.mimecast.routes.mimecast import invoke_mimecast_route, mimecast_ttp_url_route
9 +from app.integrations.mimecast.routes.mimecast import invoke_mimecast_route
10 +from app.integrations.mimecast.routes.mimecast import mimecast_ttp_url_route
11 from app.integrations.mimecast.schema.mimecast import MimecastRequest
12 from app.integrations.mimecast.schema.mimecast import MimecastResponse
13 from app.integrations.models.customer_integration_settings import CustomerIntegrations
@@ -44,6 +45,7 @@ async def invoke_mimecast_integration() -> MimecastResponse:
45 print("JobMetadata for 'invoke_mimecast_integration' not found.")
46 return MimecastResponse(success=True, message="Mimecast integration invoked.")
47
48 +
49 async def invoke_mimecast_integration_ttp() -> MimecastResponse:
50 """
51 Invokes the Mimecast integration.
src/api/soc.ts
+1 -1
@@ -94,7 +94,7 @@ export default {
94 time_unit: payload?.unit || "days"
95 }
96 /*eslint no-mixed-spaces-and-tabs: "off"*/
97 - }
97 + }
98 : undefined
99 )
100 },