@cryptotaxi247 / CoPilot / commits / f16944d6

597 sentinelone network connector (#628)

* feat: Add SentinelOne syslog forwarding integration - Created documentation for configuring SentinelOne syslog forwarding with TLS encryption. - Implemented API routes for provisioning SentinelOne integration, including key extraction and customer details handling. - Developed Pydantic schemas for request and response models related to SentinelOne provisioning. - Added service functions to handle index set creation, content pack provisioning, and Grafana datasource creation for SentinelOne. - Created a JSON template for SentinelOne syslog input configuration in Graylog. - Implemented a Vue component for the SentinelOne provisioning form in the frontend. * precommit-fixes * precommit-fixes

taylor_socfortress committed Jan 24, 2026 at 14:51 UTC f16944d6ec25527af402c5336af791161cf8248a
18 files changed +20637 -81
backend/app/connectors/grafana/dashboards/Sentinelone/sentinelone_epp_administrative.json new
+1919
@@ -0,0 +1,1919 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "EDR"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "grafana-opensearch-datasource",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "orange",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 18,
82 + "options": {
83 + "colorMode": "value",
84 + "graphMode": "area",
85 + "justifyMode": "auto",
86 + "orientation": "horizontal",
87 + "reduceOptions": {
88 + "calcs": [
89 + "sum"
90 + ],
91 + "fields": "",
92 + "values": false
93 + },
94 + "showPercentChange": false,
95 + "text": {},
96 + "textMode": "auto",
97 + "wideLayout": true
98 + },
99 + "pluginVersion": "10.4.2",
100 + "targets": [
101 + {
102 + "bucketAggs": [
103 + {
104 + "$$hashKey": "object:331",
105 + "field": "timestamp",
106 + "id": "2",
107 + "settings": {
108 + "interval": "auto",
109 + "min_doc_count": 0,
110 + "trimEdges": 0
111 + },
112 + "type": "date_histogram"
113 + }
114 + ],
115 + "datasource": {
116 + "type": "grafana-opensearch-datasource",
117 + "uid": "replace_datasource_uid"
118 + },
119 + "metrics": [
120 + {
121 + "$$hashKey": "object:329",
122 + "field": "select field",
123 + "id": "1",
124 + "type": "count"
125 + }
126 + ],
127 + "query": "eventSeverity:$eventSeverity AND cat:ADMINISTRATIVE",
128 + "refId": "A",
129 + "timeField": "timestamp"
130 + }
131 + ],
132 + "title": "EVENTS (TOTAL)",
133 + "type": "stat"
134 + },
135 + {
136 + "datasource": {
137 + "type": "grafana-opensearch-datasource",
138 + "uid": "replace_datasource_uid"
139 + },
140 + "fieldConfig": {
141 + "defaults": {
142 + "color": {
143 + "mode": "thresholds"
144 + },
145 + "custom": {
146 + "align": "auto",
147 + "cellOptions": {
148 + "type": "auto"
149 + },
150 + "inspect": false
151 + },
152 + "mappings": [],
153 + "thresholds": {
154 + "mode": "absolute",
155 + "steps": [
156 + {
157 + "color": "orange",
158 + "value": null
159 + }
160 + ]
161 + }
162 + },
163 + "overrides": [
164 + {
165 + "matcher": {
166 + "id": "byName",
167 + "options": "Time"
168 + },
169 + "properties": [
170 + {
171 + "id": "displayName",
172 + "value": "Time"
173 + },
174 + {
175 + "id": "unit",
176 + "value": "time: YYYY-MM-DD HH:mm:ss"
177 + },
178 + {
179 + "id": "custom.align"
180 + }
181 + ]
182 + },
183 + {
184 + "matcher": {
185 + "id": "byName",
186 + "options": "Count"
187 + },
188 + "properties": [
189 + {
190 + "id": "displayName",
191 + "value": "EVENTS"
192 + },
193 + {
194 + "id": "unit",
195 + "value": "short"
196 + },
197 + {
198 + "id": "decimals",
199 + "value": -1
200 + },
201 + {
202 + "id": "custom.cellOptions",
203 + "value": {
204 + "type": "color-background"
205 + }
206 + },
207 + {
208 + "id": "custom.align"
209 + },
210 + {
211 + "id": "thresholds",
212 + "value": {
213 + "mode": "absolute",
214 + "steps": [
215 + {
216 + "color": "dark-orange",
217 + "value": null
218 + }
219 + ]
220 + }
221 + }
222 + ]
223 + },
224 + {
225 + "matcher": {
226 + "id": "byName",
227 + "options": "data_groupName"
228 + },
229 + "properties": [
230 + {
231 + "id": "displayName",
232 + "value": "ALERTS BY TYPE"
233 + },
234 + {
235 + "id": "unit",
236 + "value": "short"
237 + },
238 + {
239 + "id": "decimals",
240 + "value": -1
241 + },
242 + {
243 + "id": "custom.cellOptions",
244 + "value": {
245 + "type": "color-background"
246 + }
247 + },
248 + {
249 + "id": "custom.align"
250 + }
251 + ]
252 + }
253 + ]
254 + },
255 + "gridPos": {
256 + "h": 7,
257 + "w": 7,
258 + "x": 4,
259 + "y": 0
260 + },
261 + "id": 57,
262 + "options": {
263 + "cellHeight": "sm",
264 + "footer": {
265 + "countRows": false,
266 + "fields": "",
267 + "reducer": [
268 + "sum"
269 + ],
270 + "show": false
271 + },
272 + "showHeader": true
273 + },
274 + "pluginVersion": "10.4.2",
275 + "targets": [
276 + {
277 + "bucketAggs": [
278 + {
279 + "fake": true,
280 + "field": "data_scopeName",
281 + "id": "4",
282 + "settings": {
283 + "min_doc_count": 1,
284 + "order": "desc",
285 + "orderBy": "_count",
286 + "size": "0"
287 + },
288 + "type": "terms"
289 + }
290 + ],
291 + "datasource": {
292 + "type": "grafana-opensearch-datasource",
293 + "uid": "replace_datasource_uid"
294 + },
295 + "metrics": [
296 + {
297 + "field": "select field",
298 + "id": "1",
299 + "type": "count"
300 + }
301 + ],
302 + "query": "eventSeverity:$eventSeverity AND cat:ADMINISTRATIVE",
303 + "refId": "A",
304 + "timeField": "timestamp"
305 + }
306 + ],
307 + "title": "SCOPES",
308 + "transformations": [
309 + {
310 + "id": "organize",
311 + "options": {
312 + "excludeByName": {},
313 + "indexByName": {},
314 + "renameByName": {
315 + "data_group": "GROUP"
316 + }
317 + }
318 + }
319 + ],
320 + "type": "table"
321 + },
322 + {
323 + "datasource": {
324 + "type": "grafana-opensearch-datasource",
325 + "uid": "replace_datasource_uid"
326 + },
327 + "fieldConfig": {
328 + "defaults": {
329 + "color": {
330 + "mode": "palette-classic"
331 + },
332 + "custom": {
333 + "hideFrom": {
334 + "legend": false,
335 + "tooltip": false,
336 + "viz": false
337 + }
338 + },
339 + "decimals": 0,
340 + "mappings": [],
341 + "unit": "short"
342 + },
343 + "overrides": [
344 + {
345 + "matcher": {
346 + "id": "byName",
347 + "options": "1"
348 + },
349 + "properties": [
350 + {
351 + "id": "color",
352 + "value": {
353 + "fixedColor": "#C8F2C2",
354 + "mode": "fixed"
355 + }
356 + }
357 + ]
358 + },
359 + {
360 + "matcher": {
361 + "id": "byName",
362 + "options": "2"
363 + },
364 + "properties": [
365 + {
366 + "id": "color",
367 + "value": {
368 + "fixedColor": "#96D98D",
369 + "mode": "fixed"
370 + }
371 + }
372 + ]
373 + },
374 + {
375 + "matcher": {
376 + "id": "byName",
377 + "options": "3"
378 + },
379 + "properties": [
380 + {
381 + "id": "color",
382 + "value": {
383 + "fixedColor": "#56A64B",
384 + "mode": "fixed"
385 + }
386 + }
387 + ]
388 + },
389 + {
390 + "matcher": {
391 + "id": "byName",
392 + "options": "4"
393 + },
394 + "properties": [
395 + {
396 + "id": "color",
397 + "value": {
398 + "fixedColor": "#37872D",
399 + "mode": "fixed"
400 + }
401 + }
402 + ]
403 + },
404 + {
405 + "matcher": {
406 + "id": "byName",
407 + "options": "5"
408 + },
409 + "properties": [
410 + {
411 + "id": "color",
412 + "value": {
413 + "fixedColor": "#FFF899",
414 + "mode": "fixed"
415 + }
416 + }
417 + ]
418 + },
419 + {
420 + "matcher": {
421 + "id": "byName",
422 + "options": "7"
423 + },
424 + "properties": [
425 + {
426 + "id": "color",
427 + "value": {
428 + "fixedColor": "#F2CC0C",
429 + "mode": "fixed"
430 + }
431 + }
432 + ]
433 + },
434 + {
435 + "matcher": {
436 + "id": "byName",
437 + "options": "9"
438 + },
439 + "properties": [
440 + {
441 + "id": "color",
442 + "value": {
443 + "fixedColor": "#FF9830",
444 + "mode": "fixed"
445 + }
446 + }
447 + ]
448 + },
449 + {
450 + "matcher": {
451 + "id": "byName",
452 + "options": "10"
453 + },
454 + "properties": [
455 + {
456 + "id": "color",
457 + "value": {
458 + "fixedColor": "#FF9830",
459 + "mode": "fixed"
460 + }
461 + }
462 + ]
463 + },
464 + {
465 + "matcher": {
466 + "id": "byName",
467 + "options": "12"
468 + },
469 + "properties": [
470 + {
471 + "id": "color",
472 + "value": {
473 + "fixedColor": "#F2495C",
474 + "mode": "fixed"
475 + }
476 + }
477 + ]
478 + },
479 + {
480 + "matcher": {
481 + "id": "byName",
482 + "options": "13"
483 + },
484 + "properties": [
485 + {
486 + "id": "color",
487 + "value": {
488 + "fixedColor": "#FF7383",
489 + "mode": "fixed"
490 + }
491 + }
492 + ]
493 + }
494 + ]
495 + },
496 + "gridPos": {
497 + "h": 12,
498 + "w": 6,
499 + "x": 0,
500 + "y": 7
501 + },
502 + "id": 23,
503 + "maxDataPoints": 3,
504 + "options": {
505 + "displayLabels": [],
506 + "legend": {
507 + "calcs": [],
508 + "displayMode": "table",
509 + "placement": "right",
510 + "showLegend": true,
511 + "values": [
512 + "value",
513 + "percent"
514 + ]
515 + },
516 + "pieType": "donut",
517 + "reduceOptions": {
518 + "calcs": [
519 + "sum"
520 + ],
521 + "fields": "",
522 + "values": false
523 + },
524 + "text": {},
525 + "tooltip": {
526 + "mode": "single",
527 + "sort": "none"
528 + }
529 + },
530 + "targets": [
531 + {
532 + "bucketAggs": [
533 + {
534 + "$$hashKey": "object:235",
535 + "fake": true,
536 + "field": "eventSeverity",
537 + "id": "3",
538 + "settings": {
539 + "min_doc_count": 1,
540 + "order": "desc",
541 + "orderBy": "_count",
542 + "size": "10"
543 + },
544 + "type": "terms"
545 + },
546 + {
547 + "$$hashKey": "object:236",
548 + "field": "timestamp",
549 + "id": "2",
550 + "settings": {
551 + "interval": "auto",
552 + "min_doc_count": 0,
553 + "trimEdges": 0
554 + },
555 + "type": "date_histogram"
556 + }
557 + ],
558 + "datasource": {
559 + "type": "grafana-opensearch-datasource",
560 + "uid": "replace_datasource_uid"
561 + },
562 + "metrics": [
563 + {
564 + "$$hashKey": "object:233",
565 + "field": "select field",
566 + "id": "1",
567 + "meta": {},
568 + "settings": {},
569 + "type": "count"
570 + }
571 + ],
572 + "query": "eventSeverity:$eventSeverity AND cat:ADMINISTRATIVE",
573 + "refId": "A",
574 + "timeField": "timestamp"
575 + }
576 + ],
577 + "title": "SECURITY EVENTS BY ALERT LEVEL",
578 + "type": "piechart"
579 + },
580 + {
581 + "datasource": {
582 + "type": "grafana-opensearch-datasource",
583 + "uid": "replace_datasource_uid"
584 + },
585 + "fieldConfig": {
586 + "defaults": {
587 + "color": {
588 + "mode": "palette-classic"
589 + },
590 + "custom": {
591 + "axisBorderShow": false,
592 + "axisCenteredZero": false,
593 + "axisColorMode": "text",
594 + "axisLabel": "",
595 + "axisPlacement": "auto",
596 + "barAlignment": 0,
597 + "drawStyle": "line",
598 + "fillOpacity": 0,
599 + "gradientMode": "none",
600 + "hideFrom": {
601 + "legend": false,
602 + "tooltip": false,
603 + "viz": false
604 + },
605 + "insertNulls": false,
606 + "lineInterpolation": "linear",
607 + "lineWidth": 1,
608 + "pointSize": 5,
609 + "scaleDistribution": {
610 + "type": "linear"
611 + },
612 + "showPoints": "auto",
613 + "spanNulls": false,
614 + "stacking": {
615 + "group": "A",
616 + "mode": "normal"
617 + },
618 + "thresholdsStyle": {
619 + "mode": "off"
620 + }
621 + },
622 + "mappings": [],
623 + "thresholds": {
624 + "mode": "absolute",
625 + "steps": [
626 + {
627 + "color": "green",
628 + "value": null
629 + },
630 + {
631 + "color": "red",
632 + "value": 80
633 + }
634 + ]
635 + }
636 + },
637 + "overrides": [
638 + {
639 + "matcher": {
640 + "id": "byName",
641 + "options": "10"
642 + },
643 + "properties": [
644 + {
645 + "id": "color",
646 + "value": {
647 + "fixedColor": "orange",
648 + "mode": "fixed"
649 + }
650 + }
651 + ]
652 + }
653 + ]
654 + },
655 + "gridPos": {
656 + "h": 12,
657 + "w": 18,
658 + "x": 6,
659 + "y": 7
660 + },
661 + "id": 50,
662 + "options": {
663 + "legend": {
664 + "calcs": [],
665 + "displayMode": "table",
666 + "placement": "right",
667 + "showLegend": true
668 + },
669 + "tooltip": {
670 + "mode": "single",
671 + "sort": "none"
672 + }
673 + },
674 + "targets": [
675 + {
676 + "alias": "",
677 + "bucketAggs": [
678 + {
679 + "field": "eventSeverity",
680 + "id": "3",
681 + "settings": {
682 + "min_doc_count": "1",
683 + "order": "desc",
684 + "orderBy": "_count",
685 + "size": "10"
686 + },
687 + "type": "terms"
688 + },
689 + {
690 + "field": "timestamp",
691 + "id": "2",
692 + "settings": {
693 + "interval": "auto"
694 + },
695 + "type": "date_histogram"
696 + }
697 + ],
698 + "datasource": {
699 + "type": "grafana-opensearch-datasource",
700 + "uid": "replace_datasource_uid"
701 + },
702 + "metrics": [
703 + {
704 + "id": "1",
705 + "type": "count"
706 + }
707 + ],
708 + "query": "eventSeverity:$eventSeverity AND cat:ADMINISTRATIVE",
709 + "refId": "A",
710 + "timeField": "timestamp"
711 + }
712 + ],
713 + "title": "EVENTS SEVERITY - HISTOGRAM",
714 + "type": "timeseries"
715 + },
716 + {
717 + "datasource": {
718 + "type": "grafana-opensearch-datasource",
719 + "uid": "replace_datasource_uid"
720 + },
721 + "fieldConfig": {
722 + "defaults": {
723 + "color": {
724 + "mode": "thresholds"
725 + },
726 + "custom": {
727 + "align": "auto",
728 + "cellOptions": {
729 + "type": "auto"
730 + },
731 + "filterable": true,
732 + "inspect": false
733 + },
734 + "mappings": [],
735 + "thresholds": {
736 + "mode": "absolute",
737 + "steps": [
738 + {
739 + "color": "green",
740 + "value": null
741 + },
742 + {
743 + "color": "red",
744 + "value": 80
745 + }
746 + ]
747 + }
748 + },
749 + "overrides": [
750 + {
751 + "matcher": {
752 + "id": "byName",
753 + "options": "timestamp"
754 + },
755 + "properties": [
756 + {
757 + "id": "displayName",
758 + "value": "Date/Time"
759 + },
760 + {
761 + "id": "unit",
762 + "value": "time: YYYY-MM-DD HH:mm:ss"
763 + },
764 + {
765 + "id": "custom.align"
766 + }
767 + ]
768 + },
769 + {
770 + "matcher": {
771 + "id": "byName",
772 + "options": "data_computerName"
773 + },
774 + "properties": [
775 + {
776 + "id": "displayName",
777 + "value": "AGENT"
778 + },
779 + {
780 + "id": "unit",
781 + "value": "short"
782 + },
783 + {
784 + "id": "decimals",
785 + "value": 2
786 + },
787 + {
788 + "id": "custom.align"
789 + }
790 + ]
791 + },
792 + {
793 + "matcher": {
794 + "id": "byName",
795 + "options": "agent_ip"
796 + },
797 + "properties": [
798 + {
799 + "id": "displayName",
800 + "value": "IP ADDRESS"
801 + },
802 + {
803 + "id": "unit",
804 + "value": "short"
805 + },
806 + {
807 + "id": "decimals",
808 + "value": 2
809 + },
810 + {
811 + "id": "custom.align"
812 + }
813 + ]
814 + },
815 + {
816 + "matcher": {
817 + "id": "byName",
818 + "options": "rule_description"
819 + },
820 + "properties": [
821 + {
822 + "id": "displayName",
823 + "value": "RULE DESCRIPTION"
824 + },
825 + {
826 + "id": "unit",
827 + "value": "short"
828 + },
829 + {
830 + "id": "decimals",
831 + "value": 2
832 + },
833 + {
834 + "id": "custom.align"
835 + }
836 + ]
837 + },
838 + {
839 + "matcher": {
840 + "id": "byName",
841 + "options": "Date/Time"
842 + },
843 + "properties": [
844 + {
845 + "id": "custom.width",
846 + "value": 242
847 + }
848 + ]
849 + },
850 + {
851 + "matcher": {
852 + "id": "byName",
853 + "options": "AGENT"
854 + },
855 + "properties": [
856 + {
857 + "id": "custom.width",
858 + "value": 160
859 + }
860 + ]
861 + },
862 + {
863 + "matcher": {
864 + "id": "byName",
865 + "options": "MITRE TACTIC"
866 + },
867 + "properties": [
868 + {
869 + "id": "custom.width",
870 + "value": 332
871 + }
872 + ]
873 + },
874 + {
875 + "matcher": {
876 + "id": "byName",
877 + "options": "RULE LEVEL"
878 + },
879 + "properties": [
880 + {
881 + "id": "custom.width",
882 + "value": 122
883 + }
884 + ]
885 + },
886 + {
887 + "matcher": {
888 + "id": "byName",
889 + "options": "IP ADDRESS"
890 + },
891 + "properties": [
892 + {
893 + "id": "custom.width",
894 + "value": 163
895 + }
896 + ]
897 + },
898 + {
899 + "matcher": {
900 + "id": "byName",
901 + "options": "MITRE TECHNIQUE"
902 + },
903 + "properties": [
904 + {
905 + "id": "custom.width",
906 + "value": 312
907 + }
908 + ]
909 + },
910 + {
911 + "matcher": {
912 + "id": "byName",
913 + "options": "rule_id"
914 + },
915 + "properties": [
916 + {
917 + "id": "custom.width",
918 + "value": 96
919 + }
920 + ]
921 + },
922 + {
923 + "matcher": {
924 + "id": "byName",
925 + "options": "EVENT ID"
926 + },
927 + "properties": [
928 + {
929 + "id": "links",
930 + "value": [
931 + {
932 + "targetBlank": true,
933 + "title": "VIEW EVENT DETAILS",
934 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SENTINELONE%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
935 + }
936 + ]
937 + }
938 + ]
939 + },
940 + {
941 + "matcher": {
942 + "id": "byName",
943 + "options": "IP ADD"
944 + },
945 + "properties": [
946 + {
947 + "id": "custom.width",
948 + "value": 176
949 + }
950 + ]
951 + },
952 + {
953 + "matcher": {
954 + "id": "byName",
955 + "options": "EVENT CATEGORY"
956 + },
957 + "properties": [
958 + {
959 + "id": "custom.width",
960 + "value": 209
961 + }
962 + ]
963 + },
964 + {
965 + "matcher": {
966 + "id": "byName",
967 + "options": "USER"
968 + },
969 + "properties": [
970 + {
971 + "id": "custom.width",
972 + "value": 218
973 + }
974 + ]
975 + },
976 + {
977 + "matcher": {
978 + "id": "byName",
979 + "options": "threatClassification"
980 + },
981 + "properties": [
982 + {
983 + "id": "custom.width",
984 + "value": 214
985 + }
986 + ]
987 + },
988 + {
989 + "matcher": {
990 + "id": "byName",
991 + "options": "DESCRIPTION"
992 + },
993 + "properties": [
994 + {
995 + "id": "custom.width",
996 + "value": 688
997 + }
998 + ]
999 + }
1000 + ]
1001 + },
1002 + "gridPos": {
1003 + "h": 16,
1004 + "w": 24,
1005 + "x": 0,
1006 + "y": 19
1007 + },
1008 + "id": 27,
1009 + "options": {
1010 + "cellHeight": "sm",
1011 + "footer": {
1012 + "countRows": false,
1013 + "enablePagination": true,
1014 + "fields": "",
1015 + "reducer": [
1016 + "sum"
1017 + ],
1018 + "show": false
1019 + },
1020 + "showHeader": true,
1021 + "sortBy": []
1022 + },
1023 + "pluginVersion": "10.4.2",
1024 + "targets": [
1025 + {
1026 + "bucketAggs": [],
1027 + "datasource": {
1028 + "type": "grafana-opensearch-datasource",
1029 + "uid": "replace_datasource_uid"
1030 + },
1031 + "metrics": [
1032 + {
1033 + "id": "1",
1034 + "settings": {
1035 + "size": "250"
1036 + },
1037 + "type": "raw_data"
1038 + }
1039 + ],
1040 + "query": "eventSeverity:$eventSeverity AND cat:ADMINISTRATIVE",
1041 + "refId": "A",
1042 + "timeField": "timestamp"
1043 + }
1044 + ],
1045 + "title": "EVENTS",
1046 + "transformations": [
1047 + {
1048 + "id": "filterFieldsByName",
1049 + "options": {
1050 + "include": {
1051 + "names": [
1052 + "timestamp",
1053 + "_id",
1054 + "cat",
1055 + "data_computerName",
1056 + "data_username",
1057 + "deviceAddress",
1058 + "deviceAddress_city_name",
1059 + "eventDesc",
1060 + "eventSeverity",
1061 + "fileName",
1062 + "threatClassification",
1063 + "threatConfidenceLevel"
1064 + ]
1065 + }
1066 + }
1067 + },
1068 + {
1069 + "id": "organize",
1070 + "options": {
1071 + "excludeByName": {
1072 + "@metadata_beat": true,
1073 + "@metadata_type": true,
1074 + "@metadata_version": true,
1075 + "IMPHASH": true,
1076 + "MD5": true,
1077 + "SHA1": true,
1078 + "SHA256": true,
1079 + "_id": false,
1080 + "_index": true,
1081 + "_type": true,
1082 + "accountId": true,
1083 + "accountName": true,
1084 + "activityId": true,
1085 + "activityType": true,
1086 + "activityUuid": true,
1087 + "agentId": true,
1088 + "agentUpdatedVersion": true,
1089 + "agent_ephemeral_id": true,
1090 + "agent_hostname": true,
1091 + "agent_id": true,
1092 + "agent_ip_city_name": true,
1093 + "agent_ip_country_code": true,
1094 + "agent_ip_geolocation": true,
1095 + "agent_type": true,
1096 + "agent_version": true,
1097 + "application_name": true,
1098 + "beats_type": true,
1099 + "collector_node_id": true,
1100 + "comments": true,
1101 + "createdAt": true,
1102 + "data_accountName": true,
1103 + "data_alert_action": true,
1104 + "data_alert_category": true,
1105 + "data_alert_gid": true,
1106 + "data_alert_rev": true,
1107 + "data_alert_severity": true,
1108 + "data_alert_signature": true,
1109 + "data_alert_signature_id": true,
1110 + "data_app_proto": true,
1111 + "data_audit_auid": true,
1112 + "data_audit_command": true,
1113 + "data_audit_euid": true,
1114 + "data_audit_exe": true,
1115 + "data_audit_gid": true,
1116 + "data_audit_id": true,
1117 + "data_audit_pid": true,
1118 + "data_audit_res": true,
1119 + "data_audit_session": true,
1120 + "data_audit_type": true,
1121 + "data_audit_uid": true,
1122 + "data_computerName": false,
1123 + "data_confidenceLevel": true,
1124 + "data_createdAt": true,
1125 + "data_description": true,
1126 + "data_dest_ip": true,
1127 + "data_dest_port": true,
1128 + "data_downloadUrl": true,
1129 + "data_dstuser": true,
1130 + "data_event_type": true,
1131 + "data_exclusionType": true,
1132 + "data_extra_data": true,
1133 + "data_file": true,
1134 + "data_fileContentHash": true,
1135 + "data_fileDisplayName": true,
1136 + "data_fileName": true,
1137 + "data_filePath": true,
1138 + "data_flow_bytes_toclient": true,
1139 + "data_flow_bytes_toserver": true,
1140 + "data_flow_id": true,
1141 + "data_flow_pkts_toclient": true,
1142 + "data_flow_pkts_toserver": true,
1143 + "data_flow_start": true,
1144 + "data_fullScopeDetails": true,
1145 + "data_fullScopeDetailsPath": true,
1146 + "data_globalStatus": true,
1147 + "data_groupName": true,
1148 + "data_http_http_content_type": true,
1149 + "data_http_http_port": true,
1150 + "data_http_length": true,
1151 + "data_http_status": true,
1152 + "data_http_url": true,
1153 + "data_id": true,
1154 + "data_in_iface": true,
1155 + "data_majorVersion": true,
1156 + "data_metadata_flowbits": true,
1157 + "data_metadata_flowints_http_anomaly_count": true,
1158 + "data_metadata_flowints_tcp_retransmission_count": true,
1159 + "data_minorVersion": true,
1160 + "data_osArch": true,
1161 + "data_osFamily": true,
1162 + "data_osquery_action": true,
1163 + "data_osquery_calendarTime": true,
1164 + "data_osquery_columns_address": true,
1165 + "data_osquery_columns_address_city_name": true,
1166 + "data_osquery_columns_address_country_code": true,
1167 + "data_osquery_columns_address_geolocation": true,
1168 + "data_osquery_columns_cmdline": true,
1169 + "data_osquery_columns_cwd": true,
1170 + "data_osquery_columns_description": true,
1171 + "data_osquery_columns_directory": true,
1172 + "data_osquery_columns_disk_bytes_read": true,
1173 + "data_osquery_columns_disk_bytes_written": true,
1174 + "data_osquery_columns_egid": true,
1175 + "data_osquery_columns_euid": true,
1176 + "data_osquery_columns_family": true,
1177 + "data_osquery_columns_fd": true,
1178 + "data_osquery_columns_gid": true,
1179 + "data_osquery_columns_gid_signed": true,
1180 + "data_osquery_columns_host": true,
1181 + "data_osquery_columns_interface": true,
1182 + "data_osquery_columns_local_address": true,
1183 + "data_osquery_columns_local_address_city_name": true,
1184 + "data_osquery_columns_local_address_country_code": true,
1185 + "data_osquery_columns_local_address_geolocation": true,
1186 + "data_osquery_columns_local_port": true,
1187 + "data_osquery_columns_mac": true,
1188 + "data_osquery_columns_name": true,
1189 + "data_osquery_columns_net_namespace": true,
1190 + "data_osquery_columns_nice": true,
1191 + "data_osquery_columns_on_disk": true,
1192 + "data_osquery_columns_parent": true,
1193 + "data_osquery_columns_path": true,
1194 + "data_osquery_columns_pgroup": true,
1195 + "data_osquery_columns_pid": true,
1196 + "data_osquery_columns_port": true,
1197 + "data_osquery_columns_protocol": true,
1198 + "data_osquery_columns_remote_address": true,
1199 + "data_osquery_columns_remote_address_city_name": true,
1200 + "data_osquery_columns_remote_address_country_code": true,
1201 + "data_osquery_columns_remote_address_geolocation": true,
1202 + "data_osquery_columns_remote_port": true,
1203 + "data_osquery_columns_resident_size": true,
1204 + "data_osquery_columns_root": true,
1205 + "data_osquery_columns_sgid": true,
1206 + "data_osquery_columns_shell": true,
1207 + "data_osquery_columns_socket": true,
1208 + "data_osquery_columns_start_time": true,
1209 + "data_osquery_columns_state": true,
1210 + "data_osquery_columns_suid": true,
1211 + "data_osquery_columns_system_time": true,
1212 + "data_osquery_columns_threads": true,
1213 + "data_osquery_columns_time_utc": true,
1214 + "data_osquery_columns_total_size": true,
1215 + "data_osquery_columns_tty": true,
1216 + "data_osquery_columns_type": true,
1217 + "data_osquery_columns_uid": true,
1218 + "data_osquery_columns_uid_signed": true,
1219 + "data_osquery_columns_user": true,
1220 + "data_osquery_columns_user_time": true,
1221 + "data_osquery_columns_username": true,
1222 + "data_osquery_columns_wired_size": true,
1223 + "data_osquery_counter": true,
1224 + "data_osquery_decorations_host_uuid": true,
1225 + "data_osquery_decorations_hostname": true,
1226 + "data_osquery_epoch": true,
1227 + "data_osquery_hostIdentifier": true,
1228 + "data_osquery_name": true,
1229 + "data_osquery_numerics": true,
1230 + "data_osquery_unixTime": true,
1231 + "data_packageId": true,
1232 + "data_platformType": true,
1233 + "data_proto": true,
1234 + "data_sca_check_command": true,
1235 + "data_sca_check_compliance_cis": true,
1236 + "data_sca_check_compliance_cis_csc": true,
1237 + "data_sca_check_compliance_gdpr_IV": true,
1238 + "data_sca_check_compliance_gpg_13": true,
1239 + "data_sca_check_compliance_hipaa": true,
1240 + "data_sca_check_compliance_nist_800_53": true,
1241 + "data_sca_check_compliance_pci_dss": true,
1242 + "data_sca_check_compliance_tsc": true,
1243 + "data_sca_check_description": true,
1244 + "data_sca_check_id": true,
1245 + "data_sca_check_previous_result": true,
1246 + "data_sca_check_rationale": true,
1247 + "data_sca_check_remediation": true,
1248 + "data_sca_check_result": true,
1249 + "data_sca_check_title": true,
1250 + "data_sca_description": true,
1251 + "data_sca_failed": true,
1252 + "data_sca_file": true,
1253 + "data_sca_invalid": true,
1254 + "data_sca_passed": true,
1255 + "data_sca_policy": true,
1256 + "data_sca_policy_id": true,
1257 + "data_sca_scan_id": true,
1258 + "data_sca_score": true,
1259 + "data_sca_total_checks": true,
1260 + "data_sca_type": true,
1261 + "data_scanType": true,
1262 + "data_scopeLevel": true,
1263 + "data_scopeName": true,
1264 + "data_script": true,
1265 + "data_secured": true,
1266 + "data_siteName": true,
1267 + "data_src_ip": true,
1268 + "data_src_ip_city_name": true,
1269 + "data_src_ip_country_code": true,
1270 + "data_src_ip_geolocation": true,
1271 + "data_src_port": true,
1272 + "data_srcip": true,
1273 + "data_srcip_city_name": true,
1274 + "data_srcip_country_code": true,
1275 + "data_srcip_geolocation": true,
1276 + "data_srcuser": true,
1277 + "data_status": true,
1278 + "data_threatClassification": true,
1279 + "data_timestamp": true,
1280 + "data_title": true,
1281 + "data_tls_session_resumed": true,
1282 + "data_tls_version": true,
1283 + "data_totalNewDevices": true,
1284 + "data_tx_id": true,
1285 + "data_type": true,
1286 + "data_unknown": true,
1287 + "data_unsecured": true,
1288 + "data_unsupported": true,
1289 + "data_value": true,
1290 + "data_version": true,
1291 + "data_version_city_name": true,
1292 + "data_version_country_code": true,
1293 + "data_version_geolocation": true,
1294 + "data_win_eventXML_binaryData": true,
1295 + "data_win_eventXML_binaryDataSize": true,
1296 + "data_win_eventXML_param1": true,
1297 + "data_win_eventdata_authenticationPackageName": true,
1298 + "data_win_eventdata_callTrace": true,
1299 + "data_win_eventdata_commandLine": true,
1300 + "data_win_eventdata_company": true,
1301 + "data_win_eventdata_creationUtcTime": true,
1302 + "data_win_eventdata_currentDirectory": true,
1303 + "data_win_eventdata_description": true,
1304 + "data_win_eventdata_destinationHostname": true,
1305 + "data_win_eventdata_destinationIp": true,
1306 + "data_win_eventdata_destinationIp_city_name": true,
1307 + "data_win_eventdata_destinationIp_country_code": true,
1308 + "data_win_eventdata_destinationIp_geolocation": true,
1309 + "data_win_eventdata_destinationIsIpv6": true,
1310 + "data_win_eventdata_destinationPort": true,
1311 + "data_win_eventdata_destinationPortName": true,
1312 + "data_win_eventdata_details": true,
1313 + "data_win_eventdata_elevatedToken": true,
1314 + "data_win_eventdata_eventType": true,
1315 + "data_win_eventdata_fileVersion": true,
1316 + "data_win_eventdata_fileVersion_city_name": true,
1317 + "data_win_eventdata_fileVersion_country_code": true,
1318 + "data_win_eventdata_fileVersion_geolocation": true,
1319 + "data_win_eventdata_grantedAccess": true,
1320 + "data_win_eventdata_hashes": true,
1321 + "data_win_eventdata_image": true,
1322 + "data_win_eventdata_imageLoaded": true,
1323 + "data_win_eventdata_impersonationLevel": true,
1324 + "data_win_eventdata_initiated": true,
1325 + "data_win_eventdata_integrityLevel": true,
1326 + "data_win_eventdata_ipAddress": true,
1327 + "data_win_eventdata_ipPort": true,
1328 + "data_win_eventdata_keyLength": true,
1329 + "data_win_eventdata_logonGuid": true,
1330 + "data_win_eventdata_logonId": true,
1331 + "data_win_eventdata_logonProcessName": true,
1332 + "data_win_eventdata_logonType": true,
1333 + "data_win_eventdata_originalFileName": true,
1334 + "data_win_eventdata_param1": true,
1335 + "data_win_eventdata_param2": true,
1336 + "data_win_eventdata_param3": true,
1337 + "data_win_eventdata_param4": true,
1338 + "data_win_eventdata_parentCommandLine": true,
1339 + "data_win_eventdata_parentImage": true,
1340 + "data_win_eventdata_parentProcessGuid": true,
1341 + "data_win_eventdata_parentProcessId": true,
1342 + "data_win_eventdata_processGuid": true,
1343 + "data_win_eventdata_processId": true,
1344 + "data_win_eventdata_processName": true,
1345 + "data_win_eventdata_product": true,
1346 + "data_win_eventdata_protocol": true,
1347 + "data_win_eventdata_queryName": true,
1348 + "data_win_eventdata_queryResults": true,
1349 + "data_win_eventdata_queryStatus": true,
1350 + "data_win_eventdata_ruleName": true,
1351 + "data_win_eventdata_serviceName": true,
1352 + "data_win_eventdata_serviceSid": true,
1353 + "data_win_eventdata_signature": true,
1354 + "data_win_eventdata_signatureStatus": true,
1355 + "data_win_eventdata_signed": true,
1356 + "data_win_eventdata_sourceHostname": true,
1357 + "data_win_eventdata_sourceImage": true,
1358 + "data_win_eventdata_sourceIp": true,
1359 + "data_win_eventdata_sourceIp_city_name": true,
1360 + "data_win_eventdata_sourceIp_country_code": true,
1361 + "data_win_eventdata_sourceIp_geolocation": true,
1362 + "data_win_eventdata_sourceIsIpv6": true,
1363 + "data_win_eventdata_sourcePort": true,
1364 + "data_win_eventdata_sourceProcessGUID": true,
1365 + "data_win_eventdata_sourceProcessId": true,
1366 + "data_win_eventdata_sourceThreadId": true,
1367 + "data_win_eventdata_status": true,
1368 + "data_win_eventdata_subjectDomainName": true,
1369 + "data_win_eventdata_subjectLogonId": true,
1370 + "data_win_eventdata_subjectUserName": true,
1371 + "data_win_eventdata_subjectUserSid": true,
1372 + "data_win_eventdata_targetDomainName": true,
1373 + "data_win_eventdata_targetFilename": true,
1374 + "data_win_eventdata_targetImage": true,
1375 + "data_win_eventdata_targetLinkedLogonId": true,
1376 + "data_win_eventdata_targetLogonId": true,
1377 + "data_win_eventdata_targetObject": true,
1378 + "data_win_eventdata_targetProcessGUID": true,
1379 + "data_win_eventdata_targetProcessId": true,
1380 + "data_win_eventdata_targetUserName": true,
1381 + "data_win_eventdata_targetUserSid": true,
1382 + "data_win_eventdata_terminalSessionId": true,
1383 + "data_win_eventdata_ticketEncryptionType": true,
1384 + "data_win_eventdata_ticketOptions": true,
1385 + "data_win_eventdata_user": true,
1386 + "data_win_eventdata_utcTime": true,
1387 + "data_win_eventdata_virtualAccount": true,
1388 + "data_win_system_channel": true,
1389 + "data_win_system_computer": true,
1390 + "data_win_system_eventID": true,
1391 + "data_win_system_eventRecordID": true,
1392 + "data_win_system_eventSourceName": true,
1393 + "data_win_system_keywords": true,
1394 + "data_win_system_level": true,
1395 + "data_win_system_message": true,
1396 + "data_win_system_opcode": true,
1397 + "data_win_system_processID": true,
1398 + "data_win_system_providerGuid": true,
1399 + "data_win_system_providerName": true,
1400 + "data_win_system_severityValue": true,
1401 + "data_win_system_systemTime": true,
1402 + "data_win_system_task": true,
1403 + "data_win_system_threadID": true,
1404 + "data_win_system_version": true,
1405 + "decoder_name": true,
1406 + "decoder_parent": true,
1407 + "description": true,
1408 + "deviceAddress_city_name": true,
1409 + "deviceAddress_country_code": true,
1410 + "deviceAddress_geolocation": true,
1411 + "deviceHostFqdn": true,
1412 + "deviceHostName": true,
1413 + "dns_query": true,
1414 + "dns_query_threat_indicated": true,
1415 + "dst_ip": true,
1416 + "dst_ip_city_name": true,
1417 + "dst_ip_country_code": true,
1418 + "dst_ip_geolocation": true,
1419 + "dst_ip_threat_indicated": true,
1420 + "dst_port": true,
1421 + "ecs_version": true,
1422 + "error": true,
1423 + "eventID": true,
1424 + "event_hash": true,
1425 + "facility": true,
1426 + "facility_num": true,
1427 + "fileHashMd5": true,
1428 + "fileHashSha256": true,
1429 + "fileName": false,
1430 + "file_path": true,
1431 + "firewall_rule_name": true,
1432 + "full_log": false,
1433 + "gl2_accounted_message_size": true,
1434 + "gl2_message_id": true,
1435 + "gl2_remote_ip": true,
1436 + "gl2_remote_port": true,
1437 + "gl2_source_collector": true,
1438 + "gl2_source_input": true,
1439 + "gl2_source_node": true,
1440 + "groupId": true,
1441 + "groupName": true,
1442 + "hash": true,
1443 + "hash_md5": true,
1444 + "hash_sha1": true,
1445 + "hash_sha256": true,
1446 + "highlight": true,
1447 + "host_architecture": true,
1448 + "host_containerized": true,
1449 + "host_hostname": true,
1450 + "host_id": true,
1451 + "host_ip": true,
1452 + "host_mac": true,
1453 + "host_name": true,
1454 + "host_os_codename": true,
1455 + "host_os_kernel": true,
1456 + "host_os_name": true,
1457 + "host_os_platform": true,
1458 + "host_os_version": true,
1459 + "hostname": true,
1460 + "id": true,
1461 + "input_type": true,
1462 + "ip": true,
1463 + "ip_city_name": true,
1464 + "ip_country_code": true,
1465 + "ip_geolocation": true,
1466 + "level": true,
1467 + "location": true,
1468 + "log_file_path": true,
1469 + "log_offset": true,
1470 + "manager_name": true,
1471 + "message": true,
1472 + "module": true,
1473 + "notificationScope": true,
1474 + "originatorName": true,
1475 + "originatorVersion": true,
1476 + "originatorVersion_city_name": true,
1477 + "originatorVersion_country_code": true,
1478 + "originatorVersion_geolocation": true,
1479 + "osFamily": true,
1480 + "parent_process_cmd_line": true,
1481 + "parent_process_id": true,
1482 + "parent_process_image": true,
1483 + "pid": true,
1484 + "predecoder_hostname": true,
1485 + "predecoder_program_name": true,
1486 + "predecoder_timestamp": true,
1487 + "previous_log": true,
1488 + "previous_output": true,
1489 + "process_cmd_line": true,
1490 + "process_id": true,
1491 + "process_image": true,
1492 + "process_name": true,
1493 + "protocol": true,
1494 + "rt": true,
1495 + "rule_cis": true,
1496 + "rule_cis_csc": true,
1497 + "rule_firedtimes": true,
1498 + "rule_gdpr": true,
1499 + "rule_gdpr_IV": true,
1500 + "rule_gpg13": true,
1501 + "rule_gpg_13": true,
1502 + "rule_hipaa": true,
1503 + "rule_id": false,
1504 + "rule_info": true,
1505 + "rule_mail": true,
1506 + "rule_mitre_id": true,
1507 + "rule_mitre_tactic": false,
1508 + "rule_nist_800_53": true,
1509 + "rule_pci_dss": true,
1510 + "rule_tsc": true,
1511 + "scanType": true,
1512 + "scanid": true,
1513 + "secondaryDescription": true,
1514 + "secured": true,
1515 + "service": true,
1516 + "siteId": true,
1517 + "siteName": true,
1518 + "software_package": true,
1519 + "software_vendor": true,
1520 + "sort": true,
1521 + "source": true,
1522 + "sourceAgentId": true,
1523 + "sourceAgentUuid": true,
1524 + "sourceDnsDomain": true,
1525 + "sourceFqdn": true,
1526 + "sourceGroupId": true,
1527 + "sourceGroupName": true,
1528 + "sourceHostName": true,
1529 + "sourceIpAddresses_0": true,
1530 + "sourceIpAddresses_1": true,
1531 + "sourceIpAddresses_1_city_name": true,
1532 + "sourceIpAddresses_1_country_code": true,
1533 + "sourceIpAddresses_1_geolocation": true,
1534 + "sourceIpAddresses_2": true,
1535 + "sourceIpAddresses_2_city_name": true,
1536 + "sourceIpAddresses_2_country_code": true,
1537 + "sourceIpAddresses_2_geolocation": true,
1538 + "sourceIpAddresses_3": true,
1539 + "sourceIpAddresses_3_city_name": true,
1540 + "sourceIpAddresses_3_country_code": true,
1541 + "sourceIpAddresses_3_geolocation": true,
1542 + "sourceIpAddresses_4": true,
1543 + "sourceIpAddresses_4_city_name": true,
1544 + "sourceIpAddresses_4_country_code": true,
1545 + "sourceIpAddresses_4_geolocation": true,
1546 + "sourceIpAddresses_5": true,
1547 + "sourceMacAddresses_0": true,
1548 + "sourceMacAddresses_1": true,
1549 + "sourceMgmtPrecievedAddress": true,
1550 + "sourceMgmtPrecievedAddress_city_name": true,
1551 + "sourceMgmtPrecievedAddress_country_code": true,
1552 + "sourceMgmtPrecievedAddress_geolocation": true,
1553 + "sourceNetworkState": true,
1554 + "sourceOsRevision": true,
1555 + "sourceOsType": true,
1556 + "sourceThreatCount": true,
1557 + "sourceUserId": true,
1558 + "sourceUserName": true,
1559 + "source_city_name": true,
1560 + "source_country_code": true,
1561 + "source_geolocation": true,
1562 + "src_ip": true,
1563 + "src_ip_city_name": true,
1564 + "src_ip_country_code": true,
1565 + "src_ip_geolocation": true,
1566 + "src_port": true,
1567 + "streams": true,
1568 + "syscheck_attrs_after": true,
1569 + "syscheck_audit_effective_user_id": true,
1570 + "syscheck_audit_effective_user_name": true,
1571 + "syscheck_audit_group_id": true,
1572 + "syscheck_audit_group_name": true,
1573 + "syscheck_audit_login_user_id": true,
1574 + "syscheck_audit_login_user_name": true,
1575 + "syscheck_audit_process_cwd": true,
1576 + "syscheck_audit_process_id": true,
1577 + "syscheck_audit_process_name": true,
1578 + "syscheck_audit_process_parent_cwd": true,
1579 + "syscheck_audit_process_parent_name": true,
1580 + "syscheck_audit_process_ppid": true,
1581 + "syscheck_audit_user_id": true,
1582 + "syscheck_audit_user_name": true,
1583 + "syscheck_changed_attributes": true,
1584 + "syscheck_event": true,
1585 + "syscheck_gid_after": true,
1586 + "syscheck_gname_after": true,
1587 + "syscheck_hard_links": true,
1588 + "syscheck_inode_after": true,
1589 + "syscheck_inode_before": true,
1590 + "syscheck_md5_after": true,
1591 + "syscheck_md5_before": true,
1592 + "syscheck_mode": true,
1593 + "syscheck_mtime_after": true,
1594 + "syscheck_mtime_before": true,
1595 + "syscheck_path": true,
1596 + "syscheck_perm_after": true,
1597 + "syscheck_perm_before": true,
1598 + "syscheck_sha1_after": true,
1599 + "syscheck_sha1_before": true,
1600 + "syscheck_sha256_after": true,
1601 + "syscheck_sha256_before": true,
1602 + "syscheck_size_after": true,
1603 + "syscheck_size_before": true,
1604 + "syscheck_uid_after": true,
1605 + "syscheck_uname_after": true,
1606 + "syscheck_win_perm_after": true,
1607 + "syscheck_win_perm_after_0_allowed": true,
1608 + "syscheck_win_perm_after_0_name": true,
1609 + "syscheck_win_perm_after_1_allowed": true,
1610 + "syscheck_win_perm_after_1_name": true,
1611 + "syscheck_win_perm_after_2_allowed": true,
1612 + "syscheck_win_perm_after_2_name": true,
1613 + "syscheck_win_perm_after_3_allowed": true,
1614 + "syscheck_win_perm_after_3_name": true,
1615 + "syslog_customer": true,
1616 + "syslog_tag": true,
1617 + "syslog_type": true,
1618 + "sysmon_event_description": true,
1619 + "threatClassification": false,
1620 + "threatClassificationSource": true,
1621 + "threatClassifier": true,
1622 + "threatCommandLineArguments": true,
1623 + "threatConfidenceLevel": false,
1624 + "threatDetectingEngine": true,
1625 + "threatDetectionTime": true,
1626 + "threatID": true,
1627 + "threatId": true,
1628 + "threatIndicatorsList_0": true,
1629 + "threatIndicatorsList_1": true,
1630 + "threatIndicatorsList_10": true,
1631 + "threatIndicatorsList_11": true,
1632 + "threatIndicatorsList_12": true,
1633 + "threatIndicatorsList_13": true,
1634 + "threatIndicatorsList_14": true,
1635 + "threatIndicatorsList_15": true,
1636 + "threatIndicatorsList_16": true,
1637 + "threatIndicatorsList_17": true,
1638 + "threatIndicatorsList_18": true,
1639 + "threatIndicatorsList_19": true,
1640 + "threatIndicatorsList_2": true,
1641 + "threatIndicatorsList_20": true,
1642 + "threatIndicatorsList_21": true,
1643 + "threatIndicatorsList_22": true,
1644 + "threatIndicatorsList_23": true,
1645 + "threatIndicatorsList_24": true,
1646 + "threatIndicatorsList_25": true,
1647 + "threatIndicatorsList_26": true,
1648 + "threatIndicatorsList_27": true,
1649 + "threatIndicatorsList_28": true,
1650 + "threatIndicatorsList_29": true,
1651 + "threatIndicatorsList_3": true,
1652 + "threatIndicatorsList_30": true,
1653 + "threatIndicatorsList_31": true,
1654 + "threatIndicatorsList_32": true,
1655 + "threatIndicatorsList_33": true,
1656 + "threatIndicatorsList_34": true,
1657 + "threatIndicatorsList_35": true,
1658 + "threatIndicatorsList_36": true,
1659 + "threatIndicatorsList_37": true,
1660 + "threatIndicatorsList_38": true,
1661 + "threatIndicatorsList_39": true,
1662 + "threatIndicatorsList_4": true,
1663 + "threatIndicatorsList_40": true,
1664 + "threatIndicatorsList_41": true,
1665 + "threatIndicatorsList_42": true,
1666 + "threatIndicatorsList_43": true,
1667 + "threatIndicatorsList_44": true,
1668 + "threatIndicatorsList_45": true,
1669 + "threatIndicatorsList_46": true,
1670 + "threatIndicatorsList_47": true,
1671 + "threatIndicatorsList_48": true,
1672 + "threatIndicatorsList_49": true,
1673 + "threatIndicatorsList_5": true,
1674 + "threatIndicatorsList_50": true,
1675 + "threatIndicatorsList_51": true,
1676 + "threatIndicatorsList_52": true,
1677 + "threatIndicatorsList_53": true,
1678 + "threatIndicatorsList_54": true,
1679 + "threatIndicatorsList_55": true,
1680 + "threatIndicatorsList_56": true,
1681 + "threatIndicatorsList_6": true,
1682 + "threatIndicatorsList_7": true,
1683 + "threatIndicatorsList_8": true,
1684 + "threatIndicatorsList_9": true,
1685 + "threatMitigationStatus": true,
1686 + "threatMitigationStatusID": true,
1687 + "threatProcessUser": true,
1688 + "threatStoryline": true,
1689 + "threat_ids": true,
1690 + "threat_indicated": true,
1691 + "threat_names": true,
1692 + "time": true,
1693 + "timestamp": false,
1694 + "totalNewDevices": true,
1695 + "unknown": true,
1696 + "unsecured": true,
1697 + "unsupported": true,
1698 + "updatedAt": true,
1699 + "userId": true,
1700 + "user_name": true,
1701 + "vendor": true,
1702 + "win_registry_key": true,
1703 + "win_system_eventID": true,
1704 + "windows_auth_package": true,
1705 + "windows_domain": true,
1706 + "windows_event_id": true,
1707 + "windows_event_severity": true,
1708 + "windows_logon_type": true
1709 + },
1710 + "indexByName": {
1711 + "_id": 1,
1712 + "_index": 5,
1713 + "_type": 6,
1714 + "accountId": 7,
1715 + "accountName": 8,
1716 + "activityId": 9,
1717 + "activityType": 10,
1718 + "activityUuid": 11,
1719 + "agentId": 12,
1720 + "agentUpdatedVersion": 13,
1721 + "application_name": 14,
1722 + "cat": 15,
1723 + "comments": 16,
1724 + "createdAt": 17,
1725 + "data_accountName": 18,
1726 + "data_computerName": 2,
1727 + "data_confidenceLevel": 19,
1728 + "data_downloadUrl": 20,
1729 + "data_fileContentHash": 21,
1730 + "data_fileDisplayName": 22,
1731 + "data_filePath": 23,
1732 + "data_fullScopeDetails": 24,
1733 + "data_fullScopeDetailsPath": 25,
1734 + "data_globalStatus": 26,
1735 + "data_groupName": 27,
1736 + "data_scopeLevel": 28,
1737 + "data_scopeName": 29,
1738 + "data_siteName": 30,
1739 + "data_threatClassification": 31,
1740 + "data_username": 32,
1741 + "description": 33,
1742 + "deviceAddress": 3,
1743 + "deviceAddress_city_name": 34,
1744 + "deviceAddress_country_code": 35,
1745 + "deviceAddress_geolocation": 36,
1746 + "deviceHostFqdn": 37,
1747 + "deviceHostName": 38,
1748 + "eventDesc": 39,
1749 + "eventID": 40,
1750 + "eventSeverity": 4,
1751 + "facility": 41,
1752 + "facility_num": 42,
1753 + "fileHashMd5": 43,
1754 + "fileHashSha256": 44,
1755 + "fileName": 45,
1756 + "gl2_accounted_message_size": 46,
1757 + "gl2_message_id": 47,
1758 + "gl2_remote_ip": 48,
1759 + "gl2_remote_port": 49,
1760 + "gl2_source_input": 50,
1761 + "gl2_source_node": 51,
1762 + "groupId": 52,
1763 + "groupName": 53,
1764 + "hash": 54,
1765 + "highlight": 55,
1766 + "level": 56,
1767 + "message": 57,
1768 + "notificationScope": 58,
1769 + "originatorName": 59,
1770 + "originatorVersion": 60,
1771 + "osFamily": 61,
1772 + "process_id": 62,
1773 + "rt": 63,
1774 + "secondaryDescription": 64,
1775 + "siteId": 65,
1776 + "siteName": 66,
1777 + "sort": 67,
1778 + "source": 68,
1779 + "sourceAgentId": 69,
1780 + "sourceAgentUuid": 70,
1781 + "sourceDnsDomain": 71,
1782 + "sourceFqdn": 72,
1783 + "sourceGroupId": 73,
1784 + "sourceGroupName": 74,
1785 + "sourceHostName": 75,
1786 + "sourceIpAddresses_0": 76,
1787 + "sourceIpAddresses_1": 77,
1788 + "sourceMacAddresses_0": 78,
1789 + "sourceMacAddresses_1": 79,
1790 + "sourceMgmtPrecievedAddress": 80,
1791 + "sourceMgmtPrecievedAddress_city_name": 81,
1792 + "sourceMgmtPrecievedAddress_country_code": 82,
1793 + "sourceMgmtPrecievedAddress_geolocation": 83,
1794 + "sourceNetworkState": 84,
1795 + "sourceOsRevision": 85,
1796 + "sourceOsType": 86,
1797 + "sourceThreatCount": 87,
1798 + "source_city_name": 88,
1799 + "source_country_code": 89,
1800 + "source_geolocation": 90,
1801 + "streams": 91,
1802 + "syslog_customer": 92,
1803 + "syslog_type": 93,
1804 + "threatClassification": 94,
1805 + "threatClassificationSource": 95,
1806 + "threatClassifier": 96,
1807 + "threatCommandLineArguments": 97,
1808 + "threatConfidenceLevel": 98,
1809 + "threatDetectingEngine": 99,
1810 + "threatDetectionTime": 100,
1811 + "threatID": 101,
1812 + "threatId": 102,
1813 + "threatMitigationStatus": 103,
1814 + "threatMitigationStatusID": 104,
1815 + "threatProcessUser": 105,
1816 + "threatStoryline": 106,
1817 + "timestamp": 0,
1818 + "updatedAt": 107,
1819 + "userId": 108,
1820 + "vendor": 109
1821 + },
1822 + "renameByName": {
1823 + "_id": "EVENT ID",
1824 + "cat": "EVENT CATEGORY",
1825 + "data_computerName": "AGENT",
1826 + "data_username": "USER",
1827 + "deviceAddress": "IP ADD",
1828 + "eventDesc": "DESCRIPTION",
1829 + "eventSeverity": "SEVERITY",
1830 + "rule_id": "RULE ID",
1831 + "rule_mitre_tactic": "MITRE TACTIC",
1832 + "rule_mitre_technique": "MITRE TECHNIQUE",
1833 + "timestamp": "DATE/TIME"
1834 + }
1835 + }
1836 + }
1837 + ],
1838 + "transparent": true,
1839 + "type": "table"
1840 + }
1841 + ],
1842 + "refresh": "",
1843 + "schemaVersion": 39,
1844 + "tags": [
1845 + "EDR"
1846 + ],
1847 + "templating": {
1848 + "list": [
1849 + {
1850 + "datasource": {
1851 + "type": "grafana-opensearch-datasource",
1852 + "uid": "replace_datasource_uid"
1853 + },
1854 + "filters": [],
1855 + "hide": 0,
1856 + "label": "",
1857 + "name": "Filters",
1858 + "skipUrlSync": false,
1859 + "type": "adhoc"
1860 + },
1861 + {
1862 + "current": {
1863 + "selected": false,
1864 + "text": "All",
1865 + "value": "$__all"
1866 + },
1867 + "datasource": {
1868 + "type": "grafana-opensearch-datasource",
1869 + "uid": "replace_datasource_uid"
1870 + },
1871 + "definition": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:ADMINISTRATIVE\"}",
1872 + "hide": 0,
1873 + "includeAll": true,
1874 + "label": "Event Severity",
1875 + "multi": false,
1876 + "name": "eventSeverity",
1877 + "options": [],
1878 + "query": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:ADMINISTRATIVE\"}",
1879 + "refresh": 2,
1880 + "regex": "",
1881 + "skipUrlSync": false,
1882 + "sort": 0,
1883 + "type": "query"
1884 + }
1885 + ]
1886 + },
1887 + "time": {
1888 + "from": "now-7d",
1889 + "to": "now"
1890 + },
1891 + "timepicker": {
1892 + "refresh_intervals": [
1893 + "5s",
1894 + "10s",
1895 + "30s",
1896 + "1m",
1897 + "5m",
1898 + "15m",
1899 + "30m",
1900 + "1h",
1901 + "2h",
1902 + "1d"
1903 + ],
1904 + "time_options": [
1905 + "5m",
1906 + "15m",
1907 + "1h",
1908 + "6h",
1909 + "12h",
1910 + "24h",
1911 + "2d",
1912 + "7d",
1913 + "30d"
1914 + ]
1915 + },
1916 + "timezone": "",
1917 + "title": "EDR - SENTINELONE EPP - ADMINISTRATIVE",
1918 + "weekStart": ""
1919 +}
backend/app/connectors/grafana/dashboards/Sentinelone/sentinelone_epp_malware.json new
+3915
@@ -0,0 +1,3915 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "EDR"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "grafana-opensearch-datasource",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "color": {
52 + "mode": "palette-classic"
53 + },
54 + "custom": {
55 + "hideFrom": {
56 + "legend": false,
57 + "tooltip": false,
58 + "viz": false
59 + }
60 + },
61 + "mappings": [
62 + {
63 + "options": {
64 + "match": "null",
65 + "result": {
66 + "text": "N/A"
67 + }
68 + },
69 + "type": "special"
70 + }
71 + ],
72 + "max": 15,
73 + "min": 0,
74 + "unit": "none"
75 + },
76 + "overrides": []
77 + },
78 + "gridPos": {
79 + "h": 7,
80 + "w": 4,
81 + "x": 0,
82 + "y": 0
83 + },
84 + "id": 16,
85 + "options": {
86 + "legend": {
87 + "displayMode": "table",
88 + "placement": "right",
89 + "showLegend": true
90 + },
91 + "pieType": "donut",
92 + "reduceOptions": {
93 + "calcs": [
94 + "sum"
95 + ],
96 + "fields": "",
97 + "values": false
98 + },
99 + "tooltip": {
100 + "mode": "single",
101 + "sort": "none"
102 + }
103 + },
104 + "pluginVersion": "9.2.0",
105 + "targets": [
106 + {
107 + "bucketAggs": [
108 + {
109 + "field": "data_threatClassification",
110 + "id": "3",
111 + "settings": {
112 + "min_doc_count": "1",
113 + "order": "desc",
114 + "orderBy": "_term",
115 + "size": "10"
116 + },
117 + "type": "terms"
118 + },
119 + {
120 + "field": "timestamp",
121 + "id": "2",
122 + "settings": {
123 + "interval": "auto",
124 + "min_doc_count": 0,
125 + "trimEdges": 0
126 + },
127 + "type": "date_histogram"
128 + }
129 + ],
130 + "datasource": {
131 + "type": "grafana-opensearch-datasource",
132 + "uid": "replace_datasource_uid"
133 + },
134 + "metrics": [
135 + {
136 + "id": "1",
137 + "type": "count"
138 + }
139 + ],
140 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
141 + "refId": "A",
142 + "timeField": "timestamp"
143 + }
144 + ],
145 + "title": "THREATS CLASSIFICATION",
146 + "type": "piechart"
147 + },
148 + {
149 + "datasource": {
150 + "type": "grafana-opensearch-datasource",
151 + "uid": "replace_datasource_uid"
152 + },
153 + "fieldConfig": {
154 + "defaults": {
155 + "color": {
156 + "mode": "thresholds"
157 + },
158 + "custom": {
159 + "align": "auto",
160 + "cellOptions": {
161 + "type": "auto"
162 + },
163 + "inspect": false
164 + },
165 + "mappings": [],
166 + "thresholds": {
167 + "mode": "absolute",
168 + "steps": [
169 + {
170 + "color": "orange",
171 + "value": null
172 + }
173 + ]
174 + }
175 + },
176 + "overrides": [
177 + {
178 + "matcher": {
179 + "id": "byName",
180 + "options": "Time"
181 + },
182 + "properties": [
183 + {
184 + "id": "displayName",
185 + "value": "Time"
186 + },
187 + {
188 + "id": "unit",
189 + "value": "time: YYYY-MM-DD HH:mm:ss"
190 + },
191 + {
192 + "id": "custom.align"
193 + }
194 + ]
195 + },
196 + {
197 + "matcher": {
198 + "id": "byName",
199 + "options": "Count"
200 + },
201 + "properties": [
202 + {
203 + "id": "displayName",
204 + "value": "EVENTS"
205 + },
206 + {
207 + "id": "unit",
208 + "value": "short"
209 + },
210 + {
211 + "id": "decimals",
212 + "value": -1
213 + },
214 + {
215 + "id": "custom.cellOptions",
216 + "value": {
217 + "type": "color-background"
218 + }
219 + },
220 + {
221 + "id": "custom.align"
222 + },
223 + {
224 + "id": "thresholds",
225 + "value": {
226 + "mode": "absolute",
227 + "steps": [
228 + {
229 + "color": "dark-orange",
230 + "value": null
231 + }
232 + ]
233 + }
234 + }
235 + ]
236 + },
237 + {
238 + "matcher": {
239 + "id": "byName",
240 + "options": "data_groupName"
241 + },
242 + "properties": [
243 + {
244 + "id": "displayName",
245 + "value": "ALERTS BY TYPE"
246 + },
247 + {
248 + "id": "unit",
249 + "value": "short"
250 + },
251 + {
252 + "id": "decimals",
253 + "value": -1
254 + },
255 + {
256 + "id": "custom.cellOptions",
257 + "value": {
258 + "type": "color-background"
259 + }
260 + },
261 + {
262 + "id": "custom.align"
263 + }
264 + ]
265 + }
266 + ]
267 + },
268 + "gridPos": {
269 + "h": 7,
270 + "w": 7,
271 + "x": 4,
272 + "y": 0
273 + },
274 + "id": 57,
275 + "options": {
276 + "cellHeight": "sm",
277 + "footer": {
278 + "countRows": false,
279 + "fields": "",
280 + "reducer": [
281 + "sum"
282 + ],
283 + "show": false
284 + },
285 + "showHeader": true
286 + },
287 + "pluginVersion": "10.4.2",
288 + "targets": [
289 + {
290 + "bucketAggs": [
291 + {
292 + "fake": true,
293 + "field": "data_group",
294 + "id": "4",
295 + "settings": {
296 + "min_doc_count": 1,
297 + "order": "desc",
298 + "orderBy": "_count",
299 + "size": "0"
300 + },
301 + "type": "terms"
302 + }
303 + ],
304 + "datasource": {
305 + "type": "grafana-opensearch-datasource",
306 + "uid": "replace_datasource_uid"
307 + },
308 + "metrics": [
309 + {
310 + "field": "select field",
311 + "id": "1",
312 + "type": "count"
313 + }
314 + ],
315 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
316 + "refId": "A",
317 + "timeField": "timestamp"
318 + }
319 + ],
320 + "title": "ALERTS BY POLICY GROUP",
321 + "transformations": [
322 + {
323 + "id": "organize",
324 + "options": {
325 + "excludeByName": {},
326 + "indexByName": {},
327 + "renameByName": {
328 + "data_group": "GROUP"
329 + }
330 + }
331 + }
332 + ],
333 + "type": "table"
334 + },
335 + {
336 + "datasource": {
337 + "type": "grafana-opensearch-datasource",
338 + "uid": "replace_datasource_uid"
339 + },
340 + "fieldConfig": {
341 + "defaults": {
342 + "color": {
343 + "mode": "thresholds"
344 + },
345 + "custom": {
346 + "align": "auto",
347 + "cellOptions": {
348 + "type": "auto"
349 + },
350 + "inspect": false
351 + },
352 + "mappings": [],
353 + "thresholds": {
354 + "mode": "absolute",
355 + "steps": [
356 + {
357 + "color": "orange",
358 + "value": null
359 + }
360 + ]
361 + }
362 + },
363 + "overrides": [
364 + {
365 + "matcher": {
366 + "id": "byName",
367 + "options": "Time"
368 + },
369 + "properties": [
370 + {
371 + "id": "displayName",
372 + "value": "Time"
373 + },
374 + {
375 + "id": "unit",
376 + "value": "time: YYYY-MM-DD HH:mm:ss"
377 + },
378 + {
379 + "id": "custom.align"
380 + }
381 + ]
382 + },
383 + {
384 + "matcher": {
385 + "id": "byName",
386 + "options": "Count"
387 + },
388 + "properties": [
389 + {
390 + "id": "displayName",
391 + "value": "EVENTS"
392 + },
393 + {
394 + "id": "unit",
395 + "value": "short"
396 + },
397 + {
398 + "id": "decimals",
399 + "value": -1
400 + },
401 + {
402 + "id": "custom.cellOptions",
403 + "value": {
404 + "type": "color-background"
405 + }
406 + },
407 + {
408 + "id": "custom.align"
409 + },
410 + {
411 + "id": "thresholds",
412 + "value": {
413 + "mode": "absolute",
414 + "steps": [
415 + {
416 + "color": "dark-orange",
417 + "value": null
418 + }
419 + ]
420 + }
421 + }
422 + ]
423 + },
424 + {
425 + "matcher": {
426 + "id": "byName",
427 + "options": "data_groupName"
428 + },
429 + "properties": [
430 + {
431 + "id": "displayName",
432 + "value": "ALERTS BY TYPE"
433 + },
434 + {
435 + "id": "unit",
436 + "value": "short"
437 + },
438 + {
439 + "id": "decimals",
440 + "value": -1
441 + },
442 + {
443 + "id": "custom.cellOptions",
444 + "value": {
445 + "type": "color-background"
446 + }
447 + },
448 + {
449 + "id": "custom.align"
450 + }
451 + ]
452 + }
453 + ]
454 + },
455 + "gridPos": {
456 + "h": 7,
457 + "w": 7,
458 + "x": 11,
459 + "y": 0
460 + },
461 + "id": 55,
462 + "options": {
463 + "cellHeight": "sm",
464 + "footer": {
465 + "countRows": false,
466 + "fields": "",
467 + "reducer": [
468 + "sum"
469 + ],
470 + "show": false
471 + },
472 + "showHeader": true
473 + },
474 + "pluginVersion": "10.4.2",
475 + "targets": [
476 + {
477 + "bucketAggs": [
478 + {
479 + "fake": true,
480 + "field": "cat",
481 + "id": "4",
482 + "settings": {
483 + "min_doc_count": 1,
484 + "order": "desc",
485 + "orderBy": "_term",
486 + "size": "0"
487 + },
488 + "type": "terms"
489 + }
490 + ],
491 + "datasource": {
492 + "type": "grafana-opensearch-datasource",
493 + "uid": "replace_datasource_uid"
494 + },
495 + "metrics": [
496 + {
497 + "field": "select field",
498 + "id": "1",
499 + "type": "count"
500 + }
501 + ],
502 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
503 + "refId": "A",
504 + "timeField": "timestamp"
505 + }
506 + ],
507 + "title": "ALERTS BY CATEGOTY",
508 + "transformations": [
509 + {
510 + "id": "merge",
511 + "options": {
512 + "reducers": []
513 + }
514 + }
515 + ],
516 + "type": "table"
517 + },
518 + {
519 + "datasource": {
520 + "type": "grafana-opensearch-datasource",
521 + "uid": "replace_datasource_uid"
522 + },
523 + "fieldConfig": {
524 + "defaults": {
525 + "color": {
526 + "mode": "thresholds"
527 + },
528 + "custom": {
529 + "align": "auto",
530 + "cellOptions": {
531 + "type": "auto"
532 + },
533 + "inspect": false
534 + },
535 + "mappings": [],
536 + "thresholds": {
537 + "mode": "absolute",
538 + "steps": [
539 + {
540 + "color": "orange",
541 + "value": null
542 + }
543 + ]
544 + }
545 + },
546 + "overrides": [
547 + {
548 + "matcher": {
549 + "id": "byName",
550 + "options": "Time"
551 + },
552 + "properties": [
553 + {
554 + "id": "displayName",
555 + "value": "Time"
556 + },
557 + {
558 + "id": "unit",
559 + "value": "time: YYYY-MM-DD HH:mm:ss"
560 + },
561 + {
562 + "id": "custom.align"
563 + }
564 + ]
565 + },
566 + {
567 + "matcher": {
568 + "id": "byName",
569 + "options": "Count"
570 + },
571 + "properties": [
572 + {
573 + "id": "displayName",
574 + "value": "EVENTS"
575 + },
576 + {
577 + "id": "unit",
578 + "value": "short"
579 + },
580 + {
581 + "id": "decimals",
582 + "value": -1
583 + },
584 + {
585 + "id": "custom.cellOptions",
586 + "value": {
587 + "type": "color-background"
588 + }
589 + },
590 + {
591 + "id": "custom.align"
592 + },
593 + {
594 + "id": "thresholds",
595 + "value": {
596 + "mode": "absolute",
597 + "steps": [
598 + {
599 + "color": "dark-orange",
600 + "value": null
601 + }
602 + ]
603 + }
604 + }
605 + ]
606 + },
607 + {
608 + "matcher": {
609 + "id": "byName",
610 + "options": "data_groupName"
611 + },
612 + "properties": [
613 + {
614 + "id": "displayName",
615 + "value": "ALERTS BY TYPE"
616 + },
617 + {
618 + "id": "unit",
619 + "value": "short"
620 + },
621 + {
622 + "id": "decimals",
623 + "value": -1
624 + },
625 + {
626 + "id": "custom.cellOptions",
627 + "value": {
628 + "type": "color-background"
629 + }
630 + },
631 + {
632 + "id": "custom.align"
633 + }
634 + ]
635 + }
636 + ]
637 + },
638 + "gridPos": {
639 + "h": 7,
640 + "w": 6,
641 + "x": 18,
642 + "y": 0
643 + },
644 + "id": 56,
645 + "options": {
646 + "cellHeight": "sm",
647 + "footer": {
648 + "countRows": false,
649 + "fields": "",
650 + "reducer": [
651 + "sum"
652 + ],
653 + "show": false
654 + },
655 + "showHeader": true
656 + },
657 + "pluginVersion": "10.4.2",
658 + "targets": [
659 + {
660 + "bucketAggs": [
661 + {
662 + "fake": true,
663 + "field": "data_computerName",
664 + "id": "4",
665 + "settings": {
666 + "min_doc_count": 1,
667 + "order": "desc",
668 + "orderBy": "_count",
669 + "size": "0"
670 + },
671 + "type": "terms"
672 + }
673 + ],
674 + "datasource": {
675 + "type": "grafana-opensearch-datasource",
676 + "uid": "replace_datasource_uid"
677 + },
678 + "metrics": [
679 + {
680 + "field": "select field",
681 + "id": "1",
682 + "type": "count"
683 + }
684 + ],
685 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
686 + "refId": "A",
687 + "timeField": "timestamp"
688 + }
689 + ],
690 + "title": "ALERTS BY AGENT",
691 + "transformations": [
692 + {
693 + "id": "organize",
694 + "options": {
695 + "excludeByName": {},
696 + "indexByName": {},
697 + "renameByName": {
698 + "data_computerName": "COMPUTER"
699 + }
700 + }
701 + }
702 + ],
703 + "type": "table"
704 + },
705 + {
706 + "datasource": {
707 + "type": "grafana-opensearch-datasource",
708 + "uid": "replace_datasource_uid"
709 + },
710 + "fieldConfig": {
711 + "defaults": {
712 + "mappings": [
713 + {
714 + "options": {
715 + "match": "null",
716 + "result": {
717 + "text": "N/A"
718 + }
719 + },
720 + "type": "special"
721 + }
722 + ],
723 + "thresholds": {
724 + "mode": "absolute",
725 + "steps": [
726 + {
727 + "color": "blue",
728 + "value": null
729 + }
730 + ]
731 + },
732 + "unit": "none"
733 + },
734 + "overrides": []
735 + },
736 + "gridPos": {
737 + "h": 5,
738 + "w": 4,
739 + "x": 0,
740 + "y": 7
741 + },
742 + "id": 45,
743 + "maxDataPoints": 100,
744 + "options": {
745 + "colorMode": "value",
746 + "graphMode": "none",
747 + "justifyMode": "auto",
748 + "orientation": "horizontal",
749 + "reduceOptions": {
750 + "calcs": [
751 + "max"
752 + ],
753 + "fields": "",
754 + "values": false
755 + },
756 + "showPercentChange": false,
757 + "text": {},
758 + "textMode": "auto",
759 + "wideLayout": true
760 + },
761 + "pluginVersion": "10.4.2",
762 + "targets": [
763 + {
764 + "bucketAggs": [
765 + {
766 + "$$hashKey": "object:235",
767 + "field": "timestamp",
768 + "id": "2",
769 + "settings": {
770 + "interval": "365d",
771 + "min_doc_count": 0,
772 + "trimEdges": 0
773 + },
774 + "type": "date_histogram"
775 + }
776 + ],
777 + "datasource": {
778 + "type": "grafana-opensearch-datasource",
779 + "uid": "replace_datasource_uid"
780 + },
781 + "metrics": [
782 + {
783 + "$$hashKey": "object:233",
784 + "field": "data_computerName",
785 + "id": "1",
786 + "meta": {},
787 + "settings": {},
788 + "type": "cardinality"
789 + }
790 + ],
791 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
792 + "refId": "A",
793 + "timeField": "timestamp"
794 + }
795 + ],
796 + "title": "AGENTS",
797 + "type": "stat"
798 + },
799 + {
800 + "datasource": {
801 + "type": "grafana-opensearch-datasource",
802 + "uid": "replace_datasource_uid"
803 + },
804 + "fieldConfig": {
805 + "defaults": {
806 + "color": {
807 + "mode": "palette-classic"
808 + },
809 + "custom": {
810 + "axisBorderShow": false,
811 + "axisCenteredZero": false,
812 + "axisColorMode": "text",
813 + "axisLabel": "",
814 + "axisPlacement": "auto",
815 + "barAlignment": 0,
816 + "drawStyle": "line",
817 + "fillOpacity": 0,
818 + "gradientMode": "none",
819 + "hideFrom": {
820 + "legend": false,
821 + "tooltip": false,
822 + "viz": false
823 + },
824 + "insertNulls": false,
825 + "lineInterpolation": "linear",
826 + "lineWidth": 1,
827 + "pointSize": 5,
828 + "scaleDistribution": {
829 + "type": "linear"
830 + },
831 + "showPoints": "auto",
832 + "spanNulls": false,
833 + "stacking": {
834 + "group": "A",
835 + "mode": "normal"
836 + },
837 + "thresholdsStyle": {
838 + "mode": "off"
839 + }
840 + },
841 + "mappings": [],
842 + "thresholds": {
843 + "mode": "absolute",
844 + "steps": [
845 + {
846 + "color": "green",
847 + "value": null
848 + },
849 + {
850 + "color": "red",
851 + "value": 80
852 + }
853 + ]
854 + }
855 + },
856 + "overrides": []
857 + },
858 + "gridPos": {
859 + "h": 11,
860 + "w": 20,
861 + "x": 4,
862 + "y": 7
863 + },
864 + "id": 49,
865 + "options": {
866 + "legend": {
867 + "calcs": [],
868 + "displayMode": "table",
869 + "placement": "right",
870 + "showLegend": true
871 + },
872 + "tooltip": {
873 + "mode": "single",
874 + "sort": "none"
875 + }
876 + },
877 + "targets": [
878 + {
879 + "alias": "",
880 + "bucketAggs": [
881 + {
882 + "field": "data_computerName",
883 + "id": "3",
884 + "settings": {
885 + "min_doc_count": "1",
886 + "order": "desc",
887 + "orderBy": "_term",
888 + "size": "10"
889 + },
890 + "type": "terms"
891 + },
892 + {
893 + "field": "timestamp",
894 + "id": "2",
895 + "settings": {
896 + "interval": "auto"
897 + },
898 + "type": "date_histogram"
899 + }
900 + ],
901 + "datasource": {
902 + "type": "grafana-opensearch-datasource",
903 + "uid": "replace_datasource_uid"
904 + },
905 + "metrics": [
906 + {
907 + "id": "1",
908 + "type": "count"
909 + }
910 + ],
911 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
912 + "refId": "A",
913 + "timeField": "timestamp"
914 + }
915 + ],
916 + "title": "TOP 10 AGENTS - HISTOGRAM",
917 + "transparent": true,
918 + "type": "timeseries"
919 + },
920 + {
921 + "datasource": {
922 + "type": "grafana-opensearch-datasource",
923 + "uid": "replace_datasource_uid"
924 + },
925 + "fieldConfig": {
926 + "defaults": {
927 + "mappings": [
928 + {
929 + "options": {
930 + "match": "null",
931 + "result": {
932 + "text": "N/A"
933 + }
934 + },
935 + "type": "special"
936 + }
937 + ],
938 + "thresholds": {
939 + "mode": "absolute",
940 + "steps": [
941 + {
942 + "color": "orange",
943 + "value": null
944 + }
945 + ]
946 + },
947 + "unit": "locale"
948 + },
949 + "overrides": []
950 + },
951 + "gridPos": {
952 + "h": 6,
953 + "w": 4,
954 + "x": 0,
955 + "y": 12
956 + },
957 + "id": 18,
958 + "options": {
959 + "colorMode": "value",
960 + "graphMode": "area",
961 + "justifyMode": "auto",
962 + "orientation": "horizontal",
963 + "reduceOptions": {
964 + "calcs": [
965 + "sum"
966 + ],
967 + "fields": "",
968 + "values": false
969 + },
970 + "showPercentChange": false,
971 + "text": {},
972 + "textMode": "auto",
973 + "wideLayout": true
974 + },
975 + "pluginVersion": "10.4.2",
976 + "targets": [
977 + {
978 + "bucketAggs": [
979 + {
980 + "$$hashKey": "object:331",
981 + "field": "timestamp",
982 + "id": "2",
983 + "settings": {
984 + "interval": "auto",
985 + "min_doc_count": 0,
986 + "trimEdges": 0
987 + },
988 + "type": "date_histogram"
989 + }
990 + ],
991 + "datasource": {
992 + "type": "grafana-opensearch-datasource",
993 + "uid": "replace_datasource_uid"
994 + },
995 + "metrics": [
996 + {
997 + "$$hashKey": "object:329",
998 + "field": "select field",
999 + "id": "1",
1000 + "type": "count"
1001 + }
1002 + ],
1003 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
1004 + "refId": "A",
1005 + "timeField": "timestamp"
1006 + }
1007 + ],
1008 + "title": "EVENTS (TOTAL)",
1009 + "type": "stat"
1010 + },
1011 + {
1012 + "datasource": {
1013 + "type": "grafana-opensearch-datasource",
1014 + "uid": "replace_datasource_uid"
1015 + },
1016 + "fieldConfig": {
1017 + "defaults": {
1018 + "color": {
1019 + "mode": "palette-classic"
1020 + },
1021 + "custom": {
1022 + "hideFrom": {
1023 + "legend": false,
1024 + "tooltip": false,
1025 + "viz": false
1026 + }
1027 + },
1028 + "decimals": 0,
1029 + "mappings": [],
1030 + "unit": "short"
1031 + },
1032 + "overrides": [
1033 + {
1034 + "matcher": {
1035 + "id": "byName",
1036 + "options": "1"
1037 + },
1038 + "properties": [
1039 + {
1040 + "id": "color",
1041 + "value": {
1042 + "fixedColor": "#C8F2C2",
1043 + "mode": "fixed"
1044 + }
1045 + }
1046 + ]
1047 + },
1048 + {
1049 + "matcher": {
1050 + "id": "byName",
1051 + "options": "2"
1052 + },
1053 + "properties": [
1054 + {
1055 + "id": "color",
1056 + "value": {
1057 + "fixedColor": "#96D98D",
1058 + "mode": "fixed"
1059 + }
1060 + }
1061 + ]
1062 + },
1063 + {
1064 + "matcher": {
1065 + "id": "byName",
1066 + "options": "3"
1067 + },
1068 + "properties": [
1069 + {
1070 + "id": "color",
1071 + "value": {
1072 + "fixedColor": "#56A64B",
1073 + "mode": "fixed"
1074 + }
1075 + }
1076 + ]
1077 + },
1078 + {
1079 + "matcher": {
1080 + "id": "byName",
1081 + "options": "4"
1082 + },
1083 + "properties": [
1084 + {
1085 + "id": "color",
1086 + "value": {
1087 + "fixedColor": "#37872D",
1088 + "mode": "fixed"
1089 + }
1090 + }
1091 + ]
1092 + },
1093 + {
1094 + "matcher": {
1095 + "id": "byName",
1096 + "options": "5"
1097 + },
1098 + "properties": [
1099 + {
1100 + "id": "color",
1101 + "value": {
1102 + "fixedColor": "#FFF899",
1103 + "mode": "fixed"
1104 + }
1105 + }
1106 + ]
1107 + },
1108 + {
1109 + "matcher": {
1110 + "id": "byName",
1111 + "options": "7"
1112 + },
1113 + "properties": [
1114 + {
1115 + "id": "color",
1116 + "value": {
1117 + "fixedColor": "#F2CC0C",
1118 + "mode": "fixed"
1119 + }
1120 + }
1121 + ]
1122 + },
1123 + {
1124 + "matcher": {
1125 + "id": "byName",
1126 + "options": "9"
1127 + },
1128 + "properties": [
1129 + {
1130 + "id": "color",
1131 + "value": {
1132 + "fixedColor": "#FF9830",
1133 + "mode": "fixed"
1134 + }
1135 + }
1136 + ]
1137 + },
1138 + {
1139 + "matcher": {
1140 + "id": "byName",
1141 + "options": "10"
1142 + },
1143 + "properties": [
1144 + {
1145 + "id": "color",
1146 + "value": {
1147 + "fixedColor": "#FF9830",
1148 + "mode": "fixed"
1149 + }
1150 + }
1151 + ]
1152 + },
1153 + {
1154 + "matcher": {
1155 + "id": "byName",
1156 + "options": "12"
1157 + },
1158 + "properties": [
1159 + {
1160 + "id": "color",
1161 + "value": {
1162 + "fixedColor": "#F2495C",
1163 + "mode": "fixed"
1164 + }
1165 + }
1166 + ]
1167 + },
1168 + {
1169 + "matcher": {
1170 + "id": "byName",
1171 + "options": "13"
1172 + },
1173 + "properties": [
1174 + {
1175 + "id": "color",
1176 + "value": {
1177 + "fixedColor": "#FF7383",
1178 + "mode": "fixed"
1179 + }
1180 + }
1181 + ]
1182 + }
1183 + ]
1184 + },
1185 + "gridPos": {
1186 + "h": 12,
1187 + "w": 6,
1188 + "x": 0,
1189 + "y": 18
1190 + },
1191 + "id": 23,
1192 + "maxDataPoints": 3,
1193 + "options": {
1194 + "displayLabels": [],
1195 + "legend": {
1196 + "calcs": [],
1197 + "displayMode": "table",
1198 + "placement": "right",
1199 + "showLegend": true,
1200 + "values": [
1201 + "value",
1202 + "percent"
1203 + ]
1204 + },
1205 + "pieType": "donut",
1206 + "reduceOptions": {
1207 + "calcs": [
1208 + "sum"
1209 + ],
1210 + "fields": "",
1211 + "values": false
1212 + },
1213 + "text": {},
1214 + "tooltip": {
1215 + "mode": "single",
1216 + "sort": "none"
1217 + }
1218 + },
1219 + "targets": [
1220 + {
1221 + "bucketAggs": [
1222 + {
1223 + "$$hashKey": "object:235",
1224 + "fake": true,
1225 + "field": "eventSeverity",
1226 + "id": "3",
1227 + "settings": {
1228 + "min_doc_count": 1,
1229 + "order": "desc",
1230 + "orderBy": "_count",
1231 + "size": "10"
1232 + },
1233 + "type": "terms"
1234 + },
1235 + {
1236 + "$$hashKey": "object:236",
1237 + "field": "timestamp",
1238 + "id": "2",
1239 + "settings": {
1240 + "interval": "auto",
1241 + "min_doc_count": 0,
1242 + "trimEdges": 0
1243 + },
1244 + "type": "date_histogram"
1245 + }
1246 + ],
1247 + "datasource": {
1248 + "type": "grafana-opensearch-datasource",
1249 + "uid": "replace_datasource_uid"
1250 + },
1251 + "metrics": [
1252 + {
1253 + "$$hashKey": "object:233",
1254 + "field": "select field",
1255 + "id": "1",
1256 + "meta": {},
1257 + "settings": {},
1258 + "type": "count"
1259 + }
1260 + ],
1261 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
1262 + "refId": "A",
1263 + "timeField": "timestamp"
1264 + }
1265 + ],
1266 + "title": "SECURITY EVENTS BY ALERT LEVEL",
1267 + "type": "piechart"
1268 + },
1269 + {
1270 + "datasource": {
1271 + "type": "grafana-opensearch-datasource",
1272 + "uid": "replace_datasource_uid"
1273 + },
1274 + "fieldConfig": {
1275 + "defaults": {
1276 + "color": {
1277 + "mode": "palette-classic"
1278 + },
1279 + "custom": {
1280 + "axisBorderShow": false,
1281 + "axisCenteredZero": false,
1282 + "axisColorMode": "text",
1283 + "axisLabel": "",
1284 + "axisPlacement": "auto",
1285 + "barAlignment": 0,
1286 + "drawStyle": "line",
1287 + "fillOpacity": 0,
1288 + "gradientMode": "none",
1289 + "hideFrom": {
1290 + "legend": false,
1291 + "tooltip": false,
1292 + "viz": false
1293 + },
1294 + "insertNulls": false,
1295 + "lineInterpolation": "linear",
1296 + "lineWidth": 1,
1297 + "pointSize": 5,
1298 + "scaleDistribution": {
1299 + "type": "linear"
1300 + },
1301 + "showPoints": "auto",
1302 + "spanNulls": false,
1303 + "stacking": {
1304 + "group": "A",
1305 + "mode": "normal"
1306 + },
1307 + "thresholdsStyle": {
1308 + "mode": "off"
1309 + }
1310 + },
1311 + "mappings": [],
1312 + "thresholds": {
1313 + "mode": "absolute",
1314 + "steps": [
1315 + {
1316 + "color": "green",
1317 + "value": null
1318 + },
1319 + {
1320 + "color": "red",
1321 + "value": 80
1322 + }
1323 + ]
1324 + }
1325 + },
1326 + "overrides": [
1327 + {
1328 + "matcher": {
1329 + "id": "byName",
1330 + "options": "10"
1331 + },
1332 + "properties": [
1333 + {
1334 + "id": "color",
1335 + "value": {
1336 + "fixedColor": "orange",
1337 + "mode": "fixed"
1338 + }
1339 + }
1340 + ]
1341 + }
1342 + ]
1343 + },
1344 + "gridPos": {
1345 + "h": 12,
1346 + "w": 18,
1347 + "x": 6,
1348 + "y": 18
1349 + },
1350 + "id": 50,
1351 + "options": {
1352 + "legend": {
1353 + "calcs": [],
1354 + "displayMode": "table",
1355 + "placement": "right",
1356 + "showLegend": true
1357 + },
1358 + "tooltip": {
1359 + "mode": "single",
1360 + "sort": "none"
1361 + }
1362 + },
1363 + "targets": [
1364 + {
1365 + "alias": "",
1366 + "bucketAggs": [
1367 + {
1368 + "field": "eventSeverity",
1369 + "id": "3",
1370 + "settings": {
1371 + "min_doc_count": "1",
1372 + "order": "desc",
1373 + "orderBy": "_count",
1374 + "size": "10"
1375 + },
1376 + "type": "terms"
1377 + },
1378 + {
1379 + "field": "timestamp",
1380 + "id": "2",
1381 + "settings": {
1382 + "interval": "auto"
1383 + },
1384 + "type": "date_histogram"
1385 + }
1386 + ],
1387 + "datasource": {
1388 + "type": "grafana-opensearch-datasource",
1389 + "uid": "replace_datasource_uid"
1390 + },
1391 + "metrics": [
1392 + {
1393 + "id": "1",
1394 + "type": "count"
1395 + }
1396 + ],
1397 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
1398 + "refId": "A",
1399 + "timeField": "timestamp"
1400 + }
1401 + ],
1402 + "title": "EVENTS SEVERITY - HISTOGRAM",
1403 + "type": "timeseries"
1404 + },
1405 + {
1406 + "datasource": {
1407 + "type": "grafana-opensearch-datasource",
1408 + "uid": "replace_datasource_uid"
1409 + },
1410 + "fieldConfig": {
1411 + "defaults": {
1412 + "color": {
1413 + "mode": "palette-classic"
1414 + },
1415 + "custom": {
1416 + "hideFrom": {
1417 + "legend": false,
1418 + "tooltip": false,
1419 + "viz": false
1420 + }
1421 + },
1422 + "decimals": 0,
1423 + "mappings": [],
1424 + "unit": "short"
1425 + },
1426 + "overrides": [
1427 + {
1428 + "matcher": {
1429 + "id": "byName",
1430 + "options": "1"
1431 + },
1432 + "properties": [
1433 + {
1434 + "id": "color",
1435 + "value": {
1436 + "fixedColor": "#C8F2C2",
1437 + "mode": "fixed"
1438 + }
1439 + }
1440 + ]
1441 + },
1442 + {
1443 + "matcher": {
1444 + "id": "byName",
1445 + "options": "2"
1446 + },
1447 + "properties": [
1448 + {
1449 + "id": "color",
1450 + "value": {
1451 + "fixedColor": "#96D98D",
1452 + "mode": "fixed"
1453 + }
1454 + }
1455 + ]
1456 + },
1457 + {
1458 + "matcher": {
1459 + "id": "byName",
1460 + "options": "3"
1461 + },
1462 + "properties": [
1463 + {
1464 + "id": "color",
1465 + "value": {
1466 + "fixedColor": "#56A64B",
1467 + "mode": "fixed"
1468 + }
1469 + }
1470 + ]
1471 + },
1472 + {
1473 + "matcher": {
1474 + "id": "byName",
1475 + "options": "4"
1476 + },
1477 + "properties": [
1478 + {
1479 + "id": "color",
1480 + "value": {
1481 + "fixedColor": "#37872D",
1482 + "mode": "fixed"
1483 + }
1484 + }
1485 + ]
1486 + },
1487 + {
1488 + "matcher": {
1489 + "id": "byName",
1490 + "options": "5"
1491 + },
1492 + "properties": [
1493 + {
1494 + "id": "color",
1495 + "value": {
1496 + "fixedColor": "#FFF899",
1497 + "mode": "fixed"
1498 + }
1499 + }
1500 + ]
1501 + },
1502 + {
1503 + "matcher": {
1504 + "id": "byName",
1505 + "options": "7"
1506 + },
1507 + "properties": [
1508 + {
1509 + "id": "color",
1510 + "value": {
1511 + "fixedColor": "#F2CC0C",
1512 + "mode": "fixed"
1513 + }
1514 + }
1515 + ]
1516 + },
1517 + {
1518 + "matcher": {
1519 + "id": "byName",
1520 + "options": "9"
1521 + },
1522 + "properties": [
1523 + {
1524 + "id": "color",
1525 + "value": {
1526 + "fixedColor": "#FF9830",
1527 + "mode": "fixed"
1528 + }
1529 + }
1530 + ]
1531 + },
1532 + {
1533 + "matcher": {
1534 + "id": "byName",
1535 + "options": "10"
1536 + },
1537 + "properties": [
1538 + {
1539 + "id": "color",
1540 + "value": {
1541 + "fixedColor": "#FF9830",
1542 + "mode": "fixed"
1543 + }
1544 + }
1545 + ]
1546 + },
1547 + {
1548 + "matcher": {
1549 + "id": "byName",
1550 + "options": "12"
1551 + },
1552 + "properties": [
1553 + {
1554 + "id": "color",
1555 + "value": {
1556 + "fixedColor": "#F2495C",
1557 + "mode": "fixed"
1558 + }
1559 + }
1560 + ]
1561 + },
1562 + {
1563 + "matcher": {
1564 + "id": "byName",
1565 + "options": "13"
1566 + },
1567 + "properties": [
1568 + {
1569 + "id": "color",
1570 + "value": {
1571 + "fixedColor": "#FF7383",
1572 + "mode": "fixed"
1573 + }
1574 + }
1575 + ]
1576 + },
1577 + {
1578 + "matcher": {
1579 + "id": "byName",
1580 + "options": "MALWARE"
1581 + },
1582 + "properties": [
1583 + {
1584 + "id": "color",
1585 + "value": {
1586 + "fixedColor": "orange",
1587 + "mode": "fixed"
1588 + }
1589 + }
1590 + ]
1591 + }
1592 + ]
1593 + },
1594 + "gridPos": {
1595 + "h": 12,
1596 + "w": 6,
1597 + "x": 0,
1598 + "y": 30
1599 + },
1600 + "id": 52,
1601 + "maxDataPoints": 3,
1602 + "options": {
1603 + "displayLabels": [],
1604 + "legend": {
1605 + "calcs": [],
1606 + "displayMode": "table",
1607 + "placement": "right",
1608 + "showLegend": true,
1609 + "values": [
1610 + "value",
1611 + "percent"
1612 + ]
1613 + },
1614 + "pieType": "donut",
1615 + "reduceOptions": {
1616 + "calcs": [
1617 + "sum"
1618 + ],
1619 + "fields": "",
1620 + "values": false
1621 + },
1622 + "text": {},
1623 + "tooltip": {
1624 + "mode": "single",
1625 + "sort": "none"
1626 + }
1627 + },
1628 + "targets": [
1629 + {
1630 + "bucketAggs": [
1631 + {
1632 + "$$hashKey": "object:235",
1633 + "fake": true,
1634 + "field": "cat",
1635 + "id": "3",
1636 + "settings": {
1637 + "min_doc_count": 1,
1638 + "order": "desc",
1639 + "orderBy": "_count",
1640 + "size": "10"
1641 + },
1642 + "type": "terms"
1643 + },
1644 + {
1645 + "$$hashKey": "object:236",
1646 + "field": "timestamp",
1647 + "id": "2",
1648 + "settings": {
1649 + "interval": "auto",
1650 + "min_doc_count": 0,
1651 + "trimEdges": 0
1652 + },
1653 + "type": "date_histogram"
1654 + }
1655 + ],
1656 + "datasource": {
1657 + "type": "grafana-opensearch-datasource",
1658 + "uid": "replace_datasource_uid"
1659 + },
1660 + "metrics": [
1661 + {
1662 + "$$hashKey": "object:233",
1663 + "field": "select field",
1664 + "id": "1",
1665 + "meta": {},
1666 + "settings": {},
1667 + "type": "count"
1668 + }
1669 + ],
1670 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
1671 + "refId": "A",
1672 + "timeField": "timestamp"
1673 + }
1674 + ],
1675 + "title": "SECURITY EVENTS BY CATEGORY",
1676 + "type": "piechart"
1677 + },
1678 + {
1679 + "datasource": {
1680 + "type": "grafana-opensearch-datasource",
1681 + "uid": "replace_datasource_uid"
1682 + },
1683 + "fieldConfig": {
1684 + "defaults": {
1685 + "color": {
1686 + "mode": "palette-classic"
1687 + },
1688 + "custom": {
1689 + "hideFrom": {
1690 + "legend": false,
1691 + "tooltip": false,
1692 + "viz": false
1693 + }
1694 + },
1695 + "decimals": 0,
1696 + "mappings": [],
1697 + "unit": "short"
1698 + },
1699 + "overrides": [
1700 + {
1701 + "matcher": {
1702 + "id": "byName",
1703 + "options": "1"
1704 + },
1705 + "properties": [
1706 + {
1707 + "id": "color",
1708 + "value": {
1709 + "fixedColor": "#C8F2C2",
1710 + "mode": "fixed"
1711 + }
1712 + }
1713 + ]
1714 + },
1715 + {
1716 + "matcher": {
1717 + "id": "byName",
1718 + "options": "2"
1719 + },
1720 + "properties": [
1721 + {
1722 + "id": "color",
1723 + "value": {
1724 + "fixedColor": "#96D98D",
1725 + "mode": "fixed"
1726 + }
1727 + }
1728 + ]
1729 + },
1730 + {
1731 + "matcher": {
1732 + "id": "byName",
1733 + "options": "3"
1734 + },
1735 + "properties": [
1736 + {
1737 + "id": "color",
1738 + "value": {
1739 + "fixedColor": "#56A64B",
1740 + "mode": "fixed"
1741 + }
1742 + }
1743 + ]
1744 + },
1745 + {
1746 + "matcher": {
1747 + "id": "byName",
1748 + "options": "4"
1749 + },
1750 + "properties": [
1751 + {
1752 + "id": "color",
1753 + "value": {
1754 + "fixedColor": "#37872D",
1755 + "mode": "fixed"
1756 + }
1757 + }
1758 + ]
1759 + },
1760 + {
1761 + "matcher": {
1762 + "id": "byName",
1763 + "options": "5"
1764 + },
1765 + "properties": [
1766 + {
1767 + "id": "color",
1768 + "value": {
1769 + "fixedColor": "#FFF899",
1770 + "mode": "fixed"
1771 + }
1772 + }
1773 + ]
1774 + },
1775 + {
1776 + "matcher": {
1777 + "id": "byName",
1778 + "options": "7"
1779 + },
1780 + "properties": [
1781 + {
1782 + "id": "color",
1783 + "value": {
1784 + "fixedColor": "#F2CC0C",
1785 + "mode": "fixed"
1786 + }
1787 + }
1788 + ]
1789 + },
1790 + {
1791 + "matcher": {
1792 + "id": "byName",
1793 + "options": "9"
1794 + },
1795 + "properties": [
1796 + {
1797 + "id": "color",
1798 + "value": {
1799 + "fixedColor": "#FF9830",
1800 + "mode": "fixed"
1801 + }
1802 + }
1803 + ]
1804 + },
1805 + {
1806 + "matcher": {
1807 + "id": "byName",
1808 + "options": "10"
1809 + },
1810 + "properties": [
1811 + {
1812 + "id": "color",
1813 + "value": {
1814 + "fixedColor": "#FF9830",
1815 + "mode": "fixed"
1816 + }
1817 + }
1818 + ]
1819 + },
1820 + {
1821 + "matcher": {
1822 + "id": "byName",
1823 + "options": "12"
1824 + },
1825 + "properties": [
1826 + {
1827 + "id": "color",
1828 + "value": {
1829 + "fixedColor": "#F2495C",
1830 + "mode": "fixed"
1831 + }
1832 + }
1833 + ]
1834 + },
1835 + {
1836 + "matcher": {
1837 + "id": "byName",
1838 + "options": "13"
1839 + },
1840 + "properties": [
1841 + {
1842 + "id": "color",
1843 + "value": {
1844 + "fixedColor": "#FF7383",
1845 + "mode": "fixed"
1846 + }
1847 + }
1848 + ]
1849 + },
1850 + {
1851 + "matcher": {
1852 + "id": "byName",
1853 + "options": "MALWARE"
1854 + },
1855 + "properties": [
1856 + {
1857 + "id": "color",
1858 + "value": {
1859 + "fixedColor": "orange",
1860 + "mode": "fixed"
1861 + }
1862 + }
1863 + ]
1864 + }
1865 + ]
1866 + },
1867 + "gridPos": {
1868 + "h": 12,
1869 + "w": 6,
1870 + "x": 6,
1871 + "y": 30
1872 + },
1873 + "id": 53,
1874 + "maxDataPoints": 3,
1875 + "options": {
1876 + "displayLabels": [],
1877 + "legend": {
1878 + "calcs": [],
1879 + "displayMode": "table",
1880 + "placement": "right",
1881 + "showLegend": true,
1882 + "values": [
1883 + "value",
1884 + "percent"
1885 + ]
1886 + },
1887 + "pieType": "donut",
1888 + "reduceOptions": {
1889 + "calcs": [
1890 + "sum"
1891 + ],
1892 + "fields": "",
1893 + "values": false
1894 + },
1895 + "text": {},
1896 + "tooltip": {
1897 + "mode": "single",
1898 + "sort": "none"
1899 + }
1900 + },
1901 + "targets": [
1902 + {
1903 + "bucketAggs": [
1904 + {
1905 + "$$hashKey": "object:235",
1906 + "fake": true,
1907 + "field": "siteName",
1908 + "id": "3",
1909 + "settings": {
1910 + "min_doc_count": 1,
1911 + "order": "desc",
1912 + "orderBy": "_count",
1913 + "size": "10"
1914 + },
1915 + "type": "terms"
1916 + },
1917 + {
1918 + "$$hashKey": "object:236",
1919 + "field": "timestamp",
1920 + "id": "2",
1921 + "settings": {
1922 + "interval": "auto",
1923 + "min_doc_count": 0,
1924 + "trimEdges": 0
1925 + },
1926 + "type": "date_histogram"
1927 + }
1928 + ],
1929 + "datasource": {
1930 + "type": "grafana-opensearch-datasource",
1931 + "uid": "replace_datasource_uid"
1932 + },
1933 + "metrics": [
1934 + {
1935 + "$$hashKey": "object:233",
1936 + "field": "select field",
1937 + "id": "1",
1938 + "meta": {},
1939 + "settings": {},
1940 + "type": "count"
1941 + }
1942 + ],
1943 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
1944 + "refId": "A",
1945 + "timeField": "timestamp"
1946 + }
1947 + ],
1948 + "title": "SECURITY EVENTS BY SITE",
1949 + "type": "piechart"
1950 + },
1951 + {
1952 + "datasource": {
1953 + "type": "grafana-opensearch-datasource",
1954 + "uid": "replace_datasource_uid"
1955 + },
1956 + "fieldConfig": {
1957 + "defaults": {
1958 + "color": {
1959 + "mode": "thresholds"
1960 + },
1961 + "custom": {
1962 + "align": "auto",
1963 + "cellOptions": {
1964 + "type": "auto"
1965 + },
1966 + "inspect": false
1967 + },
1968 + "decimals": 0,
1969 + "mappings": [],
1970 + "thresholds": {
1971 + "mode": "absolute",
1972 + "steps": [
1973 + {
1974 + "color": "green",
1975 + "value": null
1976 + },
1977 + {
1978 + "color": "red",
1979 + "value": 80
1980 + }
1981 + ]
1982 + },
1983 + "unit": "short"
1984 + },
1985 + "overrides": [
1986 + {
1987 + "matcher": {
1988 + "id": "byName",
1989 + "options": "FILE PATH"
1990 + },
1991 + "properties": [
1992 + {
1993 + "id": "custom.width",
1994 + "value": 895
1995 + }
1996 + ]
1997 + }
1998 + ]
1999 + },
2000 + "gridPos": {
2001 + "h": 12,
2002 + "w": 12,
2003 + "x": 12,
2004 + "y": 30
2005 + },
2006 + "id": 54,
2007 + "maxDataPoints": 3,
2008 + "options": {
2009 + "cellHeight": "sm",
2010 + "footer": {
2011 + "countRows": false,
2012 + "fields": "",
2013 + "reducer": [
2014 + "sum"
2015 + ],
2016 + "show": false
2017 + },
2018 + "showHeader": true,
2019 + "sortBy": []
2020 + },
2021 + "pluginVersion": "10.4.2",
2022 + "targets": [
2023 + {
2024 + "bucketAggs": [
2025 + {
2026 + "$$hashKey": "object:235",
2027 + "fake": true,
2028 + "field": "data_filePath",
2029 + "id": "3",
2030 + "settings": {
2031 + "min_doc_count": 1,
2032 + "order": "desc",
2033 + "orderBy": "_count",
2034 + "size": "10"
2035 + },
2036 + "type": "terms"
2037 + }
2038 + ],
2039 + "datasource": {
2040 + "type": "grafana-opensearch-datasource",
2041 + "uid": "replace_datasource_uid"
2042 + },
2043 + "metrics": [
2044 + {
2045 + "$$hashKey": "object:233",
2046 + "field": "select field",
2047 + "id": "1",
2048 + "meta": {},
2049 + "settings": {},
2050 + "type": "count"
2051 + }
2052 + ],
2053 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
2054 + "refId": "A",
2055 + "timeField": "timestamp"
2056 + }
2057 + ],
2058 + "title": "FILE PATHS",
2059 + "transformations": [
2060 + {
2061 + "id": "organize",
2062 + "options": {
2063 + "excludeByName": {},
2064 + "indexByName": {},
2065 + "renameByName": {
2066 + "data_filePath": "FILE PATH"
2067 + }
2068 + }
2069 + }
2070 + ],
2071 + "type": "table"
2072 + },
2073 + {
2074 + "datasource": {
2075 + "type": "grafana-opensearch-datasource",
2076 + "uid": "replace_datasource_uid"
2077 + },
2078 + "fieldConfig": {
2079 + "defaults": {
2080 + "color": {
2081 + "mode": "thresholds"
2082 + },
2083 + "custom": {
2084 + "align": "auto",
2085 + "cellOptions": {
2086 + "type": "auto"
2087 + },
2088 + "inspect": false
2089 + },
2090 + "decimals": 2,
2091 + "displayName": "",
2092 + "mappings": [],
2093 + "thresholds": {
2094 + "mode": "absolute",
2095 + "steps": [
2096 + {
2097 + "color": "green",
2098 + "value": null
2099 + },
2100 + {
2101 + "color": "red",
2102 + "value": 80
2103 + }
2104 + ]
2105 + },
2106 + "unit": "short"
2107 + },
2108 + "overrides": [
2109 + {
2110 + "matcher": {
2111 + "id": "byName",
2112 + "options": "Time"
2113 + },
2114 + "properties": [
2115 + {
2116 + "id": "displayName",
2117 + "value": "Time"
2118 + },
2119 + {
2120 + "id": "unit",
2121 + "value": "time: YYYY-MM-DD HH:mm:ss"
2122 + },
2123 + {
2124 + "id": "custom.align"
2125 + }
2126 + ]
2127 + },
2128 + {
2129 + "matcher": {
2130 + "id": "byName",
2131 + "options": "Count"
2132 + },
2133 + "properties": [
2134 + {
2135 + "id": "displayName",
2136 + "value": "Events"
2137 + },
2138 + {
2139 + "id": "unit",
2140 + "value": "short"
2141 + },
2142 + {
2143 + "id": "decimals",
2144 + "value": -1
2145 + },
2146 + {
2147 + "id": "custom.align"
2148 + }
2149 + ]
2150 + },
2151 + {
2152 + "matcher": {
2153 + "id": "byName",
2154 + "options": "data_groupName"
2155 + },
2156 + "properties": [
2157 + {
2158 + "id": "displayName",
2159 + "value": "Rule Groups"
2160 + },
2161 + {
2162 + "id": "unit",
2163 + "value": "short"
2164 + },
2165 + {
2166 + "id": "decimals",
2167 + "value": 2
2168 + },
2169 + {
2170 + "id": "custom.align"
2171 + },
2172 + {
2173 + "id": "mappings",
2174 + "value": [
2175 + {
2176 + "options": {
2177 + "SENTINELONE, agent_flooding": {
2178 + "index": 33,
2179 + "text": "SENTINELONE Agent - Event Queue Flooding"
2180 + },
2181 + "apache, web, modsecurity": {
2182 + "index": 7,
2183 + "text": "Apache ModSec"
2184 + },
2185 + "dnsstat, dnsstat_alert": {
2186 + "index": 47,
2187 + "text": "Domain Stats - Alert"
2188 + },
2189 + "dnsstat, dnsstat_error": {
2190 + "index": 41,
2191 + "text": "Domain Stats - Entry Not found in RDAP"
2192 + },
2193 + "docker, docker-error": {
2194 + "index": 43,
2195 + "text": "Docker Error"
2196 + },
2197 + "linux, docker, falco": {
2198 + "index": 56,
2199 + "text": "Linux Docker: Container Event"
2200 + },
2201 + "linux, packetbeat, dns": {
2202 + "index": 58,
2203 + "text": "Linux - DNS Request"
2204 + },
2205 + "linux, packetbeat, http": {
2206 + "index": 73,
2207 + "text": "Linux Packetbeat - HTTP Connection"
2208 + },
2209 + "linux, packetbeat, tls": {
2210 + "index": 72,
2211 + "text": "Linux Packetbeat - HTTPS Connection"
2212 + },
2213 + "linux, sysmon, sysmon_event1": {
2214 + "index": 3,
2215 + "text": "Linux Sysmon - Process Started"
2216 + },
2217 + "linux, sysmon, sysmon_event3": {
2218 + "index": 2,
2219 + "text": "Linux Sysmon - Network Connection"
2220 + },
2221 + "linux, sysmon, sysmon_event5": {
2222 + "index": 1,
2223 + "text": "Linux Sysmon - Process Terminated"
2224 + },
2225 + "linux, sysmon, sysmon_event9": {
2226 + "index": 46,
2227 + "text": "Linux Sysmon - RawAccessRead"
2228 + },
2229 + "linux, sysmon, sysmon_event_11": {
2230 + "index": 4,
2231 + "text": "Linux Sysmon - FileCreate"
2232 + },
2233 + "linux, sysmon, sysmon_event_16": {
2234 + "index": 6,
2235 + "text": "Linux Sysmon - Sysmon Config Changed"
2236 + },
2237 + "linux, sysmon, sysmon_event_23": {
2238 + "index": 5,
2239 + "text": "Linux Sysmon - File Removed"
2240 + },
2241 + "local, systemd": {
2242 + "index": 74,
2243 + "text": "Linux Systemd"
2244 + },
2245 + "openvpn, authentication_success": {
2246 + "index": 68,
2247 + "text": "OpenVPN Client - Auth Success"
2248 + },
2249 + "ossec": {
2250 + "index": 15,
2251 + "text": "OSSEC Event"
2252 + },
2253 + "ossec, rootcheck": {
2254 + "index": 19,
2255 + "text": "OSSEC - Rootcheck"
2256 + },
2257 + "ossec, syscheck, syscheck_entry_added, syscheck_file": {
2258 + "index": 9,
2259 + "text": "Syscheck - File Added"
2260 + },
2261 + "ossec, syscheck, syscheck_entry_added, syscheck_registry": {
2262 + "index": 39,
2263 + "text": "Syscheck - Windows Registry (Entry Added)"
2264 + },
2265 + "ossec, syscheck, syscheck_entry_deleted, syscheck_file": {
2266 + "index": 52,
2267 + "text": "Syscheck - File Deleted"
2268 + },
2269 + "ossec, syscheck, syscheck_entry_deleted, syscheck_registry": {
2270 + "index": 45,
2271 + "text": "Syscheck - Windows Registry (Entry Deleted)"
2272 + },
2273 + "ossec, syscheck, syscheck_entry_modified, syscheck_file": {
2274 + "index": 14,
2275 + "text": "Syscheck - File Modified"
2276 + },
2277 + "ossec, syscheck, syscheck_entry_modified, syscheck_registry": {
2278 + "index": 30,
2279 + "text": "Syscheck - Windows Registry (Entry Modified)"
2280 + },
2281 + "pam, syslog": {
2282 + "index": 18,
2283 + "text": "Linux PAM"
2284 + },
2285 + "pam, syslog, authentication_failed": {
2286 + "index": 67,
2287 + "text": "Linux PAM - Auth Failed"
2288 + },
2289 + "pam, syslog, authentication_success": {
2290 + "index": 12,
2291 + "text": "Linux PAM - Auth Success"
2292 + },
2293 + "sca": {
2294 + "index": 17,
2295 + "text": "Security Config Assessment"
2296 + },
2297 + "syslog, adduser": {
2298 + "index": 54,
2299 + "text": "Linux - User Added"
2300 + },
2301 + "syslog, dpkg": {
2302 + "index": 11,
2303 + "text": "Lunux dpkg"
2304 + },
2305 + "syslog, dpkg, config_changed": {
2306 + "index": 10,
2307 + "text": "Linux dpkg - Config Changed"
2308 + },
2309 + "syslog, errors, service_availability": {
2310 + "index": 75,
2311 + "text": "Linux Syslog - System Error"
2312 + },
2313 + "syslog, linuxkernel": {
2314 + "index": 57,
2315 + "text": "Linux - Kernel Event"
2316 + },
2317 + "syslog, linuxkernel, promisc": {
2318 + "index": 29,
2319 + "text": "Linux Kernel - Promisc. Interface"
2320 + },
2321 + "syslog, sshd, authentication_success": {
2322 + "index": 13,
2323 + "text": "SSH - Auth Success"
2324 + },
2325 + "syslog, sshd, recon": {
2326 + "index": 51,
2327 + "text": "Linux - SSH Daemon Alert"
2328 + },
2329 + "syslog, sudo": {
2330 + "index": 16,
2331 + "text": "Lunux - Sudo"
2332 + },
2333 + "threat_intel, alienvault, otx_alert": {
2334 + "index": 63,
2335 + "text": "Threat Intel - AlienVault OTX IoC Alert"
2336 + },
2337 + "threat_intel, misp, misp_alert": {
2338 + "index": 40,
2339 + "text": "Threat Intel - MISP IoC Alert"
2340 + },
2341 + "threat_intel, opencti, opencti_alert": {
2342 + "index": 62,
2343 + "text": "Threat Intel - OpenCTI IoC Alert"
2344 + },
2345 + "threat_intel, opencti, opencti_error": {
2346 + "index": 64,
2347 + "text": "Threat Intel - OpenCTI API Error"
2348 + },
2349 + "usb": {
2350 + "index": 69,
2351 + "text": "USB Port Event"
2352 + },
2353 + "vulnerability-detector": {
2354 + "index": 0,
2355 + "text": "Vulnerability Detector"
2356 + },
2357 + "vulnerability-detector, snyk": {
2358 + "index": 55,
2359 + "text": "Vulnerability Detector - Docker Images"
2360 + },
2361 + "windows, inventory": {
2362 + "index": 27,
2363 + "text": "Windows Agent Inventory"
2364 + },
2365 + "windows, sysmon, sysmon_event1, windows_sysmon_event1": {
2366 + "index": 48,
2367 + "text": "Windows Sysmon - Process Started"
2368 + },
2369 + "windows, sysmon, sysmon_event1, windows_sysmon_event1, sysmon_anomaly": {
2370 + "index": 77,
2371 + "text": "Windows Sysmon - Process Started Anomaly"
2372 + },
2373 + "windows, sysmon, sysmon_event2": {
2374 + "index": 78,
2375 + "text": "Windows Sysmon - A Process changed File Creation Time"
2376 + },
2377 + "windows, sysmon, sysmon_event3": {
2378 + "index": 36,
2379 + "text": "Windows Sysmon - Network Connection"
2380 + },
2381 + "windows, sysmon, sysmon_event3, sysmon_anomaly": {
2382 + "index": 76,
2383 + "text": "Windows Sysmon - Network Connection Anomaly"
2384 + },
2385 + "windows, sysmon, sysmon_event7": {
2386 + "index": 25,
2387 + "text": "Windows Sysmon - DLL SideLoading"
2388 + },
2389 + "windows, sysmon, sysmon_event_10": {
2390 + "index": 32,
2391 + "text": "Windows Sysmon - Process Injection"
2392 + },
2393 + "windows, sysmon, sysmon_event_11": {
2394 + "index": 20,
2395 + "text": "Windows Sysmon - FileCreate"
2396 + },
2397 + "windows, sysmon, sysmon_event_12": {
2398 + "index": 23,
2399 + "text": "Windows Sysmon - RegistryEvent (Object create and delete)"
2400 + },
2401 + "windows, sysmon, sysmon_event_13": {
2402 + "index": 24,
2403 + "text": "Windows Sysmon - RegistryEvent (ValueSet)"
2404 + },
2405 + "windows, sysmon, sysmon_event_15": {
2406 + "index": 61,
2407 + "text": "Windows Sysmon - FileCreateStreamHash"
2408 + },
2409 + "windows, sysmon, sysmon_event_17": {
2410 + "index": 70,
2411 + "text": "Windows Sysmon - Pipe Created"
2412 + },
2413 + "windows, sysmon, sysmon_event_22": {
2414 + "index": 38,
2415 + "text": "Windows Sysmon - DNS Request"
2416 + },
2417 + "windows, sysmon, sysmon_event_23": {
2418 + "index": 28,
2419 + "text": "Windows Sysmon - File Removed"
2420 + },
2421 + "windows, sysmon, sysmon_event_25": {
2422 + "index": 71,
2423 + "text": "Windows Sysmon - Process Tampering"
2424 + },
2425 + "windows, sysmon, sysmon_process-anomalies": {
2426 + "index": 53,
2427 + "text": "Windows Sysmon - Process Anomalies"
2428 + },
2429 + "windows, system_error": {
2430 + "index": 49,
2431 + "text": "Windows - System Error"
2432 + },
2433 + "windows, windows_application": {
2434 + "index": 31,
2435 + "text": "WinEvtLogs - Application"
2436 + },
2437 + "windows, windows_application, system_error": {
2438 + "index": 59,
2439 + "text": "WinEvtLogs - Application Error"
2440 + },
2441 + "windows, windows_autoruns": {
2442 + "index": 37,
2443 + "text": "Windows Persistent Footholds"
2444 + },
2445 + "windows, windows_defender": {
2446 + "index": 35,
2447 + "text": "Windows Defender"
2448 + },
2449 + "windows, windows_firewall, firewall": {
2450 + "index": 60,
2451 + "text": "Windows - Windows Firewall"
2452 + },
2453 + "windows, windows_logonsessions": {
2454 + "index": 26,
2455 + "text": "Windows Logon Sessions (Snapshot)"
2456 + },
2457 + "windows, windows_powershell": {
2458 + "index": 50,
2459 + "text": "Windows - PowerShell"
2460 + },
2461 + "windows, windows_security": {
2462 + "index": 22,
2463 + "text": "WinEvtLogs - Security"
2464 + },
2465 + "windows, windows_security, authentication_failed": {
2466 + "index": 65,
2467 + "text": "Windows - Failed Authentication"
2468 + },
2469 + "windows, windows_security, authentication_success": {
2470 + "index": 21,
2471 + "text": "Windows - Successful Auths"
2472 + },
2473 + "windows, windows_sigcheck": {
2474 + "index": 42,
2475 + "text": "Windows Exec Analysis"
2476 + },
2477 + "windows, windows_system": {
2478 + "index": 44,
2479 + "text": "WinEvtLogs - System"
2480 + },
2481 + "windows, windows_system, policy_changed": {
2482 + "index": 34,
2483 + "text": "Windows Group Policy"
2484 + },
2485 + "windows, windows_system, system_error": {
2486 + "index": 66,
2487 + "text": "Windows - System Error"
2488 + },
2489 + "yara": {
2490 + "index": 8,
2491 + "text": "Yara Malware Scanner"
2492 + }
2493 + },
2494 + "type": "value"
2495 + }
2496 + ]
2497 + },
2498 + {
2499 + "id": "links",
2500 + "value": [
2501 + {
2502 + "targetBlank": true,
2503 + "title": "VIEW EVENTS",
2504 + "url": "https://grafana.company.local/explore?left=%5B%22now-1h%22,%22now%22,%22SENTINELONE%22,%7B%22refId%22:%22A%22,%22query%22:%22data_groupName:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
2505 + }
2506 + ]
2507 + }
2508 + ]
2509 + },
2510 + {
2511 + "matcher": {
2512 + "id": "byName",
2513 + "options": "Rule Groups"
2514 + },
2515 + "properties": [
2516 + {
2517 + "id": "custom.width",
2518 + "value": 302
2519 + }
2520 + ]
2521 + }
2522 + ]
2523 + },
2524 + "gridPos": {
2525 + "h": 14,
2526 + "w": 6,
2527 + "x": 0,
2528 + "y": 42
2529 + },
2530 + "id": 24,
2531 + "options": {
2532 + "cellHeight": "sm",
2533 + "footer": {
2534 + "countRows": false,
2535 + "fields": "",
2536 + "reducer": [
2537 + "sum"
2538 + ],
2539 + "show": false
2540 + },
2541 + "showHeader": true,
2542 + "sortBy": []
2543 + },
2544 + "pluginVersion": "10.4.2",
2545 + "targets": [
2546 + {
2547 + "bucketAggs": [
2548 + {
2549 + "$$hashKey": "object:332",
2550 + "field": "data_groupName",
2551 + "id": "2",
2552 + "settings": {
2553 + "min_doc_count": 1,
2554 + "order": "desc",
2555 + "orderBy": "_count",
2556 + "size": "0"
2557 + },
2558 + "type": "terms"
2559 + }
2560 + ],
2561 + "datasource": {
2562 + "type": "grafana-opensearch-datasource",
2563 + "uid": "replace_datasource_uid"
2564 + },
2565 + "metrics": [
2566 + {
2567 + "$$hashKey": "object:330",
2568 + "field": "select field",
2569 + "id": "1",
2570 + "meta": {},
2571 + "settings": {},
2572 + "type": "count"
2573 + }
2574 + ],
2575 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
2576 + "refId": "A",
2577 + "timeField": "timestamp"
2578 + }
2579 + ],
2580 + "title": "EVENTS BY GROUP",
2581 + "transformations": [
2582 + {
2583 + "id": "merge",
2584 + "options": {
2585 + "reducers": []
2586 + }
2587 + }
2588 + ],
2589 + "type": "table"
2590 + },
2591 + {
2592 + "datasource": {
2593 + "type": "grafana-opensearch-datasource",
2594 + "uid": "replace_datasource_uid"
2595 + },
2596 + "fieldConfig": {
2597 + "defaults": {
2598 + "color": {
2599 + "mode": "palette-classic"
2600 + },
2601 + "custom": {
2602 + "axisBorderShow": false,
2603 + "axisCenteredZero": false,
2604 + "axisColorMode": "text",
2605 + "axisLabel": "",
2606 + "axisPlacement": "auto",
2607 + "barAlignment": -1,
2608 + "drawStyle": "line",
2609 + "fillOpacity": 0,
2610 + "gradientMode": "none",
2611 + "hideFrom": {
2612 + "legend": false,
2613 + "tooltip": false,
2614 + "viz": false
2615 + },
2616 + "insertNulls": false,
2617 + "lineInterpolation": "linear",
2618 + "lineWidth": 1,
2619 + "pointSize": 5,
2620 + "scaleDistribution": {
2621 + "type": "linear"
2622 + },
2623 + "showPoints": "auto",
2624 + "spanNulls": false,
2625 + "stacking": {
2626 + "group": "A",
2627 + "mode": "normal"
2628 + },
2629 + "thresholdsStyle": {
2630 + "mode": "off"
2631 + }
2632 + },
2633 + "mappings": [],
2634 + "thresholds": {
2635 + "mode": "absolute",
2636 + "steps": [
2637 + {
2638 + "color": "green",
2639 + "value": null
2640 + },
2641 + {
2642 + "color": "red",
2643 + "value": 80
2644 + }
2645 + ]
2646 + }
2647 + },
2648 + "overrides": []
2649 + },
2650 + "gridPos": {
2651 + "h": 14,
2652 + "w": 18,
2653 + "x": 6,
2654 + "y": 42
2655 + },
2656 + "id": 51,
2657 + "options": {
2658 + "legend": {
2659 + "calcs": [],
2660 + "displayMode": "table",
2661 + "placement": "right",
2662 + "showLegend": true
2663 + },
2664 + "tooltip": {
2665 + "mode": "single",
2666 + "sort": "none"
2667 + }
2668 + },
2669 + "targets": [
2670 + {
2671 + "alias": "",
2672 + "bucketAggs": [
2673 + {
2674 + "field": "data_groupName",
2675 + "id": "3",
2676 + "settings": {
2677 + "min_doc_count": "1",
2678 + "order": "desc",
2679 + "orderBy": "_count",
2680 + "size": "10"
2681 + },
2682 + "type": "terms"
2683 + },
2684 + {
2685 + "field": "timestamp",
2686 + "id": "2",
2687 + "settings": {
2688 + "interval": "auto"
2689 + },
2690 + "type": "date_histogram"
2691 + }
2692 + ],
2693 + "datasource": {
2694 + "type": "grafana-opensearch-datasource",
2695 + "uid": "replace_datasource_uid"
2696 + },
2697 + "metrics": [
2698 + {
2699 + "id": "1",
2700 + "type": "count"
2701 + }
2702 + ],
2703 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
2704 + "refId": "A",
2705 + "timeField": "timestamp"
2706 + }
2707 + ],
2708 + "title": "EVENTS BY ALERT GROUP (TOP 10) - HISTOGRAM",
2709 + "transparent": true,
2710 + "type": "timeseries"
2711 + },
2712 + {
2713 + "datasource": {
2714 + "type": "grafana-opensearch-datasource",
2715 + "uid": "replace_datasource_uid"
2716 + },
2717 + "fieldConfig": {
2718 + "defaults": {
2719 + "color": {
2720 + "mode": "thresholds"
2721 + },
2722 + "custom": {
2723 + "align": "auto",
2724 + "cellOptions": {
2725 + "type": "auto"
2726 + },
2727 + "filterable": true,
2728 + "inspect": false
2729 + },
2730 + "mappings": [],
2731 + "thresholds": {
2732 + "mode": "absolute",
2733 + "steps": [
2734 + {
2735 + "color": "green",
2736 + "value": null
2737 + },
2738 + {
2739 + "color": "red",
2740 + "value": 80
2741 + }
2742 + ]
2743 + }
2744 + },
2745 + "overrides": [
2746 + {
2747 + "matcher": {
2748 + "id": "byName",
2749 + "options": "timestamp"
2750 + },
2751 + "properties": [
2752 + {
2753 + "id": "displayName",
2754 + "value": "Date/Time"
2755 + },
2756 + {
2757 + "id": "unit",
2758 + "value": "time: YYYY-MM-DD HH:mm:ss"
2759 + },
2760 + {
2761 + "id": "custom.align"
2762 + }
2763 + ]
2764 + },
2765 + {
2766 + "matcher": {
2767 + "id": "byName",
2768 + "options": "data_computerName"
2769 + },
2770 + "properties": [
2771 + {
2772 + "id": "displayName",
2773 + "value": "AGENT"
2774 + },
2775 + {
2776 + "id": "unit",
2777 + "value": "short"
2778 + },
2779 + {
2780 + "id": "decimals",
2781 + "value": 2
2782 + },
2783 + {
2784 + "id": "custom.align"
2785 + }
2786 + ]
2787 + },
2788 + {
2789 + "matcher": {
2790 + "id": "byName",
2791 + "options": "agent_ip"
2792 + },
2793 + "properties": [
2794 + {
2795 + "id": "displayName",
2796 + "value": "IP ADDRESS"
2797 + },
2798 + {
2799 + "id": "unit",
2800 + "value": "short"
2801 + },
2802 + {
2803 + "id": "decimals",
2804 + "value": 2
2805 + },
2806 + {
2807 + "id": "custom.align"
2808 + }
2809 + ]
2810 + },
2811 + {
2812 + "matcher": {
2813 + "id": "byName",
2814 + "options": "rule_description"
2815 + },
2816 + "properties": [
2817 + {
2818 + "id": "displayName",
2819 + "value": "RULE DESCRIPTION"
2820 + },
2821 + {
2822 + "id": "unit",
2823 + "value": "short"
2824 + },
2825 + {
2826 + "id": "decimals",
2827 + "value": 2
2828 + },
2829 + {
2830 + "id": "custom.align"
2831 + }
2832 + ]
2833 + },
2834 + {
2835 + "matcher": {
2836 + "id": "byName",
2837 + "options": "Date/Time"
2838 + },
2839 + "properties": [
2840 + {
2841 + "id": "custom.width",
2842 + "value": 242
2843 + }
2844 + ]
2845 + },
2846 + {
2847 + "matcher": {
2848 + "id": "byName",
2849 + "options": "AGENT"
2850 + },
2851 + "properties": [
2852 + {
2853 + "id": "custom.width",
2854 + "value": 160
2855 + }
2856 + ]
2857 + },
2858 + {
2859 + "matcher": {
2860 + "id": "byName",
2861 + "options": "MITRE TACTIC"
2862 + },
2863 + "properties": [
2864 + {
2865 + "id": "custom.width",
2866 + "value": 332
2867 + }
2868 + ]
2869 + },
2870 + {
2871 + "matcher": {
2872 + "id": "byName",
2873 + "options": "RULE LEVEL"
2874 + },
2875 + "properties": [
2876 + {
2877 + "id": "custom.width",
2878 + "value": 122
2879 + }
2880 + ]
2881 + },
2882 + {
2883 + "matcher": {
2884 + "id": "byName",
2885 + "options": "IP ADDRESS"
2886 + },
2887 + "properties": [
2888 + {
2889 + "id": "custom.width",
2890 + "value": 163
2891 + }
2892 + ]
2893 + },
2894 + {
2895 + "matcher": {
2896 + "id": "byName",
2897 + "options": "MITRE TECHNIQUE"
2898 + },
2899 + "properties": [
2900 + {
2901 + "id": "custom.width",
2902 + "value": 312
2903 + }
2904 + ]
2905 + },
2906 + {
2907 + "matcher": {
2908 + "id": "byName",
2909 + "options": "rule_id"
2910 + },
2911 + "properties": [
2912 + {
2913 + "id": "custom.width",
2914 + "value": 96
2915 + }
2916 + ]
2917 + },
2918 + {
2919 + "matcher": {
2920 + "id": "byName",
2921 + "options": "EVENT ID"
2922 + },
2923 + "properties": [
2924 + {
2925 + "id": "links",
2926 + "value": [
2927 + {
2928 + "targetBlank": true,
2929 + "title": "VIEW EVENT DETAILS",
2930 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SENTINELONE%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
2931 + }
2932 + ]
2933 + }
2934 + ]
2935 + },
2936 + {
2937 + "matcher": {
2938 + "id": "byName",
2939 + "options": "IP ADD"
2940 + },
2941 + "properties": [
2942 + {
2943 + "id": "custom.width",
2944 + "value": 176
2945 + }
2946 + ]
2947 + },
2948 + {
2949 + "matcher": {
2950 + "id": "byName",
2951 + "options": "EVENT CATEGORY"
2952 + },
2953 + "properties": [
2954 + {
2955 + "id": "custom.width",
2956 + "value": 209
2957 + }
2958 + ]
2959 + },
2960 + {
2961 + "matcher": {
2962 + "id": "byName",
2963 + "options": "USER"
2964 + },
2965 + "properties": [
2966 + {
2967 + "id": "custom.width",
2968 + "value": 218
2969 + }
2970 + ]
2971 + },
2972 + {
2973 + "matcher": {
2974 + "id": "byName",
2975 + "options": "threatClassification"
2976 + },
2977 + "properties": [
2978 + {
2979 + "id": "custom.width",
2980 + "value": 214
2981 + }
2982 + ]
2983 + },
2984 + {
2985 + "matcher": {
2986 + "id": "byName",
2987 + "options": "DESCRIPTION"
2988 + },
2989 + "properties": [
2990 + {
2991 + "id": "custom.width",
2992 + "value": 688
2993 + }
2994 + ]
2995 + }
2996 + ]
2997 + },
2998 + "gridPos": {
2999 + "h": 16,
3000 + "w": 24,
3001 + "x": 0,
3002 + "y": 56
3003 + },
3004 + "id": 27,
3005 + "options": {
3006 + "cellHeight": "sm",
3007 + "footer": {
3008 + "countRows": false,
3009 + "enablePagination": true,
3010 + "fields": "",
3011 + "reducer": [
3012 + "sum"
3013 + ],
3014 + "show": false
3015 + },
3016 + "showHeader": true,
3017 + "sortBy": []
3018 + },
3019 + "pluginVersion": "10.4.2",
3020 + "targets": [
3021 + {
3022 + "bucketAggs": [],
3023 + "datasource": {
3024 + "type": "grafana-opensearch-datasource",
3025 + "uid": "replace_datasource_uid"
3026 + },
3027 + "metrics": [
3028 + {
3029 + "id": "1",
3030 + "settings": {
3031 + "size": "250"
3032 + },
3033 + "type": "raw_data"
3034 + }
3035 + ],
3036 + "query": "eventSeverity:$eventSeverity AND cat:MALWARE",
3037 + "refId": "A",
3038 + "timeField": "timestamp"
3039 + }
3040 + ],
3041 + "title": "EVENTS",
3042 + "transformations": [
3043 + {
3044 + "id": "filterFieldsByName",
3045 + "options": {
3046 + "include": {
3047 + "names": [
3048 + "timestamp",
3049 + "_id",
3050 + "cat",
3051 + "data_computerName",
3052 + "data_username",
3053 + "deviceAddress",
3054 + "deviceAddress_city_name",
3055 + "eventDesc",
3056 + "eventSeverity",
3057 + "fileName",
3058 + "threatClassification",
3059 + "threatConfidenceLevel"
3060 + ]
3061 + }
3062 + }
3063 + },
3064 + {
3065 + "id": "organize",
3066 + "options": {
3067 + "excludeByName": {
3068 + "@metadata_beat": true,
3069 + "@metadata_type": true,
3070 + "@metadata_version": true,
3071 + "IMPHASH": true,
3072 + "MD5": true,
3073 + "SHA1": true,
3074 + "SHA256": true,
3075 + "_id": false,
3076 + "_index": true,
3077 + "_type": true,
3078 + "accountId": true,
3079 + "accountName": true,
3080 + "activityId": true,
3081 + "activityType": true,
3082 + "activityUuid": true,
3083 + "agentId": true,
3084 + "agentUpdatedVersion": true,
3085 + "agent_ephemeral_id": true,
3086 + "agent_hostname": true,
3087 + "agent_id": true,
3088 + "agent_ip_city_name": true,
3089 + "agent_ip_country_code": true,
3090 + "agent_ip_geolocation": true,
3091 + "agent_type": true,
3092 + "agent_version": true,
3093 + "application_name": true,
3094 + "beats_type": true,
3095 + "collector_node_id": true,
3096 + "comments": true,
3097 + "createdAt": true,
3098 + "data_accountName": true,
3099 + "data_alert_action": true,
3100 + "data_alert_category": true,
3101 + "data_alert_gid": true,
3102 + "data_alert_rev": true,
3103 + "data_alert_severity": true,
3104 + "data_alert_signature": true,
3105 + "data_alert_signature_id": true,
3106 + "data_app_proto": true,
3107 + "data_audit_auid": true,
3108 + "data_audit_command": true,
3109 + "data_audit_euid": true,
3110 + "data_audit_exe": true,
3111 + "data_audit_gid": true,
3112 + "data_audit_id": true,
3113 + "data_audit_pid": true,
3114 + "data_audit_res": true,
3115 + "data_audit_session": true,
3116 + "data_audit_type": true,
3117 + "data_audit_uid": true,
3118 + "data_computerName": false,
3119 + "data_confidenceLevel": true,
3120 + "data_createdAt": true,
3121 + "data_description": true,
3122 + "data_dest_ip": true,
3123 + "data_dest_port": true,
3124 + "data_downloadUrl": true,
3125 + "data_dstuser": true,
3126 + "data_event_type": true,
3127 + "data_exclusionType": true,
3128 + "data_extra_data": true,
3129 + "data_file": true,
3130 + "data_fileContentHash": true,
3131 + "data_fileDisplayName": true,
3132 + "data_fileName": true,
3133 + "data_filePath": true,
3134 + "data_flow_bytes_toclient": true,
3135 + "data_flow_bytes_toserver": true,
3136 + "data_flow_id": true,
3137 + "data_flow_pkts_toclient": true,
3138 + "data_flow_pkts_toserver": true,
3139 + "data_flow_start": true,
3140 + "data_fullScopeDetails": true,
3141 + "data_fullScopeDetailsPath": true,
3142 + "data_globalStatus": true,
3143 + "data_groupName": true,
3144 + "data_http_http_content_type": true,
3145 + "data_http_http_port": true,
3146 + "data_http_length": true,
3147 + "data_http_status": true,
3148 + "data_http_url": true,
3149 + "data_id": true,
3150 + "data_in_iface": true,
3151 + "data_majorVersion": true,
3152 + "data_metadata_flowbits": true,
3153 + "data_metadata_flowints_http_anomaly_count": true,
3154 + "data_metadata_flowints_tcp_retransmission_count": true,
3155 + "data_minorVersion": true,
3156 + "data_osArch": true,
3157 + "data_osFamily": true,
3158 + "data_osquery_action": true,
3159 + "data_osquery_calendarTime": true,
3160 + "data_osquery_columns_address": true,
3161 + "data_osquery_columns_address_city_name": true,
3162 + "data_osquery_columns_address_country_code": true,
3163 + "data_osquery_columns_address_geolocation": true,
3164 + "data_osquery_columns_cmdline": true,
3165 + "data_osquery_columns_cwd": true,
3166 + "data_osquery_columns_description": true,
3167 + "data_osquery_columns_directory": true,
3168 + "data_osquery_columns_disk_bytes_read": true,
3169 + "data_osquery_columns_disk_bytes_written": true,
3170 + "data_osquery_columns_egid": true,
3171 + "data_osquery_columns_euid": true,
3172 + "data_osquery_columns_family": true,
3173 + "data_osquery_columns_fd": true,
3174 + "data_osquery_columns_gid": true,
3175 + "data_osquery_columns_gid_signed": true,
3176 + "data_osquery_columns_host": true,
3177 + "data_osquery_columns_interface": true,
3178 + "data_osquery_columns_local_address": true,
3179 + "data_osquery_columns_local_address_city_name": true,
3180 + "data_osquery_columns_local_address_country_code": true,
3181 + "data_osquery_columns_local_address_geolocation": true,
3182 + "data_osquery_columns_local_port": true,
3183 + "data_osquery_columns_mac": true,
3184 + "data_osquery_columns_name": true,
3185 + "data_osquery_columns_net_namespace": true,
3186 + "data_osquery_columns_nice": true,
3187 + "data_osquery_columns_on_disk": true,
3188 + "data_osquery_columns_parent": true,
3189 + "data_osquery_columns_path": true,
3190 + "data_osquery_columns_pgroup": true,
3191 + "data_osquery_columns_pid": true,
3192 + "data_osquery_columns_port": true,
3193 + "data_osquery_columns_protocol": true,
3194 + "data_osquery_columns_remote_address": true,
3195 + "data_osquery_columns_remote_address_city_name": true,
3196 + "data_osquery_columns_remote_address_country_code": true,
3197 + "data_osquery_columns_remote_address_geolocation": true,
3198 + "data_osquery_columns_remote_port": true,
3199 + "data_osquery_columns_resident_size": true,
3200 + "data_osquery_columns_root": true,
3201 + "data_osquery_columns_sgid": true,
3202 + "data_osquery_columns_shell": true,
3203 + "data_osquery_columns_socket": true,
3204 + "data_osquery_columns_start_time": true,
3205 + "data_osquery_columns_state": true,
3206 + "data_osquery_columns_suid": true,
3207 + "data_osquery_columns_system_time": true,
3208 + "data_osquery_columns_threads": true,
3209 + "data_osquery_columns_time_utc": true,
3210 + "data_osquery_columns_total_size": true,
3211 + "data_osquery_columns_tty": true,
3212 + "data_osquery_columns_type": true,
3213 + "data_osquery_columns_uid": true,
3214 + "data_osquery_columns_uid_signed": true,
3215 + "data_osquery_columns_user": true,
3216 + "data_osquery_columns_user_time": true,
3217 + "data_osquery_columns_username": true,
3218 + "data_osquery_columns_wired_size": true,
3219 + "data_osquery_counter": true,
3220 + "data_osquery_decorations_host_uuid": true,
3221 + "data_osquery_decorations_hostname": true,
3222 + "data_osquery_epoch": true,
3223 + "data_osquery_hostIdentifier": true,
3224 + "data_osquery_name": true,
3225 + "data_osquery_numerics": true,
3226 + "data_osquery_unixTime": true,
3227 + "data_packageId": true,
3228 + "data_platformType": true,
3229 + "data_proto": true,
3230 + "data_sca_check_command": true,
3231 + "data_sca_check_compliance_cis": true,
3232 + "data_sca_check_compliance_cis_csc": true,
3233 + "data_sca_check_compliance_gdpr_IV": true,
3234 + "data_sca_check_compliance_gpg_13": true,
3235 + "data_sca_check_compliance_hipaa": true,
3236 + "data_sca_check_compliance_nist_800_53": true,
3237 + "data_sca_check_compliance_pci_dss": true,
3238 + "data_sca_check_compliance_tsc": true,
3239 + "data_sca_check_description": true,
3240 + "data_sca_check_id": true,
3241 + "data_sca_check_previous_result": true,
3242 + "data_sca_check_rationale": true,
3243 + "data_sca_check_remediation": true,
3244 + "data_sca_check_result": true,
3245 + "data_sca_check_title": true,
3246 + "data_sca_description": true,
3247 + "data_sca_failed": true,
3248 + "data_sca_file": true,
3249 + "data_sca_invalid": true,
3250 + "data_sca_passed": true,
3251 + "data_sca_policy": true,
3252 + "data_sca_policy_id": true,
3253 + "data_sca_scan_id": true,
3254 + "data_sca_score": true,
3255 + "data_sca_total_checks": true,
3256 + "data_sca_type": true,
3257 + "data_scanType": true,
3258 + "data_scopeLevel": true,
3259 + "data_scopeName": true,
3260 + "data_script": true,
3261 + "data_secured": true,
3262 + "data_siteName": true,
3263 + "data_src_ip": true,
3264 + "data_src_ip_city_name": true,
3265 + "data_src_ip_country_code": true,
3266 + "data_src_ip_geolocation": true,
3267 + "data_src_port": true,
3268 + "data_srcip": true,
3269 + "data_srcip_city_name": true,
3270 + "data_srcip_country_code": true,
3271 + "data_srcip_geolocation": true,
3272 + "data_srcuser": true,
3273 + "data_status": true,
3274 + "data_threatClassification": true,
3275 + "data_timestamp": true,
3276 + "data_title": true,
3277 + "data_tls_session_resumed": true,
3278 + "data_tls_version": true,
3279 + "data_totalNewDevices": true,
3280 + "data_tx_id": true,
3281 + "data_type": true,
3282 + "data_unknown": true,
3283 + "data_unsecured": true,
3284 + "data_unsupported": true,
3285 + "data_value": true,
3286 + "data_version": true,
3287 + "data_version_city_name": true,
3288 + "data_version_country_code": true,
3289 + "data_version_geolocation": true,
3290 + "data_win_eventXML_binaryData": true,
3291 + "data_win_eventXML_binaryDataSize": true,
3292 + "data_win_eventXML_param1": true,
3293 + "data_win_eventdata_authenticationPackageName": true,
3294 + "data_win_eventdata_callTrace": true,
3295 + "data_win_eventdata_commandLine": true,
3296 + "data_win_eventdata_company": true,
3297 + "data_win_eventdata_creationUtcTime": true,
3298 + "data_win_eventdata_currentDirectory": true,
3299 + "data_win_eventdata_description": true,
3300 + "data_win_eventdata_destinationHostname": true,
3301 + "data_win_eventdata_destinationIp": true,
3302 + "data_win_eventdata_destinationIp_city_name": true,
3303 + "data_win_eventdata_destinationIp_country_code": true,
3304 + "data_win_eventdata_destinationIp_geolocation": true,
3305 + "data_win_eventdata_destinationIsIpv6": true,
3306 + "data_win_eventdata_destinationPort": true,
3307 + "data_win_eventdata_destinationPortName": true,
3308 + "data_win_eventdata_details": true,
3309 + "data_win_eventdata_elevatedToken": true,
3310 + "data_win_eventdata_eventType": true,
3311 + "data_win_eventdata_fileVersion": true,
3312 + "data_win_eventdata_fileVersion_city_name": true,
3313 + "data_win_eventdata_fileVersion_country_code": true,
3314 + "data_win_eventdata_fileVersion_geolocation": true,
3315 + "data_win_eventdata_grantedAccess": true,
3316 + "data_win_eventdata_hashes": true,
3317 + "data_win_eventdata_image": true,
3318 + "data_win_eventdata_imageLoaded": true,
3319 + "data_win_eventdata_impersonationLevel": true,
3320 + "data_win_eventdata_initiated": true,
3321 + "data_win_eventdata_integrityLevel": true,
3322 + "data_win_eventdata_ipAddress": true,
3323 + "data_win_eventdata_ipPort": true,
3324 + "data_win_eventdata_keyLength": true,
3325 + "data_win_eventdata_logonGuid": true,
3326 + "data_win_eventdata_logonId": true,
3327 + "data_win_eventdata_logonProcessName": true,
3328 + "data_win_eventdata_logonType": true,
3329 + "data_win_eventdata_originalFileName": true,
3330 + "data_win_eventdata_param1": true,
3331 + "data_win_eventdata_param2": true,
3332 + "data_win_eventdata_param3": true,
3333 + "data_win_eventdata_param4": true,
3334 + "data_win_eventdata_parentCommandLine": true,
3335 + "data_win_eventdata_parentImage": true,
3336 + "data_win_eventdata_parentProcessGuid": true,
3337 + "data_win_eventdata_parentProcessId": true,
3338 + "data_win_eventdata_processGuid": true,
3339 + "data_win_eventdata_processId": true,
3340 + "data_win_eventdata_processName": true,
3341 + "data_win_eventdata_product": true,
3342 + "data_win_eventdata_protocol": true,
3343 + "data_win_eventdata_queryName": true,
3344 + "data_win_eventdata_queryResults": true,
3345 + "data_win_eventdata_queryStatus": true,
3346 + "data_win_eventdata_ruleName": true,
3347 + "data_win_eventdata_serviceName": true,
3348 + "data_win_eventdata_serviceSid": true,
3349 + "data_win_eventdata_signature": true,
3350 + "data_win_eventdata_signatureStatus": true,
3351 + "data_win_eventdata_signed": true,
3352 + "data_win_eventdata_sourceHostname": true,
3353 + "data_win_eventdata_sourceImage": true,
3354 + "data_win_eventdata_sourceIp": true,
3355 + "data_win_eventdata_sourceIp_city_name": true,
3356 + "data_win_eventdata_sourceIp_country_code": true,
3357 + "data_win_eventdata_sourceIp_geolocation": true,
3358 + "data_win_eventdata_sourceIsIpv6": true,
3359 + "data_win_eventdata_sourcePort": true,
3360 + "data_win_eventdata_sourceProcessGUID": true,
3361 + "data_win_eventdata_sourceProcessId": true,
3362 + "data_win_eventdata_sourceThreadId": true,
3363 + "data_win_eventdata_status": true,
3364 + "data_win_eventdata_subjectDomainName": true,
3365 + "data_win_eventdata_subjectLogonId": true,
3366 + "data_win_eventdata_subjectUserName": true,
3367 + "data_win_eventdata_subjectUserSid": true,
3368 + "data_win_eventdata_targetDomainName": true,
3369 + "data_win_eventdata_targetFilename": true,
3370 + "data_win_eventdata_targetImage": true,
3371 + "data_win_eventdata_targetLinkedLogonId": true,
3372 + "data_win_eventdata_targetLogonId": true,
3373 + "data_win_eventdata_targetObject": true,
3374 + "data_win_eventdata_targetProcessGUID": true,
3375 + "data_win_eventdata_targetProcessId": true,
3376 + "data_win_eventdata_targetUserName": true,
3377 + "data_win_eventdata_targetUserSid": true,
3378 + "data_win_eventdata_terminalSessionId": true,
3379 + "data_win_eventdata_ticketEncryptionType": true,
3380 + "data_win_eventdata_ticketOptions": true,
3381 + "data_win_eventdata_user": true,
3382 + "data_win_eventdata_utcTime": true,
3383 + "data_win_eventdata_virtualAccount": true,
3384 + "data_win_system_channel": true,
3385 + "data_win_system_computer": true,
3386 + "data_win_system_eventID": true,
3387 + "data_win_system_eventRecordID": true,
3388 + "data_win_system_eventSourceName": true,
3389 + "data_win_system_keywords": true,
3390 + "data_win_system_level": true,
3391 + "data_win_system_message": true,
3392 + "data_win_system_opcode": true,
3393 + "data_win_system_processID": true,
3394 + "data_win_system_providerGuid": true,
3395 + "data_win_system_providerName": true,
3396 + "data_win_system_severityValue": true,
3397 + "data_win_system_systemTime": true,
3398 + "data_win_system_task": true,
3399 + "data_win_system_threadID": true,
3400 + "data_win_system_version": true,
3401 + "decoder_name": true,
3402 + "decoder_parent": true,
3403 + "description": true,
3404 + "deviceAddress_city_name": true,
3405 + "deviceAddress_country_code": true,
3406 + "deviceAddress_geolocation": true,
3407 + "deviceHostFqdn": true,
3408 + "deviceHostName": true,
3409 + "dns_query": true,
3410 + "dns_query_threat_indicated": true,
3411 + "dst_ip": true,
3412 + "dst_ip_city_name": true,
3413 + "dst_ip_country_code": true,
3414 + "dst_ip_geolocation": true,
3415 + "dst_ip_threat_indicated": true,
3416 + "dst_port": true,
3417 + "ecs_version": true,
3418 + "error": true,
3419 + "eventID": true,
3420 + "event_hash": true,
3421 + "facility": true,
3422 + "facility_num": true,
3423 + "fileHashMd5": true,
3424 + "fileHashSha256": true,
3425 + "fileName": false,
3426 + "file_path": true,
3427 + "firewall_rule_name": true,
3428 + "full_log": false,
3429 + "gl2_accounted_message_size": true,
3430 + "gl2_message_id": true,
3431 + "gl2_remote_ip": true,
3432 + "gl2_remote_port": true,
3433 + "gl2_source_collector": true,
3434 + "gl2_source_input": true,
3435 + "gl2_source_node": true,
3436 + "groupId": true,
3437 + "groupName": true,
3438 + "hash": true,
3439 + "hash_md5": true,
3440 + "hash_sha1": true,
3441 + "hash_sha256": true,
3442 + "highlight": true,
3443 + "host_architecture": true,
3444 + "host_containerized": true,
3445 + "host_hostname": true,
3446 + "host_id": true,
3447 + "host_ip": true,
3448 + "host_mac": true,
3449 + "host_name": true,
3450 + "host_os_codename": true,
3451 + "host_os_kernel": true,
3452 + "host_os_name": true,
3453 + "host_os_platform": true,
3454 + "host_os_version": true,
3455 + "hostname": true,
3456 + "id": true,
3457 + "input_type": true,
3458 + "ip": true,
3459 + "ip_city_name": true,
3460 + "ip_country_code": true,
3461 + "ip_geolocation": true,
3462 + "level": true,
3463 + "location": true,
3464 + "log_file_path": true,
3465 + "log_offset": true,
3466 + "manager_name": true,
3467 + "message": true,
3468 + "module": true,
3469 + "notificationScope": true,
3470 + "originatorName": true,
3471 + "originatorVersion": true,
3472 + "originatorVersion_city_name": true,
3473 + "originatorVersion_country_code": true,
3474 + "originatorVersion_geolocation": true,
3475 + "osFamily": true,
3476 + "parent_process_cmd_line": true,
3477 + "parent_process_id": true,
3478 + "parent_process_image": true,
3479 + "pid": true,
3480 + "predecoder_hostname": true,
3481 + "predecoder_program_name": true,
3482 + "predecoder_timestamp": true,
3483 + "previous_log": true,
3484 + "previous_output": true,
3485 + "process_cmd_line": true,
3486 + "process_id": true,
3487 + "process_image": true,
3488 + "process_name": true,
3489 + "protocol": true,
3490 + "rt": true,
3491 + "rule_cis": true,
3492 + "rule_cis_csc": true,
3493 + "rule_firedtimes": true,
3494 + "rule_gdpr": true,
3495 + "rule_gdpr_IV": true,
3496 + "rule_gpg13": true,
3497 + "rule_gpg_13": true,
3498 + "rule_hipaa": true,
3499 + "rule_id": false,
3500 + "rule_info": true,
3501 + "rule_mail": true,
3502 + "rule_mitre_id": true,
3503 + "rule_mitre_tactic": false,
3504 + "rule_nist_800_53": true,
3505 + "rule_pci_dss": true,
3506 + "rule_tsc": true,
3507 + "scanType": true,
3508 + "scanid": true,
3509 + "secondaryDescription": true,
3510 + "secured": true,
3511 + "service": true,
3512 + "siteId": true,
3513 + "siteName": true,
3514 + "software_package": true,
3515 + "software_vendor": true,
3516 + "sort": true,
3517 + "source": true,
3518 + "sourceAgentId": true,
3519 + "sourceAgentUuid": true,
3520 + "sourceDnsDomain": true,
3521 + "sourceFqdn": true,
3522 + "sourceGroupId": true,
3523 + "sourceGroupName": true,
3524 + "sourceHostName": true,
3525 + "sourceIpAddresses_0": true,
3526 + "sourceIpAddresses_1": true,
3527 + "sourceIpAddresses_1_city_name": true,
3528 + "sourceIpAddresses_1_country_code": true,
3529 + "sourceIpAddresses_1_geolocation": true,
3530 + "sourceIpAddresses_2": true,
3531 + "sourceIpAddresses_2_city_name": true,
3532 + "sourceIpAddresses_2_country_code": true,
3533 + "sourceIpAddresses_2_geolocation": true,
3534 + "sourceIpAddresses_3": true,
3535 + "sourceIpAddresses_3_city_name": true,
3536 + "sourceIpAddresses_3_country_code": true,
3537 + "sourceIpAddresses_3_geolocation": true,
3538 + "sourceIpAddresses_4": true,
3539 + "sourceIpAddresses_4_city_name": true,
3540 + "sourceIpAddresses_4_country_code": true,
3541 + "sourceIpAddresses_4_geolocation": true,
3542 + "sourceIpAddresses_5": true,
3543 + "sourceMacAddresses_0": true,
3544 + "sourceMacAddresses_1": true,
3545 + "sourceMgmtPrecievedAddress": true,
3546 + "sourceMgmtPrecievedAddress_city_name": true,
3547 + "sourceMgmtPrecievedAddress_country_code": true,
3548 + "sourceMgmtPrecievedAddress_geolocation": true,
3549 + "sourceNetworkState": true,
3550 + "sourceOsRevision": true,
3551 + "sourceOsType": true,
3552 + "sourceThreatCount": true,
3553 + "sourceUserId": true,
3554 + "sourceUserName": true,
3555 + "source_city_name": true,
3556 + "source_country_code": true,
3557 + "source_geolocation": true,
3558 + "src_ip": true,
3559 + "src_ip_city_name": true,
3560 + "src_ip_country_code": true,
3561 + "src_ip_geolocation": true,
3562 + "src_port": true,
3563 + "streams": true,
3564 + "syscheck_attrs_after": true,
3565 + "syscheck_audit_effective_user_id": true,
3566 + "syscheck_audit_effective_user_name": true,
3567 + "syscheck_audit_group_id": true,
3568 + "syscheck_audit_group_name": true,
3569 + "syscheck_audit_login_user_id": true,
3570 + "syscheck_audit_login_user_name": true,
3571 + "syscheck_audit_process_cwd": true,
3572 + "syscheck_audit_process_id": true,
3573 + "syscheck_audit_process_name": true,
3574 + "syscheck_audit_process_parent_cwd": true,
3575 + "syscheck_audit_process_parent_name": true,
3576 + "syscheck_audit_process_ppid": true,
3577 + "syscheck_audit_user_id": true,
3578 + "syscheck_audit_user_name": true,
3579 + "syscheck_changed_attributes": true,
3580 + "syscheck_event": true,
3581 + "syscheck_gid_after": true,
3582 + "syscheck_gname_after": true,
3583 + "syscheck_hard_links": true,
3584 + "syscheck_inode_after": true,
3585 + "syscheck_inode_before": true,
3586 + "syscheck_md5_after": true,
3587 + "syscheck_md5_before": true,
3588 + "syscheck_mode": true,
3589 + "syscheck_mtime_after": true,
3590 + "syscheck_mtime_before": true,
3591 + "syscheck_path": true,
3592 + "syscheck_perm_after": true,
3593 + "syscheck_perm_before": true,
3594 + "syscheck_sha1_after": true,
3595 + "syscheck_sha1_before": true,
3596 + "syscheck_sha256_after": true,
3597 + "syscheck_sha256_before": true,
3598 + "syscheck_size_after": true,
3599 + "syscheck_size_before": true,
3600 + "syscheck_uid_after": true,
3601 + "syscheck_uname_after": true,
3602 + "syscheck_win_perm_after": true,
3603 + "syscheck_win_perm_after_0_allowed": true,
3604 + "syscheck_win_perm_after_0_name": true,
3605 + "syscheck_win_perm_after_1_allowed": true,
3606 + "syscheck_win_perm_after_1_name": true,
3607 + "syscheck_win_perm_after_2_allowed": true,
3608 + "syscheck_win_perm_after_2_name": true,
3609 + "syscheck_win_perm_after_3_allowed": true,
3610 + "syscheck_win_perm_after_3_name": true,
3611 + "syslog_customer": true,
3612 + "syslog_tag": true,
3613 + "syslog_type": true,
3614 + "sysmon_event_description": true,
3615 + "threatClassification": false,
3616 + "threatClassificationSource": true,
3617 + "threatClassifier": true,
3618 + "threatCommandLineArguments": true,
3619 + "threatConfidenceLevel": false,
3620 + "threatDetectingEngine": true,
3621 + "threatDetectionTime": true,
3622 + "threatID": true,
3623 + "threatId": true,
3624 + "threatIndicatorsList_0": true,
3625 + "threatIndicatorsList_1": true,
3626 + "threatIndicatorsList_10": true,
3627 + "threatIndicatorsList_11": true,
3628 + "threatIndicatorsList_12": true,
3629 + "threatIndicatorsList_13": true,
3630 + "threatIndicatorsList_14": true,
3631 + "threatIndicatorsList_15": true,
3632 + "threatIndicatorsList_16": true,
3633 + "threatIndicatorsList_17": true,
3634 + "threatIndicatorsList_18": true,
3635 + "threatIndicatorsList_19": true,
3636 + "threatIndicatorsList_2": true,
3637 + "threatIndicatorsList_20": true,
3638 + "threatIndicatorsList_21": true,
3639 + "threatIndicatorsList_22": true,
3640 + "threatIndicatorsList_23": true,
3641 + "threatIndicatorsList_24": true,
3642 + "threatIndicatorsList_25": true,
3643 + "threatIndicatorsList_26": true,
3644 + "threatIndicatorsList_27": true,
3645 + "threatIndicatorsList_28": true,
3646 + "threatIndicatorsList_29": true,
3647 + "threatIndicatorsList_3": true,
3648 + "threatIndicatorsList_30": true,
3649 + "threatIndicatorsList_31": true,
3650 + "threatIndicatorsList_32": true,
3651 + "threatIndicatorsList_33": true,
3652 + "threatIndicatorsList_34": true,
3653 + "threatIndicatorsList_35": true,
3654 + "threatIndicatorsList_36": true,
3655 + "threatIndicatorsList_37": true,
3656 + "threatIndicatorsList_38": true,
3657 + "threatIndicatorsList_39": true,
3658 + "threatIndicatorsList_4": true,
3659 + "threatIndicatorsList_40": true,
3660 + "threatIndicatorsList_41": true,
3661 + "threatIndicatorsList_42": true,
3662 + "threatIndicatorsList_43": true,
3663 + "threatIndicatorsList_44": true,
3664 + "threatIndicatorsList_45": true,
3665 + "threatIndicatorsList_46": true,
3666 + "threatIndicatorsList_47": true,
3667 + "threatIndicatorsList_48": true,
3668 + "threatIndicatorsList_49": true,
3669 + "threatIndicatorsList_5": true,
3670 + "threatIndicatorsList_50": true,
3671 + "threatIndicatorsList_51": true,
3672 + "threatIndicatorsList_52": true,
3673 + "threatIndicatorsList_53": true,
3674 + "threatIndicatorsList_54": true,
3675 + "threatIndicatorsList_55": true,
3676 + "threatIndicatorsList_56": true,
3677 + "threatIndicatorsList_6": true,
3678 + "threatIndicatorsList_7": true,
3679 + "threatIndicatorsList_8": true,
3680 + "threatIndicatorsList_9": true,
3681 + "threatMitigationStatus": true,
3682 + "threatMitigationStatusID": true,
3683 + "threatProcessUser": true,
3684 + "threatStoryline": true,
3685 + "threat_ids": true,
3686 + "threat_indicated": true,
3687 + "threat_names": true,
3688 + "time": true,
3689 + "timestamp": false,
3690 + "totalNewDevices": true,
3691 + "unknown": true,
3692 + "unsecured": true,
3693 + "unsupported": true,
3694 + "updatedAt": true,
3695 + "userId": true,
3696 + "user_name": true,
3697 + "vendor": true,
3698 + "win_registry_key": true,
3699 + "win_system_eventID": true,
3700 + "windows_auth_package": true,
3701 + "windows_domain": true,
3702 + "windows_event_id": true,
3703 + "windows_event_severity": true,
3704 + "windows_logon_type": true
3705 + },
3706 + "indexByName": {
3707 + "_id": 1,
3708 + "_index": 5,
3709 + "_type": 6,
3710 + "accountId": 7,
3711 + "accountName": 8,
3712 + "activityId": 9,
3713 + "activityType": 10,
3714 + "activityUuid": 11,
3715 + "agentId": 12,
3716 + "agentUpdatedVersion": 13,
3717 + "application_name": 14,
3718 + "cat": 15,
3719 + "comments": 16,
3720 + "createdAt": 17,
3721 + "data_accountName": 18,
3722 + "data_computerName": 2,
3723 + "data_confidenceLevel": 19,
3724 + "data_downloadUrl": 20,
3725 + "data_fileContentHash": 21,
3726 + "data_fileDisplayName": 22,
3727 + "data_filePath": 23,
3728 + "data_fullScopeDetails": 24,
3729 + "data_fullScopeDetailsPath": 25,
3730 + "data_globalStatus": 26,
3731 + "data_groupName": 27,
3732 + "data_scopeLevel": 28,
3733 + "data_scopeName": 29,
3734 + "data_siteName": 30,
3735 + "data_threatClassification": 31,
3736 + "data_username": 32,
3737 + "description": 33,
3738 + "deviceAddress": 3,
3739 + "deviceAddress_city_name": 34,
3740 + "deviceAddress_country_code": 35,
3741 + "deviceAddress_geolocation": 36,
3742 + "deviceHostFqdn": 37,
3743 + "deviceHostName": 38,
3744 + "eventDesc": 39,
3745 + "eventID": 40,
3746 + "eventSeverity": 4,
3747 + "facility": 41,
3748 + "facility_num": 42,
3749 + "fileHashMd5": 43,
3750 + "fileHashSha256": 44,
3751 + "fileName": 45,
3752 + "gl2_accounted_message_size": 46,
3753 + "gl2_message_id": 47,
3754 + "gl2_remote_ip": 48,
3755 + "gl2_remote_port": 49,
3756 + "gl2_source_input": 50,
3757 + "gl2_source_node": 51,
3758 + "groupId": 52,
3759 + "groupName": 53,
3760 + "hash": 54,
3761 + "highlight": 55,
3762 + "level": 56,
3763 + "message": 57,
3764 + "notificationScope": 58,
3765 + "originatorName": 59,
3766 + "originatorVersion": 60,
3767 + "osFamily": 61,
3768 + "process_id": 62,
3769 + "rt": 63,
3770 + "secondaryDescription": 64,
3771 + "siteId": 65,
3772 + "siteName": 66,
3773 + "sort": 67,
3774 + "source": 68,
3775 + "sourceAgentId": 69,
3776 + "sourceAgentUuid": 70,
3777 + "sourceDnsDomain": 71,
3778 + "sourceFqdn": 72,
3779 + "sourceGroupId": 73,
3780 + "sourceGroupName": 74,
3781 + "sourceHostName": 75,
3782 + "sourceIpAddresses_0": 76,
3783 + "sourceIpAddresses_1": 77,
3784 + "sourceMacAddresses_0": 78,
3785 + "sourceMacAddresses_1": 79,
3786 + "sourceMgmtPrecievedAddress": 80,
3787 + "sourceMgmtPrecievedAddress_city_name": 81,
3788 + "sourceMgmtPrecievedAddress_country_code": 82,
3789 + "sourceMgmtPrecievedAddress_geolocation": 83,
3790 + "sourceNetworkState": 84,
3791 + "sourceOsRevision": 85,
3792 + "sourceOsType": 86,
3793 + "sourceThreatCount": 87,
3794 + "source_city_name": 88,
3795 + "source_country_code": 89,
3796 + "source_geolocation": 90,
3797 + "streams": 91,
3798 + "syslog_customer": 92,
3799 + "syslog_type": 93,
3800 + "threatClassification": 94,
3801 + "threatClassificationSource": 95,
3802 + "threatClassifier": 96,
3803 + "threatCommandLineArguments": 97,
3804 + "threatConfidenceLevel": 98,
3805 + "threatDetectingEngine": 99,
3806 + "threatDetectionTime": 100,
3807 + "threatID": 101,
3808 + "threatId": 102,
3809 + "threatMitigationStatus": 103,
3810 + "threatMitigationStatusID": 104,
3811 + "threatProcessUser": 105,
3812 + "threatStoryline": 106,
3813 + "timestamp": 0,
3814 + "updatedAt": 107,
3815 + "userId": 108,
3816 + "vendor": 109
3817 + },
3818 + "renameByName": {
3819 + "_id": "EVENT ID",
3820 + "cat": "EVENT CATEGORY",
3821 + "data_computerName": "AGENT",
3822 + "data_username": "USER",
3823 + "deviceAddress": "IP ADD",
3824 + "eventDesc": "DESCRIPTION",
3825 + "eventSeverity": "SEVERITY",
3826 + "rule_id": "RULE ID",
3827 + "rule_mitre_tactic": "MITRE TACTIC",
3828 + "rule_mitre_technique": "MITRE TECHNIQUE",
3829 + "timestamp": "DATE/TIME"
3830 + }
3831 + }
3832 + }
3833 + ],
3834 + "transparent": true,
3835 + "type": "table"
3836 + }
3837 + ],
3838 + "refresh": "",
3839 + "schemaVersion": 39,
3840 + "tags": [
3841 + "EDR"
3842 + ],
3843 + "templating": {
3844 + "list": [
3845 + {
3846 + "datasource": {
3847 + "type": "grafana-opensearch-datasource",
3848 + "uid": "replace_datasource_uid"
3849 + },
3850 + "filters": [],
3851 + "hide": 0,
3852 + "label": "",
3853 + "name": "Filters",
3854 + "skipUrlSync": false,
3855 + "type": "adhoc"
3856 + },
3857 + {
3858 + "current": {
3859 + "selected": false,
3860 + "text": "All",
3861 + "value": "$__all"
3862 + },
3863 + "datasource": {
3864 + "type": "grafana-opensearch-datasource",
3865 + "uid": "replace_datasource_uid"
3866 + },
3867 + "definition": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:MALWARE\"}",
3868 + "hide": 0,
3869 + "includeAll": true,
3870 + "label": "Event Severity",
3871 + "multi": false,
3872 + "name": "eventSeverity",
3873 + "options": [],
3874 + "query": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:MALWARE\"}",
3875 + "refresh": 2,
3876 + "regex": "",
3877 + "skipUrlSync": false,
3878 + "sort": 0,
3879 + "type": "query"
3880 + }
3881 + ]
3882 + },
3883 + "time": {
3884 + "from": "now-30d",
3885 + "to": "now"
3886 + },
3887 + "timepicker": {
3888 + "refresh_intervals": [
3889 + "5s",
3890 + "10s",
3891 + "30s",
3892 + "1m",
3893 + "5m",
3894 + "15m",
3895 + "30m",
3896 + "1h",
3897 + "2h",
3898 + "1d"
3899 + ],
3900 + "time_options": [
3901 + "5m",
3902 + "15m",
3903 + "1h",
3904 + "6h",
3905 + "12h",
3906 + "24h",
3907 + "2d",
3908 + "7d",
3909 + "30d"
3910 + ]
3911 + },
3912 + "timezone": "",
3913 + "title": "EDR - SENTINELONE EPP - MALWARE",
3914 + "weekStart": ""
3915 +}
backend/app/connectors/grafana/dashboards/Sentinelone/sentinelone_epp_mitigation.json new
+3915
@@ -0,0 +1,3915 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "EDR"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "grafana-opensearch-datasource",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "color": {
52 + "mode": "palette-classic"
53 + },
54 + "custom": {
55 + "hideFrom": {
56 + "legend": false,
57 + "tooltip": false,
58 + "viz": false
59 + }
60 + },
61 + "mappings": [
62 + {
63 + "options": {
64 + "match": "null",
65 + "result": {
66 + "text": "N/A"
67 + }
68 + },
69 + "type": "special"
70 + }
71 + ],
72 + "max": 15,
73 + "min": 0,
74 + "unit": "none"
75 + },
76 + "overrides": []
77 + },
78 + "gridPos": {
79 + "h": 7,
80 + "w": 4,
81 + "x": 0,
82 + "y": 0
83 + },
84 + "id": 16,
85 + "options": {
86 + "legend": {
87 + "displayMode": "table",
88 + "placement": "right",
89 + "showLegend": true
90 + },
91 + "pieType": "donut",
92 + "reduceOptions": {
93 + "calcs": [
94 + "sum"
95 + ],
96 + "fields": "",
97 + "values": false
98 + },
99 + "tooltip": {
100 + "mode": "single",
101 + "sort": "none"
102 + }
103 + },
104 + "pluginVersion": "9.2.0",
105 + "targets": [
106 + {
107 + "bucketAggs": [
108 + {
109 + "field": "data_threatClassification",
110 + "id": "3",
111 + "settings": {
112 + "min_doc_count": "1",
113 + "order": "desc",
114 + "orderBy": "_term",
115 + "size": "10"
116 + },
117 + "type": "terms"
118 + },
119 + {
120 + "field": "timestamp",
121 + "id": "2",
122 + "settings": {
123 + "interval": "auto",
124 + "min_doc_count": 0,
125 + "trimEdges": 0
126 + },
127 + "type": "date_histogram"
128 + }
129 + ],
130 + "datasource": {
131 + "type": "grafana-opensearch-datasource",
132 + "uid": "replace_datasource_uid"
133 + },
134 + "metrics": [
135 + {
136 + "id": "1",
137 + "type": "count"
138 + }
139 + ],
140 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
141 + "refId": "A",
142 + "timeField": "timestamp"
143 + }
144 + ],
145 + "title": "THREATS CLASSIFICATION",
146 + "type": "piechart"
147 + },
148 + {
149 + "datasource": {
150 + "type": "grafana-opensearch-datasource",
151 + "uid": "replace_datasource_uid"
152 + },
153 + "fieldConfig": {
154 + "defaults": {
155 + "color": {
156 + "mode": "thresholds"
157 + },
158 + "custom": {
159 + "align": "auto",
160 + "cellOptions": {
161 + "type": "auto"
162 + },
163 + "inspect": false
164 + },
165 + "mappings": [],
166 + "thresholds": {
167 + "mode": "absolute",
168 + "steps": [
169 + {
170 + "color": "orange",
171 + "value": null
172 + }
173 + ]
174 + }
175 + },
176 + "overrides": [
177 + {
178 + "matcher": {
179 + "id": "byName",
180 + "options": "Time"
181 + },
182 + "properties": [
183 + {
184 + "id": "displayName",
185 + "value": "Time"
186 + },
187 + {
188 + "id": "unit",
189 + "value": "time: YYYY-MM-DD HH:mm:ss"
190 + },
191 + {
192 + "id": "custom.align"
193 + }
194 + ]
195 + },
196 + {
197 + "matcher": {
198 + "id": "byName",
199 + "options": "Count"
200 + },
201 + "properties": [
202 + {
203 + "id": "displayName",
204 + "value": "EVENTS"
205 + },
206 + {
207 + "id": "unit",
208 + "value": "short"
209 + },
210 + {
211 + "id": "decimals",
212 + "value": -1
213 + },
214 + {
215 + "id": "custom.cellOptions",
216 + "value": {
217 + "type": "color-background"
218 + }
219 + },
220 + {
221 + "id": "custom.align"
222 + },
223 + {
224 + "id": "thresholds",
225 + "value": {
226 + "mode": "absolute",
227 + "steps": [
228 + {
229 + "color": "dark-orange",
230 + "value": null
231 + }
232 + ]
233 + }
234 + }
235 + ]
236 + },
237 + {
238 + "matcher": {
239 + "id": "byName",
240 + "options": "data_groupName"
241 + },
242 + "properties": [
243 + {
244 + "id": "displayName",
245 + "value": "ALERTS BY TYPE"
246 + },
247 + {
248 + "id": "unit",
249 + "value": "short"
250 + },
251 + {
252 + "id": "decimals",
253 + "value": -1
254 + },
255 + {
256 + "id": "custom.cellOptions",
257 + "value": {
258 + "type": "color-background"
259 + }
260 + },
261 + {
262 + "id": "custom.align"
263 + }
264 + ]
265 + }
266 + ]
267 + },
268 + "gridPos": {
269 + "h": 7,
270 + "w": 7,
271 + "x": 4,
272 + "y": 0
273 + },
274 + "id": 57,
275 + "options": {
276 + "cellHeight": "sm",
277 + "footer": {
278 + "countRows": false,
279 + "fields": "",
280 + "reducer": [
281 + "sum"
282 + ],
283 + "show": false
284 + },
285 + "showHeader": true
286 + },
287 + "pluginVersion": "10.4.2",
288 + "targets": [
289 + {
290 + "bucketAggs": [
291 + {
292 + "fake": true,
293 + "field": "data_group",
294 + "id": "4",
295 + "settings": {
296 + "min_doc_count": 1,
297 + "order": "desc",
298 + "orderBy": "_count",
299 + "size": "0"
300 + },
301 + "type": "terms"
302 + }
303 + ],
304 + "datasource": {
305 + "type": "grafana-opensearch-datasource",
306 + "uid": "replace_datasource_uid"
307 + },
308 + "metrics": [
309 + {
310 + "field": "select field",
311 + "id": "1",
312 + "type": "count"
313 + }
314 + ],
315 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
316 + "refId": "A",
317 + "timeField": "timestamp"
318 + }
319 + ],
320 + "title": "ALERTS BY POLICY GROUP",
321 + "transformations": [
322 + {
323 + "id": "organize",
324 + "options": {
325 + "excludeByName": {},
326 + "indexByName": {},
327 + "renameByName": {
328 + "data_group": "GROUP"
329 + }
330 + }
331 + }
332 + ],
333 + "type": "table"
334 + },
335 + {
336 + "datasource": {
337 + "type": "grafana-opensearch-datasource",
338 + "uid": "replace_datasource_uid"
339 + },
340 + "fieldConfig": {
341 + "defaults": {
342 + "color": {
343 + "mode": "thresholds"
344 + },
345 + "custom": {
346 + "align": "auto",
347 + "cellOptions": {
348 + "type": "auto"
349 + },
350 + "inspect": false
351 + },
352 + "mappings": [],
353 + "thresholds": {
354 + "mode": "absolute",
355 + "steps": [
356 + {
357 + "color": "orange",
358 + "value": null
359 + }
360 + ]
361 + }
362 + },
363 + "overrides": [
364 + {
365 + "matcher": {
366 + "id": "byName",
367 + "options": "Time"
368 + },
369 + "properties": [
370 + {
371 + "id": "displayName",
372 + "value": "Time"
373 + },
374 + {
375 + "id": "unit",
376 + "value": "time: YYYY-MM-DD HH:mm:ss"
377 + },
378 + {
379 + "id": "custom.align"
380 + }
381 + ]
382 + },
383 + {
384 + "matcher": {
385 + "id": "byName",
386 + "options": "Count"
387 + },
388 + "properties": [
389 + {
390 + "id": "displayName",
391 + "value": "EVENTS"
392 + },
393 + {
394 + "id": "unit",
395 + "value": "short"
396 + },
397 + {
398 + "id": "decimals",
399 + "value": -1
400 + },
401 + {
402 + "id": "custom.cellOptions",
403 + "value": {
404 + "type": "color-background"
405 + }
406 + },
407 + {
408 + "id": "custom.align"
409 + },
410 + {
411 + "id": "thresholds",
412 + "value": {
413 + "mode": "absolute",
414 + "steps": [
415 + {
416 + "color": "dark-orange",
417 + "value": null
418 + }
419 + ]
420 + }
421 + }
422 + ]
423 + },
424 + {
425 + "matcher": {
426 + "id": "byName",
427 + "options": "data_groupName"
428 + },
429 + "properties": [
430 + {
431 + "id": "displayName",
432 + "value": "ALERTS BY TYPE"
433 + },
434 + {
435 + "id": "unit",
436 + "value": "short"
437 + },
438 + {
439 + "id": "decimals",
440 + "value": -1
441 + },
442 + {
443 + "id": "custom.cellOptions",
444 + "value": {
445 + "type": "color-background"
446 + }
447 + },
448 + {
449 + "id": "custom.align"
450 + }
451 + ]
452 + }
453 + ]
454 + },
455 + "gridPos": {
456 + "h": 7,
457 + "w": 7,
458 + "x": 11,
459 + "y": 0
460 + },
461 + "id": 55,
462 + "options": {
463 + "cellHeight": "sm",
464 + "footer": {
465 + "countRows": false,
466 + "fields": "",
467 + "reducer": [
468 + "sum"
469 + ],
470 + "show": false
471 + },
472 + "showHeader": true
473 + },
474 + "pluginVersion": "10.4.2",
475 + "targets": [
476 + {
477 + "bucketAggs": [
478 + {
479 + "fake": true,
480 + "field": "cat",
481 + "id": "4",
482 + "settings": {
483 + "min_doc_count": 1,
484 + "order": "desc",
485 + "orderBy": "_term",
486 + "size": "0"
487 + },
488 + "type": "terms"
489 + }
490 + ],
491 + "datasource": {
492 + "type": "grafana-opensearch-datasource",
493 + "uid": "replace_datasource_uid"
494 + },
495 + "metrics": [
496 + {
497 + "field": "select field",
498 + "id": "1",
499 + "type": "count"
500 + }
501 + ],
502 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
503 + "refId": "A",
504 + "timeField": "timestamp"
505 + }
506 + ],
507 + "title": "ALERTS BY CATEGOTY",
508 + "transformations": [
509 + {
510 + "id": "merge",
511 + "options": {
512 + "reducers": []
513 + }
514 + }
515 + ],
516 + "type": "table"
517 + },
518 + {
519 + "datasource": {
520 + "type": "grafana-opensearch-datasource",
521 + "uid": "replace_datasource_uid"
522 + },
523 + "fieldConfig": {
524 + "defaults": {
525 + "color": {
526 + "mode": "thresholds"
527 + },
528 + "custom": {
529 + "align": "auto",
530 + "cellOptions": {
531 + "type": "auto"
532 + },
533 + "inspect": false
534 + },
535 + "mappings": [],
536 + "thresholds": {
537 + "mode": "absolute",
538 + "steps": [
539 + {
540 + "color": "orange",
541 + "value": null
542 + }
543 + ]
544 + }
545 + },
546 + "overrides": [
547 + {
548 + "matcher": {
549 + "id": "byName",
550 + "options": "Time"
551 + },
552 + "properties": [
553 + {
554 + "id": "displayName",
555 + "value": "Time"
556 + },
557 + {
558 + "id": "unit",
559 + "value": "time: YYYY-MM-DD HH:mm:ss"
560 + },
561 + {
562 + "id": "custom.align"
563 + }
564 + ]
565 + },
566 + {
567 + "matcher": {
568 + "id": "byName",
569 + "options": "Count"
570 + },
571 + "properties": [
572 + {
573 + "id": "displayName",
574 + "value": "EVENTS"
575 + },
576 + {
577 + "id": "unit",
578 + "value": "short"
579 + },
580 + {
581 + "id": "decimals",
582 + "value": -1
583 + },
584 + {
585 + "id": "custom.cellOptions",
586 + "value": {
587 + "type": "color-background"
588 + }
589 + },
590 + {
591 + "id": "custom.align"
592 + },
593 + {
594 + "id": "thresholds",
595 + "value": {
596 + "mode": "absolute",
597 + "steps": [
598 + {
599 + "color": "dark-orange",
600 + "value": null
601 + }
602 + ]
603 + }
604 + }
605 + ]
606 + },
607 + {
608 + "matcher": {
609 + "id": "byName",
610 + "options": "data_groupName"
611 + },
612 + "properties": [
613 + {
614 + "id": "displayName",
615 + "value": "ALERTS BY TYPE"
616 + },
617 + {
618 + "id": "unit",
619 + "value": "short"
620 + },
621 + {
622 + "id": "decimals",
623 + "value": -1
624 + },
625 + {
626 + "id": "custom.cellOptions",
627 + "value": {
628 + "type": "color-background"
629 + }
630 + },
631 + {
632 + "id": "custom.align"
633 + }
634 + ]
635 + }
636 + ]
637 + },
638 + "gridPos": {
639 + "h": 7,
640 + "w": 6,
641 + "x": 18,
642 + "y": 0
643 + },
644 + "id": 56,
645 + "options": {
646 + "cellHeight": "sm",
647 + "footer": {
648 + "countRows": false,
649 + "fields": "",
650 + "reducer": [
651 + "sum"
652 + ],
653 + "show": false
654 + },
655 + "showHeader": true
656 + },
657 + "pluginVersion": "10.4.2",
658 + "targets": [
659 + {
660 + "bucketAggs": [
661 + {
662 + "fake": true,
663 + "field": "data_computerName",
664 + "id": "4",
665 + "settings": {
666 + "min_doc_count": 1,
667 + "order": "desc",
668 + "orderBy": "_count",
669 + "size": "0"
670 + },
671 + "type": "terms"
672 + }
673 + ],
674 + "datasource": {
675 + "type": "grafana-opensearch-datasource",
676 + "uid": "replace_datasource_uid"
677 + },
678 + "metrics": [
679 + {
680 + "field": "select field",
681 + "id": "1",
682 + "type": "count"
683 + }
684 + ],
685 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
686 + "refId": "A",
687 + "timeField": "timestamp"
688 + }
689 + ],
690 + "title": "ALERTS BY AGENT",
691 + "transformations": [
692 + {
693 + "id": "organize",
694 + "options": {
695 + "excludeByName": {},
696 + "indexByName": {},
697 + "renameByName": {
698 + "data_computerName": "COMPUTER"
699 + }
700 + }
701 + }
702 + ],
703 + "type": "table"
704 + },
705 + {
706 + "datasource": {
707 + "type": "grafana-opensearch-datasource",
708 + "uid": "replace_datasource_uid"
709 + },
710 + "fieldConfig": {
711 + "defaults": {
712 + "mappings": [
713 + {
714 + "options": {
715 + "match": "null",
716 + "result": {
717 + "text": "N/A"
718 + }
719 + },
720 + "type": "special"
721 + }
722 + ],
723 + "thresholds": {
724 + "mode": "absolute",
725 + "steps": [
726 + {
727 + "color": "blue",
728 + "value": null
729 + }
730 + ]
731 + },
732 + "unit": "none"
733 + },
734 + "overrides": []
735 + },
736 + "gridPos": {
737 + "h": 5,
738 + "w": 4,
739 + "x": 0,
740 + "y": 7
741 + },
742 + "id": 45,
743 + "maxDataPoints": 100,
744 + "options": {
745 + "colorMode": "value",
746 + "graphMode": "none",
747 + "justifyMode": "auto",
748 + "orientation": "horizontal",
749 + "reduceOptions": {
750 + "calcs": [
751 + "max"
752 + ],
753 + "fields": "",
754 + "values": false
755 + },
756 + "showPercentChange": false,
757 + "text": {},
758 + "textMode": "auto",
759 + "wideLayout": true
760 + },
761 + "pluginVersion": "10.4.2",
762 + "targets": [
763 + {
764 + "bucketAggs": [
765 + {
766 + "$$hashKey": "object:235",
767 + "field": "timestamp",
768 + "id": "2",
769 + "settings": {
770 + "interval": "365d",
771 + "min_doc_count": 0,
772 + "trimEdges": 0
773 + },
774 + "type": "date_histogram"
775 + }
776 + ],
777 + "datasource": {
778 + "type": "grafana-opensearch-datasource",
779 + "uid": "replace_datasource_uid"
780 + },
781 + "metrics": [
782 + {
783 + "$$hashKey": "object:233",
784 + "field": "data_computerName",
785 + "id": "1",
786 + "meta": {},
787 + "settings": {},
788 + "type": "cardinality"
789 + }
790 + ],
791 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
792 + "refId": "A",
793 + "timeField": "timestamp"
794 + }
795 + ],
796 + "title": "AGENTS",
797 + "type": "stat"
798 + },
799 + {
800 + "datasource": {
801 + "type": "grafana-opensearch-datasource",
802 + "uid": "replace_datasource_uid"
803 + },
804 + "fieldConfig": {
805 + "defaults": {
806 + "color": {
807 + "mode": "palette-classic"
808 + },
809 + "custom": {
810 + "axisBorderShow": false,
811 + "axisCenteredZero": false,
812 + "axisColorMode": "text",
813 + "axisLabel": "",
814 + "axisPlacement": "auto",
815 + "barAlignment": 0,
816 + "drawStyle": "line",
817 + "fillOpacity": 0,
818 + "gradientMode": "none",
819 + "hideFrom": {
820 + "legend": false,
821 + "tooltip": false,
822 + "viz": false
823 + },
824 + "insertNulls": false,
825 + "lineInterpolation": "linear",
826 + "lineWidth": 1,
827 + "pointSize": 5,
828 + "scaleDistribution": {
829 + "type": "linear"
830 + },
831 + "showPoints": "auto",
832 + "spanNulls": false,
833 + "stacking": {
834 + "group": "A",
835 + "mode": "normal"
836 + },
837 + "thresholdsStyle": {
838 + "mode": "off"
839 + }
840 + },
841 + "mappings": [],
842 + "thresholds": {
843 + "mode": "absolute",
844 + "steps": [
845 + {
846 + "color": "green",
847 + "value": null
848 + },
849 + {
850 + "color": "red",
851 + "value": 80
852 + }
853 + ]
854 + }
855 + },
856 + "overrides": []
857 + },
858 + "gridPos": {
859 + "h": 11,
860 + "w": 20,
861 + "x": 4,
862 + "y": 7
863 + },
864 + "id": 49,
865 + "options": {
866 + "legend": {
867 + "calcs": [],
868 + "displayMode": "table",
869 + "placement": "right",
870 + "showLegend": true
871 + },
872 + "tooltip": {
873 + "mode": "single",
874 + "sort": "none"
875 + }
876 + },
877 + "targets": [
878 + {
879 + "alias": "",
880 + "bucketAggs": [
881 + {
882 + "field": "data_computerName",
883 + "id": "3",
884 + "settings": {
885 + "min_doc_count": "1",
886 + "order": "desc",
887 + "orderBy": "_term",
888 + "size": "10"
889 + },
890 + "type": "terms"
891 + },
892 + {
893 + "field": "timestamp",
894 + "id": "2",
895 + "settings": {
896 + "interval": "auto"
897 + },
898 + "type": "date_histogram"
899 + }
900 + ],
901 + "datasource": {
902 + "type": "grafana-opensearch-datasource",
903 + "uid": "replace_datasource_uid"
904 + },
905 + "metrics": [
906 + {
907 + "id": "1",
908 + "type": "count"
909 + }
910 + ],
911 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
912 + "refId": "A",
913 + "timeField": "timestamp"
914 + }
915 + ],
916 + "title": "TOP 10 AGENTS - HISTOGRAM",
917 + "transparent": true,
918 + "type": "timeseries"
919 + },
920 + {
921 + "datasource": {
922 + "type": "grafana-opensearch-datasource",
923 + "uid": "replace_datasource_uid"
924 + },
925 + "fieldConfig": {
926 + "defaults": {
927 + "mappings": [
928 + {
929 + "options": {
930 + "match": "null",
931 + "result": {
932 + "text": "N/A"
933 + }
934 + },
935 + "type": "special"
936 + }
937 + ],
938 + "thresholds": {
939 + "mode": "absolute",
940 + "steps": [
941 + {
942 + "color": "orange",
943 + "value": null
944 + }
945 + ]
946 + },
947 + "unit": "locale"
948 + },
949 + "overrides": []
950 + },
951 + "gridPos": {
952 + "h": 6,
953 + "w": 4,
954 + "x": 0,
955 + "y": 12
956 + },
957 + "id": 18,
958 + "options": {
959 + "colorMode": "value",
960 + "graphMode": "area",
961 + "justifyMode": "auto",
962 + "orientation": "horizontal",
963 + "reduceOptions": {
964 + "calcs": [
965 + "sum"
966 + ],
967 + "fields": "",
968 + "values": false
969 + },
970 + "showPercentChange": false,
971 + "text": {},
972 + "textMode": "auto",
973 + "wideLayout": true
974 + },
975 + "pluginVersion": "10.4.2",
976 + "targets": [
977 + {
978 + "bucketAggs": [
979 + {
980 + "$$hashKey": "object:331",
981 + "field": "timestamp",
982 + "id": "2",
983 + "settings": {
984 + "interval": "auto",
985 + "min_doc_count": 0,
986 + "trimEdges": 0
987 + },
988 + "type": "date_histogram"
989 + }
990 + ],
991 + "datasource": {
992 + "type": "grafana-opensearch-datasource",
993 + "uid": "replace_datasource_uid"
994 + },
995 + "metrics": [
996 + {
997 + "$$hashKey": "object:329",
998 + "field": "select field",
999 + "id": "1",
1000 + "type": "count"
1001 + }
1002 + ],
1003 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
1004 + "refId": "A",
1005 + "timeField": "timestamp"
1006 + }
1007 + ],
1008 + "title": "EVENTS (TOTAL)",
1009 + "type": "stat"
1010 + },
1011 + {
1012 + "datasource": {
1013 + "type": "grafana-opensearch-datasource",
1014 + "uid": "replace_datasource_uid"
1015 + },
1016 + "fieldConfig": {
1017 + "defaults": {
1018 + "color": {
1019 + "mode": "palette-classic"
1020 + },
1021 + "custom": {
1022 + "hideFrom": {
1023 + "legend": false,
1024 + "tooltip": false,
1025 + "viz": false
1026 + }
1027 + },
1028 + "decimals": 0,
1029 + "mappings": [],
1030 + "unit": "short"
1031 + },
1032 + "overrides": [
1033 + {
1034 + "matcher": {
1035 + "id": "byName",
1036 + "options": "1"
1037 + },
1038 + "properties": [
1039 + {
1040 + "id": "color",
1041 + "value": {
1042 + "fixedColor": "#C8F2C2",
1043 + "mode": "fixed"
1044 + }
1045 + }
1046 + ]
1047 + },
1048 + {
1049 + "matcher": {
1050 + "id": "byName",
1051 + "options": "2"
1052 + },
1053 + "properties": [
1054 + {
1055 + "id": "color",
1056 + "value": {
1057 + "fixedColor": "#96D98D",
1058 + "mode": "fixed"
1059 + }
1060 + }
1061 + ]
1062 + },
1063 + {
1064 + "matcher": {
1065 + "id": "byName",
1066 + "options": "3"
1067 + },
1068 + "properties": [
1069 + {
1070 + "id": "color",
1071 + "value": {
1072 + "fixedColor": "#56A64B",
1073 + "mode": "fixed"
1074 + }
1075 + }
1076 + ]
1077 + },
1078 + {
1079 + "matcher": {
1080 + "id": "byName",
1081 + "options": "4"
1082 + },
1083 + "properties": [
1084 + {
1085 + "id": "color",
1086 + "value": {
1087 + "fixedColor": "#37872D",
1088 + "mode": "fixed"
1089 + }
1090 + }
1091 + ]
1092 + },
1093 + {
1094 + "matcher": {
1095 + "id": "byName",
1096 + "options": "5"
1097 + },
1098 + "properties": [
1099 + {
1100 + "id": "color",
1101 + "value": {
1102 + "fixedColor": "#FFF899",
1103 + "mode": "fixed"
1104 + }
1105 + }
1106 + ]
1107 + },
1108 + {
1109 + "matcher": {
1110 + "id": "byName",
1111 + "options": "7"
1112 + },
1113 + "properties": [
1114 + {
1115 + "id": "color",
1116 + "value": {
1117 + "fixedColor": "#F2CC0C",
1118 + "mode": "fixed"
1119 + }
1120 + }
1121 + ]
1122 + },
1123 + {
1124 + "matcher": {
1125 + "id": "byName",
1126 + "options": "9"
1127 + },
1128 + "properties": [
1129 + {
1130 + "id": "color",
1131 + "value": {
1132 + "fixedColor": "#FF9830",
1133 + "mode": "fixed"
1134 + }
1135 + }
1136 + ]
1137 + },
1138 + {
1139 + "matcher": {
1140 + "id": "byName",
1141 + "options": "10"
1142 + },
1143 + "properties": [
1144 + {
1145 + "id": "color",
1146 + "value": {
1147 + "fixedColor": "#FF9830",
1148 + "mode": "fixed"
1149 + }
1150 + }
1151 + ]
1152 + },
1153 + {
1154 + "matcher": {
1155 + "id": "byName",
1156 + "options": "12"
1157 + },
1158 + "properties": [
1159 + {
1160 + "id": "color",
1161 + "value": {
1162 + "fixedColor": "#F2495C",
1163 + "mode": "fixed"
1164 + }
1165 + }
1166 + ]
1167 + },
1168 + {
1169 + "matcher": {
1170 + "id": "byName",
1171 + "options": "13"
1172 + },
1173 + "properties": [
1174 + {
1175 + "id": "color",
1176 + "value": {
1177 + "fixedColor": "#FF7383",
1178 + "mode": "fixed"
1179 + }
1180 + }
1181 + ]
1182 + }
1183 + ]
1184 + },
1185 + "gridPos": {
1186 + "h": 12,
1187 + "w": 6,
1188 + "x": 0,
1189 + "y": 18
1190 + },
1191 + "id": 23,
1192 + "maxDataPoints": 3,
1193 + "options": {
1194 + "displayLabels": [],
1195 + "legend": {
1196 + "calcs": [],
1197 + "displayMode": "table",
1198 + "placement": "right",
1199 + "showLegend": true,
1200 + "values": [
1201 + "value",
1202 + "percent"
1203 + ]
1204 + },
1205 + "pieType": "donut",
1206 + "reduceOptions": {
1207 + "calcs": [
1208 + "sum"
1209 + ],
1210 + "fields": "",
1211 + "values": false
1212 + },
1213 + "text": {},
1214 + "tooltip": {
1215 + "mode": "single",
1216 + "sort": "none"
1217 + }
1218 + },
1219 + "targets": [
1220 + {
1221 + "bucketAggs": [
1222 + {
1223 + "$$hashKey": "object:235",
1224 + "fake": true,
1225 + "field": "eventSeverity",
1226 + "id": "3",
1227 + "settings": {
1228 + "min_doc_count": 1,
1229 + "order": "desc",
1230 + "orderBy": "_count",
1231 + "size": "10"
1232 + },
1233 + "type": "terms"
1234 + },
1235 + {
1236 + "$$hashKey": "object:236",
1237 + "field": "timestamp",
1238 + "id": "2",
1239 + "settings": {
1240 + "interval": "auto",
1241 + "min_doc_count": 0,
1242 + "trimEdges": 0
1243 + },
1244 + "type": "date_histogram"
1245 + }
1246 + ],
1247 + "datasource": {
1248 + "type": "grafana-opensearch-datasource",
1249 + "uid": "replace_datasource_uid"
1250 + },
1251 + "metrics": [
1252 + {
1253 + "$$hashKey": "object:233",
1254 + "field": "select field",
1255 + "id": "1",
1256 + "meta": {},
1257 + "settings": {},
1258 + "type": "count"
1259 + }
1260 + ],
1261 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
1262 + "refId": "A",
1263 + "timeField": "timestamp"
1264 + }
1265 + ],
1266 + "title": "SECURITY EVENTS BY ALERT LEVEL",
1267 + "type": "piechart"
1268 + },
1269 + {
1270 + "datasource": {
1271 + "type": "grafana-opensearch-datasource",
1272 + "uid": "replace_datasource_uid"
1273 + },
1274 + "fieldConfig": {
1275 + "defaults": {
1276 + "color": {
1277 + "mode": "palette-classic"
1278 + },
1279 + "custom": {
1280 + "axisBorderShow": false,
1281 + "axisCenteredZero": false,
1282 + "axisColorMode": "text",
1283 + "axisLabel": "",
1284 + "axisPlacement": "auto",
1285 + "barAlignment": 0,
1286 + "drawStyle": "line",
1287 + "fillOpacity": 0,
1288 + "gradientMode": "none",
1289 + "hideFrom": {
1290 + "legend": false,
1291 + "tooltip": false,
1292 + "viz": false
1293 + },
1294 + "insertNulls": false,
1295 + "lineInterpolation": "linear",
1296 + "lineWidth": 1,
1297 + "pointSize": 5,
1298 + "scaleDistribution": {
1299 + "type": "linear"
1300 + },
1301 + "showPoints": "auto",
1302 + "spanNulls": false,
1303 + "stacking": {
1304 + "group": "A",
1305 + "mode": "normal"
1306 + },
1307 + "thresholdsStyle": {
1308 + "mode": "off"
1309 + }
1310 + },
1311 + "mappings": [],
1312 + "thresholds": {
1313 + "mode": "absolute",
1314 + "steps": [
1315 + {
1316 + "color": "green",
1317 + "value": null
1318 + },
1319 + {
1320 + "color": "red",
1321 + "value": 80
1322 + }
1323 + ]
1324 + }
1325 + },
1326 + "overrides": [
1327 + {
1328 + "matcher": {
1329 + "id": "byName",
1330 + "options": "10"
1331 + },
1332 + "properties": [
1333 + {
1334 + "id": "color",
1335 + "value": {
1336 + "fixedColor": "orange",
1337 + "mode": "fixed"
1338 + }
1339 + }
1340 + ]
1341 + }
1342 + ]
1343 + },
1344 + "gridPos": {
1345 + "h": 12,
1346 + "w": 18,
1347 + "x": 6,
1348 + "y": 18
1349 + },
1350 + "id": 50,
1351 + "options": {
1352 + "legend": {
1353 + "calcs": [],
1354 + "displayMode": "table",
1355 + "placement": "right",
1356 + "showLegend": true
1357 + },
1358 + "tooltip": {
1359 + "mode": "single",
1360 + "sort": "none"
1361 + }
1362 + },
1363 + "targets": [
1364 + {
1365 + "alias": "",
1366 + "bucketAggs": [
1367 + {
1368 + "field": "eventSeverity",
1369 + "id": "3",
1370 + "settings": {
1371 + "min_doc_count": "1",
1372 + "order": "desc",
1373 + "orderBy": "_count",
1374 + "size": "10"
1375 + },
1376 + "type": "terms"
1377 + },
1378 + {
1379 + "field": "timestamp",
1380 + "id": "2",
1381 + "settings": {
1382 + "interval": "auto"
1383 + },
1384 + "type": "date_histogram"
1385 + }
1386 + ],
1387 + "datasource": {
1388 + "type": "grafana-opensearch-datasource",
1389 + "uid": "replace_datasource_uid"
1390 + },
1391 + "metrics": [
1392 + {
1393 + "id": "1",
1394 + "type": "count"
1395 + }
1396 + ],
1397 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
1398 + "refId": "A",
1399 + "timeField": "timestamp"
1400 + }
1401 + ],
1402 + "title": "EVENTS SEVERITY - HISTOGRAM",
1403 + "type": "timeseries"
1404 + },
1405 + {
1406 + "datasource": {
1407 + "type": "grafana-opensearch-datasource",
1408 + "uid": "replace_datasource_uid"
1409 + },
1410 + "fieldConfig": {
1411 + "defaults": {
1412 + "color": {
1413 + "mode": "palette-classic"
1414 + },
1415 + "custom": {
1416 + "hideFrom": {
1417 + "legend": false,
1418 + "tooltip": false,
1419 + "viz": false
1420 + }
1421 + },
1422 + "decimals": 0,
1423 + "mappings": [],
1424 + "unit": "short"
1425 + },
1426 + "overrides": [
1427 + {
1428 + "matcher": {
1429 + "id": "byName",
1430 + "options": "1"
1431 + },
1432 + "properties": [
1433 + {
1434 + "id": "color",
1435 + "value": {
1436 + "fixedColor": "#C8F2C2",
1437 + "mode": "fixed"
1438 + }
1439 + }
1440 + ]
1441 + },
1442 + {
1443 + "matcher": {
1444 + "id": "byName",
1445 + "options": "2"
1446 + },
1447 + "properties": [
1448 + {
1449 + "id": "color",
1450 + "value": {
1451 + "fixedColor": "#96D98D",
1452 + "mode": "fixed"
1453 + }
1454 + }
1455 + ]
1456 + },
1457 + {
1458 + "matcher": {
1459 + "id": "byName",
1460 + "options": "3"
1461 + },
1462 + "properties": [
1463 + {
1464 + "id": "color",
1465 + "value": {
1466 + "fixedColor": "#56A64B",
1467 + "mode": "fixed"
1468 + }
1469 + }
1470 + ]
1471 + },
1472 + {
1473 + "matcher": {
1474 + "id": "byName",
1475 + "options": "4"
1476 + },
1477 + "properties": [
1478 + {
1479 + "id": "color",
1480 + "value": {
1481 + "fixedColor": "#37872D",
1482 + "mode": "fixed"
1483 + }
1484 + }
1485 + ]
1486 + },
1487 + {
1488 + "matcher": {
1489 + "id": "byName",
1490 + "options": "5"
1491 + },
1492 + "properties": [
1493 + {
1494 + "id": "color",
1495 + "value": {
1496 + "fixedColor": "#FFF899",
1497 + "mode": "fixed"
1498 + }
1499 + }
1500 + ]
1501 + },
1502 + {
1503 + "matcher": {
1504 + "id": "byName",
1505 + "options": "7"
1506 + },
1507 + "properties": [
1508 + {
1509 + "id": "color",
1510 + "value": {
1511 + "fixedColor": "#F2CC0C",
1512 + "mode": "fixed"
1513 + }
1514 + }
1515 + ]
1516 + },
1517 + {
1518 + "matcher": {
1519 + "id": "byName",
1520 + "options": "9"
1521 + },
1522 + "properties": [
1523 + {
1524 + "id": "color",
1525 + "value": {
1526 + "fixedColor": "#FF9830",
1527 + "mode": "fixed"
1528 + }
1529 + }
1530 + ]
1531 + },
1532 + {
1533 + "matcher": {
1534 + "id": "byName",
1535 + "options": "10"
1536 + },
1537 + "properties": [
1538 + {
1539 + "id": "color",
1540 + "value": {
1541 + "fixedColor": "#FF9830",
1542 + "mode": "fixed"
1543 + }
1544 + }
1545 + ]
1546 + },
1547 + {
1548 + "matcher": {
1549 + "id": "byName",
1550 + "options": "12"
1551 + },
1552 + "properties": [
1553 + {
1554 + "id": "color",
1555 + "value": {
1556 + "fixedColor": "#F2495C",
1557 + "mode": "fixed"
1558 + }
1559 + }
1560 + ]
1561 + },
1562 + {
1563 + "matcher": {
1564 + "id": "byName",
1565 + "options": "13"
1566 + },
1567 + "properties": [
1568 + {
1569 + "id": "color",
1570 + "value": {
1571 + "fixedColor": "#FF7383",
1572 + "mode": "fixed"
1573 + }
1574 + }
1575 + ]
1576 + },
1577 + {
1578 + "matcher": {
1579 + "id": "byName",
1580 + "options": "MITIGATION"
1581 + },
1582 + "properties": [
1583 + {
1584 + "id": "color",
1585 + "value": {
1586 + "fixedColor": "orange",
1587 + "mode": "fixed"
1588 + }
1589 + }
1590 + ]
1591 + }
1592 + ]
1593 + },
1594 + "gridPos": {
1595 + "h": 12,
1596 + "w": 6,
1597 + "x": 0,
1598 + "y": 30
1599 + },
1600 + "id": 52,
1601 + "maxDataPoints": 3,
1602 + "options": {
1603 + "displayLabels": [],
1604 + "legend": {
1605 + "calcs": [],
1606 + "displayMode": "table",
1607 + "placement": "right",
1608 + "showLegend": true,
1609 + "values": [
1610 + "value",
1611 + "percent"
1612 + ]
1613 + },
1614 + "pieType": "donut",
1615 + "reduceOptions": {
1616 + "calcs": [
1617 + "sum"
1618 + ],
1619 + "fields": "",
1620 + "values": false
1621 + },
1622 + "text": {},
1623 + "tooltip": {
1624 + "mode": "single",
1625 + "sort": "none"
1626 + }
1627 + },
1628 + "targets": [
1629 + {
1630 + "bucketAggs": [
1631 + {
1632 + "$$hashKey": "object:235",
1633 + "fake": true,
1634 + "field": "cat",
1635 + "id": "3",
1636 + "settings": {
1637 + "min_doc_count": 1,
1638 + "order": "desc",
1639 + "orderBy": "_count",
1640 + "size": "10"
1641 + },
1642 + "type": "terms"
1643 + },
1644 + {
1645 + "$$hashKey": "object:236",
1646 + "field": "timestamp",
1647 + "id": "2",
1648 + "settings": {
1649 + "interval": "auto",
1650 + "min_doc_count": 0,
1651 + "trimEdges": 0
1652 + },
1653 + "type": "date_histogram"
1654 + }
1655 + ],
1656 + "datasource": {
1657 + "type": "grafana-opensearch-datasource",
1658 + "uid": "replace_datasource_uid"
1659 + },
1660 + "metrics": [
1661 + {
1662 + "$$hashKey": "object:233",
1663 + "field": "select field",
1664 + "id": "1",
1665 + "meta": {},
1666 + "settings": {},
1667 + "type": "count"
1668 + }
1669 + ],
1670 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
1671 + "refId": "A",
1672 + "timeField": "timestamp"
1673 + }
1674 + ],
1675 + "title": "SECURITY EVENTS BY CATEGORY",
1676 + "type": "piechart"
1677 + },
1678 + {
1679 + "datasource": {
1680 + "type": "grafana-opensearch-datasource",
1681 + "uid": "replace_datasource_uid"
1682 + },
1683 + "fieldConfig": {
1684 + "defaults": {
1685 + "color": {
1686 + "mode": "palette-classic"
1687 + },
1688 + "custom": {
1689 + "hideFrom": {
1690 + "legend": false,
1691 + "tooltip": false,
1692 + "viz": false
1693 + }
1694 + },
1695 + "decimals": 0,
1696 + "mappings": [],
1697 + "unit": "short"
1698 + },
1699 + "overrides": [
1700 + {
1701 + "matcher": {
1702 + "id": "byName",
1703 + "options": "1"
1704 + },
1705 + "properties": [
1706 + {
1707 + "id": "color",
1708 + "value": {
1709 + "fixedColor": "#C8F2C2",
1710 + "mode": "fixed"
1711 + }
1712 + }
1713 + ]
1714 + },
1715 + {
1716 + "matcher": {
1717 + "id": "byName",
1718 + "options": "2"
1719 + },
1720 + "properties": [
1721 + {
1722 + "id": "color",
1723 + "value": {
1724 + "fixedColor": "#96D98D",
1725 + "mode": "fixed"
1726 + }
1727 + }
1728 + ]
1729 + },
1730 + {
1731 + "matcher": {
1732 + "id": "byName",
1733 + "options": "3"
1734 + },
1735 + "properties": [
1736 + {
1737 + "id": "color",
1738 + "value": {
1739 + "fixedColor": "#56A64B",
1740 + "mode": "fixed"
1741 + }
1742 + }
1743 + ]
1744 + },
1745 + {
1746 + "matcher": {
1747 + "id": "byName",
1748 + "options": "4"
1749 + },
1750 + "properties": [
1751 + {
1752 + "id": "color",
1753 + "value": {
1754 + "fixedColor": "#37872D",
1755 + "mode": "fixed"
1756 + }
1757 + }
1758 + ]
1759 + },
1760 + {
1761 + "matcher": {
1762 + "id": "byName",
1763 + "options": "5"
1764 + },
1765 + "properties": [
1766 + {
1767 + "id": "color",
1768 + "value": {
1769 + "fixedColor": "#FFF899",
1770 + "mode": "fixed"
1771 + }
1772 + }
1773 + ]
1774 + },
1775 + {
1776 + "matcher": {
1777 + "id": "byName",
1778 + "options": "7"
1779 + },
1780 + "properties": [
1781 + {
1782 + "id": "color",
1783 + "value": {
1784 + "fixedColor": "#F2CC0C",
1785 + "mode": "fixed"
1786 + }
1787 + }
1788 + ]
1789 + },
1790 + {
1791 + "matcher": {
1792 + "id": "byName",
1793 + "options": "9"
1794 + },
1795 + "properties": [
1796 + {
1797 + "id": "color",
1798 + "value": {
1799 + "fixedColor": "#FF9830",
1800 + "mode": "fixed"
1801 + }
1802 + }
1803 + ]
1804 + },
1805 + {
1806 + "matcher": {
1807 + "id": "byName",
1808 + "options": "10"
1809 + },
1810 + "properties": [
1811 + {
1812 + "id": "color",
1813 + "value": {
1814 + "fixedColor": "#FF9830",
1815 + "mode": "fixed"
1816 + }
1817 + }
1818 + ]
1819 + },
1820 + {
1821 + "matcher": {
1822 + "id": "byName",
1823 + "options": "12"
1824 + },
1825 + "properties": [
1826 + {
1827 + "id": "color",
1828 + "value": {
1829 + "fixedColor": "#F2495C",
1830 + "mode": "fixed"
1831 + }
1832 + }
1833 + ]
1834 + },
1835 + {
1836 + "matcher": {
1837 + "id": "byName",
1838 + "options": "13"
1839 + },
1840 + "properties": [
1841 + {
1842 + "id": "color",
1843 + "value": {
1844 + "fixedColor": "#FF7383",
1845 + "mode": "fixed"
1846 + }
1847 + }
1848 + ]
1849 + },
1850 + {
1851 + "matcher": {
1852 + "id": "byName",
1853 + "options": "MITIGATION"
1854 + },
1855 + "properties": [
1856 + {
1857 + "id": "color",
1858 + "value": {
1859 + "fixedColor": "orange",
1860 + "mode": "fixed"
1861 + }
1862 + }
1863 + ]
1864 + }
1865 + ]
1866 + },
1867 + "gridPos": {
1868 + "h": 12,
1869 + "w": 6,
1870 + "x": 6,
1871 + "y": 30
1872 + },
1873 + "id": 53,
1874 + "maxDataPoints": 3,
1875 + "options": {
1876 + "displayLabels": [],
1877 + "legend": {
1878 + "calcs": [],
1879 + "displayMode": "table",
1880 + "placement": "right",
1881 + "showLegend": true,
1882 + "values": [
1883 + "value",
1884 + "percent"
1885 + ]
1886 + },
1887 + "pieType": "donut",
1888 + "reduceOptions": {
1889 + "calcs": [
1890 + "sum"
1891 + ],
1892 + "fields": "",
1893 + "values": false
1894 + },
1895 + "text": {},
1896 + "tooltip": {
1897 + "mode": "single",
1898 + "sort": "none"
1899 + }
1900 + },
1901 + "targets": [
1902 + {
1903 + "bucketAggs": [
1904 + {
1905 + "$$hashKey": "object:235",
1906 + "fake": true,
1907 + "field": "siteName",
1908 + "id": "3",
1909 + "settings": {
1910 + "min_doc_count": 1,
1911 + "order": "desc",
1912 + "orderBy": "_count",
1913 + "size": "10"
1914 + },
1915 + "type": "terms"
1916 + },
1917 + {
1918 + "$$hashKey": "object:236",
1919 + "field": "timestamp",
1920 + "id": "2",
1921 + "settings": {
1922 + "interval": "auto",
1923 + "min_doc_count": 0,
1924 + "trimEdges": 0
1925 + },
1926 + "type": "date_histogram"
1927 + }
1928 + ],
1929 + "datasource": {
1930 + "type": "grafana-opensearch-datasource",
1931 + "uid": "replace_datasource_uid"
1932 + },
1933 + "metrics": [
1934 + {
1935 + "$$hashKey": "object:233",
1936 + "field": "select field",
1937 + "id": "1",
1938 + "meta": {},
1939 + "settings": {},
1940 + "type": "count"
1941 + }
1942 + ],
1943 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
1944 + "refId": "A",
1945 + "timeField": "timestamp"
1946 + }
1947 + ],
1948 + "title": "SECURITY EVENTS BY SITE",
1949 + "type": "piechart"
1950 + },
1951 + {
1952 + "datasource": {
1953 + "type": "grafana-opensearch-datasource",
1954 + "uid": "replace_datasource_uid"
1955 + },
1956 + "fieldConfig": {
1957 + "defaults": {
1958 + "color": {
1959 + "mode": "thresholds"
1960 + },
1961 + "custom": {
1962 + "align": "auto",
1963 + "cellOptions": {
1964 + "type": "auto"
1965 + },
1966 + "inspect": false
1967 + },
1968 + "decimals": 0,
1969 + "mappings": [],
1970 + "thresholds": {
1971 + "mode": "absolute",
1972 + "steps": [
1973 + {
1974 + "color": "green",
1975 + "value": null
1976 + },
1977 + {
1978 + "color": "red",
1979 + "value": 80
1980 + }
1981 + ]
1982 + },
1983 + "unit": "short"
1984 + },
1985 + "overrides": [
1986 + {
1987 + "matcher": {
1988 + "id": "byName",
1989 + "options": "FILE PATH"
1990 + },
1991 + "properties": [
1992 + {
1993 + "id": "custom.width",
1994 + "value": 895
1995 + }
1996 + ]
1997 + }
1998 + ]
1999 + },
2000 + "gridPos": {
2001 + "h": 12,
2002 + "w": 12,
2003 + "x": 12,
2004 + "y": 30
2005 + },
2006 + "id": 54,
2007 + "maxDataPoints": 3,
2008 + "options": {
2009 + "cellHeight": "sm",
2010 + "footer": {
2011 + "countRows": false,
2012 + "fields": "",
2013 + "reducer": [
2014 + "sum"
2015 + ],
2016 + "show": false
2017 + },
2018 + "showHeader": true,
2019 + "sortBy": []
2020 + },
2021 + "pluginVersion": "10.4.2",
2022 + "targets": [
2023 + {
2024 + "bucketAggs": [
2025 + {
2026 + "$$hashKey": "object:235",
2027 + "fake": true,
2028 + "field": "data_filePath",
2029 + "id": "3",
2030 + "settings": {
2031 + "min_doc_count": 1,
2032 + "order": "desc",
2033 + "orderBy": "_count",
2034 + "size": "10"
2035 + },
2036 + "type": "terms"
2037 + }
2038 + ],
2039 + "datasource": {
2040 + "type": "grafana-opensearch-datasource",
2041 + "uid": "replace_datasource_uid"
2042 + },
2043 + "metrics": [
2044 + {
2045 + "$$hashKey": "object:233",
2046 + "field": "select field",
2047 + "id": "1",
2048 + "meta": {},
2049 + "settings": {},
2050 + "type": "count"
2051 + }
2052 + ],
2053 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
2054 + "refId": "A",
2055 + "timeField": "timestamp"
2056 + }
2057 + ],
2058 + "title": "FILE PATHS",
2059 + "transformations": [
2060 + {
2061 + "id": "organize",
2062 + "options": {
2063 + "excludeByName": {},
2064 + "indexByName": {},
2065 + "renameByName": {
2066 + "data_filePath": "FILE PATH"
2067 + }
2068 + }
2069 + }
2070 + ],
2071 + "type": "table"
2072 + },
2073 + {
2074 + "datasource": {
2075 + "type": "grafana-opensearch-datasource",
2076 + "uid": "replace_datasource_uid"
2077 + },
2078 + "fieldConfig": {
2079 + "defaults": {
2080 + "color": {
2081 + "mode": "thresholds"
2082 + },
2083 + "custom": {
2084 + "align": "auto",
2085 + "cellOptions": {
2086 + "type": "auto"
2087 + },
2088 + "inspect": false
2089 + },
2090 + "decimals": 2,
2091 + "displayName": "",
2092 + "mappings": [],
2093 + "thresholds": {
2094 + "mode": "absolute",
2095 + "steps": [
2096 + {
2097 + "color": "green",
2098 + "value": null
2099 + },
2100 + {
2101 + "color": "red",
2102 + "value": 80
2103 + }
2104 + ]
2105 + },
2106 + "unit": "short"
2107 + },
2108 + "overrides": [
2109 + {
2110 + "matcher": {
2111 + "id": "byName",
2112 + "options": "Time"
2113 + },
2114 + "properties": [
2115 + {
2116 + "id": "displayName",
2117 + "value": "Time"
2118 + },
2119 + {
2120 + "id": "unit",
2121 + "value": "time: YYYY-MM-DD HH:mm:ss"
2122 + },
2123 + {
2124 + "id": "custom.align"
2125 + }
2126 + ]
2127 + },
2128 + {
2129 + "matcher": {
2130 + "id": "byName",
2131 + "options": "Count"
2132 + },
2133 + "properties": [
2134 + {
2135 + "id": "displayName",
2136 + "value": "Events"
2137 + },
2138 + {
2139 + "id": "unit",
2140 + "value": "short"
2141 + },
2142 + {
2143 + "id": "decimals",
2144 + "value": -1
2145 + },
2146 + {
2147 + "id": "custom.align"
2148 + }
2149 + ]
2150 + },
2151 + {
2152 + "matcher": {
2153 + "id": "byName",
2154 + "options": "data_groupName"
2155 + },
2156 + "properties": [
2157 + {
2158 + "id": "displayName",
2159 + "value": "Rule Groups"
2160 + },
2161 + {
2162 + "id": "unit",
2163 + "value": "short"
2164 + },
2165 + {
2166 + "id": "decimals",
2167 + "value": 2
2168 + },
2169 + {
2170 + "id": "custom.align"
2171 + },
2172 + {
2173 + "id": "mappings",
2174 + "value": [
2175 + {
2176 + "options": {
2177 + "SENTINELONE, agent_flooding": {
2178 + "index": 33,
2179 + "text": "SENTINELONE Agent - Event Queue Flooding"
2180 + },
2181 + "apache, web, modsecurity": {
2182 + "index": 7,
2183 + "text": "Apache ModSec"
2184 + },
2185 + "dnsstat, dnsstat_alert": {
2186 + "index": 47,
2187 + "text": "Domain Stats - Alert"
2188 + },
2189 + "dnsstat, dnsstat_error": {
2190 + "index": 41,
2191 + "text": "Domain Stats - Entry Not found in RDAP"
2192 + },
2193 + "docker, docker-error": {
2194 + "index": 43,
2195 + "text": "Docker Error"
2196 + },
2197 + "linux, docker, falco": {
2198 + "index": 56,
2199 + "text": "Linux Docker: Container Event"
2200 + },
2201 + "linux, packetbeat, dns": {
2202 + "index": 58,
2203 + "text": "Linux - DNS Request"
2204 + },
2205 + "linux, packetbeat, http": {
2206 + "index": 73,
2207 + "text": "Linux Packetbeat - HTTP Connection"
2208 + },
2209 + "linux, packetbeat, tls": {
2210 + "index": 72,
2211 + "text": "Linux Packetbeat - HTTPS Connection"
2212 + },
2213 + "linux, sysmon, sysmon_event1": {
2214 + "index": 3,
2215 + "text": "Linux Sysmon - Process Started"
2216 + },
2217 + "linux, sysmon, sysmon_event3": {
2218 + "index": 2,
2219 + "text": "Linux Sysmon - Network Connection"
2220 + },
2221 + "linux, sysmon, sysmon_event5": {
2222 + "index": 1,
2223 + "text": "Linux Sysmon - Process Terminated"
2224 + },
2225 + "linux, sysmon, sysmon_event9": {
2226 + "index": 46,
2227 + "text": "Linux Sysmon - RawAccessRead"
2228 + },
2229 + "linux, sysmon, sysmon_event_11": {
2230 + "index": 4,
2231 + "text": "Linux Sysmon - FileCreate"
2232 + },
2233 + "linux, sysmon, sysmon_event_16": {
2234 + "index": 6,
2235 + "text": "Linux Sysmon - Sysmon Config Changed"
2236 + },
2237 + "linux, sysmon, sysmon_event_23": {
2238 + "index": 5,
2239 + "text": "Linux Sysmon - File Removed"
2240 + },
2241 + "local, systemd": {
2242 + "index": 74,
2243 + "text": "Linux Systemd"
2244 + },
2245 + "openvpn, authentication_success": {
2246 + "index": 68,
2247 + "text": "OpenVPN Client - Auth Success"
2248 + },
2249 + "ossec": {
2250 + "index": 15,
2251 + "text": "OSSEC Event"
2252 + },
2253 + "ossec, rootcheck": {
2254 + "index": 19,
2255 + "text": "OSSEC - Rootcheck"
2256 + },
2257 + "ossec, syscheck, syscheck_entry_added, syscheck_file": {
2258 + "index": 9,
2259 + "text": "Syscheck - File Added"
2260 + },
2261 + "ossec, syscheck, syscheck_entry_added, syscheck_registry": {
2262 + "index": 39,
2263 + "text": "Syscheck - Windows Registry (Entry Added)"
2264 + },
2265 + "ossec, syscheck, syscheck_entry_deleted, syscheck_file": {
2266 + "index": 52,
2267 + "text": "Syscheck - File Deleted"
2268 + },
2269 + "ossec, syscheck, syscheck_entry_deleted, syscheck_registry": {
2270 + "index": 45,
2271 + "text": "Syscheck - Windows Registry (Entry Deleted)"
2272 + },
2273 + "ossec, syscheck, syscheck_entry_modified, syscheck_file": {
2274 + "index": 14,
2275 + "text": "Syscheck - File Modified"
2276 + },
2277 + "ossec, syscheck, syscheck_entry_modified, syscheck_registry": {
2278 + "index": 30,
2279 + "text": "Syscheck - Windows Registry (Entry Modified)"
2280 + },
2281 + "pam, syslog": {
2282 + "index": 18,
2283 + "text": "Linux PAM"
2284 + },
2285 + "pam, syslog, authentication_failed": {
2286 + "index": 67,
2287 + "text": "Linux PAM - Auth Failed"
2288 + },
2289 + "pam, syslog, authentication_success": {
2290 + "index": 12,
2291 + "text": "Linux PAM - Auth Success"
2292 + },
2293 + "sca": {
2294 + "index": 17,
2295 + "text": "Security Config Assessment"
2296 + },
2297 + "syslog, adduser": {
2298 + "index": 54,
2299 + "text": "Linux - User Added"
2300 + },
2301 + "syslog, dpkg": {
2302 + "index": 11,
2303 + "text": "Lunux dpkg"
2304 + },
2305 + "syslog, dpkg, config_changed": {
2306 + "index": 10,
2307 + "text": "Linux dpkg - Config Changed"
2308 + },
2309 + "syslog, errors, service_availability": {
2310 + "index": 75,
2311 + "text": "Linux Syslog - System Error"
2312 + },
2313 + "syslog, linuxkernel": {
2314 + "index": 57,
2315 + "text": "Linux - Kernel Event"
2316 + },
2317 + "syslog, linuxkernel, promisc": {
2318 + "index": 29,
2319 + "text": "Linux Kernel - Promisc. Interface"
2320 + },
2321 + "syslog, sshd, authentication_success": {
2322 + "index": 13,
2323 + "text": "SSH - Auth Success"
2324 + },
2325 + "syslog, sshd, recon": {
2326 + "index": 51,
2327 + "text": "Linux - SSH Daemon Alert"
2328 + },
2329 + "syslog, sudo": {
2330 + "index": 16,
2331 + "text": "Lunux - Sudo"
2332 + },
2333 + "threat_intel, alienvault, otx_alert": {
2334 + "index": 63,
2335 + "text": "Threat Intel - AlienVault OTX IoC Alert"
2336 + },
2337 + "threat_intel, misp, misp_alert": {
2338 + "index": 40,
2339 + "text": "Threat Intel - MISP IoC Alert"
2340 + },
2341 + "threat_intel, opencti, opencti_alert": {
2342 + "index": 62,
2343 + "text": "Threat Intel - OpenCTI IoC Alert"
2344 + },
2345 + "threat_intel, opencti, opencti_error": {
2346 + "index": 64,
2347 + "text": "Threat Intel - OpenCTI API Error"
2348 + },
2349 + "usb": {
2350 + "index": 69,
2351 + "text": "USB Port Event"
2352 + },
2353 + "vulnerability-detector": {
2354 + "index": 0,
2355 + "text": "Vulnerability Detector"
2356 + },
2357 + "vulnerability-detector, snyk": {
2358 + "index": 55,
2359 + "text": "Vulnerability Detector - Docker Images"
2360 + },
2361 + "windows, inventory": {
2362 + "index": 27,
2363 + "text": "Windows Agent Inventory"
2364 + },
2365 + "windows, sysmon, sysmon_event1, windows_sysmon_event1": {
2366 + "index": 48,
2367 + "text": "Windows Sysmon - Process Started"
2368 + },
2369 + "windows, sysmon, sysmon_event1, windows_sysmon_event1, sysmon_anomaly": {
2370 + "index": 77,
2371 + "text": "Windows Sysmon - Process Started Anomaly"
2372 + },
2373 + "windows, sysmon, sysmon_event2": {
2374 + "index": 78,
2375 + "text": "Windows Sysmon - A Process changed File Creation Time"
2376 + },
2377 + "windows, sysmon, sysmon_event3": {
2378 + "index": 36,
2379 + "text": "Windows Sysmon - Network Connection"
2380 + },
2381 + "windows, sysmon, sysmon_event3, sysmon_anomaly": {
2382 + "index": 76,
2383 + "text": "Windows Sysmon - Network Connection Anomaly"
2384 + },
2385 + "windows, sysmon, sysmon_event7": {
2386 + "index": 25,
2387 + "text": "Windows Sysmon - DLL SideLoading"
2388 + },
2389 + "windows, sysmon, sysmon_event_10": {
2390 + "index": 32,
2391 + "text": "Windows Sysmon - Process Injection"
2392 + },
2393 + "windows, sysmon, sysmon_event_11": {
2394 + "index": 20,
2395 + "text": "Windows Sysmon - FileCreate"
2396 + },
2397 + "windows, sysmon, sysmon_event_12": {
2398 + "index": 23,
2399 + "text": "Windows Sysmon - RegistryEvent (Object create and delete)"
2400 + },
2401 + "windows, sysmon, sysmon_event_13": {
2402 + "index": 24,
2403 + "text": "Windows Sysmon - RegistryEvent (ValueSet)"
2404 + },
2405 + "windows, sysmon, sysmon_event_15": {
2406 + "index": 61,
2407 + "text": "Windows Sysmon - FileCreateStreamHash"
2408 + },
2409 + "windows, sysmon, sysmon_event_17": {
2410 + "index": 70,
2411 + "text": "Windows Sysmon - Pipe Created"
2412 + },
2413 + "windows, sysmon, sysmon_event_22": {
2414 + "index": 38,
2415 + "text": "Windows Sysmon - DNS Request"
2416 + },
2417 + "windows, sysmon, sysmon_event_23": {
2418 + "index": 28,
2419 + "text": "Windows Sysmon - File Removed"
2420 + },
2421 + "windows, sysmon, sysmon_event_25": {
2422 + "index": 71,
2423 + "text": "Windows Sysmon - Process Tampering"
2424 + },
2425 + "windows, sysmon, sysmon_process-anomalies": {
2426 + "index": 53,
2427 + "text": "Windows Sysmon - Process Anomalies"
2428 + },
2429 + "windows, system_error": {
2430 + "index": 49,
2431 + "text": "Windows - System Error"
2432 + },
2433 + "windows, windows_application": {
2434 + "index": 31,
2435 + "text": "WinEvtLogs - Application"
2436 + },
2437 + "windows, windows_application, system_error": {
2438 + "index": 59,
2439 + "text": "WinEvtLogs - Application Error"
2440 + },
2441 + "windows, windows_autoruns": {
2442 + "index": 37,
2443 + "text": "Windows Persistent Footholds"
2444 + },
2445 + "windows, windows_defender": {
2446 + "index": 35,
2447 + "text": "Windows Defender"
2448 + },
2449 + "windows, windows_firewall, firewall": {
2450 + "index": 60,
2451 + "text": "Windows - Windows Firewall"
2452 + },
2453 + "windows, windows_logonsessions": {
2454 + "index": 26,
2455 + "text": "Windows Logon Sessions (Snapshot)"
2456 + },
2457 + "windows, windows_powershell": {
2458 + "index": 50,
2459 + "text": "Windows - PowerShell"
2460 + },
2461 + "windows, windows_security": {
2462 + "index": 22,
2463 + "text": "WinEvtLogs - Security"
2464 + },
2465 + "windows, windows_security, authentication_failed": {
2466 + "index": 65,
2467 + "text": "Windows - Failed Authentication"
2468 + },
2469 + "windows, windows_security, authentication_success": {
2470 + "index": 21,
2471 + "text": "Windows - Successful Auths"
2472 + },
2473 + "windows, windows_sigcheck": {
2474 + "index": 42,
2475 + "text": "Windows Exec Analysis"
2476 + },
2477 + "windows, windows_system": {
2478 + "index": 44,
2479 + "text": "WinEvtLogs - System"
2480 + },
2481 + "windows, windows_system, policy_changed": {
2482 + "index": 34,
2483 + "text": "Windows Group Policy"
2484 + },
2485 + "windows, windows_system, system_error": {
2486 + "index": 66,
2487 + "text": "Windows - System Error"
2488 + },
2489 + "yara": {
2490 + "index": 8,
2491 + "text": "Yara MITIGATION Scanner"
2492 + }
2493 + },
2494 + "type": "value"
2495 + }
2496 + ]
2497 + },
2498 + {
2499 + "id": "links",
2500 + "value": [
2501 + {
2502 + "targetBlank": true,
2503 + "title": "VIEW EVENTS",
2504 + "url": "https://grafana.company.local/explore?left=%5B%22now-1h%22,%22now%22,%22SENTINELONE%22,%7B%22refId%22:%22A%22,%22query%22:%22data_groupName:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
2505 + }
2506 + ]
2507 + }
2508 + ]
2509 + },
2510 + {
2511 + "matcher": {
2512 + "id": "byName",
2513 + "options": "Rule Groups"
2514 + },
2515 + "properties": [
2516 + {
2517 + "id": "custom.width",
2518 + "value": 302
2519 + }
2520 + ]
2521 + }
2522 + ]
2523 + },
2524 + "gridPos": {
2525 + "h": 14,
2526 + "w": 6,
2527 + "x": 0,
2528 + "y": 42
2529 + },
2530 + "id": 24,
2531 + "options": {
2532 + "cellHeight": "sm",
2533 + "footer": {
2534 + "countRows": false,
2535 + "fields": "",
2536 + "reducer": [
2537 + "sum"
2538 + ],
2539 + "show": false
2540 + },
2541 + "showHeader": true,
2542 + "sortBy": []
2543 + },
2544 + "pluginVersion": "10.4.2",
2545 + "targets": [
2546 + {
2547 + "bucketAggs": [
2548 + {
2549 + "$$hashKey": "object:332",
2550 + "field": "data_groupName",
2551 + "id": "2",
2552 + "settings": {
2553 + "min_doc_count": 1,
2554 + "order": "desc",
2555 + "orderBy": "_count",
2556 + "size": "0"
2557 + },
2558 + "type": "terms"
2559 + }
2560 + ],
2561 + "datasource": {
2562 + "type": "grafana-opensearch-datasource",
2563 + "uid": "replace_datasource_uid"
2564 + },
2565 + "metrics": [
2566 + {
2567 + "$$hashKey": "object:330",
2568 + "field": "select field",
2569 + "id": "1",
2570 + "meta": {},
2571 + "settings": {},
2572 + "type": "count"
2573 + }
2574 + ],
2575 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
2576 + "refId": "A",
2577 + "timeField": "timestamp"
2578 + }
2579 + ],
2580 + "title": "EVENTS BY GROUP",
2581 + "transformations": [
2582 + {
2583 + "id": "merge",
2584 + "options": {
2585 + "reducers": []
2586 + }
2587 + }
2588 + ],
2589 + "type": "table"
2590 + },
2591 + {
2592 + "datasource": {
2593 + "type": "grafana-opensearch-datasource",
2594 + "uid": "replace_datasource_uid"
2595 + },
2596 + "fieldConfig": {
2597 + "defaults": {
2598 + "color": {
2599 + "mode": "palette-classic"
2600 + },
2601 + "custom": {
2602 + "axisBorderShow": false,
2603 + "axisCenteredZero": false,
2604 + "axisColorMode": "text",
2605 + "axisLabel": "",
2606 + "axisPlacement": "auto",
2607 + "barAlignment": -1,
2608 + "drawStyle": "line",
2609 + "fillOpacity": 0,
2610 + "gradientMode": "none",
2611 + "hideFrom": {
2612 + "legend": false,
2613 + "tooltip": false,
2614 + "viz": false
2615 + },
2616 + "insertNulls": false,
2617 + "lineInterpolation": "linear",
2618 + "lineWidth": 1,
2619 + "pointSize": 5,
2620 + "scaleDistribution": {
2621 + "type": "linear"
2622 + },
2623 + "showPoints": "auto",
2624 + "spanNulls": false,
2625 + "stacking": {
2626 + "group": "A",
2627 + "mode": "normal"
2628 + },
2629 + "thresholdsStyle": {
2630 + "mode": "off"
2631 + }
2632 + },
2633 + "mappings": [],
2634 + "thresholds": {
2635 + "mode": "absolute",
2636 + "steps": [
2637 + {
2638 + "color": "green",
2639 + "value": null
2640 + },
2641 + {
2642 + "color": "red",
2643 + "value": 80
2644 + }
2645 + ]
2646 + }
2647 + },
2648 + "overrides": []
2649 + },
2650 + "gridPos": {
2651 + "h": 14,
2652 + "w": 18,
2653 + "x": 6,
2654 + "y": 42
2655 + },
2656 + "id": 51,
2657 + "options": {
2658 + "legend": {
2659 + "calcs": [],
2660 + "displayMode": "table",
2661 + "placement": "right",
2662 + "showLegend": true
2663 + },
2664 + "tooltip": {
2665 + "mode": "single",
2666 + "sort": "none"
2667 + }
2668 + },
2669 + "targets": [
2670 + {
2671 + "alias": "",
2672 + "bucketAggs": [
2673 + {
2674 + "field": "data_groupName",
2675 + "id": "3",
2676 + "settings": {
2677 + "min_doc_count": "1",
2678 + "order": "desc",
2679 + "orderBy": "_count",
2680 + "size": "10"
2681 + },
2682 + "type": "terms"
2683 + },
2684 + {
2685 + "field": "timestamp",
2686 + "id": "2",
2687 + "settings": {
2688 + "interval": "auto"
2689 + },
2690 + "type": "date_histogram"
2691 + }
2692 + ],
2693 + "datasource": {
2694 + "type": "grafana-opensearch-datasource",
2695 + "uid": "replace_datasource_uid"
2696 + },
2697 + "metrics": [
2698 + {
2699 + "id": "1",
2700 + "type": "count"
2701 + }
2702 + ],
2703 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
2704 + "refId": "A",
2705 + "timeField": "timestamp"
2706 + }
2707 + ],
2708 + "title": "EVENTS BY ALERT GROUP (TOP 10) - HISTOGRAM",
2709 + "transparent": true,
2710 + "type": "timeseries"
2711 + },
2712 + {
2713 + "datasource": {
2714 + "type": "grafana-opensearch-datasource",
2715 + "uid": "replace_datasource_uid"
2716 + },
2717 + "fieldConfig": {
2718 + "defaults": {
2719 + "color": {
2720 + "mode": "thresholds"
2721 + },
2722 + "custom": {
2723 + "align": "auto",
2724 + "cellOptions": {
2725 + "type": "auto"
2726 + },
2727 + "filterable": true,
2728 + "inspect": false
2729 + },
2730 + "mappings": [],
2731 + "thresholds": {
2732 + "mode": "absolute",
2733 + "steps": [
2734 + {
2735 + "color": "green",
2736 + "value": null
2737 + },
2738 + {
2739 + "color": "red",
2740 + "value": 80
2741 + }
2742 + ]
2743 + }
2744 + },
2745 + "overrides": [
2746 + {
2747 + "matcher": {
2748 + "id": "byName",
2749 + "options": "timestamp"
2750 + },
2751 + "properties": [
2752 + {
2753 + "id": "displayName",
2754 + "value": "Date/Time"
2755 + },
2756 + {
2757 + "id": "unit",
2758 + "value": "time: YYYY-MM-DD HH:mm:ss"
2759 + },
2760 + {
2761 + "id": "custom.align"
2762 + }
2763 + ]
2764 + },
2765 + {
2766 + "matcher": {
2767 + "id": "byName",
2768 + "options": "data_computerName"
2769 + },
2770 + "properties": [
2771 + {
2772 + "id": "displayName",
2773 + "value": "AGENT"
2774 + },
2775 + {
2776 + "id": "unit",
2777 + "value": "short"
2778 + },
2779 + {
2780 + "id": "decimals",
2781 + "value": 2
2782 + },
2783 + {
2784 + "id": "custom.align"
2785 + }
2786 + ]
2787 + },
2788 + {
2789 + "matcher": {
2790 + "id": "byName",
2791 + "options": "agent_ip"
2792 + },
2793 + "properties": [
2794 + {
2795 + "id": "displayName",
2796 + "value": "IP ADDRESS"
2797 + },
2798 + {
2799 + "id": "unit",
2800 + "value": "short"
2801 + },
2802 + {
2803 + "id": "decimals",
2804 + "value": 2
2805 + },
2806 + {
2807 + "id": "custom.align"
2808 + }
2809 + ]
2810 + },
2811 + {
2812 + "matcher": {
2813 + "id": "byName",
2814 + "options": "rule_description"
2815 + },
2816 + "properties": [
2817 + {
2818 + "id": "displayName",
2819 + "value": "RULE DESCRIPTION"
2820 + },
2821 + {
2822 + "id": "unit",
2823 + "value": "short"
2824 + },
2825 + {
2826 + "id": "decimals",
2827 + "value": 2
2828 + },
2829 + {
2830 + "id": "custom.align"
2831 + }
2832 + ]
2833 + },
2834 + {
2835 + "matcher": {
2836 + "id": "byName",
2837 + "options": "Date/Time"
2838 + },
2839 + "properties": [
2840 + {
2841 + "id": "custom.width",
2842 + "value": 242
2843 + }
2844 + ]
2845 + },
2846 + {
2847 + "matcher": {
2848 + "id": "byName",
2849 + "options": "AGENT"
2850 + },
2851 + "properties": [
2852 + {
2853 + "id": "custom.width",
2854 + "value": 160
2855 + }
2856 + ]
2857 + },
2858 + {
2859 + "matcher": {
2860 + "id": "byName",
2861 + "options": "MITRE TACTIC"
2862 + },
2863 + "properties": [
2864 + {
2865 + "id": "custom.width",
2866 + "value": 332
2867 + }
2868 + ]
2869 + },
2870 + {
2871 + "matcher": {
2872 + "id": "byName",
2873 + "options": "RULE LEVEL"
2874 + },
2875 + "properties": [
2876 + {
2877 + "id": "custom.width",
2878 + "value": 122
2879 + }
2880 + ]
2881 + },
2882 + {
2883 + "matcher": {
2884 + "id": "byName",
2885 + "options": "IP ADDRESS"
2886 + },
2887 + "properties": [
2888 + {
2889 + "id": "custom.width",
2890 + "value": 163
2891 + }
2892 + ]
2893 + },
2894 + {
2895 + "matcher": {
2896 + "id": "byName",
2897 + "options": "MITRE TECHNIQUE"
2898 + },
2899 + "properties": [
2900 + {
2901 + "id": "custom.width",
2902 + "value": 312
2903 + }
2904 + ]
2905 + },
2906 + {
2907 + "matcher": {
2908 + "id": "byName",
2909 + "options": "rule_id"
2910 + },
2911 + "properties": [
2912 + {
2913 + "id": "custom.width",
2914 + "value": 96
2915 + }
2916 + ]
2917 + },
2918 + {
2919 + "matcher": {
2920 + "id": "byName",
2921 + "options": "EVENT ID"
2922 + },
2923 + "properties": [
2924 + {
2925 + "id": "links",
2926 + "value": [
2927 + {
2928 + "targetBlank": true,
2929 + "title": "VIEW EVENT DETAILS",
2930 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SENTINELONE%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
2931 + }
2932 + ]
2933 + }
2934 + ]
2935 + },
2936 + {
2937 + "matcher": {
2938 + "id": "byName",
2939 + "options": "IP ADD"
2940 + },
2941 + "properties": [
2942 + {
2943 + "id": "custom.width",
2944 + "value": 176
2945 + }
2946 + ]
2947 + },
2948 + {
2949 + "matcher": {
2950 + "id": "byName",
2951 + "options": "EVENT CATEGORY"
2952 + },
2953 + "properties": [
2954 + {
2955 + "id": "custom.width",
2956 + "value": 209
2957 + }
2958 + ]
2959 + },
2960 + {
2961 + "matcher": {
2962 + "id": "byName",
2963 + "options": "USER"
2964 + },
2965 + "properties": [
2966 + {
2967 + "id": "custom.width",
2968 + "value": 218
2969 + }
2970 + ]
2971 + },
2972 + {
2973 + "matcher": {
2974 + "id": "byName",
2975 + "options": "threatClassification"
2976 + },
2977 + "properties": [
2978 + {
2979 + "id": "custom.width",
2980 + "value": 214
2981 + }
2982 + ]
2983 + },
2984 + {
2985 + "matcher": {
2986 + "id": "byName",
2987 + "options": "DESCRIPTION"
2988 + },
2989 + "properties": [
2990 + {
2991 + "id": "custom.width",
2992 + "value": 688
2993 + }
2994 + ]
2995 + }
2996 + ]
2997 + },
2998 + "gridPos": {
2999 + "h": 16,
3000 + "w": 24,
3001 + "x": 0,
3002 + "y": 56
3003 + },
3004 + "id": 27,
3005 + "options": {
3006 + "cellHeight": "sm",
3007 + "footer": {
3008 + "countRows": false,
3009 + "enablePagination": true,
3010 + "fields": "",
3011 + "reducer": [
3012 + "sum"
3013 + ],
3014 + "show": false
3015 + },
3016 + "showHeader": true,
3017 + "sortBy": []
3018 + },
3019 + "pluginVersion": "10.4.2",
3020 + "targets": [
3021 + {
3022 + "bucketAggs": [],
3023 + "datasource": {
3024 + "type": "grafana-opensearch-datasource",
3025 + "uid": "replace_datasource_uid"
3026 + },
3027 + "metrics": [
3028 + {
3029 + "id": "1",
3030 + "settings": {
3031 + "size": "250"
3032 + },
3033 + "type": "raw_data"
3034 + }
3035 + ],
3036 + "query": "eventSeverity:$eventSeverity AND cat:MITIGATION",
3037 + "refId": "A",
3038 + "timeField": "timestamp"
3039 + }
3040 + ],
3041 + "title": "EVENTS",
3042 + "transformations": [
3043 + {
3044 + "id": "filterFieldsByName",
3045 + "options": {
3046 + "include": {
3047 + "names": [
3048 + "timestamp",
3049 + "_id",
3050 + "cat",
3051 + "data_computerName",
3052 + "data_username",
3053 + "deviceAddress",
3054 + "deviceAddress_city_name",
3055 + "eventDesc",
3056 + "eventSeverity",
3057 + "fileName",
3058 + "threatClassification",
3059 + "threatConfidenceLevel"
3060 + ]
3061 + }
3062 + }
3063 + },
3064 + {
3065 + "id": "organize",
3066 + "options": {
3067 + "excludeByName": {
3068 + "@metadata_beat": true,
3069 + "@metadata_type": true,
3070 + "@metadata_version": true,
3071 + "IMPHASH": true,
3072 + "MD5": true,
3073 + "SHA1": true,
3074 + "SHA256": true,
3075 + "_id": false,
3076 + "_index": true,
3077 + "_type": true,
3078 + "accountId": true,
3079 + "accountName": true,
3080 + "activityId": true,
3081 + "activityType": true,
3082 + "activityUuid": true,
3083 + "agentId": true,
3084 + "agentUpdatedVersion": true,
3085 + "agent_ephemeral_id": true,
3086 + "agent_hostname": true,
3087 + "agent_id": true,
3088 + "agent_ip_city_name": true,
3089 + "agent_ip_country_code": true,
3090 + "agent_ip_geolocation": true,
3091 + "agent_type": true,
3092 + "agent_version": true,
3093 + "application_name": true,
3094 + "beats_type": true,
3095 + "collector_node_id": true,
3096 + "comments": true,
3097 + "createdAt": true,
3098 + "data_accountName": true,
3099 + "data_alert_action": true,
3100 + "data_alert_category": true,
3101 + "data_alert_gid": true,
3102 + "data_alert_rev": true,
3103 + "data_alert_severity": true,
3104 + "data_alert_signature": true,
3105 + "data_alert_signature_id": true,
3106 + "data_app_proto": true,
3107 + "data_audit_auid": true,
3108 + "data_audit_command": true,
3109 + "data_audit_euid": true,
3110 + "data_audit_exe": true,
3111 + "data_audit_gid": true,
3112 + "data_audit_id": true,
3113 + "data_audit_pid": true,
3114 + "data_audit_res": true,
3115 + "data_audit_session": true,
3116 + "data_audit_type": true,
3117 + "data_audit_uid": true,
3118 + "data_computerName": false,
3119 + "data_confidenceLevel": true,
3120 + "data_createdAt": true,
3121 + "data_description": true,
3122 + "data_dest_ip": true,
3123 + "data_dest_port": true,
3124 + "data_downloadUrl": true,
3125 + "data_dstuser": true,
3126 + "data_event_type": true,
3127 + "data_exclusionType": true,
3128 + "data_extra_data": true,
3129 + "data_file": true,
3130 + "data_fileContentHash": true,
3131 + "data_fileDisplayName": true,
3132 + "data_fileName": true,
3133 + "data_filePath": true,
3134 + "data_flow_bytes_toclient": true,
3135 + "data_flow_bytes_toserver": true,
3136 + "data_flow_id": true,
3137 + "data_flow_pkts_toclient": true,
3138 + "data_flow_pkts_toserver": true,
3139 + "data_flow_start": true,
3140 + "data_fullScopeDetails": true,
3141 + "data_fullScopeDetailsPath": true,
3142 + "data_globalStatus": true,
3143 + "data_groupName": true,
3144 + "data_http_http_content_type": true,
3145 + "data_http_http_port": true,
3146 + "data_http_length": true,
3147 + "data_http_status": true,
3148 + "data_http_url": true,
3149 + "data_id": true,
3150 + "data_in_iface": true,
3151 + "data_majorVersion": true,
3152 + "data_metadata_flowbits": true,
3153 + "data_metadata_flowints_http_anomaly_count": true,
3154 + "data_metadata_flowints_tcp_retransmission_count": true,
3155 + "data_minorVersion": true,
3156 + "data_osArch": true,
3157 + "data_osFamily": true,
3158 + "data_osquery_action": true,
3159 + "data_osquery_calendarTime": true,
3160 + "data_osquery_columns_address": true,
3161 + "data_osquery_columns_address_city_name": true,
3162 + "data_osquery_columns_address_country_code": true,
3163 + "data_osquery_columns_address_geolocation": true,
3164 + "data_osquery_columns_cmdline": true,
3165 + "data_osquery_columns_cwd": true,
3166 + "data_osquery_columns_description": true,
3167 + "data_osquery_columns_directory": true,
3168 + "data_osquery_columns_disk_bytes_read": true,
3169 + "data_osquery_columns_disk_bytes_written": true,
3170 + "data_osquery_columns_egid": true,
3171 + "data_osquery_columns_euid": true,
3172 + "data_osquery_columns_family": true,
3173 + "data_osquery_columns_fd": true,
3174 + "data_osquery_columns_gid": true,
3175 + "data_osquery_columns_gid_signed": true,
3176 + "data_osquery_columns_host": true,
3177 + "data_osquery_columns_interface": true,
3178 + "data_osquery_columns_local_address": true,
3179 + "data_osquery_columns_local_address_city_name": true,
3180 + "data_osquery_columns_local_address_country_code": true,
3181 + "data_osquery_columns_local_address_geolocation": true,
3182 + "data_osquery_columns_local_port": true,
3183 + "data_osquery_columns_mac": true,
3184 + "data_osquery_columns_name": true,
3185 + "data_osquery_columns_net_namespace": true,
3186 + "data_osquery_columns_nice": true,
3187 + "data_osquery_columns_on_disk": true,
3188 + "data_osquery_columns_parent": true,
3189 + "data_osquery_columns_path": true,
3190 + "data_osquery_columns_pgroup": true,
3191 + "data_osquery_columns_pid": true,
3192 + "data_osquery_columns_port": true,
3193 + "data_osquery_columns_protocol": true,
3194 + "data_osquery_columns_remote_address": true,
3195 + "data_osquery_columns_remote_address_city_name": true,
3196 + "data_osquery_columns_remote_address_country_code": true,
3197 + "data_osquery_columns_remote_address_geolocation": true,
3198 + "data_osquery_columns_remote_port": true,
3199 + "data_osquery_columns_resident_size": true,
3200 + "data_osquery_columns_root": true,
3201 + "data_osquery_columns_sgid": true,
3202 + "data_osquery_columns_shell": true,
3203 + "data_osquery_columns_socket": true,
3204 + "data_osquery_columns_start_time": true,
3205 + "data_osquery_columns_state": true,
3206 + "data_osquery_columns_suid": true,
3207 + "data_osquery_columns_system_time": true,
3208 + "data_osquery_columns_threads": true,
3209 + "data_osquery_columns_time_utc": true,
3210 + "data_osquery_columns_total_size": true,
3211 + "data_osquery_columns_tty": true,
3212 + "data_osquery_columns_type": true,
3213 + "data_osquery_columns_uid": true,
3214 + "data_osquery_columns_uid_signed": true,
3215 + "data_osquery_columns_user": true,
3216 + "data_osquery_columns_user_time": true,
3217 + "data_osquery_columns_username": true,
3218 + "data_osquery_columns_wired_size": true,
3219 + "data_osquery_counter": true,
3220 + "data_osquery_decorations_host_uuid": true,
3221 + "data_osquery_decorations_hostname": true,
3222 + "data_osquery_epoch": true,
3223 + "data_osquery_hostIdentifier": true,
3224 + "data_osquery_name": true,
3225 + "data_osquery_numerics": true,
3226 + "data_osquery_unixTime": true,
3227 + "data_packageId": true,
3228 + "data_platformType": true,
3229 + "data_proto": true,
3230 + "data_sca_check_command": true,
3231 + "data_sca_check_compliance_cis": true,
3232 + "data_sca_check_compliance_cis_csc": true,
3233 + "data_sca_check_compliance_gdpr_IV": true,
3234 + "data_sca_check_compliance_gpg_13": true,
3235 + "data_sca_check_compliance_hipaa": true,
3236 + "data_sca_check_compliance_nist_800_53": true,
3237 + "data_sca_check_compliance_pci_dss": true,
3238 + "data_sca_check_compliance_tsc": true,
3239 + "data_sca_check_description": true,
3240 + "data_sca_check_id": true,
3241 + "data_sca_check_previous_result": true,
3242 + "data_sca_check_rationale": true,
3243 + "data_sca_check_remediation": true,
3244 + "data_sca_check_result": true,
3245 + "data_sca_check_title": true,
3246 + "data_sca_description": true,
3247 + "data_sca_failed": true,
3248 + "data_sca_file": true,
3249 + "data_sca_invalid": true,
3250 + "data_sca_passed": true,
3251 + "data_sca_policy": true,
3252 + "data_sca_policy_id": true,
3253 + "data_sca_scan_id": true,
3254 + "data_sca_score": true,
3255 + "data_sca_total_checks": true,
3256 + "data_sca_type": true,
3257 + "data_scanType": true,
3258 + "data_scopeLevel": true,
3259 + "data_scopeName": true,
3260 + "data_script": true,
3261 + "data_secured": true,
3262 + "data_siteName": true,
3263 + "data_src_ip": true,
3264 + "data_src_ip_city_name": true,
3265 + "data_src_ip_country_code": true,
3266 + "data_src_ip_geolocation": true,
3267 + "data_src_port": true,
3268 + "data_srcip": true,
3269 + "data_srcip_city_name": true,
3270 + "data_srcip_country_code": true,
3271 + "data_srcip_geolocation": true,
3272 + "data_srcuser": true,
3273 + "data_status": true,
3274 + "data_threatClassification": true,
3275 + "data_timestamp": true,
3276 + "data_title": true,
3277 + "data_tls_session_resumed": true,
3278 + "data_tls_version": true,
3279 + "data_totalNewDevices": true,
3280 + "data_tx_id": true,
3281 + "data_type": true,
3282 + "data_unknown": true,
3283 + "data_unsecured": true,
3284 + "data_unsupported": true,
3285 + "data_value": true,
3286 + "data_version": true,
3287 + "data_version_city_name": true,
3288 + "data_version_country_code": true,
3289 + "data_version_geolocation": true,
3290 + "data_win_eventXML_binaryData": true,
3291 + "data_win_eventXML_binaryDataSize": true,
3292 + "data_win_eventXML_param1": true,
3293 + "data_win_eventdata_authenticationPackageName": true,
3294 + "data_win_eventdata_callTrace": true,
3295 + "data_win_eventdata_commandLine": true,
3296 + "data_win_eventdata_company": true,
3297 + "data_win_eventdata_creationUtcTime": true,
3298 + "data_win_eventdata_currentDirectory": true,
3299 + "data_win_eventdata_description": true,
3300 + "data_win_eventdata_destinationHostname": true,
3301 + "data_win_eventdata_destinationIp": true,
3302 + "data_win_eventdata_destinationIp_city_name": true,
3303 + "data_win_eventdata_destinationIp_country_code": true,
3304 + "data_win_eventdata_destinationIp_geolocation": true,
3305 + "data_win_eventdata_destinationIsIpv6": true,
3306 + "data_win_eventdata_destinationPort": true,
3307 + "data_win_eventdata_destinationPortName": true,
3308 + "data_win_eventdata_details": true,
3309 + "data_win_eventdata_elevatedToken": true,
3310 + "data_win_eventdata_eventType": true,
3311 + "data_win_eventdata_fileVersion": true,
3312 + "data_win_eventdata_fileVersion_city_name": true,
3313 + "data_win_eventdata_fileVersion_country_code": true,
3314 + "data_win_eventdata_fileVersion_geolocation": true,
3315 + "data_win_eventdata_grantedAccess": true,
3316 + "data_win_eventdata_hashes": true,
3317 + "data_win_eventdata_image": true,
3318 + "data_win_eventdata_imageLoaded": true,
3319 + "data_win_eventdata_impersonationLevel": true,
3320 + "data_win_eventdata_initiated": true,
3321 + "data_win_eventdata_integrityLevel": true,
3322 + "data_win_eventdata_ipAddress": true,
3323 + "data_win_eventdata_ipPort": true,
3324 + "data_win_eventdata_keyLength": true,
3325 + "data_win_eventdata_logonGuid": true,
3326 + "data_win_eventdata_logonId": true,
3327 + "data_win_eventdata_logonProcessName": true,
3328 + "data_win_eventdata_logonType": true,
3329 + "data_win_eventdata_originalFileName": true,
3330 + "data_win_eventdata_param1": true,
3331 + "data_win_eventdata_param2": true,
3332 + "data_win_eventdata_param3": true,
3333 + "data_win_eventdata_param4": true,
3334 + "data_win_eventdata_parentCommandLine": true,
3335 + "data_win_eventdata_parentImage": true,
3336 + "data_win_eventdata_parentProcessGuid": true,
3337 + "data_win_eventdata_parentProcessId": true,
3338 + "data_win_eventdata_processGuid": true,
3339 + "data_win_eventdata_processId": true,
3340 + "data_win_eventdata_processName": true,
3341 + "data_win_eventdata_product": true,
3342 + "data_win_eventdata_protocol": true,
3343 + "data_win_eventdata_queryName": true,
3344 + "data_win_eventdata_queryResults": true,
3345 + "data_win_eventdata_queryStatus": true,
3346 + "data_win_eventdata_ruleName": true,
3347 + "data_win_eventdata_serviceName": true,
3348 + "data_win_eventdata_serviceSid": true,
3349 + "data_win_eventdata_signature": true,
3350 + "data_win_eventdata_signatureStatus": true,
3351 + "data_win_eventdata_signed": true,
3352 + "data_win_eventdata_sourceHostname": true,
3353 + "data_win_eventdata_sourceImage": true,
3354 + "data_win_eventdata_sourceIp": true,
3355 + "data_win_eventdata_sourceIp_city_name": true,
3356 + "data_win_eventdata_sourceIp_country_code": true,
3357 + "data_win_eventdata_sourceIp_geolocation": true,
3358 + "data_win_eventdata_sourceIsIpv6": true,
3359 + "data_win_eventdata_sourcePort": true,
3360 + "data_win_eventdata_sourceProcessGUID": true,
3361 + "data_win_eventdata_sourceProcessId": true,
3362 + "data_win_eventdata_sourceThreadId": true,
3363 + "data_win_eventdata_status": true,
3364 + "data_win_eventdata_subjectDomainName": true,
3365 + "data_win_eventdata_subjectLogonId": true,
3366 + "data_win_eventdata_subjectUserName": true,
3367 + "data_win_eventdata_subjectUserSid": true,
3368 + "data_win_eventdata_targetDomainName": true,
3369 + "data_win_eventdata_targetFilename": true,
3370 + "data_win_eventdata_targetImage": true,
3371 + "data_win_eventdata_targetLinkedLogonId": true,
3372 + "data_win_eventdata_targetLogonId": true,
3373 + "data_win_eventdata_targetObject": true,
3374 + "data_win_eventdata_targetProcessGUID": true,
3375 + "data_win_eventdata_targetProcessId": true,
3376 + "data_win_eventdata_targetUserName": true,
3377 + "data_win_eventdata_targetUserSid": true,
3378 + "data_win_eventdata_terminalSessionId": true,
3379 + "data_win_eventdata_ticketEncryptionType": true,
3380 + "data_win_eventdata_ticketOptions": true,
3381 + "data_win_eventdata_user": true,
3382 + "data_win_eventdata_utcTime": true,
3383 + "data_win_eventdata_virtualAccount": true,
3384 + "data_win_system_channel": true,
3385 + "data_win_system_computer": true,
3386 + "data_win_system_eventID": true,
3387 + "data_win_system_eventRecordID": true,
3388 + "data_win_system_eventSourceName": true,
3389 + "data_win_system_keywords": true,
3390 + "data_win_system_level": true,
3391 + "data_win_system_message": true,
3392 + "data_win_system_opcode": true,
3393 + "data_win_system_processID": true,
3394 + "data_win_system_providerGuid": true,
3395 + "data_win_system_providerName": true,
3396 + "data_win_system_severityValue": true,
3397 + "data_win_system_systemTime": true,
3398 + "data_win_system_task": true,
3399 + "data_win_system_threadID": true,
3400 + "data_win_system_version": true,
3401 + "decoder_name": true,
3402 + "decoder_parent": true,
3403 + "description": true,
3404 + "deviceAddress_city_name": true,
3405 + "deviceAddress_country_code": true,
3406 + "deviceAddress_geolocation": true,
3407 + "deviceHostFqdn": true,
3408 + "deviceHostName": true,
3409 + "dns_query": true,
3410 + "dns_query_threat_indicated": true,
3411 + "dst_ip": true,
3412 + "dst_ip_city_name": true,
3413 + "dst_ip_country_code": true,
3414 + "dst_ip_geolocation": true,
3415 + "dst_ip_threat_indicated": true,
3416 + "dst_port": true,
3417 + "ecs_version": true,
3418 + "error": true,
3419 + "eventID": true,
3420 + "event_hash": true,
3421 + "facility": true,
3422 + "facility_num": true,
3423 + "fileHashMd5": true,
3424 + "fileHashSha256": true,
3425 + "fileName": false,
3426 + "file_path": true,
3427 + "firewall_rule_name": true,
3428 + "full_log": false,
3429 + "gl2_accounted_message_size": true,
3430 + "gl2_message_id": true,
3431 + "gl2_remote_ip": true,
3432 + "gl2_remote_port": true,
3433 + "gl2_source_collector": true,
3434 + "gl2_source_input": true,
3435 + "gl2_source_node": true,
3436 + "groupId": true,
3437 + "groupName": true,
3438 + "hash": true,
3439 + "hash_md5": true,
3440 + "hash_sha1": true,
3441 + "hash_sha256": true,
3442 + "highlight": true,
3443 + "host_architecture": true,
3444 + "host_containerized": true,
3445 + "host_hostname": true,
3446 + "host_id": true,
3447 + "host_ip": true,
3448 + "host_mac": true,
3449 + "host_name": true,
3450 + "host_os_codename": true,
3451 + "host_os_kernel": true,
3452 + "host_os_name": true,
3453 + "host_os_platform": true,
3454 + "host_os_version": true,
3455 + "hostname": true,
3456 + "id": true,
3457 + "input_type": true,
3458 + "ip": true,
3459 + "ip_city_name": true,
3460 + "ip_country_code": true,
3461 + "ip_geolocation": true,
3462 + "level": true,
3463 + "location": true,
3464 + "log_file_path": true,
3465 + "log_offset": true,
3466 + "manager_name": true,
3467 + "message": true,
3468 + "module": true,
3469 + "notificationScope": true,
3470 + "originatorName": true,
3471 + "originatorVersion": true,
3472 + "originatorVersion_city_name": true,
3473 + "originatorVersion_country_code": true,
3474 + "originatorVersion_geolocation": true,
3475 + "osFamily": true,
3476 + "parent_process_cmd_line": true,
3477 + "parent_process_id": true,
3478 + "parent_process_image": true,
3479 + "pid": true,
3480 + "predecoder_hostname": true,
3481 + "predecoder_program_name": true,
3482 + "predecoder_timestamp": true,
3483 + "previous_log": true,
3484 + "previous_output": true,
3485 + "process_cmd_line": true,
3486 + "process_id": true,
3487 + "process_image": true,
3488 + "process_name": true,
3489 + "protocol": true,
3490 + "rt": true,
3491 + "rule_cis": true,
3492 + "rule_cis_csc": true,
3493 + "rule_firedtimes": true,
3494 + "rule_gdpr": true,
3495 + "rule_gdpr_IV": true,
3496 + "rule_gpg13": true,
3497 + "rule_gpg_13": true,
3498 + "rule_hipaa": true,
3499 + "rule_id": false,
3500 + "rule_info": true,
3501 + "rule_mail": true,
3502 + "rule_mitre_id": true,
3503 + "rule_mitre_tactic": false,
3504 + "rule_nist_800_53": true,
3505 + "rule_pci_dss": true,
3506 + "rule_tsc": true,
3507 + "scanType": true,
3508 + "scanid": true,
3509 + "secondaryDescription": true,
3510 + "secured": true,
3511 + "service": true,
3512 + "siteId": true,
3513 + "siteName": true,
3514 + "software_package": true,
3515 + "software_vendor": true,
3516 + "sort": true,
3517 + "source": true,
3518 + "sourceAgentId": true,
3519 + "sourceAgentUuid": true,
3520 + "sourceDnsDomain": true,
3521 + "sourceFqdn": true,
3522 + "sourceGroupId": true,
3523 + "sourceGroupName": true,
3524 + "sourceHostName": true,
3525 + "sourceIpAddresses_0": true,
3526 + "sourceIpAddresses_1": true,
3527 + "sourceIpAddresses_1_city_name": true,
3528 + "sourceIpAddresses_1_country_code": true,
3529 + "sourceIpAddresses_1_geolocation": true,
3530 + "sourceIpAddresses_2": true,
3531 + "sourceIpAddresses_2_city_name": true,
3532 + "sourceIpAddresses_2_country_code": true,
3533 + "sourceIpAddresses_2_geolocation": true,
3534 + "sourceIpAddresses_3": true,
3535 + "sourceIpAddresses_3_city_name": true,
3536 + "sourceIpAddresses_3_country_code": true,
3537 + "sourceIpAddresses_3_geolocation": true,
3538 + "sourceIpAddresses_4": true,
3539 + "sourceIpAddresses_4_city_name": true,
3540 + "sourceIpAddresses_4_country_code": true,
3541 + "sourceIpAddresses_4_geolocation": true,
3542 + "sourceIpAddresses_5": true,
3543 + "sourceMacAddresses_0": true,
3544 + "sourceMacAddresses_1": true,
3545 + "sourceMgmtPrecievedAddress": true,
3546 + "sourceMgmtPrecievedAddress_city_name": true,
3547 + "sourceMgmtPrecievedAddress_country_code": true,
3548 + "sourceMgmtPrecievedAddress_geolocation": true,
3549 + "sourceNetworkState": true,
3550 + "sourceOsRevision": true,
3551 + "sourceOsType": true,
3552 + "sourceThreatCount": true,
3553 + "sourceUserId": true,
3554 + "sourceUserName": true,
3555 + "source_city_name": true,
3556 + "source_country_code": true,
3557 + "source_geolocation": true,
3558 + "src_ip": true,
3559 + "src_ip_city_name": true,
3560 + "src_ip_country_code": true,
3561 + "src_ip_geolocation": true,
3562 + "src_port": true,
3563 + "streams": true,
3564 + "syscheck_attrs_after": true,
3565 + "syscheck_audit_effective_user_id": true,
3566 + "syscheck_audit_effective_user_name": true,
3567 + "syscheck_audit_group_id": true,
3568 + "syscheck_audit_group_name": true,
3569 + "syscheck_audit_login_user_id": true,
3570 + "syscheck_audit_login_user_name": true,
3571 + "syscheck_audit_process_cwd": true,
3572 + "syscheck_audit_process_id": true,
3573 + "syscheck_audit_process_name": true,
3574 + "syscheck_audit_process_parent_cwd": true,
3575 + "syscheck_audit_process_parent_name": true,
3576 + "syscheck_audit_process_ppid": true,
3577 + "syscheck_audit_user_id": true,
3578 + "syscheck_audit_user_name": true,
3579 + "syscheck_changed_attributes": true,
3580 + "syscheck_event": true,
3581 + "syscheck_gid_after": true,
3582 + "syscheck_gname_after": true,
3583 + "syscheck_hard_links": true,
3584 + "syscheck_inode_after": true,
3585 + "syscheck_inode_before": true,
3586 + "syscheck_md5_after": true,
3587 + "syscheck_md5_before": true,
3588 + "syscheck_mode": true,
3589 + "syscheck_mtime_after": true,
3590 + "syscheck_mtime_before": true,
3591 + "syscheck_path": true,
3592 + "syscheck_perm_after": true,
3593 + "syscheck_perm_before": true,
3594 + "syscheck_sha1_after": true,
3595 + "syscheck_sha1_before": true,
3596 + "syscheck_sha256_after": true,
3597 + "syscheck_sha256_before": true,
3598 + "syscheck_size_after": true,
3599 + "syscheck_size_before": true,
3600 + "syscheck_uid_after": true,
3601 + "syscheck_uname_after": true,
3602 + "syscheck_win_perm_after": true,
3603 + "syscheck_win_perm_after_0_allowed": true,
3604 + "syscheck_win_perm_after_0_name": true,
3605 + "syscheck_win_perm_after_1_allowed": true,
3606 + "syscheck_win_perm_after_1_name": true,
3607 + "syscheck_win_perm_after_2_allowed": true,
3608 + "syscheck_win_perm_after_2_name": true,
3609 + "syscheck_win_perm_after_3_allowed": true,
3610 + "syscheck_win_perm_after_3_name": true,
3611 + "syslog_customer": true,
3612 + "syslog_tag": true,
3613 + "syslog_type": true,
3614 + "sysmon_event_description": true,
3615 + "threatClassification": false,
3616 + "threatClassificationSource": true,
3617 + "threatClassifier": true,
3618 + "threatCommandLineArguments": true,
3619 + "threatConfidenceLevel": false,
3620 + "threatDetectingEngine": true,
3621 + "threatDetectionTime": true,
3622 + "threatID": true,
3623 + "threatId": true,
3624 + "threatIndicatorsList_0": true,
3625 + "threatIndicatorsList_1": true,
3626 + "threatIndicatorsList_10": true,
3627 + "threatIndicatorsList_11": true,
3628 + "threatIndicatorsList_12": true,
3629 + "threatIndicatorsList_13": true,
3630 + "threatIndicatorsList_14": true,
3631 + "threatIndicatorsList_15": true,
3632 + "threatIndicatorsList_16": true,
3633 + "threatIndicatorsList_17": true,
3634 + "threatIndicatorsList_18": true,
3635 + "threatIndicatorsList_19": true,
3636 + "threatIndicatorsList_2": true,
3637 + "threatIndicatorsList_20": true,
3638 + "threatIndicatorsList_21": true,
3639 + "threatIndicatorsList_22": true,
3640 + "threatIndicatorsList_23": true,
3641 + "threatIndicatorsList_24": true,
3642 + "threatIndicatorsList_25": true,
3643 + "threatIndicatorsList_26": true,
3644 + "threatIndicatorsList_27": true,
3645 + "threatIndicatorsList_28": true,
3646 + "threatIndicatorsList_29": true,
3647 + "threatIndicatorsList_3": true,
3648 + "threatIndicatorsList_30": true,
3649 + "threatIndicatorsList_31": true,
3650 + "threatIndicatorsList_32": true,
3651 + "threatIndicatorsList_33": true,
3652 + "threatIndicatorsList_34": true,
3653 + "threatIndicatorsList_35": true,
3654 + "threatIndicatorsList_36": true,
3655 + "threatIndicatorsList_37": true,
3656 + "threatIndicatorsList_38": true,
3657 + "threatIndicatorsList_39": true,
3658 + "threatIndicatorsList_4": true,
3659 + "threatIndicatorsList_40": true,
3660 + "threatIndicatorsList_41": true,
3661 + "threatIndicatorsList_42": true,
3662 + "threatIndicatorsList_43": true,
3663 + "threatIndicatorsList_44": true,
3664 + "threatIndicatorsList_45": true,
3665 + "threatIndicatorsList_46": true,
3666 + "threatIndicatorsList_47": true,
3667 + "threatIndicatorsList_48": true,
3668 + "threatIndicatorsList_49": true,
3669 + "threatIndicatorsList_5": true,
3670 + "threatIndicatorsList_50": true,
3671 + "threatIndicatorsList_51": true,
3672 + "threatIndicatorsList_52": true,
3673 + "threatIndicatorsList_53": true,
3674 + "threatIndicatorsList_54": true,
3675 + "threatIndicatorsList_55": true,
3676 + "threatIndicatorsList_56": true,
3677 + "threatIndicatorsList_6": true,
3678 + "threatIndicatorsList_7": true,
3679 + "threatIndicatorsList_8": true,
3680 + "threatIndicatorsList_9": true,
3681 + "threatMitigationStatus": true,
3682 + "threatMitigationStatusID": true,
3683 + "threatProcessUser": true,
3684 + "threatStoryline": true,
3685 + "threat_ids": true,
3686 + "threat_indicated": true,
3687 + "threat_names": true,
3688 + "time": true,
3689 + "timestamp": false,
3690 + "totalNewDevices": true,
3691 + "unknown": true,
3692 + "unsecured": true,
3693 + "unsupported": true,
3694 + "updatedAt": true,
3695 + "userId": true,
3696 + "user_name": true,
3697 + "vendor": true,
3698 + "win_registry_key": true,
3699 + "win_system_eventID": true,
3700 + "windows_auth_package": true,
3701 + "windows_domain": true,
3702 + "windows_event_id": true,
3703 + "windows_event_severity": true,
3704 + "windows_logon_type": true
3705 + },
3706 + "indexByName": {
3707 + "_id": 1,
3708 + "_index": 5,
3709 + "_type": 6,
3710 + "accountId": 7,
3711 + "accountName": 8,
3712 + "activityId": 9,
3713 + "activityType": 10,
3714 + "activityUuid": 11,
3715 + "agentId": 12,
3716 + "agentUpdatedVersion": 13,
3717 + "application_name": 14,
3718 + "cat": 15,
3719 + "comments": 16,
3720 + "createdAt": 17,
3721 + "data_accountName": 18,
3722 + "data_computerName": 2,
3723 + "data_confidenceLevel": 19,
3724 + "data_downloadUrl": 20,
3725 + "data_fileContentHash": 21,
3726 + "data_fileDisplayName": 22,
3727 + "data_filePath": 23,
3728 + "data_fullScopeDetails": 24,
3729 + "data_fullScopeDetailsPath": 25,
3730 + "data_globalStatus": 26,
3731 + "data_groupName": 27,
3732 + "data_scopeLevel": 28,
3733 + "data_scopeName": 29,
3734 + "data_siteName": 30,
3735 + "data_threatClassification": 31,
3736 + "data_username": 32,
3737 + "description": 33,
3738 + "deviceAddress": 3,
3739 + "deviceAddress_city_name": 34,
3740 + "deviceAddress_country_code": 35,
3741 + "deviceAddress_geolocation": 36,
3742 + "deviceHostFqdn": 37,
3743 + "deviceHostName": 38,
3744 + "eventDesc": 39,
3745 + "eventID": 40,
3746 + "eventSeverity": 4,
3747 + "facility": 41,
3748 + "facility_num": 42,
3749 + "fileHashMd5": 43,
3750 + "fileHashSha256": 44,
3751 + "fileName": 45,
3752 + "gl2_accounted_message_size": 46,
3753 + "gl2_message_id": 47,
3754 + "gl2_remote_ip": 48,
3755 + "gl2_remote_port": 49,
3756 + "gl2_source_input": 50,
3757 + "gl2_source_node": 51,
3758 + "groupId": 52,
3759 + "groupName": 53,
3760 + "hash": 54,
3761 + "highlight": 55,
3762 + "level": 56,
3763 + "message": 57,
3764 + "notificationScope": 58,
3765 + "originatorName": 59,
3766 + "originatorVersion": 60,
3767 + "osFamily": 61,
3768 + "process_id": 62,
3769 + "rt": 63,
3770 + "secondaryDescription": 64,
3771 + "siteId": 65,
3772 + "siteName": 66,
3773 + "sort": 67,
3774 + "source": 68,
3775 + "sourceAgentId": 69,
3776 + "sourceAgentUuid": 70,
3777 + "sourceDnsDomain": 71,
3778 + "sourceFqdn": 72,
3779 + "sourceGroupId": 73,
3780 + "sourceGroupName": 74,
3781 + "sourceHostName": 75,
3782 + "sourceIpAddresses_0": 76,
3783 + "sourceIpAddresses_1": 77,
3784 + "sourceMacAddresses_0": 78,
3785 + "sourceMacAddresses_1": 79,
3786 + "sourceMgmtPrecievedAddress": 80,
3787 + "sourceMgmtPrecievedAddress_city_name": 81,
3788 + "sourceMgmtPrecievedAddress_country_code": 82,
3789 + "sourceMgmtPrecievedAddress_geolocation": 83,
3790 + "sourceNetworkState": 84,
3791 + "sourceOsRevision": 85,
3792 + "sourceOsType": 86,
3793 + "sourceThreatCount": 87,
3794 + "source_city_name": 88,
3795 + "source_country_code": 89,
3796 + "source_geolocation": 90,
3797 + "streams": 91,
3798 + "syslog_customer": 92,
3799 + "syslog_type": 93,
3800 + "threatClassification": 94,
3801 + "threatClassificationSource": 95,
3802 + "threatClassifier": 96,
3803 + "threatCommandLineArguments": 97,
3804 + "threatConfidenceLevel": 98,
3805 + "threatDetectingEngine": 99,
3806 + "threatDetectionTime": 100,
3807 + "threatID": 101,
3808 + "threatId": 102,
3809 + "threatMitigationStatus": 103,
3810 + "threatMitigationStatusID": 104,
3811 + "threatProcessUser": 105,
3812 + "threatStoryline": 106,
3813 + "timestamp": 0,
3814 + "updatedAt": 107,
3815 + "userId": 108,
3816 + "vendor": 109
3817 + },
3818 + "renameByName": {
3819 + "_id": "EVENT ID",
3820 + "cat": "EVENT CATEGORY",
3821 + "data_computerName": "AGENT",
3822 + "data_username": "USER",
3823 + "deviceAddress": "IP ADD",
3824 + "eventDesc": "DESCRIPTION",
3825 + "eventSeverity": "SEVERITY",
3826 + "rule_id": "RULE ID",
3827 + "rule_mitre_tactic": "MITRE TACTIC",
3828 + "rule_mitre_technique": "MITRE TECHNIQUE",
3829 + "timestamp": "DATE/TIME"
3830 + }
3831 + }
3832 + }
3833 + ],
3834 + "transparent": true,
3835 + "type": "table"
3836 + }
3837 + ],
3838 + "refresh": "",
3839 + "schemaVersion": 39,
3840 + "tags": [
3841 + "EDR"
3842 + ],
3843 + "templating": {
3844 + "list": [
3845 + {
3846 + "datasource": {
3847 + "type": "grafana-opensearch-datasource",
3848 + "uid": "replace_datasource_uid"
3849 + },
3850 + "filters": [],
3851 + "hide": 0,
3852 + "label": "",
3853 + "name": "Filters",
3854 + "skipUrlSync": false,
3855 + "type": "adhoc"
3856 + },
3857 + {
3858 + "current": {
3859 + "selected": false,
3860 + "text": "All",
3861 + "value": "$__all"
3862 + },
3863 + "datasource": {
3864 + "type": "grafana-opensearch-datasource",
3865 + "uid": "replace_datasource_uid"
3866 + },
3867 + "definition": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:MITIGATION\"}",
3868 + "hide": 0,
3869 + "includeAll": true,
3870 + "label": "Event Severity",
3871 + "multi": false,
3872 + "name": "eventSeverity",
3873 + "options": [],
3874 + "query": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:MITIGATION\"}",
3875 + "refresh": 2,
3876 + "regex": "",
3877 + "skipUrlSync": false,
3878 + "sort": 0,
3879 + "type": "query"
3880 + }
3881 + ]
3882 + },
3883 + "time": {
3884 + "from": "now-30d",
3885 + "to": "now"
3886 + },
3887 + "timepicker": {
3888 + "refresh_intervals": [
3889 + "5s",
3890 + "10s",
3891 + "30s",
3892 + "1m",
3893 + "5m",
3894 + "15m",
3895 + "30m",
3896 + "1h",
3897 + "2h",
3898 + "1d"
3899 + ],
3900 + "time_options": [
3901 + "5m",
3902 + "15m",
3903 + "1h",
3904 + "6h",
3905 + "12h",
3906 + "24h",
3907 + "2d",
3908 + "7d",
3909 + "30d"
3910 + ]
3911 + },
3912 + "timezone": "",
3913 + "title": "EDR - SENTINELONE EPP - MITIGATION",
3914 + "weekStart": ""
3915 +}
backend/app/connectors/grafana/dashboards/Sentinelone/sentinelone_epp_operations.json new
+1919
@@ -0,0 +1,1919 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "EDR"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "grafana-opensearch-datasource",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "orange",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 18,
82 + "options": {
83 + "colorMode": "value",
84 + "graphMode": "area",
85 + "justifyMode": "auto",
86 + "orientation": "horizontal",
87 + "reduceOptions": {
88 + "calcs": [
89 + "sum"
90 + ],
91 + "fields": "",
92 + "values": false
93 + },
94 + "showPercentChange": false,
95 + "text": {},
96 + "textMode": "auto",
97 + "wideLayout": true
98 + },
99 + "pluginVersion": "10.4.2",
100 + "targets": [
101 + {
102 + "bucketAggs": [
103 + {
104 + "$$hashKey": "object:331",
105 + "field": "timestamp",
106 + "id": "2",
107 + "settings": {
108 + "interval": "auto",
109 + "min_doc_count": 0,
110 + "trimEdges": 0
111 + },
112 + "type": "date_histogram"
113 + }
114 + ],
115 + "datasource": {
116 + "type": "grafana-opensearch-datasource",
117 + "uid": "replace_datasource_uid"
118 + },
119 + "metrics": [
120 + {
121 + "$$hashKey": "object:329",
122 + "field": "select field",
123 + "id": "1",
124 + "type": "count"
125 + }
126 + ],
127 + "query": "eventSeverity:$eventSeverity AND cat:OPERATIONS",
128 + "refId": "A",
129 + "timeField": "timestamp"
130 + }
131 + ],
132 + "title": "EVENTS (TOTAL)",
133 + "type": "stat"
134 + },
135 + {
136 + "datasource": {
137 + "type": "grafana-opensearch-datasource",
138 + "uid": "replace_datasource_uid"
139 + },
140 + "fieldConfig": {
141 + "defaults": {
142 + "color": {
143 + "mode": "thresholds"
144 + },
145 + "custom": {
146 + "align": "auto",
147 + "cellOptions": {
148 + "type": "auto"
149 + },
150 + "inspect": false
151 + },
152 + "mappings": [],
153 + "thresholds": {
154 + "mode": "absolute",
155 + "steps": [
156 + {
157 + "color": "orange",
158 + "value": null
159 + }
160 + ]
161 + }
162 + },
163 + "overrides": [
164 + {
165 + "matcher": {
166 + "id": "byName",
167 + "options": "Time"
168 + },
169 + "properties": [
170 + {
171 + "id": "displayName",
172 + "value": "Time"
173 + },
174 + {
175 + "id": "unit",
176 + "value": "time: YYYY-MM-DD HH:mm:ss"
177 + },
178 + {
179 + "id": "custom.align"
180 + }
181 + ]
182 + },
183 + {
184 + "matcher": {
185 + "id": "byName",
186 + "options": "Count"
187 + },
188 + "properties": [
189 + {
190 + "id": "displayName",
191 + "value": "EVENTS"
192 + },
193 + {
194 + "id": "unit",
195 + "value": "short"
196 + },
197 + {
198 + "id": "decimals",
199 + "value": -1
200 + },
201 + {
202 + "id": "custom.cellOptions",
203 + "value": {
204 + "type": "color-background"
205 + }
206 + },
207 + {
208 + "id": "custom.align"
209 + },
210 + {
211 + "id": "thresholds",
212 + "value": {
213 + "mode": "absolute",
214 + "steps": [
215 + {
216 + "color": "dark-orange",
217 + "value": null
218 + }
219 + ]
220 + }
221 + }
222 + ]
223 + },
224 + {
225 + "matcher": {
226 + "id": "byName",
227 + "options": "data_groupName"
228 + },
229 + "properties": [
230 + {
231 + "id": "displayName",
232 + "value": "ALERTS BY TYPE"
233 + },
234 + {
235 + "id": "unit",
236 + "value": "short"
237 + },
238 + {
239 + "id": "decimals",
240 + "value": -1
241 + },
242 + {
243 + "id": "custom.cellOptions",
244 + "value": {
245 + "type": "color-background"
246 + }
247 + },
248 + {
249 + "id": "custom.align"
250 + }
251 + ]
252 + }
253 + ]
254 + },
255 + "gridPos": {
256 + "h": 7,
257 + "w": 7,
258 + "x": 4,
259 + "y": 0
260 + },
261 + "id": 57,
262 + "options": {
263 + "cellHeight": "sm",
264 + "footer": {
265 + "countRows": false,
266 + "fields": "",
267 + "reducer": [
268 + "sum"
269 + ],
270 + "show": false
271 + },
272 + "showHeader": true
273 + },
274 + "pluginVersion": "10.4.2",
275 + "targets": [
276 + {
277 + "bucketAggs": [
278 + {
279 + "fake": true,
280 + "field": "data_scopeName",
281 + "id": "4",
282 + "settings": {
283 + "min_doc_count": 1,
284 + "order": "desc",
285 + "orderBy": "_count",
286 + "size": "0"
287 + },
288 + "type": "terms"
289 + }
290 + ],
291 + "datasource": {
292 + "type": "grafana-opensearch-datasource",
293 + "uid": "replace_datasource_uid"
294 + },
295 + "metrics": [
296 + {
297 + "field": "select field",
298 + "id": "1",
299 + "type": "count"
300 + }
301 + ],
302 + "query": "eventSeverity:$eventSeverity AND cat:OPERATIONS",
303 + "refId": "A",
304 + "timeField": "timestamp"
305 + }
306 + ],
307 + "title": "SCOPES",
308 + "transformations": [
309 + {
310 + "id": "organize",
311 + "options": {
312 + "excludeByName": {},
313 + "indexByName": {},
314 + "renameByName": {
315 + "data_group": "GROUP"
316 + }
317 + }
318 + }
319 + ],
320 + "type": "table"
321 + },
322 + {
323 + "datasource": {
324 + "type": "grafana-opensearch-datasource",
325 + "uid": "replace_datasource_uid"
326 + },
327 + "fieldConfig": {
328 + "defaults": {
329 + "color": {
330 + "mode": "palette-classic"
331 + },
332 + "custom": {
333 + "hideFrom": {
334 + "legend": false,
335 + "tooltip": false,
336 + "viz": false
337 + }
338 + },
339 + "decimals": 0,
340 + "mappings": [],
341 + "unit": "short"
342 + },
343 + "overrides": [
344 + {
345 + "matcher": {
346 + "id": "byName",
347 + "options": "1"
348 + },
349 + "properties": [
350 + {
351 + "id": "color",
352 + "value": {
353 + "fixedColor": "#C8F2C2",
354 + "mode": "fixed"
355 + }
356 + }
357 + ]
358 + },
359 + {
360 + "matcher": {
361 + "id": "byName",
362 + "options": "2"
363 + },
364 + "properties": [
365 + {
366 + "id": "color",
367 + "value": {
368 + "fixedColor": "#96D98D",
369 + "mode": "fixed"
370 + }
371 + }
372 + ]
373 + },
374 + {
375 + "matcher": {
376 + "id": "byName",
377 + "options": "3"
378 + },
379 + "properties": [
380 + {
381 + "id": "color",
382 + "value": {
383 + "fixedColor": "#56A64B",
384 + "mode": "fixed"
385 + }
386 + }
387 + ]
388 + },
389 + {
390 + "matcher": {
391 + "id": "byName",
392 + "options": "4"
393 + },
394 + "properties": [
395 + {
396 + "id": "color",
397 + "value": {
398 + "fixedColor": "#37872D",
399 + "mode": "fixed"
400 + }
401 + }
402 + ]
403 + },
404 + {
405 + "matcher": {
406 + "id": "byName",
407 + "options": "5"
408 + },
409 + "properties": [
410 + {
411 + "id": "color",
412 + "value": {
413 + "fixedColor": "#FFF899",
414 + "mode": "fixed"
415 + }
416 + }
417 + ]
418 + },
419 + {
420 + "matcher": {
421 + "id": "byName",
422 + "options": "7"
423 + },
424 + "properties": [
425 + {
426 + "id": "color",
427 + "value": {
428 + "fixedColor": "#F2CC0C",
429 + "mode": "fixed"
430 + }
431 + }
432 + ]
433 + },
434 + {
435 + "matcher": {
436 + "id": "byName",
437 + "options": "9"
438 + },
439 + "properties": [
440 + {
441 + "id": "color",
442 + "value": {
443 + "fixedColor": "#FF9830",
444 + "mode": "fixed"
445 + }
446 + }
447 + ]
448 + },
449 + {
450 + "matcher": {
451 + "id": "byName",
452 + "options": "10"
453 + },
454 + "properties": [
455 + {
456 + "id": "color",
457 + "value": {
458 + "fixedColor": "#FF9830",
459 + "mode": "fixed"
460 + }
461 + }
462 + ]
463 + },
464 + {
465 + "matcher": {
466 + "id": "byName",
467 + "options": "12"
468 + },
469 + "properties": [
470 + {
471 + "id": "color",
472 + "value": {
473 + "fixedColor": "#F2495C",
474 + "mode": "fixed"
475 + }
476 + }
477 + ]
478 + },
479 + {
480 + "matcher": {
481 + "id": "byName",
482 + "options": "13"
483 + },
484 + "properties": [
485 + {
486 + "id": "color",
487 + "value": {
488 + "fixedColor": "#FF7383",
489 + "mode": "fixed"
490 + }
491 + }
492 + ]
493 + }
494 + ]
495 + },
496 + "gridPos": {
497 + "h": 12,
498 + "w": 6,
499 + "x": 0,
500 + "y": 7
501 + },
502 + "id": 23,
503 + "maxDataPoints": 3,
504 + "options": {
505 + "displayLabels": [],
506 + "legend": {
507 + "calcs": [],
508 + "displayMode": "table",
509 + "placement": "right",
510 + "showLegend": true,
511 + "values": [
512 + "value",
513 + "percent"
514 + ]
515 + },
516 + "pieType": "donut",
517 + "reduceOptions": {
518 + "calcs": [
519 + "sum"
520 + ],
521 + "fields": "",
522 + "values": false
523 + },
524 + "text": {},
525 + "tooltip": {
526 + "mode": "single",
527 + "sort": "none"
528 + }
529 + },
530 + "targets": [
531 + {
532 + "bucketAggs": [
533 + {
534 + "$$hashKey": "object:235",
535 + "fake": true,
536 + "field": "eventSeverity",
537 + "id": "3",
538 + "settings": {
539 + "min_doc_count": 1,
540 + "order": "desc",
541 + "orderBy": "_count",
542 + "size": "10"
543 + },
544 + "type": "terms"
545 + },
546 + {
547 + "$$hashKey": "object:236",
548 + "field": "timestamp",
549 + "id": "2",
550 + "settings": {
551 + "interval": "auto",
552 + "min_doc_count": 0,
553 + "trimEdges": 0
554 + },
555 + "type": "date_histogram"
556 + }
557 + ],
558 + "datasource": {
559 + "type": "grafana-opensearch-datasource",
560 + "uid": "replace_datasource_uid"
561 + },
562 + "metrics": [
563 + {
564 + "$$hashKey": "object:233",
565 + "field": "select field",
566 + "id": "1",
567 + "meta": {},
568 + "settings": {},
569 + "type": "count"
570 + }
571 + ],
572 + "query": "eventSeverity:$eventSeverity AND cat:OPERATIONS",
573 + "refId": "A",
574 + "timeField": "timestamp"
575 + }
576 + ],
577 + "title": "SECURITY EVENTS BY ALERT LEVEL",
578 + "type": "piechart"
579 + },
580 + {
581 + "datasource": {
582 + "type": "grafana-opensearch-datasource",
583 + "uid": "replace_datasource_uid"
584 + },
585 + "fieldConfig": {
586 + "defaults": {
587 + "color": {
588 + "mode": "palette-classic"
589 + },
590 + "custom": {
591 + "axisBorderShow": false,
592 + "axisCenteredZero": false,
593 + "axisColorMode": "text",
594 + "axisLabel": "",
595 + "axisPlacement": "auto",
596 + "barAlignment": 0,
597 + "drawStyle": "line",
598 + "fillOpacity": 0,
599 + "gradientMode": "none",
600 + "hideFrom": {
601 + "legend": false,
602 + "tooltip": false,
603 + "viz": false
604 + },
605 + "insertNulls": false,
606 + "lineInterpolation": "linear",
607 + "lineWidth": 1,
608 + "pointSize": 5,
609 + "scaleDistribution": {
610 + "type": "linear"
611 + },
612 + "showPoints": "auto",
613 + "spanNulls": false,
614 + "stacking": {
615 + "group": "A",
616 + "mode": "normal"
617 + },
618 + "thresholdsStyle": {
619 + "mode": "off"
620 + }
621 + },
622 + "mappings": [],
623 + "thresholds": {
624 + "mode": "absolute",
625 + "steps": [
626 + {
627 + "color": "green",
628 + "value": null
629 + },
630 + {
631 + "color": "red",
632 + "value": 80
633 + }
634 + ]
635 + }
636 + },
637 + "overrides": [
638 + {
639 + "matcher": {
640 + "id": "byName",
641 + "options": "10"
642 + },
643 + "properties": [
644 + {
645 + "id": "color",
646 + "value": {
647 + "fixedColor": "orange",
648 + "mode": "fixed"
649 + }
650 + }
651 + ]
652 + }
653 + ]
654 + },
655 + "gridPos": {
656 + "h": 12,
657 + "w": 18,
658 + "x": 6,
659 + "y": 7
660 + },
661 + "id": 50,
662 + "options": {
663 + "legend": {
664 + "calcs": [],
665 + "displayMode": "table",
666 + "placement": "right",
667 + "showLegend": true
668 + },
669 + "tooltip": {
670 + "mode": "single",
671 + "sort": "none"
672 + }
673 + },
674 + "targets": [
675 + {
676 + "alias": "",
677 + "bucketAggs": [
678 + {
679 + "field": "eventSeverity",
680 + "id": "3",
681 + "settings": {
682 + "min_doc_count": "1",
683 + "order": "desc",
684 + "orderBy": "_count",
685 + "size": "10"
686 + },
687 + "type": "terms"
688 + },
689 + {
690 + "field": "timestamp",
691 + "id": "2",
692 + "settings": {
693 + "interval": "auto"
694 + },
695 + "type": "date_histogram"
696 + }
697 + ],
698 + "datasource": {
699 + "type": "grafana-opensearch-datasource",
700 + "uid": "replace_datasource_uid"
701 + },
702 + "metrics": [
703 + {
704 + "id": "1",
705 + "type": "count"
706 + }
707 + ],
708 + "query": "eventSeverity:$eventSeverity AND cat:OPERATIONS",
709 + "refId": "A",
710 + "timeField": "timestamp"
711 + }
712 + ],
713 + "title": "EVENTS SEVERITY - HISTOGRAM",
714 + "type": "timeseries"
715 + },
716 + {
717 + "datasource": {
718 + "type": "grafana-opensearch-datasource",
719 + "uid": "replace_datasource_uid"
720 + },
721 + "fieldConfig": {
722 + "defaults": {
723 + "color": {
724 + "mode": "thresholds"
725 + },
726 + "custom": {
727 + "align": "auto",
728 + "cellOptions": {
729 + "type": "auto"
730 + },
731 + "filterable": true,
732 + "inspect": false
733 + },
734 + "mappings": [],
735 + "thresholds": {
736 + "mode": "absolute",
737 + "steps": [
738 + {
739 + "color": "green",
740 + "value": null
741 + },
742 + {
743 + "color": "red",
744 + "value": 80
745 + }
746 + ]
747 + }
748 + },
749 + "overrides": [
750 + {
751 + "matcher": {
752 + "id": "byName",
753 + "options": "timestamp"
754 + },
755 + "properties": [
756 + {
757 + "id": "displayName",
758 + "value": "Date/Time"
759 + },
760 + {
761 + "id": "unit",
762 + "value": "time: YYYY-MM-DD HH:mm:ss"
763 + },
764 + {
765 + "id": "custom.align"
766 + }
767 + ]
768 + },
769 + {
770 + "matcher": {
771 + "id": "byName",
772 + "options": "data_computerName"
773 + },
774 + "properties": [
775 + {
776 + "id": "displayName",
777 + "value": "AGENT"
778 + },
779 + {
780 + "id": "unit",
781 + "value": "short"
782 + },
783 + {
784 + "id": "decimals",
785 + "value": 2
786 + },
787 + {
788 + "id": "custom.align"
789 + }
790 + ]
791 + },
792 + {
793 + "matcher": {
794 + "id": "byName",
795 + "options": "agent_ip"
796 + },
797 + "properties": [
798 + {
799 + "id": "displayName",
800 + "value": "IP ADDRESS"
801 + },
802 + {
803 + "id": "unit",
804 + "value": "short"
805 + },
806 + {
807 + "id": "decimals",
808 + "value": 2
809 + },
810 + {
811 + "id": "custom.align"
812 + }
813 + ]
814 + },
815 + {
816 + "matcher": {
817 + "id": "byName",
818 + "options": "rule_description"
819 + },
820 + "properties": [
821 + {
822 + "id": "displayName",
823 + "value": "RULE DESCRIPTION"
824 + },
825 + {
826 + "id": "unit",
827 + "value": "short"
828 + },
829 + {
830 + "id": "decimals",
831 + "value": 2
832 + },
833 + {
834 + "id": "custom.align"
835 + }
836 + ]
837 + },
838 + {
839 + "matcher": {
840 + "id": "byName",
841 + "options": "Date/Time"
842 + },
843 + "properties": [
844 + {
845 + "id": "custom.width",
846 + "value": 242
847 + }
848 + ]
849 + },
850 + {
851 + "matcher": {
852 + "id": "byName",
853 + "options": "AGENT"
854 + },
855 + "properties": [
856 + {
857 + "id": "custom.width",
858 + "value": 160
859 + }
860 + ]
861 + },
862 + {
863 + "matcher": {
864 + "id": "byName",
865 + "options": "MITRE TACTIC"
866 + },
867 + "properties": [
868 + {
869 + "id": "custom.width",
870 + "value": 332
871 + }
872 + ]
873 + },
874 + {
875 + "matcher": {
876 + "id": "byName",
877 + "options": "RULE LEVEL"
878 + },
879 + "properties": [
880 + {
881 + "id": "custom.width",
882 + "value": 122
883 + }
884 + ]
885 + },
886 + {
887 + "matcher": {
888 + "id": "byName",
889 + "options": "IP ADDRESS"
890 + },
891 + "properties": [
892 + {
893 + "id": "custom.width",
894 + "value": 163
895 + }
896 + ]
897 + },
898 + {
899 + "matcher": {
900 + "id": "byName",
901 + "options": "MITRE TECHNIQUE"
902 + },
903 + "properties": [
904 + {
905 + "id": "custom.width",
906 + "value": 312
907 + }
908 + ]
909 + },
910 + {
911 + "matcher": {
912 + "id": "byName",
913 + "options": "rule_id"
914 + },
915 + "properties": [
916 + {
917 + "id": "custom.width",
918 + "value": 96
919 + }
920 + ]
921 + },
922 + {
923 + "matcher": {
924 + "id": "byName",
925 + "options": "EVENT ID"
926 + },
927 + "properties": [
928 + {
929 + "id": "links",
930 + "value": [
931 + {
932 + "targetBlank": true,
933 + "title": "VIEW EVENT DETAILS",
934 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SENTINELONE%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
935 + }
936 + ]
937 + }
938 + ]
939 + },
940 + {
941 + "matcher": {
942 + "id": "byName",
943 + "options": "IP ADD"
944 + },
945 + "properties": [
946 + {
947 + "id": "custom.width",
948 + "value": 176
949 + }
950 + ]
951 + },
952 + {
953 + "matcher": {
954 + "id": "byName",
955 + "options": "EVENT CATEGORY"
956 + },
957 + "properties": [
958 + {
959 + "id": "custom.width",
960 + "value": 209
961 + }
962 + ]
963 + },
964 + {
965 + "matcher": {
966 + "id": "byName",
967 + "options": "USER"
968 + },
969 + "properties": [
970 + {
971 + "id": "custom.width",
972 + "value": 218
973 + }
974 + ]
975 + },
976 + {
977 + "matcher": {
978 + "id": "byName",
979 + "options": "threatClassification"
980 + },
981 + "properties": [
982 + {
983 + "id": "custom.width",
984 + "value": 214
985 + }
986 + ]
987 + },
988 + {
989 + "matcher": {
990 + "id": "byName",
991 + "options": "DESCRIPTION"
992 + },
993 + "properties": [
994 + {
995 + "id": "custom.width",
996 + "value": 688
997 + }
998 + ]
999 + }
1000 + ]
1001 + },
1002 + "gridPos": {
1003 + "h": 16,
1004 + "w": 24,
1005 + "x": 0,
1006 + "y": 19
1007 + },
1008 + "id": 27,
1009 + "options": {
1010 + "cellHeight": "sm",
1011 + "footer": {
1012 + "countRows": false,
1013 + "enablePagination": true,
1014 + "fields": "",
1015 + "reducer": [
1016 + "sum"
1017 + ],
1018 + "show": false
1019 + },
1020 + "showHeader": true,
1021 + "sortBy": []
1022 + },
1023 + "pluginVersion": "10.4.2",
1024 + "targets": [
1025 + {
1026 + "bucketAggs": [],
1027 + "datasource": {
1028 + "type": "grafana-opensearch-datasource",
1029 + "uid": "replace_datasource_uid"
1030 + },
1031 + "metrics": [
1032 + {
1033 + "id": "1",
1034 + "settings": {
1035 + "size": "250"
1036 + },
1037 + "type": "raw_data"
1038 + }
1039 + ],
1040 + "query": "eventSeverity:$eventSeverity AND cat:OPERATIONS",
1041 + "refId": "A",
1042 + "timeField": "timestamp"
1043 + }
1044 + ],
1045 + "title": "EVENTS",
1046 + "transformations": [
1047 + {
1048 + "id": "filterFieldsByName",
1049 + "options": {
1050 + "include": {
1051 + "names": [
1052 + "timestamp",
1053 + "_id",
1054 + "cat",
1055 + "data_computerName",
1056 + "data_username",
1057 + "deviceAddress",
1058 + "deviceAddress_city_name",
1059 + "eventDesc",
1060 + "eventSeverity",
1061 + "fileName",
1062 + "threatClassification",
1063 + "threatConfidenceLevel"
1064 + ]
1065 + }
1066 + }
1067 + },
1068 + {
1069 + "id": "organize",
1070 + "options": {
1071 + "excludeByName": {
1072 + "@metadata_beat": true,
1073 + "@metadata_type": true,
1074 + "@metadata_version": true,
1075 + "IMPHASH": true,
1076 + "MD5": true,
1077 + "SHA1": true,
1078 + "SHA256": true,
1079 + "_id": false,
1080 + "_index": true,
1081 + "_type": true,
1082 + "accountId": true,
1083 + "accountName": true,
1084 + "activityId": true,
1085 + "activityType": true,
1086 + "activityUuid": true,
1087 + "agentId": true,
1088 + "agentUpdatedVersion": true,
1089 + "agent_ephemeral_id": true,
1090 + "agent_hostname": true,
1091 + "agent_id": true,
1092 + "agent_ip_city_name": true,
1093 + "agent_ip_country_code": true,
1094 + "agent_ip_geolocation": true,
1095 + "agent_type": true,
1096 + "agent_version": true,
1097 + "application_name": true,
1098 + "beats_type": true,
1099 + "collector_node_id": true,
1100 + "comments": true,
1101 + "createdAt": true,
1102 + "data_accountName": true,
1103 + "data_alert_action": true,
1104 + "data_alert_category": true,
1105 + "data_alert_gid": true,
1106 + "data_alert_rev": true,
1107 + "data_alert_severity": true,
1108 + "data_alert_signature": true,
1109 + "data_alert_signature_id": true,
1110 + "data_app_proto": true,
1111 + "data_audit_auid": true,
1112 + "data_audit_command": true,
1113 + "data_audit_euid": true,
1114 + "data_audit_exe": true,
1115 + "data_audit_gid": true,
1116 + "data_audit_id": true,
1117 + "data_audit_pid": true,
1118 + "data_audit_res": true,
1119 + "data_audit_session": true,
1120 + "data_audit_type": true,
1121 + "data_audit_uid": true,
1122 + "data_computerName": false,
1123 + "data_confidenceLevel": true,
1124 + "data_createdAt": true,
1125 + "data_description": true,
1126 + "data_dest_ip": true,
1127 + "data_dest_port": true,
1128 + "data_downloadUrl": true,
1129 + "data_dstuser": true,
1130 + "data_event_type": true,
1131 + "data_exclusionType": true,
1132 + "data_extra_data": true,
1133 + "data_file": true,
1134 + "data_fileContentHash": true,
1135 + "data_fileDisplayName": true,
1136 + "data_fileName": true,
1137 + "data_filePath": true,
1138 + "data_flow_bytes_toclient": true,
1139 + "data_flow_bytes_toserver": true,
1140 + "data_flow_id": true,
1141 + "data_flow_pkts_toclient": true,
1142 + "data_flow_pkts_toserver": true,
1143 + "data_flow_start": true,
1144 + "data_fullScopeDetails": true,
1145 + "data_fullScopeDetailsPath": true,
1146 + "data_globalStatus": true,
1147 + "data_groupName": true,
1148 + "data_http_http_content_type": true,
1149 + "data_http_http_port": true,
1150 + "data_http_length": true,
1151 + "data_http_status": true,
1152 + "data_http_url": true,
1153 + "data_id": true,
1154 + "data_in_iface": true,
1155 + "data_majorVersion": true,
1156 + "data_metadata_flowbits": true,
1157 + "data_metadata_flowints_http_anomaly_count": true,
1158 + "data_metadata_flowints_tcp_retransmission_count": true,
1159 + "data_minorVersion": true,
1160 + "data_osArch": true,
1161 + "data_osFamily": true,
1162 + "data_osquery_action": true,
1163 + "data_osquery_calendarTime": true,
1164 + "data_osquery_columns_address": true,
1165 + "data_osquery_columns_address_city_name": true,
1166 + "data_osquery_columns_address_country_code": true,
1167 + "data_osquery_columns_address_geolocation": true,
1168 + "data_osquery_columns_cmdline": true,
1169 + "data_osquery_columns_cwd": true,
1170 + "data_osquery_columns_description": true,
1171 + "data_osquery_columns_directory": true,
1172 + "data_osquery_columns_disk_bytes_read": true,
1173 + "data_osquery_columns_disk_bytes_written": true,
1174 + "data_osquery_columns_egid": true,
1175 + "data_osquery_columns_euid": true,
1176 + "data_osquery_columns_family": true,
1177 + "data_osquery_columns_fd": true,
1178 + "data_osquery_columns_gid": true,
1179 + "data_osquery_columns_gid_signed": true,
1180 + "data_osquery_columns_host": true,
1181 + "data_osquery_columns_interface": true,
1182 + "data_osquery_columns_local_address": true,
1183 + "data_osquery_columns_local_address_city_name": true,
1184 + "data_osquery_columns_local_address_country_code": true,
1185 + "data_osquery_columns_local_address_geolocation": true,
1186 + "data_osquery_columns_local_port": true,
1187 + "data_osquery_columns_mac": true,
1188 + "data_osquery_columns_name": true,
1189 + "data_osquery_columns_net_namespace": true,
1190 + "data_osquery_columns_nice": true,
1191 + "data_osquery_columns_on_disk": true,
1192 + "data_osquery_columns_parent": true,
1193 + "data_osquery_columns_path": true,
1194 + "data_osquery_columns_pgroup": true,
1195 + "data_osquery_columns_pid": true,
1196 + "data_osquery_columns_port": true,
1197 + "data_osquery_columns_protocol": true,
1198 + "data_osquery_columns_remote_address": true,
1199 + "data_osquery_columns_remote_address_city_name": true,
1200 + "data_osquery_columns_remote_address_country_code": true,
1201 + "data_osquery_columns_remote_address_geolocation": true,
1202 + "data_osquery_columns_remote_port": true,
1203 + "data_osquery_columns_resident_size": true,
1204 + "data_osquery_columns_root": true,
1205 + "data_osquery_columns_sgid": true,
1206 + "data_osquery_columns_shell": true,
1207 + "data_osquery_columns_socket": true,
1208 + "data_osquery_columns_start_time": true,
1209 + "data_osquery_columns_state": true,
1210 + "data_osquery_columns_suid": true,
1211 + "data_osquery_columns_system_time": true,
1212 + "data_osquery_columns_threads": true,
1213 + "data_osquery_columns_time_utc": true,
1214 + "data_osquery_columns_total_size": true,
1215 + "data_osquery_columns_tty": true,
1216 + "data_osquery_columns_type": true,
1217 + "data_osquery_columns_uid": true,
1218 + "data_osquery_columns_uid_signed": true,
1219 + "data_osquery_columns_user": true,
1220 + "data_osquery_columns_user_time": true,
1221 + "data_osquery_columns_username": true,
1222 + "data_osquery_columns_wired_size": true,
1223 + "data_osquery_counter": true,
1224 + "data_osquery_decorations_host_uuid": true,
1225 + "data_osquery_decorations_hostname": true,
1226 + "data_osquery_epoch": true,
1227 + "data_osquery_hostIdentifier": true,
1228 + "data_osquery_name": true,
1229 + "data_osquery_numerics": true,
1230 + "data_osquery_unixTime": true,
1231 + "data_packageId": true,
1232 + "data_platformType": true,
1233 + "data_proto": true,
1234 + "data_sca_check_command": true,
1235 + "data_sca_check_compliance_cis": true,
1236 + "data_sca_check_compliance_cis_csc": true,
1237 + "data_sca_check_compliance_gdpr_IV": true,
1238 + "data_sca_check_compliance_gpg_13": true,
1239 + "data_sca_check_compliance_hipaa": true,
1240 + "data_sca_check_compliance_nist_800_53": true,
1241 + "data_sca_check_compliance_pci_dss": true,
1242 + "data_sca_check_compliance_tsc": true,
1243 + "data_sca_check_description": true,
1244 + "data_sca_check_id": true,
1245 + "data_sca_check_previous_result": true,
1246 + "data_sca_check_rationale": true,
1247 + "data_sca_check_remediation": true,
1248 + "data_sca_check_result": true,
1249 + "data_sca_check_title": true,
1250 + "data_sca_description": true,
1251 + "data_sca_failed": true,
1252 + "data_sca_file": true,
1253 + "data_sca_invalid": true,
1254 + "data_sca_passed": true,
1255 + "data_sca_policy": true,
1256 + "data_sca_policy_id": true,
1257 + "data_sca_scan_id": true,
1258 + "data_sca_score": true,
1259 + "data_sca_total_checks": true,
1260 + "data_sca_type": true,
1261 + "data_scanType": true,
1262 + "data_scopeLevel": true,
1263 + "data_scopeName": true,
1264 + "data_script": true,
1265 + "data_secured": true,
1266 + "data_siteName": true,
1267 + "data_src_ip": true,
1268 + "data_src_ip_city_name": true,
1269 + "data_src_ip_country_code": true,
1270 + "data_src_ip_geolocation": true,
1271 + "data_src_port": true,
1272 + "data_srcip": true,
1273 + "data_srcip_city_name": true,
1274 + "data_srcip_country_code": true,
1275 + "data_srcip_geolocation": true,
1276 + "data_srcuser": true,
1277 + "data_status": true,
1278 + "data_threatClassification": true,
1279 + "data_timestamp": true,
1280 + "data_title": true,
1281 + "data_tls_session_resumed": true,
1282 + "data_tls_version": true,
1283 + "data_totalNewDevices": true,
1284 + "data_tx_id": true,
1285 + "data_type": true,
1286 + "data_unknown": true,
1287 + "data_unsecured": true,
1288 + "data_unsupported": true,
1289 + "data_value": true,
1290 + "data_version": true,
1291 + "data_version_city_name": true,
1292 + "data_version_country_code": true,
1293 + "data_version_geolocation": true,
1294 + "data_win_eventXML_binaryData": true,
1295 + "data_win_eventXML_binaryDataSize": true,
1296 + "data_win_eventXML_param1": true,
1297 + "data_win_eventdata_authenticationPackageName": true,
1298 + "data_win_eventdata_callTrace": true,
1299 + "data_win_eventdata_commandLine": true,
1300 + "data_win_eventdata_company": true,
1301 + "data_win_eventdata_creationUtcTime": true,
1302 + "data_win_eventdata_currentDirectory": true,
1303 + "data_win_eventdata_description": true,
1304 + "data_win_eventdata_destinationHostname": true,
1305 + "data_win_eventdata_destinationIp": true,
1306 + "data_win_eventdata_destinationIp_city_name": true,
1307 + "data_win_eventdata_destinationIp_country_code": true,
1308 + "data_win_eventdata_destinationIp_geolocation": true,
1309 + "data_win_eventdata_destinationIsIpv6": true,
1310 + "data_win_eventdata_destinationPort": true,
1311 + "data_win_eventdata_destinationPortName": true,
1312 + "data_win_eventdata_details": true,
1313 + "data_win_eventdata_elevatedToken": true,
1314 + "data_win_eventdata_eventType": true,
1315 + "data_win_eventdata_fileVersion": true,
1316 + "data_win_eventdata_fileVersion_city_name": true,
1317 + "data_win_eventdata_fileVersion_country_code": true,
1318 + "data_win_eventdata_fileVersion_geolocation": true,
1319 + "data_win_eventdata_grantedAccess": true,
1320 + "data_win_eventdata_hashes": true,
1321 + "data_win_eventdata_image": true,
1322 + "data_win_eventdata_imageLoaded": true,
1323 + "data_win_eventdata_impersonationLevel": true,
1324 + "data_win_eventdata_initiated": true,
1325 + "data_win_eventdata_integrityLevel": true,
1326 + "data_win_eventdata_ipAddress": true,
1327 + "data_win_eventdata_ipPort": true,
1328 + "data_win_eventdata_keyLength": true,
1329 + "data_win_eventdata_logonGuid": true,
1330 + "data_win_eventdata_logonId": true,
1331 + "data_win_eventdata_logonProcessName": true,
1332 + "data_win_eventdata_logonType": true,
1333 + "data_win_eventdata_originalFileName": true,
1334 + "data_win_eventdata_param1": true,
1335 + "data_win_eventdata_param2": true,
1336 + "data_win_eventdata_param3": true,
1337 + "data_win_eventdata_param4": true,
1338 + "data_win_eventdata_parentCommandLine": true,
1339 + "data_win_eventdata_parentImage": true,
1340 + "data_win_eventdata_parentProcessGuid": true,
1341 + "data_win_eventdata_parentProcessId": true,
1342 + "data_win_eventdata_processGuid": true,
1343 + "data_win_eventdata_processId": true,
1344 + "data_win_eventdata_processName": true,
1345 + "data_win_eventdata_product": true,
1346 + "data_win_eventdata_protocol": true,
1347 + "data_win_eventdata_queryName": true,
1348 + "data_win_eventdata_queryResults": true,
1349 + "data_win_eventdata_queryStatus": true,
1350 + "data_win_eventdata_ruleName": true,
1351 + "data_win_eventdata_serviceName": true,
1352 + "data_win_eventdata_serviceSid": true,
1353 + "data_win_eventdata_signature": true,
1354 + "data_win_eventdata_signatureStatus": true,
1355 + "data_win_eventdata_signed": true,
1356 + "data_win_eventdata_sourceHostname": true,
1357 + "data_win_eventdata_sourceImage": true,
1358 + "data_win_eventdata_sourceIp": true,
1359 + "data_win_eventdata_sourceIp_city_name": true,
1360 + "data_win_eventdata_sourceIp_country_code": true,
1361 + "data_win_eventdata_sourceIp_geolocation": true,
1362 + "data_win_eventdata_sourceIsIpv6": true,
1363 + "data_win_eventdata_sourcePort": true,
1364 + "data_win_eventdata_sourceProcessGUID": true,
1365 + "data_win_eventdata_sourceProcessId": true,
1366 + "data_win_eventdata_sourceThreadId": true,
1367 + "data_win_eventdata_status": true,
1368 + "data_win_eventdata_subjectDomainName": true,
1369 + "data_win_eventdata_subjectLogonId": true,
1370 + "data_win_eventdata_subjectUserName": true,
1371 + "data_win_eventdata_subjectUserSid": true,
1372 + "data_win_eventdata_targetDomainName": true,
1373 + "data_win_eventdata_targetFilename": true,
1374 + "data_win_eventdata_targetImage": true,
1375 + "data_win_eventdata_targetLinkedLogonId": true,
1376 + "data_win_eventdata_targetLogonId": true,
1377 + "data_win_eventdata_targetObject": true,
1378 + "data_win_eventdata_targetProcessGUID": true,
1379 + "data_win_eventdata_targetProcessId": true,
1380 + "data_win_eventdata_targetUserName": true,
1381 + "data_win_eventdata_targetUserSid": true,
1382 + "data_win_eventdata_terminalSessionId": true,
1383 + "data_win_eventdata_ticketEncryptionType": true,
1384 + "data_win_eventdata_ticketOptions": true,
1385 + "data_win_eventdata_user": true,
1386 + "data_win_eventdata_utcTime": true,
1387 + "data_win_eventdata_virtualAccount": true,
1388 + "data_win_system_channel": true,
1389 + "data_win_system_computer": true,
1390 + "data_win_system_eventID": true,
1391 + "data_win_system_eventRecordID": true,
1392 + "data_win_system_eventSourceName": true,
1393 + "data_win_system_keywords": true,
1394 + "data_win_system_level": true,
1395 + "data_win_system_message": true,
1396 + "data_win_system_opcode": true,
1397 + "data_win_system_processID": true,
1398 + "data_win_system_providerGuid": true,
1399 + "data_win_system_providerName": true,
1400 + "data_win_system_severityValue": true,
1401 + "data_win_system_systemTime": true,
1402 + "data_win_system_task": true,
1403 + "data_win_system_threadID": true,
1404 + "data_win_system_version": true,
1405 + "decoder_name": true,
1406 + "decoder_parent": true,
1407 + "description": true,
1408 + "deviceAddress_city_name": true,
1409 + "deviceAddress_country_code": true,
1410 + "deviceAddress_geolocation": true,
1411 + "deviceHostFqdn": true,
1412 + "deviceHostName": true,
1413 + "dns_query": true,
1414 + "dns_query_threat_indicated": true,
1415 + "dst_ip": true,
1416 + "dst_ip_city_name": true,
1417 + "dst_ip_country_code": true,
1418 + "dst_ip_geolocation": true,
1419 + "dst_ip_threat_indicated": true,
1420 + "dst_port": true,
1421 + "ecs_version": true,
1422 + "error": true,
1423 + "eventID": true,
1424 + "event_hash": true,
1425 + "facility": true,
1426 + "facility_num": true,
1427 + "fileHashMd5": true,
1428 + "fileHashSha256": true,
1429 + "fileName": false,
1430 + "file_path": true,
1431 + "firewall_rule_name": true,
1432 + "full_log": false,
1433 + "gl2_accounted_message_size": true,
1434 + "gl2_message_id": true,
1435 + "gl2_remote_ip": true,
1436 + "gl2_remote_port": true,
1437 + "gl2_source_collector": true,
1438 + "gl2_source_input": true,
1439 + "gl2_source_node": true,
1440 + "groupId": true,
1441 + "groupName": true,
1442 + "hash": true,
1443 + "hash_md5": true,
1444 + "hash_sha1": true,
1445 + "hash_sha256": true,
1446 + "highlight": true,
1447 + "host_architecture": true,
1448 + "host_containerized": true,
1449 + "host_hostname": true,
1450 + "host_id": true,
1451 + "host_ip": true,
1452 + "host_mac": true,
1453 + "host_name": true,
1454 + "host_os_codename": true,
1455 + "host_os_kernel": true,
1456 + "host_os_name": true,
1457 + "host_os_platform": true,
1458 + "host_os_version": true,
1459 + "hostname": true,
1460 + "id": true,
1461 + "input_type": true,
1462 + "ip": true,
1463 + "ip_city_name": true,
1464 + "ip_country_code": true,
1465 + "ip_geolocation": true,
1466 + "level": true,
1467 + "location": true,
1468 + "log_file_path": true,
1469 + "log_offset": true,
1470 + "manager_name": true,
1471 + "message": true,
1472 + "module": true,
1473 + "notificationScope": true,
1474 + "originatorName": true,
1475 + "originatorVersion": true,
1476 + "originatorVersion_city_name": true,
1477 + "originatorVersion_country_code": true,
1478 + "originatorVersion_geolocation": true,
1479 + "osFamily": true,
1480 + "parent_process_cmd_line": true,
1481 + "parent_process_id": true,
1482 + "parent_process_image": true,
1483 + "pid": true,
1484 + "predecoder_hostname": true,
1485 + "predecoder_program_name": true,
1486 + "predecoder_timestamp": true,
1487 + "previous_log": true,
1488 + "previous_output": true,
1489 + "process_cmd_line": true,
1490 + "process_id": true,
1491 + "process_image": true,
1492 + "process_name": true,
1493 + "protocol": true,
1494 + "rt": true,
1495 + "rule_cis": true,
1496 + "rule_cis_csc": true,
1497 + "rule_firedtimes": true,
1498 + "rule_gdpr": true,
1499 + "rule_gdpr_IV": true,
1500 + "rule_gpg13": true,
1501 + "rule_gpg_13": true,
1502 + "rule_hipaa": true,
1503 + "rule_id": false,
1504 + "rule_info": true,
1505 + "rule_mail": true,
1506 + "rule_mitre_id": true,
1507 + "rule_mitre_tactic": false,
1508 + "rule_nist_800_53": true,
1509 + "rule_pci_dss": true,
1510 + "rule_tsc": true,
1511 + "scanType": true,
1512 + "scanid": true,
1513 + "secondaryDescription": true,
1514 + "secured": true,
1515 + "service": true,
1516 + "siteId": true,
1517 + "siteName": true,
1518 + "software_package": true,
1519 + "software_vendor": true,
1520 + "sort": true,
1521 + "source": true,
1522 + "sourceAgentId": true,
1523 + "sourceAgentUuid": true,
1524 + "sourceDnsDomain": true,
1525 + "sourceFqdn": true,
1526 + "sourceGroupId": true,
1527 + "sourceGroupName": true,
1528 + "sourceHostName": true,
1529 + "sourceIpAddresses_0": true,
1530 + "sourceIpAddresses_1": true,
1531 + "sourceIpAddresses_1_city_name": true,
1532 + "sourceIpAddresses_1_country_code": true,
1533 + "sourceIpAddresses_1_geolocation": true,
1534 + "sourceIpAddresses_2": true,
1535 + "sourceIpAddresses_2_city_name": true,
1536 + "sourceIpAddresses_2_country_code": true,
1537 + "sourceIpAddresses_2_geolocation": true,
1538 + "sourceIpAddresses_3": true,
1539 + "sourceIpAddresses_3_city_name": true,
1540 + "sourceIpAddresses_3_country_code": true,
1541 + "sourceIpAddresses_3_geolocation": true,
1542 + "sourceIpAddresses_4": true,
1543 + "sourceIpAddresses_4_city_name": true,
1544 + "sourceIpAddresses_4_country_code": true,
1545 + "sourceIpAddresses_4_geolocation": true,
1546 + "sourceIpAddresses_5": true,
1547 + "sourceMacAddresses_0": true,
1548 + "sourceMacAddresses_1": true,
1549 + "sourceMgmtPrecievedAddress": true,
1550 + "sourceMgmtPrecievedAddress_city_name": true,
1551 + "sourceMgmtPrecievedAddress_country_code": true,
1552 + "sourceMgmtPrecievedAddress_geolocation": true,
1553 + "sourceNetworkState": true,
1554 + "sourceOsRevision": true,
1555 + "sourceOsType": true,
1556 + "sourceThreatCount": true,
1557 + "sourceUserId": true,
1558 + "sourceUserName": true,
1559 + "source_city_name": true,
1560 + "source_country_code": true,
1561 + "source_geolocation": true,
1562 + "src_ip": true,
1563 + "src_ip_city_name": true,
1564 + "src_ip_country_code": true,
1565 + "src_ip_geolocation": true,
1566 + "src_port": true,
1567 + "streams": true,
1568 + "syscheck_attrs_after": true,
1569 + "syscheck_audit_effective_user_id": true,
1570 + "syscheck_audit_effective_user_name": true,
1571 + "syscheck_audit_group_id": true,
1572 + "syscheck_audit_group_name": true,
1573 + "syscheck_audit_login_user_id": true,
1574 + "syscheck_audit_login_user_name": true,
1575 + "syscheck_audit_process_cwd": true,
1576 + "syscheck_audit_process_id": true,
1577 + "syscheck_audit_process_name": true,
1578 + "syscheck_audit_process_parent_cwd": true,
1579 + "syscheck_audit_process_parent_name": true,
1580 + "syscheck_audit_process_ppid": true,
1581 + "syscheck_audit_user_id": true,
1582 + "syscheck_audit_user_name": true,
1583 + "syscheck_changed_attributes": true,
1584 + "syscheck_event": true,
1585 + "syscheck_gid_after": true,
1586 + "syscheck_gname_after": true,
1587 + "syscheck_hard_links": true,
1588 + "syscheck_inode_after": true,
1589 + "syscheck_inode_before": true,
1590 + "syscheck_md5_after": true,
1591 + "syscheck_md5_before": true,
1592 + "syscheck_mode": true,
1593 + "syscheck_mtime_after": true,
1594 + "syscheck_mtime_before": true,
1595 + "syscheck_path": true,
1596 + "syscheck_perm_after": true,
1597 + "syscheck_perm_before": true,
1598 + "syscheck_sha1_after": true,
1599 + "syscheck_sha1_before": true,
1600 + "syscheck_sha256_after": true,
1601 + "syscheck_sha256_before": true,
1602 + "syscheck_size_after": true,
1603 + "syscheck_size_before": true,
1604 + "syscheck_uid_after": true,
1605 + "syscheck_uname_after": true,
1606 + "syscheck_win_perm_after": true,
1607 + "syscheck_win_perm_after_0_allowed": true,
1608 + "syscheck_win_perm_after_0_name": true,
1609 + "syscheck_win_perm_after_1_allowed": true,
1610 + "syscheck_win_perm_after_1_name": true,
1611 + "syscheck_win_perm_after_2_allowed": true,
1612 + "syscheck_win_perm_after_2_name": true,
1613 + "syscheck_win_perm_after_3_allowed": true,
1614 + "syscheck_win_perm_after_3_name": true,
1615 + "syslog_customer": true,
1616 + "syslog_tag": true,
1617 + "syslog_type": true,
1618 + "sysmon_event_description": true,
1619 + "threatClassification": false,
1620 + "threatClassificationSource": true,
1621 + "threatClassifier": true,
1622 + "threatCommandLineArguments": true,
1623 + "threatConfidenceLevel": false,
1624 + "threatDetectingEngine": true,
1625 + "threatDetectionTime": true,
1626 + "threatID": true,
1627 + "threatId": true,
1628 + "threatIndicatorsList_0": true,
1629 + "threatIndicatorsList_1": true,
1630 + "threatIndicatorsList_10": true,
1631 + "threatIndicatorsList_11": true,
1632 + "threatIndicatorsList_12": true,
1633 + "threatIndicatorsList_13": true,
1634 + "threatIndicatorsList_14": true,
1635 + "threatIndicatorsList_15": true,
1636 + "threatIndicatorsList_16": true,
1637 + "threatIndicatorsList_17": true,
1638 + "threatIndicatorsList_18": true,
1639 + "threatIndicatorsList_19": true,
1640 + "threatIndicatorsList_2": true,
1641 + "threatIndicatorsList_20": true,
1642 + "threatIndicatorsList_21": true,
1643 + "threatIndicatorsList_22": true,
1644 + "threatIndicatorsList_23": true,
1645 + "threatIndicatorsList_24": true,
1646 + "threatIndicatorsList_25": true,
1647 + "threatIndicatorsList_26": true,
1648 + "threatIndicatorsList_27": true,
1649 + "threatIndicatorsList_28": true,
1650 + "threatIndicatorsList_29": true,
1651 + "threatIndicatorsList_3": true,
1652 + "threatIndicatorsList_30": true,
1653 + "threatIndicatorsList_31": true,
1654 + "threatIndicatorsList_32": true,
1655 + "threatIndicatorsList_33": true,
1656 + "threatIndicatorsList_34": true,
1657 + "threatIndicatorsList_35": true,
1658 + "threatIndicatorsList_36": true,
1659 + "threatIndicatorsList_37": true,
1660 + "threatIndicatorsList_38": true,
1661 + "threatIndicatorsList_39": true,
1662 + "threatIndicatorsList_4": true,
1663 + "threatIndicatorsList_40": true,
1664 + "threatIndicatorsList_41": true,
1665 + "threatIndicatorsList_42": true,
1666 + "threatIndicatorsList_43": true,
1667 + "threatIndicatorsList_44": true,
1668 + "threatIndicatorsList_45": true,
1669 + "threatIndicatorsList_46": true,
1670 + "threatIndicatorsList_47": true,
1671 + "threatIndicatorsList_48": true,
1672 + "threatIndicatorsList_49": true,
1673 + "threatIndicatorsList_5": true,
1674 + "threatIndicatorsList_50": true,
1675 + "threatIndicatorsList_51": true,
1676 + "threatIndicatorsList_52": true,
1677 + "threatIndicatorsList_53": true,
1678 + "threatIndicatorsList_54": true,
1679 + "threatIndicatorsList_55": true,
1680 + "threatIndicatorsList_56": true,
1681 + "threatIndicatorsList_6": true,
1682 + "threatIndicatorsList_7": true,
1683 + "threatIndicatorsList_8": true,
1684 + "threatIndicatorsList_9": true,
1685 + "threatMitigationStatus": true,
1686 + "threatMitigationStatusID": true,
1687 + "threatProcessUser": true,
1688 + "threatStoryline": true,
1689 + "threat_ids": true,
1690 + "threat_indicated": true,
1691 + "threat_names": true,
1692 + "time": true,
1693 + "timestamp": false,
1694 + "totalNewDevices": true,
1695 + "unknown": true,
1696 + "unsecured": true,
1697 + "unsupported": true,
1698 + "updatedAt": true,
1699 + "userId": true,
1700 + "user_name": true,
1701 + "vendor": true,
1702 + "win_registry_key": true,
1703 + "win_system_eventID": true,
1704 + "windows_auth_package": true,
1705 + "windows_domain": true,
1706 + "windows_event_id": true,
1707 + "windows_event_severity": true,
1708 + "windows_logon_type": true
1709 + },
1710 + "indexByName": {
1711 + "_id": 1,
1712 + "_index": 5,
1713 + "_type": 6,
1714 + "accountId": 7,
1715 + "accountName": 8,
1716 + "activityId": 9,
1717 + "activityType": 10,
1718 + "activityUuid": 11,
1719 + "agentId": 12,
1720 + "agentUpdatedVersion": 13,
1721 + "application_name": 14,
1722 + "cat": 15,
1723 + "comments": 16,
1724 + "createdAt": 17,
1725 + "data_accountName": 18,
1726 + "data_computerName": 2,
1727 + "data_confidenceLevel": 19,
1728 + "data_downloadUrl": 20,
1729 + "data_fileContentHash": 21,
1730 + "data_fileDisplayName": 22,
1731 + "data_filePath": 23,
1732 + "data_fullScopeDetails": 24,
1733 + "data_fullScopeDetailsPath": 25,
1734 + "data_globalStatus": 26,
1735 + "data_groupName": 27,
1736 + "data_scopeLevel": 28,
1737 + "data_scopeName": 29,
1738 + "data_siteName": 30,
1739 + "data_threatClassification": 31,
1740 + "data_username": 32,
1741 + "description": 33,
1742 + "deviceAddress": 3,
1743 + "deviceAddress_city_name": 34,
1744 + "deviceAddress_country_code": 35,
1745 + "deviceAddress_geolocation": 36,
1746 + "deviceHostFqdn": 37,
1747 + "deviceHostName": 38,
1748 + "eventDesc": 39,
1749 + "eventID": 40,
1750 + "eventSeverity": 4,
1751 + "facility": 41,
1752 + "facility_num": 42,
1753 + "fileHashMd5": 43,
1754 + "fileHashSha256": 44,
1755 + "fileName": 45,
1756 + "gl2_accounted_message_size": 46,
1757 + "gl2_message_id": 47,
1758 + "gl2_remote_ip": 48,
1759 + "gl2_remote_port": 49,
1760 + "gl2_source_input": 50,
1761 + "gl2_source_node": 51,
1762 + "groupId": 52,
1763 + "groupName": 53,
1764 + "hash": 54,
1765 + "highlight": 55,
1766 + "level": 56,
1767 + "message": 57,
1768 + "notificationScope": 58,
1769 + "originatorName": 59,
1770 + "originatorVersion": 60,
1771 + "osFamily": 61,
1772 + "process_id": 62,
1773 + "rt": 63,
1774 + "secondaryDescription": 64,
1775 + "siteId": 65,
1776 + "siteName": 66,
1777 + "sort": 67,
1778 + "source": 68,
1779 + "sourceAgentId": 69,
1780 + "sourceAgentUuid": 70,
1781 + "sourceDnsDomain": 71,
1782 + "sourceFqdn": 72,
1783 + "sourceGroupId": 73,
1784 + "sourceGroupName": 74,
1785 + "sourceHostName": 75,
1786 + "sourceIpAddresses_0": 76,
1787 + "sourceIpAddresses_1": 77,
1788 + "sourceMacAddresses_0": 78,
1789 + "sourceMacAddresses_1": 79,
1790 + "sourceMgmtPrecievedAddress": 80,
1791 + "sourceMgmtPrecievedAddress_city_name": 81,
1792 + "sourceMgmtPrecievedAddress_country_code": 82,
1793 + "sourceMgmtPrecievedAddress_geolocation": 83,
1794 + "sourceNetworkState": 84,
1795 + "sourceOsRevision": 85,
1796 + "sourceOsType": 86,
1797 + "sourceThreatCount": 87,
1798 + "source_city_name": 88,
1799 + "source_country_code": 89,
1800 + "source_geolocation": 90,
1801 + "streams": 91,
1802 + "syslog_customer": 92,
1803 + "syslog_type": 93,
1804 + "threatClassification": 94,
1805 + "threatClassificationSource": 95,
1806 + "threatClassifier": 96,
1807 + "threatCommandLineArguments": 97,
1808 + "threatConfidenceLevel": 98,
1809 + "threatDetectingEngine": 99,
1810 + "threatDetectionTime": 100,
1811 + "threatID": 101,
1812 + "threatId": 102,
1813 + "threatMitigationStatus": 103,
1814 + "threatMitigationStatusID": 104,
1815 + "threatProcessUser": 105,
1816 + "threatStoryline": 106,
1817 + "timestamp": 0,
1818 + "updatedAt": 107,
1819 + "userId": 108,
1820 + "vendor": 109
1821 + },
1822 + "renameByName": {
1823 + "_id": "EVENT ID",
1824 + "cat": "EVENT CATEGORY",
1825 + "data_computerName": "AGENT",
1826 + "data_username": "USER",
1827 + "deviceAddress": "IP ADD",
1828 + "eventDesc": "DESCRIPTION",
1829 + "eventSeverity": "SEVERITY",
1830 + "rule_id": "RULE ID",
1831 + "rule_mitre_tactic": "MITRE TACTIC",
1832 + "rule_mitre_technique": "MITRE TECHNIQUE",
1833 + "timestamp": "DATE/TIME"
1834 + }
1835 + }
1836 + }
1837 + ],
1838 + "transparent": true,
1839 + "type": "table"
1840 + }
1841 + ],
1842 + "refresh": "",
1843 + "schemaVersion": 39,
1844 + "tags": [
1845 + "EDR"
1846 + ],
1847 + "templating": {
1848 + "list": [
1849 + {
1850 + "datasource": {
1851 + "type": "grafana-opensearch-datasource",
1852 + "uid": "replace_datasource_uid"
1853 + },
1854 + "filters": [],
1855 + "hide": 0,
1856 + "label": "",
1857 + "name": "Filters",
1858 + "skipUrlSync": false,
1859 + "type": "adhoc"
1860 + },
1861 + {
1862 + "current": {
1863 + "selected": false,
1864 + "text": "All",
1865 + "value": "$__all"
1866 + },
1867 + "datasource": {
1868 + "type": "grafana-opensearch-datasource",
1869 + "uid": "replace_datasource_uid"
1870 + },
1871 + "definition": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:OPERATIONS\"}",
1872 + "hide": 0,
1873 + "includeAll": true,
1874 + "label": "Event Severity",
1875 + "multi": false,
1876 + "name": "eventSeverity",
1877 + "options": [],
1878 + "query": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:OPERATIONS\"}",
1879 + "refresh": 2,
1880 + "regex": "",
1881 + "skipUrlSync": false,
1882 + "sort": 0,
1883 + "type": "query"
1884 + }
1885 + ]
1886 + },
1887 + "time": {
1888 + "from": "now-7d",
1889 + "to": "now"
1890 + },
1891 + "timepicker": {
1892 + "refresh_intervals": [
1893 + "5s",
1894 + "10s",
1895 + "30s",
1896 + "1m",
1897 + "5m",
1898 + "15m",
1899 + "30m",
1900 + "1h",
1901 + "2h",
1902 + "1d"
1903 + ],
1904 + "time_options": [
1905 + "5m",
1906 + "15m",
1907 + "1h",
1908 + "6h",
1909 + "12h",
1910 + "24h",
1911 + "2d",
1912 + "7d",
1913 + "30d"
1914 + ]
1915 + },
1916 + "timezone": "",
1917 + "title": "EDR - SENTINELONE EPP - OPERATIONS",
1918 + "weekStart": ""
1919 +}
backend/app/connectors/grafana/dashboards/Sentinelone/sentinelone_epp_ranger.json new
+1919
@@ -0,0 +1,1919 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "EDR"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "grafana-opensearch-datasource",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "orange",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 18,
82 + "options": {
83 + "colorMode": "value",
84 + "graphMode": "area",
85 + "justifyMode": "auto",
86 + "orientation": "horizontal",
87 + "reduceOptions": {
88 + "calcs": [
89 + "sum"
90 + ],
91 + "fields": "",
92 + "values": false
93 + },
94 + "showPercentChange": false,
95 + "text": {},
96 + "textMode": "auto",
97 + "wideLayout": true
98 + },
99 + "pluginVersion": "10.4.2",
100 + "targets": [
101 + {
102 + "bucketAggs": [
103 + {
104 + "$$hashKey": "object:331",
105 + "field": "timestamp",
106 + "id": "2",
107 + "settings": {
108 + "interval": "auto",
109 + "min_doc_count": 0,
110 + "trimEdges": 0
111 + },
112 + "type": "date_histogram"
113 + }
114 + ],
115 + "datasource": {
116 + "type": "grafana-opensearch-datasource",
117 + "uid": "replace_datasource_uid"
118 + },
119 + "metrics": [
120 + {
121 + "$$hashKey": "object:329",
122 + "field": "select field",
123 + "id": "1",
124 + "type": "count"
125 + }
126 + ],
127 + "query": "eventSeverity:$eventSeverity AND cat:RANGER",
128 + "refId": "A",
129 + "timeField": "timestamp"
130 + }
131 + ],
132 + "title": "EVENTS (TOTAL)",
133 + "type": "stat"
134 + },
135 + {
136 + "datasource": {
137 + "type": "grafana-opensearch-datasource",
138 + "uid": "replace_datasource_uid"
139 + },
140 + "fieldConfig": {
141 + "defaults": {
142 + "color": {
143 + "mode": "thresholds"
144 + },
145 + "custom": {
146 + "align": "auto",
147 + "cellOptions": {
148 + "type": "auto"
149 + },
150 + "inspect": false
151 + },
152 + "mappings": [],
153 + "thresholds": {
154 + "mode": "absolute",
155 + "steps": [
156 + {
157 + "color": "orange",
158 + "value": null
159 + }
160 + ]
161 + }
162 + },
163 + "overrides": [
164 + {
165 + "matcher": {
166 + "id": "byName",
167 + "options": "Time"
168 + },
169 + "properties": [
170 + {
171 + "id": "displayName",
172 + "value": "Time"
173 + },
174 + {
175 + "id": "unit",
176 + "value": "time: YYYY-MM-DD HH:mm:ss"
177 + },
178 + {
179 + "id": "custom.align"
180 + }
181 + ]
182 + },
183 + {
184 + "matcher": {
185 + "id": "byName",
186 + "options": "Count"
187 + },
188 + "properties": [
189 + {
190 + "id": "displayName",
191 + "value": "EVENTS"
192 + },
193 + {
194 + "id": "unit",
195 + "value": "short"
196 + },
197 + {
198 + "id": "decimals",
199 + "value": -1
200 + },
201 + {
202 + "id": "custom.cellOptions",
203 + "value": {
204 + "type": "color-background"
205 + }
206 + },
207 + {
208 + "id": "custom.align"
209 + },
210 + {
211 + "id": "thresholds",
212 + "value": {
213 + "mode": "absolute",
214 + "steps": [
215 + {
216 + "color": "dark-orange",
217 + "value": null
218 + }
219 + ]
220 + }
221 + }
222 + ]
223 + },
224 + {
225 + "matcher": {
226 + "id": "byName",
227 + "options": "data_groupName"
228 + },
229 + "properties": [
230 + {
231 + "id": "displayName",
232 + "value": "ALERTS BY TYPE"
233 + },
234 + {
235 + "id": "unit",
236 + "value": "short"
237 + },
238 + {
239 + "id": "decimals",
240 + "value": -1
241 + },
242 + {
243 + "id": "custom.cellOptions",
244 + "value": {
245 + "type": "color-background"
246 + }
247 + },
248 + {
249 + "id": "custom.align"
250 + }
251 + ]
252 + }
253 + ]
254 + },
255 + "gridPos": {
256 + "h": 7,
257 + "w": 7,
258 + "x": 4,
259 + "y": 0
260 + },
261 + "id": 57,
262 + "options": {
263 + "cellHeight": "sm",
264 + "footer": {
265 + "countRows": false,
266 + "fields": "",
267 + "reducer": [
268 + "sum"
269 + ],
270 + "show": false
271 + },
272 + "showHeader": true
273 + },
274 + "pluginVersion": "10.4.2",
275 + "targets": [
276 + {
277 + "bucketAggs": [
278 + {
279 + "fake": true,
280 + "field": "data_scopeName",
281 + "id": "4",
282 + "settings": {
283 + "min_doc_count": 1,
284 + "order": "desc",
285 + "orderBy": "_count",
286 + "size": "0"
287 + },
288 + "type": "terms"
289 + }
290 + ],
291 + "datasource": {
292 + "type": "grafana-opensearch-datasource",
293 + "uid": "replace_datasource_uid"
294 + },
295 + "metrics": [
296 + {
297 + "field": "select field",
298 + "id": "1",
299 + "type": "count"
300 + }
301 + ],
302 + "query": "eventSeverity:$eventSeverity AND cat:RANGER",
303 + "refId": "A",
304 + "timeField": "timestamp"
305 + }
306 + ],
307 + "title": "SCOPES",
308 + "transformations": [
309 + {
310 + "id": "organize",
311 + "options": {
312 + "excludeByName": {},
313 + "indexByName": {},
314 + "renameByName": {
315 + "data_group": "GROUP"
316 + }
317 + }
318 + }
319 + ],
320 + "type": "table"
321 + },
322 + {
323 + "datasource": {
324 + "type": "grafana-opensearch-datasource",
325 + "uid": "replace_datasource_uid"
326 + },
327 + "fieldConfig": {
328 + "defaults": {
329 + "color": {
330 + "mode": "palette-classic"
331 + },
332 + "custom": {
333 + "hideFrom": {
334 + "legend": false,
335 + "tooltip": false,
336 + "viz": false
337 + }
338 + },
339 + "decimals": 0,
340 + "mappings": [],
341 + "unit": "short"
342 + },
343 + "overrides": [
344 + {
345 + "matcher": {
346 + "id": "byName",
347 + "options": "1"
348 + },
349 + "properties": [
350 + {
351 + "id": "color",
352 + "value": {
353 + "fixedColor": "#C8F2C2",
354 + "mode": "fixed"
355 + }
356 + }
357 + ]
358 + },
359 + {
360 + "matcher": {
361 + "id": "byName",
362 + "options": "2"
363 + },
364 + "properties": [
365 + {
366 + "id": "color",
367 + "value": {
368 + "fixedColor": "#96D98D",
369 + "mode": "fixed"
370 + }
371 + }
372 + ]
373 + },
374 + {
375 + "matcher": {
376 + "id": "byName",
377 + "options": "3"
378 + },
379 + "properties": [
380 + {
381 + "id": "color",
382 + "value": {
383 + "fixedColor": "#56A64B",
384 + "mode": "fixed"
385 + }
386 + }
387 + ]
388 + },
389 + {
390 + "matcher": {
391 + "id": "byName",
392 + "options": "4"
393 + },
394 + "properties": [
395 + {
396 + "id": "color",
397 + "value": {
398 + "fixedColor": "#37872D",
399 + "mode": "fixed"
400 + }
401 + }
402 + ]
403 + },
404 + {
405 + "matcher": {
406 + "id": "byName",
407 + "options": "5"
408 + },
409 + "properties": [
410 + {
411 + "id": "color",
412 + "value": {
413 + "fixedColor": "#FFF899",
414 + "mode": "fixed"
415 + }
416 + }
417 + ]
418 + },
419 + {
420 + "matcher": {
421 + "id": "byName",
422 + "options": "7"
423 + },
424 + "properties": [
425 + {
426 + "id": "color",
427 + "value": {
428 + "fixedColor": "#F2CC0C",
429 + "mode": "fixed"
430 + }
431 + }
432 + ]
433 + },
434 + {
435 + "matcher": {
436 + "id": "byName",
437 + "options": "9"
438 + },
439 + "properties": [
440 + {
441 + "id": "color",
442 + "value": {
443 + "fixedColor": "#FF9830",
444 + "mode": "fixed"
445 + }
446 + }
447 + ]
448 + },
449 + {
450 + "matcher": {
451 + "id": "byName",
452 + "options": "10"
453 + },
454 + "properties": [
455 + {
456 + "id": "color",
457 + "value": {
458 + "fixedColor": "#FF9830",
459 + "mode": "fixed"
460 + }
461 + }
462 + ]
463 + },
464 + {
465 + "matcher": {
466 + "id": "byName",
467 + "options": "12"
468 + },
469 + "properties": [
470 + {
471 + "id": "color",
472 + "value": {
473 + "fixedColor": "#F2495C",
474 + "mode": "fixed"
475 + }
476 + }
477 + ]
478 + },
479 + {
480 + "matcher": {
481 + "id": "byName",
482 + "options": "13"
483 + },
484 + "properties": [
485 + {
486 + "id": "color",
487 + "value": {
488 + "fixedColor": "#FF7383",
489 + "mode": "fixed"
490 + }
491 + }
492 + ]
493 + }
494 + ]
495 + },
496 + "gridPos": {
497 + "h": 12,
498 + "w": 6,
499 + "x": 0,
500 + "y": 7
501 + },
502 + "id": 23,
503 + "maxDataPoints": 3,
504 + "options": {
505 + "displayLabels": [],
506 + "legend": {
507 + "calcs": [],
508 + "displayMode": "table",
509 + "placement": "right",
510 + "showLegend": true,
511 + "values": [
512 + "value",
513 + "percent"
514 + ]
515 + },
516 + "pieType": "donut",
517 + "reduceOptions": {
518 + "calcs": [
519 + "sum"
520 + ],
521 + "fields": "",
522 + "values": false
523 + },
524 + "text": {},
525 + "tooltip": {
526 + "mode": "single",
527 + "sort": "none"
528 + }
529 + },
530 + "targets": [
531 + {
532 + "bucketAggs": [
533 + {
534 + "$$hashKey": "object:235",
535 + "fake": true,
536 + "field": "eventSeverity",
537 + "id": "3",
538 + "settings": {
539 + "min_doc_count": 1,
540 + "order": "desc",
541 + "orderBy": "_count",
542 + "size": "10"
543 + },
544 + "type": "terms"
545 + },
546 + {
547 + "$$hashKey": "object:236",
548 + "field": "timestamp",
549 + "id": "2",
550 + "settings": {
551 + "interval": "auto",
552 + "min_doc_count": 0,
553 + "trimEdges": 0
554 + },
555 + "type": "date_histogram"
556 + }
557 + ],
558 + "datasource": {
559 + "type": "grafana-opensearch-datasource",
560 + "uid": "replace_datasource_uid"
561 + },
562 + "metrics": [
563 + {
564 + "$$hashKey": "object:233",
565 + "field": "select field",
566 + "id": "1",
567 + "meta": {},
568 + "settings": {},
569 + "type": "count"
570 + }
571 + ],
572 + "query": "eventSeverity:$eventSeverity AND cat:RANGER",
573 + "refId": "A",
574 + "timeField": "timestamp"
575 + }
576 + ],
577 + "title": "SECURITY EVENTS BY ALERT LEVEL",
578 + "type": "piechart"
579 + },
580 + {
581 + "datasource": {
582 + "type": "grafana-opensearch-datasource",
583 + "uid": "replace_datasource_uid"
584 + },
585 + "fieldConfig": {
586 + "defaults": {
587 + "color": {
588 + "mode": "palette-classic"
589 + },
590 + "custom": {
591 + "axisBorderShow": false,
592 + "axisCenteredZero": false,
593 + "axisColorMode": "text",
594 + "axisLabel": "",
595 + "axisPlacement": "auto",
596 + "barAlignment": 0,
597 + "drawStyle": "line",
598 + "fillOpacity": 0,
599 + "gradientMode": "none",
600 + "hideFrom": {
601 + "legend": false,
602 + "tooltip": false,
603 + "viz": false
604 + },
605 + "insertNulls": false,
606 + "lineInterpolation": "linear",
607 + "lineWidth": 1,
608 + "pointSize": 5,
609 + "scaleDistribution": {
610 + "type": "linear"
611 + },
612 + "showPoints": "auto",
613 + "spanNulls": false,
614 + "stacking": {
615 + "group": "A",
616 + "mode": "normal"
617 + },
618 + "thresholdsStyle": {
619 + "mode": "off"
620 + }
621 + },
622 + "mappings": [],
623 + "thresholds": {
624 + "mode": "absolute",
625 + "steps": [
626 + {
627 + "color": "green",
628 + "value": null
629 + },
630 + {
631 + "color": "red",
632 + "value": 80
633 + }
634 + ]
635 + }
636 + },
637 + "overrides": [
638 + {
639 + "matcher": {
640 + "id": "byName",
641 + "options": "10"
642 + },
643 + "properties": [
644 + {
645 + "id": "color",
646 + "value": {
647 + "fixedColor": "orange",
648 + "mode": "fixed"
649 + }
650 + }
651 + ]
652 + }
653 + ]
654 + },
655 + "gridPos": {
656 + "h": 12,
657 + "w": 18,
658 + "x": 6,
659 + "y": 7
660 + },
661 + "id": 50,
662 + "options": {
663 + "legend": {
664 + "calcs": [],
665 + "displayMode": "table",
666 + "placement": "right",
667 + "showLegend": true
668 + },
669 + "tooltip": {
670 + "mode": "single",
671 + "sort": "none"
672 + }
673 + },
674 + "targets": [
675 + {
676 + "alias": "",
677 + "bucketAggs": [
678 + {
679 + "field": "eventSeverity",
680 + "id": "3",
681 + "settings": {
682 + "min_doc_count": "1",
683 + "order": "desc",
684 + "orderBy": "_count",
685 + "size": "10"
686 + },
687 + "type": "terms"
688 + },
689 + {
690 + "field": "timestamp",
691 + "id": "2",
692 + "settings": {
693 + "interval": "auto"
694 + },
695 + "type": "date_histogram"
696 + }
697 + ],
698 + "datasource": {
699 + "type": "grafana-opensearch-datasource",
700 + "uid": "replace_datasource_uid"
701 + },
702 + "metrics": [
703 + {
704 + "id": "1",
705 + "type": "count"
706 + }
707 + ],
708 + "query": "eventSeverity:$eventSeverity AND cat:RANGER",
709 + "refId": "A",
710 + "timeField": "timestamp"
711 + }
712 + ],
713 + "title": "EVENTS SEVERITY - HISTOGRAM",
714 + "type": "timeseries"
715 + },
716 + {
717 + "datasource": {
718 + "type": "grafana-opensearch-datasource",
719 + "uid": "replace_datasource_uid"
720 + },
721 + "fieldConfig": {
722 + "defaults": {
723 + "color": {
724 + "mode": "thresholds"
725 + },
726 + "custom": {
727 + "align": "auto",
728 + "cellOptions": {
729 + "type": "auto"
730 + },
731 + "filterable": true,
732 + "inspect": false
733 + },
734 + "mappings": [],
735 + "thresholds": {
736 + "mode": "absolute",
737 + "steps": [
738 + {
739 + "color": "green",
740 + "value": null
741 + },
742 + {
743 + "color": "red",
744 + "value": 80
745 + }
746 + ]
747 + }
748 + },
749 + "overrides": [
750 + {
751 + "matcher": {
752 + "id": "byName",
753 + "options": "timestamp"
754 + },
755 + "properties": [
756 + {
757 + "id": "displayName",
758 + "value": "Date/Time"
759 + },
760 + {
761 + "id": "unit",
762 + "value": "time: YYYY-MM-DD HH:mm:ss"
763 + },
764 + {
765 + "id": "custom.align"
766 + }
767 + ]
768 + },
769 + {
770 + "matcher": {
771 + "id": "byName",
772 + "options": "data_computerName"
773 + },
774 + "properties": [
775 + {
776 + "id": "displayName",
777 + "value": "AGENT"
778 + },
779 + {
780 + "id": "unit",
781 + "value": "short"
782 + },
783 + {
784 + "id": "decimals",
785 + "value": 2
786 + },
787 + {
788 + "id": "custom.align"
789 + }
790 + ]
791 + },
792 + {
793 + "matcher": {
794 + "id": "byName",
795 + "options": "agent_ip"
796 + },
797 + "properties": [
798 + {
799 + "id": "displayName",
800 + "value": "IP ADDRESS"
801 + },
802 + {
803 + "id": "unit",
804 + "value": "short"
805 + },
806 + {
807 + "id": "decimals",
808 + "value": 2
809 + },
810 + {
811 + "id": "custom.align"
812 + }
813 + ]
814 + },
815 + {
816 + "matcher": {
817 + "id": "byName",
818 + "options": "rule_description"
819 + },
820 + "properties": [
821 + {
822 + "id": "displayName",
823 + "value": "RULE DESCRIPTION"
824 + },
825 + {
826 + "id": "unit",
827 + "value": "short"
828 + },
829 + {
830 + "id": "decimals",
831 + "value": 2
832 + },
833 + {
834 + "id": "custom.align"
835 + }
836 + ]
837 + },
838 + {
839 + "matcher": {
840 + "id": "byName",
841 + "options": "Date/Time"
842 + },
843 + "properties": [
844 + {
845 + "id": "custom.width",
846 + "value": 242
847 + }
848 + ]
849 + },
850 + {
851 + "matcher": {
852 + "id": "byName",
853 + "options": "AGENT"
854 + },
855 + "properties": [
856 + {
857 + "id": "custom.width",
858 + "value": 160
859 + }
860 + ]
861 + },
862 + {
863 + "matcher": {
864 + "id": "byName",
865 + "options": "MITRE TACTIC"
866 + },
867 + "properties": [
868 + {
869 + "id": "custom.width",
870 + "value": 332
871 + }
872 + ]
873 + },
874 + {
875 + "matcher": {
876 + "id": "byName",
877 + "options": "RULE LEVEL"
878 + },
879 + "properties": [
880 + {
881 + "id": "custom.width",
882 + "value": 122
883 + }
884 + ]
885 + },
886 + {
887 + "matcher": {
888 + "id": "byName",
889 + "options": "IP ADDRESS"
890 + },
891 + "properties": [
892 + {
893 + "id": "custom.width",
894 + "value": 163
895 + }
896 + ]
897 + },
898 + {
899 + "matcher": {
900 + "id": "byName",
901 + "options": "MITRE TECHNIQUE"
902 + },
903 + "properties": [
904 + {
905 + "id": "custom.width",
906 + "value": 312
907 + }
908 + ]
909 + },
910 + {
911 + "matcher": {
912 + "id": "byName",
913 + "options": "rule_id"
914 + },
915 + "properties": [
916 + {
917 + "id": "custom.width",
918 + "value": 96
919 + }
920 + ]
921 + },
922 + {
923 + "matcher": {
924 + "id": "byName",
925 + "options": "EVENT ID"
926 + },
927 + "properties": [
928 + {
929 + "id": "links",
930 + "value": [
931 + {
932 + "targetBlank": true,
933 + "title": "VIEW EVENT DETAILS",
934 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SENTINELONE%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
935 + }
936 + ]
937 + }
938 + ]
939 + },
940 + {
941 + "matcher": {
942 + "id": "byName",
943 + "options": "IP ADD"
944 + },
945 + "properties": [
946 + {
947 + "id": "custom.width",
948 + "value": 176
949 + }
950 + ]
951 + },
952 + {
953 + "matcher": {
954 + "id": "byName",
955 + "options": "EVENT CATEGORY"
956 + },
957 + "properties": [
958 + {
959 + "id": "custom.width",
960 + "value": 209
961 + }
962 + ]
963 + },
964 + {
965 + "matcher": {
966 + "id": "byName",
967 + "options": "USER"
968 + },
969 + "properties": [
970 + {
971 + "id": "custom.width",
972 + "value": 218
973 + }
974 + ]
975 + },
976 + {
977 + "matcher": {
978 + "id": "byName",
979 + "options": "threatClassification"
980 + },
981 + "properties": [
982 + {
983 + "id": "custom.width",
984 + "value": 214
985 + }
986 + ]
987 + },
988 + {
989 + "matcher": {
990 + "id": "byName",
991 + "options": "DESCRIPTION"
992 + },
993 + "properties": [
994 + {
995 + "id": "custom.width",
996 + "value": 688
997 + }
998 + ]
999 + }
1000 + ]
1001 + },
1002 + "gridPos": {
1003 + "h": 16,
1004 + "w": 24,
1005 + "x": 0,
1006 + "y": 19
1007 + },
1008 + "id": 27,
1009 + "options": {
1010 + "cellHeight": "sm",
1011 + "footer": {
1012 + "countRows": false,
1013 + "enablePagination": true,
1014 + "fields": "",
1015 + "reducer": [
1016 + "sum"
1017 + ],
1018 + "show": false
1019 + },
1020 + "showHeader": true,
1021 + "sortBy": []
1022 + },
1023 + "pluginVersion": "10.4.2",
1024 + "targets": [
1025 + {
1026 + "bucketAggs": [],
1027 + "datasource": {
1028 + "type": "grafana-opensearch-datasource",
1029 + "uid": "replace_datasource_uid"
1030 + },
1031 + "metrics": [
1032 + {
1033 + "id": "1",
1034 + "settings": {
1035 + "size": "250"
1036 + },
1037 + "type": "raw_data"
1038 + }
1039 + ],
1040 + "query": "eventSeverity:$eventSeverity AND cat:RANGER",
1041 + "refId": "A",
1042 + "timeField": "timestamp"
1043 + }
1044 + ],
1045 + "title": "EVENTS",
1046 + "transformations": [
1047 + {
1048 + "id": "filterFieldsByName",
1049 + "options": {
1050 + "include": {
1051 + "names": [
1052 + "timestamp",
1053 + "_id",
1054 + "cat",
1055 + "data_computerName",
1056 + "data_username",
1057 + "deviceAddress",
1058 + "deviceAddress_city_name",
1059 + "eventDesc",
1060 + "eventSeverity",
1061 + "fileName",
1062 + "threatClassification",
1063 + "threatConfidenceLevel"
1064 + ]
1065 + }
1066 + }
1067 + },
1068 + {
1069 + "id": "organize",
1070 + "options": {
1071 + "excludeByName": {
1072 + "@metadata_beat": true,
1073 + "@metadata_type": true,
1074 + "@metadata_version": true,
1075 + "IMPHASH": true,
1076 + "MD5": true,
1077 + "SHA1": true,
1078 + "SHA256": true,
1079 + "_id": false,
1080 + "_index": true,
1081 + "_type": true,
1082 + "accountId": true,
1083 + "accountName": true,
1084 + "activityId": true,
1085 + "activityType": true,
1086 + "activityUuid": true,
1087 + "agentId": true,
1088 + "agentUpdatedVersion": true,
1089 + "agent_ephemeral_id": true,
1090 + "agent_hostname": true,
1091 + "agent_id": true,
1092 + "agent_ip_city_name": true,
1093 + "agent_ip_country_code": true,
1094 + "agent_ip_geolocation": true,
1095 + "agent_type": true,
1096 + "agent_version": true,
1097 + "application_name": true,
1098 + "beats_type": true,
1099 + "collector_node_id": true,
1100 + "comments": true,
1101 + "createdAt": true,
1102 + "data_accountName": true,
1103 + "data_alert_action": true,
1104 + "data_alert_category": true,
1105 + "data_alert_gid": true,
1106 + "data_alert_rev": true,
1107 + "data_alert_severity": true,
1108 + "data_alert_signature": true,
1109 + "data_alert_signature_id": true,
1110 + "data_app_proto": true,
1111 + "data_audit_auid": true,
1112 + "data_audit_command": true,
1113 + "data_audit_euid": true,
1114 + "data_audit_exe": true,
1115 + "data_audit_gid": true,
1116 + "data_audit_id": true,
1117 + "data_audit_pid": true,
1118 + "data_audit_res": true,
1119 + "data_audit_session": true,
1120 + "data_audit_type": true,
1121 + "data_audit_uid": true,
1122 + "data_computerName": false,
1123 + "data_confidenceLevel": true,
1124 + "data_createdAt": true,
1125 + "data_description": true,
1126 + "data_dest_ip": true,
1127 + "data_dest_port": true,
1128 + "data_downloadUrl": true,
1129 + "data_dstuser": true,
1130 + "data_event_type": true,
1131 + "data_exclusionType": true,
1132 + "data_extra_data": true,
1133 + "data_file": true,
1134 + "data_fileContentHash": true,
1135 + "data_fileDisplayName": true,
1136 + "data_fileName": true,
1137 + "data_filePath": true,
1138 + "data_flow_bytes_toclient": true,
1139 + "data_flow_bytes_toserver": true,
1140 + "data_flow_id": true,
1141 + "data_flow_pkts_toclient": true,
1142 + "data_flow_pkts_toserver": true,
1143 + "data_flow_start": true,
1144 + "data_fullScopeDetails": true,
1145 + "data_fullScopeDetailsPath": true,
1146 + "data_globalStatus": true,
1147 + "data_groupName": true,
1148 + "data_http_http_content_type": true,
1149 + "data_http_http_port": true,
1150 + "data_http_length": true,
1151 + "data_http_status": true,
1152 + "data_http_url": true,
1153 + "data_id": true,
1154 + "data_in_iface": true,
1155 + "data_majorVersion": true,
1156 + "data_metadata_flowbits": true,
1157 + "data_metadata_flowints_http_anomaly_count": true,
1158 + "data_metadata_flowints_tcp_retransmission_count": true,
1159 + "data_minorVersion": true,
1160 + "data_osArch": true,
1161 + "data_osFamily": true,
1162 + "data_osquery_action": true,
1163 + "data_osquery_calendarTime": true,
1164 + "data_osquery_columns_address": true,
1165 + "data_osquery_columns_address_city_name": true,
1166 + "data_osquery_columns_address_country_code": true,
1167 + "data_osquery_columns_address_geolocation": true,
1168 + "data_osquery_columns_cmdline": true,
1169 + "data_osquery_columns_cwd": true,
1170 + "data_osquery_columns_description": true,
1171 + "data_osquery_columns_directory": true,
1172 + "data_osquery_columns_disk_bytes_read": true,
1173 + "data_osquery_columns_disk_bytes_written": true,
1174 + "data_osquery_columns_egid": true,
1175 + "data_osquery_columns_euid": true,
1176 + "data_osquery_columns_family": true,
1177 + "data_osquery_columns_fd": true,
1178 + "data_osquery_columns_gid": true,
1179 + "data_osquery_columns_gid_signed": true,
1180 + "data_osquery_columns_host": true,
1181 + "data_osquery_columns_interface": true,
1182 + "data_osquery_columns_local_address": true,
1183 + "data_osquery_columns_local_address_city_name": true,
1184 + "data_osquery_columns_local_address_country_code": true,
1185 + "data_osquery_columns_local_address_geolocation": true,
1186 + "data_osquery_columns_local_port": true,
1187 + "data_osquery_columns_mac": true,
1188 + "data_osquery_columns_name": true,
1189 + "data_osquery_columns_net_namespace": true,
1190 + "data_osquery_columns_nice": true,
1191 + "data_osquery_columns_on_disk": true,
1192 + "data_osquery_columns_parent": true,
1193 + "data_osquery_columns_path": true,
1194 + "data_osquery_columns_pgroup": true,
1195 + "data_osquery_columns_pid": true,
1196 + "data_osquery_columns_port": true,
1197 + "data_osquery_columns_protocol": true,
1198 + "data_osquery_columns_remote_address": true,
1199 + "data_osquery_columns_remote_address_city_name": true,
1200 + "data_osquery_columns_remote_address_country_code": true,
1201 + "data_osquery_columns_remote_address_geolocation": true,
1202 + "data_osquery_columns_remote_port": true,
1203 + "data_osquery_columns_resident_size": true,
1204 + "data_osquery_columns_root": true,
1205 + "data_osquery_columns_sgid": true,
1206 + "data_osquery_columns_shell": true,
1207 + "data_osquery_columns_socket": true,
1208 + "data_osquery_columns_start_time": true,
1209 + "data_osquery_columns_state": true,
1210 + "data_osquery_columns_suid": true,
1211 + "data_osquery_columns_system_time": true,
1212 + "data_osquery_columns_threads": true,
1213 + "data_osquery_columns_time_utc": true,
1214 + "data_osquery_columns_total_size": true,
1215 + "data_osquery_columns_tty": true,
1216 + "data_osquery_columns_type": true,
1217 + "data_osquery_columns_uid": true,
1218 + "data_osquery_columns_uid_signed": true,
1219 + "data_osquery_columns_user": true,
1220 + "data_osquery_columns_user_time": true,
1221 + "data_osquery_columns_username": true,
1222 + "data_osquery_columns_wired_size": true,
1223 + "data_osquery_counter": true,
1224 + "data_osquery_decorations_host_uuid": true,
1225 + "data_osquery_decorations_hostname": true,
1226 + "data_osquery_epoch": true,
1227 + "data_osquery_hostIdentifier": true,
1228 + "data_osquery_name": true,
1229 + "data_osquery_numerics": true,
1230 + "data_osquery_unixTime": true,
1231 + "data_packageId": true,
1232 + "data_platformType": true,
1233 + "data_proto": true,
1234 + "data_sca_check_command": true,
1235 + "data_sca_check_compliance_cis": true,
1236 + "data_sca_check_compliance_cis_csc": true,
1237 + "data_sca_check_compliance_gdpr_IV": true,
1238 + "data_sca_check_compliance_gpg_13": true,
1239 + "data_sca_check_compliance_hipaa": true,
1240 + "data_sca_check_compliance_nist_800_53": true,
1241 + "data_sca_check_compliance_pci_dss": true,
1242 + "data_sca_check_compliance_tsc": true,
1243 + "data_sca_check_description": true,
1244 + "data_sca_check_id": true,
1245 + "data_sca_check_previous_result": true,
1246 + "data_sca_check_rationale": true,
1247 + "data_sca_check_remediation": true,
1248 + "data_sca_check_result": true,
1249 + "data_sca_check_title": true,
1250 + "data_sca_description": true,
1251 + "data_sca_failed": true,
1252 + "data_sca_file": true,
1253 + "data_sca_invalid": true,
1254 + "data_sca_passed": true,
1255 + "data_sca_policy": true,
1256 + "data_sca_policy_id": true,
1257 + "data_sca_scan_id": true,
1258 + "data_sca_score": true,
1259 + "data_sca_total_checks": true,
1260 + "data_sca_type": true,
1261 + "data_scanType": true,
1262 + "data_scopeLevel": true,
1263 + "data_scopeName": true,
1264 + "data_script": true,
1265 + "data_secured": true,
1266 + "data_siteName": true,
1267 + "data_src_ip": true,
1268 + "data_src_ip_city_name": true,
1269 + "data_src_ip_country_code": true,
1270 + "data_src_ip_geolocation": true,
1271 + "data_src_port": true,
1272 + "data_srcip": true,
1273 + "data_srcip_city_name": true,
1274 + "data_srcip_country_code": true,
1275 + "data_srcip_geolocation": true,
1276 + "data_srcuser": true,
1277 + "data_status": true,
1278 + "data_threatClassification": true,
1279 + "data_timestamp": true,
1280 + "data_title": true,
1281 + "data_tls_session_resumed": true,
1282 + "data_tls_version": true,
1283 + "data_totalNewDevices": true,
1284 + "data_tx_id": true,
1285 + "data_type": true,
1286 + "data_unknown": true,
1287 + "data_unsecured": true,
1288 + "data_unsupported": true,
1289 + "data_value": true,
1290 + "data_version": true,
1291 + "data_version_city_name": true,
1292 + "data_version_country_code": true,
1293 + "data_version_geolocation": true,
1294 + "data_win_eventXML_binaryData": true,
1295 + "data_win_eventXML_binaryDataSize": true,
1296 + "data_win_eventXML_param1": true,
1297 + "data_win_eventdata_authenticationPackageName": true,
1298 + "data_win_eventdata_callTrace": true,
1299 + "data_win_eventdata_commandLine": true,
1300 + "data_win_eventdata_company": true,
1301 + "data_win_eventdata_creationUtcTime": true,
1302 + "data_win_eventdata_currentDirectory": true,
1303 + "data_win_eventdata_description": true,
1304 + "data_win_eventdata_destinationHostname": true,
1305 + "data_win_eventdata_destinationIp": true,
1306 + "data_win_eventdata_destinationIp_city_name": true,
1307 + "data_win_eventdata_destinationIp_country_code": true,
1308 + "data_win_eventdata_destinationIp_geolocation": true,
1309 + "data_win_eventdata_destinationIsIpv6": true,
1310 + "data_win_eventdata_destinationPort": true,
1311 + "data_win_eventdata_destinationPortName": true,
1312 + "data_win_eventdata_details": true,
1313 + "data_win_eventdata_elevatedToken": true,
1314 + "data_win_eventdata_eventType": true,
1315 + "data_win_eventdata_fileVersion": true,
1316 + "data_win_eventdata_fileVersion_city_name": true,
1317 + "data_win_eventdata_fileVersion_country_code": true,
1318 + "data_win_eventdata_fileVersion_geolocation": true,
1319 + "data_win_eventdata_grantedAccess": true,
1320 + "data_win_eventdata_hashes": true,
1321 + "data_win_eventdata_image": true,
1322 + "data_win_eventdata_imageLoaded": true,
1323 + "data_win_eventdata_impersonationLevel": true,
1324 + "data_win_eventdata_initiated": true,
1325 + "data_win_eventdata_integrityLevel": true,
1326 + "data_win_eventdata_ipAddress": true,
1327 + "data_win_eventdata_ipPort": true,
1328 + "data_win_eventdata_keyLength": true,
1329 + "data_win_eventdata_logonGuid": true,
1330 + "data_win_eventdata_logonId": true,
1331 + "data_win_eventdata_logonProcessName": true,
1332 + "data_win_eventdata_logonType": true,
1333 + "data_win_eventdata_originalFileName": true,
1334 + "data_win_eventdata_param1": true,
1335 + "data_win_eventdata_param2": true,
1336 + "data_win_eventdata_param3": true,
1337 + "data_win_eventdata_param4": true,
1338 + "data_win_eventdata_parentCommandLine": true,
1339 + "data_win_eventdata_parentImage": true,
1340 + "data_win_eventdata_parentProcessGuid": true,
1341 + "data_win_eventdata_parentProcessId": true,
1342 + "data_win_eventdata_processGuid": true,
1343 + "data_win_eventdata_processId": true,
1344 + "data_win_eventdata_processName": true,
1345 + "data_win_eventdata_product": true,
1346 + "data_win_eventdata_protocol": true,
1347 + "data_win_eventdata_queryName": true,
1348 + "data_win_eventdata_queryResults": true,
1349 + "data_win_eventdata_queryStatus": true,
1350 + "data_win_eventdata_ruleName": true,
1351 + "data_win_eventdata_serviceName": true,
1352 + "data_win_eventdata_serviceSid": true,
1353 + "data_win_eventdata_signature": true,
1354 + "data_win_eventdata_signatureStatus": true,
1355 + "data_win_eventdata_signed": true,
1356 + "data_win_eventdata_sourceHostname": true,
1357 + "data_win_eventdata_sourceImage": true,
1358 + "data_win_eventdata_sourceIp": true,
1359 + "data_win_eventdata_sourceIp_city_name": true,
1360 + "data_win_eventdata_sourceIp_country_code": true,
1361 + "data_win_eventdata_sourceIp_geolocation": true,
1362 + "data_win_eventdata_sourceIsIpv6": true,
1363 + "data_win_eventdata_sourcePort": true,
1364 + "data_win_eventdata_sourceProcessGUID": true,
1365 + "data_win_eventdata_sourceProcessId": true,
1366 + "data_win_eventdata_sourceThreadId": true,
1367 + "data_win_eventdata_status": true,
1368 + "data_win_eventdata_subjectDomainName": true,
1369 + "data_win_eventdata_subjectLogonId": true,
1370 + "data_win_eventdata_subjectUserName": true,
1371 + "data_win_eventdata_subjectUserSid": true,
1372 + "data_win_eventdata_targetDomainName": true,
1373 + "data_win_eventdata_targetFilename": true,
1374 + "data_win_eventdata_targetImage": true,
1375 + "data_win_eventdata_targetLinkedLogonId": true,
1376 + "data_win_eventdata_targetLogonId": true,
1377 + "data_win_eventdata_targetObject": true,
1378 + "data_win_eventdata_targetProcessGUID": true,
1379 + "data_win_eventdata_targetProcessId": true,
1380 + "data_win_eventdata_targetUserName": true,
1381 + "data_win_eventdata_targetUserSid": true,
1382 + "data_win_eventdata_terminalSessionId": true,
1383 + "data_win_eventdata_ticketEncryptionType": true,
1384 + "data_win_eventdata_ticketOptions": true,
1385 + "data_win_eventdata_user": true,
1386 + "data_win_eventdata_utcTime": true,
1387 + "data_win_eventdata_virtualAccount": true,
1388 + "data_win_system_channel": true,
1389 + "data_win_system_computer": true,
1390 + "data_win_system_eventID": true,
1391 + "data_win_system_eventRecordID": true,
1392 + "data_win_system_eventSourceName": true,
1393 + "data_win_system_keywords": true,
1394 + "data_win_system_level": true,
1395 + "data_win_system_message": true,
1396 + "data_win_system_opcode": true,
1397 + "data_win_system_processID": true,
1398 + "data_win_system_providerGuid": true,
1399 + "data_win_system_providerName": true,
1400 + "data_win_system_severityValue": true,
1401 + "data_win_system_systemTime": true,
1402 + "data_win_system_task": true,
1403 + "data_win_system_threadID": true,
1404 + "data_win_system_version": true,
1405 + "decoder_name": true,
1406 + "decoder_parent": true,
1407 + "description": true,
1408 + "deviceAddress_city_name": true,
1409 + "deviceAddress_country_code": true,
1410 + "deviceAddress_geolocation": true,
1411 + "deviceHostFqdn": true,
1412 + "deviceHostName": true,
1413 + "dns_query": true,
1414 + "dns_query_threat_indicated": true,
1415 + "dst_ip": true,
1416 + "dst_ip_city_name": true,
1417 + "dst_ip_country_code": true,
1418 + "dst_ip_geolocation": true,
1419 + "dst_ip_threat_indicated": true,
1420 + "dst_port": true,
1421 + "ecs_version": true,
1422 + "error": true,
1423 + "eventID": true,
1424 + "event_hash": true,
1425 + "facility": true,
1426 + "facility_num": true,
1427 + "fileHashMd5": true,
1428 + "fileHashSha256": true,
1429 + "fileName": false,
1430 + "file_path": true,
1431 + "firewall_rule_name": true,
1432 + "full_log": false,
1433 + "gl2_accounted_message_size": true,
1434 + "gl2_message_id": true,
1435 + "gl2_remote_ip": true,
1436 + "gl2_remote_port": true,
1437 + "gl2_source_collector": true,
1438 + "gl2_source_input": true,
1439 + "gl2_source_node": true,
1440 + "groupId": true,
1441 + "groupName": true,
1442 + "hash": true,
1443 + "hash_md5": true,
1444 + "hash_sha1": true,
1445 + "hash_sha256": true,
1446 + "highlight": true,
1447 + "host_architecture": true,
1448 + "host_containerized": true,
1449 + "host_hostname": true,
1450 + "host_id": true,
1451 + "host_ip": true,
1452 + "host_mac": true,
1453 + "host_name": true,
1454 + "host_os_codename": true,
1455 + "host_os_kernel": true,
1456 + "host_os_name": true,
1457 + "host_os_platform": true,
1458 + "host_os_version": true,
1459 + "hostname": true,
1460 + "id": true,
1461 + "input_type": true,
1462 + "ip": true,
1463 + "ip_city_name": true,
1464 + "ip_country_code": true,
1465 + "ip_geolocation": true,
1466 + "level": true,
1467 + "location": true,
1468 + "log_file_path": true,
1469 + "log_offset": true,
1470 + "manager_name": true,
1471 + "message": true,
1472 + "module": true,
1473 + "notificationScope": true,
1474 + "originatorName": true,
1475 + "originatorVersion": true,
1476 + "originatorVersion_city_name": true,
1477 + "originatorVersion_country_code": true,
1478 + "originatorVersion_geolocation": true,
1479 + "osFamily": true,
1480 + "parent_process_cmd_line": true,
1481 + "parent_process_id": true,
1482 + "parent_process_image": true,
1483 + "pid": true,
1484 + "predecoder_hostname": true,
1485 + "predecoder_program_name": true,
1486 + "predecoder_timestamp": true,
1487 + "previous_log": true,
1488 + "previous_output": true,
1489 + "process_cmd_line": true,
1490 + "process_id": true,
1491 + "process_image": true,
1492 + "process_name": true,
1493 + "protocol": true,
1494 + "rt": true,
1495 + "rule_cis": true,
1496 + "rule_cis_csc": true,
1497 + "rule_firedtimes": true,
1498 + "rule_gdpr": true,
1499 + "rule_gdpr_IV": true,
1500 + "rule_gpg13": true,
1501 + "rule_gpg_13": true,
1502 + "rule_hipaa": true,
1503 + "rule_id": false,
1504 + "rule_info": true,
1505 + "rule_mail": true,
1506 + "rule_mitre_id": true,
1507 + "rule_mitre_tactic": false,
1508 + "rule_nist_800_53": true,
1509 + "rule_pci_dss": true,
1510 + "rule_tsc": true,
1511 + "scanType": true,
1512 + "scanid": true,
1513 + "secondaryDescription": true,
1514 + "secured": true,
1515 + "service": true,
1516 + "siteId": true,
1517 + "siteName": true,
1518 + "software_package": true,
1519 + "software_vendor": true,
1520 + "sort": true,
1521 + "source": true,
1522 + "sourceAgentId": true,
1523 + "sourceAgentUuid": true,
1524 + "sourceDnsDomain": true,
1525 + "sourceFqdn": true,
1526 + "sourceGroupId": true,
1527 + "sourceGroupName": true,
1528 + "sourceHostName": true,
1529 + "sourceIpAddresses_0": true,
1530 + "sourceIpAddresses_1": true,
1531 + "sourceIpAddresses_1_city_name": true,
1532 + "sourceIpAddresses_1_country_code": true,
1533 + "sourceIpAddresses_1_geolocation": true,
1534 + "sourceIpAddresses_2": true,
1535 + "sourceIpAddresses_2_city_name": true,
1536 + "sourceIpAddresses_2_country_code": true,
1537 + "sourceIpAddresses_2_geolocation": true,
1538 + "sourceIpAddresses_3": true,
1539 + "sourceIpAddresses_3_city_name": true,
1540 + "sourceIpAddresses_3_country_code": true,
1541 + "sourceIpAddresses_3_geolocation": true,
1542 + "sourceIpAddresses_4": true,
1543 + "sourceIpAddresses_4_city_name": true,
1544 + "sourceIpAddresses_4_country_code": true,
1545 + "sourceIpAddresses_4_geolocation": true,
1546 + "sourceIpAddresses_5": true,
1547 + "sourceMacAddresses_0": true,
1548 + "sourceMacAddresses_1": true,
1549 + "sourceMgmtPrecievedAddress": true,
1550 + "sourceMgmtPrecievedAddress_city_name": true,
1551 + "sourceMgmtPrecievedAddress_country_code": true,
1552 + "sourceMgmtPrecievedAddress_geolocation": true,
1553 + "sourceNetworkState": true,
1554 + "sourceOsRevision": true,
1555 + "sourceOsType": true,
1556 + "sourceThreatCount": true,
1557 + "sourceUserId": true,
1558 + "sourceUserName": true,
1559 + "source_city_name": true,
1560 + "source_country_code": true,
1561 + "source_geolocation": true,
1562 + "src_ip": true,
1563 + "src_ip_city_name": true,
1564 + "src_ip_country_code": true,
1565 + "src_ip_geolocation": true,
1566 + "src_port": true,
1567 + "streams": true,
1568 + "syscheck_attrs_after": true,
1569 + "syscheck_audit_effective_user_id": true,
1570 + "syscheck_audit_effective_user_name": true,
1571 + "syscheck_audit_group_id": true,
1572 + "syscheck_audit_group_name": true,
1573 + "syscheck_audit_login_user_id": true,
1574 + "syscheck_audit_login_user_name": true,
1575 + "syscheck_audit_process_cwd": true,
1576 + "syscheck_audit_process_id": true,
1577 + "syscheck_audit_process_name": true,
1578 + "syscheck_audit_process_parent_cwd": true,
1579 + "syscheck_audit_process_parent_name": true,
1580 + "syscheck_audit_process_ppid": true,
1581 + "syscheck_audit_user_id": true,
1582 + "syscheck_audit_user_name": true,
1583 + "syscheck_changed_attributes": true,
1584 + "syscheck_event": true,
1585 + "syscheck_gid_after": true,
1586 + "syscheck_gname_after": true,
1587 + "syscheck_hard_links": true,
1588 + "syscheck_inode_after": true,
1589 + "syscheck_inode_before": true,
1590 + "syscheck_md5_after": true,
1591 + "syscheck_md5_before": true,
1592 + "syscheck_mode": true,
1593 + "syscheck_mtime_after": true,
1594 + "syscheck_mtime_before": true,
1595 + "syscheck_path": true,
1596 + "syscheck_perm_after": true,
1597 + "syscheck_perm_before": true,
1598 + "syscheck_sha1_after": true,
1599 + "syscheck_sha1_before": true,
1600 + "syscheck_sha256_after": true,
1601 + "syscheck_sha256_before": true,
1602 + "syscheck_size_after": true,
1603 + "syscheck_size_before": true,
1604 + "syscheck_uid_after": true,
1605 + "syscheck_uname_after": true,
1606 + "syscheck_win_perm_after": true,
1607 + "syscheck_win_perm_after_0_allowed": true,
1608 + "syscheck_win_perm_after_0_name": true,
1609 + "syscheck_win_perm_after_1_allowed": true,
1610 + "syscheck_win_perm_after_1_name": true,
1611 + "syscheck_win_perm_after_2_allowed": true,
1612 + "syscheck_win_perm_after_2_name": true,
1613 + "syscheck_win_perm_after_3_allowed": true,
1614 + "syscheck_win_perm_after_3_name": true,
1615 + "syslog_customer": true,
1616 + "syslog_tag": true,
1617 + "syslog_type": true,
1618 + "sysmon_event_description": true,
1619 + "threatClassification": false,
1620 + "threatClassificationSource": true,
1621 + "threatClassifier": true,
1622 + "threatCommandLineArguments": true,
1623 + "threatConfidenceLevel": false,
1624 + "threatDetectingEngine": true,
1625 + "threatDetectionTime": true,
1626 + "threatID": true,
1627 + "threatId": true,
1628 + "threatIndicatorsList_0": true,
1629 + "threatIndicatorsList_1": true,
1630 + "threatIndicatorsList_10": true,
1631 + "threatIndicatorsList_11": true,
1632 + "threatIndicatorsList_12": true,
1633 + "threatIndicatorsList_13": true,
1634 + "threatIndicatorsList_14": true,
1635 + "threatIndicatorsList_15": true,
1636 + "threatIndicatorsList_16": true,
1637 + "threatIndicatorsList_17": true,
1638 + "threatIndicatorsList_18": true,
1639 + "threatIndicatorsList_19": true,
1640 + "threatIndicatorsList_2": true,
1641 + "threatIndicatorsList_20": true,
1642 + "threatIndicatorsList_21": true,
1643 + "threatIndicatorsList_22": true,
1644 + "threatIndicatorsList_23": true,
1645 + "threatIndicatorsList_24": true,
1646 + "threatIndicatorsList_25": true,
1647 + "threatIndicatorsList_26": true,
1648 + "threatIndicatorsList_27": true,
1649 + "threatIndicatorsList_28": true,
1650 + "threatIndicatorsList_29": true,
1651 + "threatIndicatorsList_3": true,
1652 + "threatIndicatorsList_30": true,
1653 + "threatIndicatorsList_31": true,
1654 + "threatIndicatorsList_32": true,
1655 + "threatIndicatorsList_33": true,
1656 + "threatIndicatorsList_34": true,
1657 + "threatIndicatorsList_35": true,
1658 + "threatIndicatorsList_36": true,
1659 + "threatIndicatorsList_37": true,
1660 + "threatIndicatorsList_38": true,
1661 + "threatIndicatorsList_39": true,
1662 + "threatIndicatorsList_4": true,
1663 + "threatIndicatorsList_40": true,
1664 + "threatIndicatorsList_41": true,
1665 + "threatIndicatorsList_42": true,
1666 + "threatIndicatorsList_43": true,
1667 + "threatIndicatorsList_44": true,
1668 + "threatIndicatorsList_45": true,
1669 + "threatIndicatorsList_46": true,
1670 + "threatIndicatorsList_47": true,
1671 + "threatIndicatorsList_48": true,
1672 + "threatIndicatorsList_49": true,
1673 + "threatIndicatorsList_5": true,
1674 + "threatIndicatorsList_50": true,
1675 + "threatIndicatorsList_51": true,
1676 + "threatIndicatorsList_52": true,
1677 + "threatIndicatorsList_53": true,
1678 + "threatIndicatorsList_54": true,
1679 + "threatIndicatorsList_55": true,
1680 + "threatIndicatorsList_56": true,
1681 + "threatIndicatorsList_6": true,
1682 + "threatIndicatorsList_7": true,
1683 + "threatIndicatorsList_8": true,
1684 + "threatIndicatorsList_9": true,
1685 + "threatMitigationStatus": true,
1686 + "threatMitigationStatusID": true,
1687 + "threatProcessUser": true,
1688 + "threatStoryline": true,
1689 + "threat_ids": true,
1690 + "threat_indicated": true,
1691 + "threat_names": true,
1692 + "time": true,
1693 + "timestamp": false,
1694 + "totalNewDevices": true,
1695 + "unknown": true,
1696 + "unsecured": true,
1697 + "unsupported": true,
1698 + "updatedAt": true,
1699 + "userId": true,
1700 + "user_name": true,
1701 + "vendor": true,
1702 + "win_registry_key": true,
1703 + "win_system_eventID": true,
1704 + "windows_auth_package": true,
1705 + "windows_domain": true,
1706 + "windows_event_id": true,
1707 + "windows_event_severity": true,
1708 + "windows_logon_type": true
1709 + },
1710 + "indexByName": {
1711 + "_id": 1,
1712 + "_index": 5,
1713 + "_type": 6,
1714 + "accountId": 7,
1715 + "accountName": 8,
1716 + "activityId": 9,
1717 + "activityType": 10,
1718 + "activityUuid": 11,
1719 + "agentId": 12,
1720 + "agentUpdatedVersion": 13,
1721 + "application_name": 14,
1722 + "cat": 15,
1723 + "comments": 16,
1724 + "createdAt": 17,
1725 + "data_accountName": 18,
1726 + "data_computerName": 2,
1727 + "data_confidenceLevel": 19,
1728 + "data_downloadUrl": 20,
1729 + "data_fileContentHash": 21,
1730 + "data_fileDisplayName": 22,
1731 + "data_filePath": 23,
1732 + "data_fullScopeDetails": 24,
1733 + "data_fullScopeDetailsPath": 25,
1734 + "data_globalStatus": 26,
1735 + "data_groupName": 27,
1736 + "data_scopeLevel": 28,
1737 + "data_scopeName": 29,
1738 + "data_siteName": 30,
1739 + "data_threatClassification": 31,
1740 + "data_username": 32,
1741 + "description": 33,
1742 + "deviceAddress": 3,
1743 + "deviceAddress_city_name": 34,
1744 + "deviceAddress_country_code": 35,
1745 + "deviceAddress_geolocation": 36,
1746 + "deviceHostFqdn": 37,
1747 + "deviceHostName": 38,
1748 + "eventDesc": 39,
1749 + "eventID": 40,
1750 + "eventSeverity": 4,
1751 + "facility": 41,
1752 + "facility_num": 42,
1753 + "fileHashMd5": 43,
1754 + "fileHashSha256": 44,
1755 + "fileName": 45,
1756 + "gl2_accounted_message_size": 46,
1757 + "gl2_message_id": 47,
1758 + "gl2_remote_ip": 48,
1759 + "gl2_remote_port": 49,
1760 + "gl2_source_input": 50,
1761 + "gl2_source_node": 51,
1762 + "groupId": 52,
1763 + "groupName": 53,
1764 + "hash": 54,
1765 + "highlight": 55,
1766 + "level": 56,
1767 + "message": 57,
1768 + "notificationScope": 58,
1769 + "originatorName": 59,
1770 + "originatorVersion": 60,
1771 + "osFamily": 61,
1772 + "process_id": 62,
1773 + "rt": 63,
1774 + "secondaryDescription": 64,
1775 + "siteId": 65,
1776 + "siteName": 66,
1777 + "sort": 67,
1778 + "source": 68,
1779 + "sourceAgentId": 69,
1780 + "sourceAgentUuid": 70,
1781 + "sourceDnsDomain": 71,
1782 + "sourceFqdn": 72,
1783 + "sourceGroupId": 73,
1784 + "sourceGroupName": 74,
1785 + "sourceHostName": 75,
1786 + "sourceIpAddresses_0": 76,
1787 + "sourceIpAddresses_1": 77,
1788 + "sourceMacAddresses_0": 78,
1789 + "sourceMacAddresses_1": 79,
1790 + "sourceMgmtPrecievedAddress": 80,
1791 + "sourceMgmtPrecievedAddress_city_name": 81,
1792 + "sourceMgmtPrecievedAddress_country_code": 82,
1793 + "sourceMgmtPrecievedAddress_geolocation": 83,
1794 + "sourceNetworkState": 84,
1795 + "sourceOsRevision": 85,
1796 + "sourceOsType": 86,
1797 + "sourceThreatCount": 87,
1798 + "source_city_name": 88,
1799 + "source_country_code": 89,
1800 + "source_geolocation": 90,
1801 + "streams": 91,
1802 + "syslog_customer": 92,
1803 + "syslog_type": 93,
1804 + "threatClassification": 94,
1805 + "threatClassificationSource": 95,
1806 + "threatClassifier": 96,
1807 + "threatCommandLineArguments": 97,
1808 + "threatConfidenceLevel": 98,
1809 + "threatDetectingEngine": 99,
1810 + "threatDetectionTime": 100,
1811 + "threatID": 101,
1812 + "threatId": 102,
1813 + "threatMitigationStatus": 103,
1814 + "threatMitigationStatusID": 104,
1815 + "threatProcessUser": 105,
1816 + "threatStoryline": 106,
1817 + "timestamp": 0,
1818 + "updatedAt": 107,
1819 + "userId": 108,
1820 + "vendor": 109
1821 + },
1822 + "renameByName": {
1823 + "_id": "EVENT ID",
1824 + "cat": "EVENT CATEGORY",
1825 + "data_computerName": "AGENT",
1826 + "data_username": "USER",
1827 + "deviceAddress": "IP ADD",
1828 + "eventDesc": "DESCRIPTION",
1829 + "eventSeverity": "SEVERITY",
1830 + "rule_id": "RULE ID",
1831 + "rule_mitre_tactic": "MITRE TACTIC",
1832 + "rule_mitre_technique": "MITRE TECHNIQUE",
1833 + "timestamp": "DATE/TIME"
1834 + }
1835 + }
1836 + }
1837 + ],
1838 + "transparent": true,
1839 + "type": "table"
1840 + }
1841 + ],
1842 + "refresh": "",
1843 + "schemaVersion": 39,
1844 + "tags": [
1845 + "EDR"
1846 + ],
1847 + "templating": {
1848 + "list": [
1849 + {
1850 + "datasource": {
1851 + "type": "grafana-opensearch-datasource",
1852 + "uid": "replace_datasource_uid"
1853 + },
1854 + "filters": [],
1855 + "hide": 0,
1856 + "label": "",
1857 + "name": "Filters",
1858 + "skipUrlSync": false,
1859 + "type": "adhoc"
1860 + },
1861 + {
1862 + "current": {
1863 + "selected": false,
1864 + "text": "All",
1865 + "value": "$__all"
1866 + },
1867 + "datasource": {
1868 + "type": "grafana-opensearch-datasource",
1869 + "uid": "replace_datasource_uid"
1870 + },
1871 + "definition": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:RANGER\"}",
1872 + "hide": 0,
1873 + "includeAll": true,
1874 + "label": "Event Severity",
1875 + "multi": false,
1876 + "name": "eventSeverity",
1877 + "options": [],
1878 + "query": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:RANGER\"}",
1879 + "refresh": 2,
1880 + "regex": "",
1881 + "skipUrlSync": false,
1882 + "sort": 0,
1883 + "type": "query"
1884 + }
1885 + ]
1886 + },
1887 + "time": {
1888 + "from": "now-7d",
1889 + "to": "now"
1890 + },
1891 + "timepicker": {
1892 + "refresh_intervals": [
1893 + "5s",
1894 + "10s",
1895 + "30s",
1896 + "1m",
1897 + "5m",
1898 + "15m",
1899 + "30m",
1900 + "1h",
1901 + "2h",
1902 + "1d"
1903 + ],
1904 + "time_options": [
1905 + "5m",
1906 + "15m",
1907 + "1h",
1908 + "6h",
1909 + "12h",
1910 + "24h",
1911 + "2d",
1912 + "7d",
1913 + "30d"
1914 + ]
1915 + },
1916 + "timezone": "",
1917 + "title": "EDR - SENTINELONE EPP - RANGER",
1918 + "weekStart": ""
1919 +}
backend/app/connectors/grafana/dashboards/Sentinelone/sentinelone_epp_summary.json new
+3918
@@ -0,0 +1,3918 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "EDR"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "grafana-opensearch-datasource",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "color": {
52 + "mode": "palette-classic"
53 + },
54 + "custom": {
55 + "hideFrom": {
56 + "legend": false,
57 + "tooltip": false,
58 + "viz": false
59 + }
60 + },
61 + "mappings": [
62 + {
63 + "options": {
64 + "match": "null",
65 + "result": {
66 + "text": "N/A"
67 + }
68 + },
69 + "type": "special"
70 + }
71 + ],
72 + "max": 15,
73 + "min": 0,
74 + "unit": "none"
75 + },
76 + "overrides": []
77 + },
78 + "gridPos": {
79 + "h": 7,
80 + "w": 4,
81 + "x": 0,
82 + "y": 0
83 + },
84 + "id": 16,
85 + "links": [],
86 + "options": {
87 + "legend": {
88 + "displayMode": "table",
89 + "placement": "right",
90 + "showLegend": true
91 + },
92 + "pieType": "donut",
93 + "reduceOptions": {
94 + "calcs": [
95 + "sum"
96 + ],
97 + "fields": "",
98 + "values": false
99 + },
100 + "tooltip": {
101 + "mode": "single",
102 + "sort": "none"
103 + }
104 + },
105 + "pluginVersion": "9.2.0",
106 + "targets": [
107 + {
108 + "bucketAggs": [
109 + {
110 + "field": "data_threatClassification",
111 + "id": "3",
112 + "settings": {
113 + "min_doc_count": "1",
114 + "order": "desc",
115 + "orderBy": "_term",
116 + "size": "10"
117 + },
118 + "type": "terms"
119 + },
120 + {
121 + "field": "timestamp",
122 + "id": "2",
123 + "settings": {
124 + "interval": "auto",
125 + "min_doc_count": 0,
126 + "trimEdges": 0
127 + },
128 + "type": "date_histogram"
129 + }
130 + ],
131 + "datasource": {
132 + "type": "grafana-opensearch-datasource",
133 + "uid": "replace_datasource_uid"
134 + },
135 + "metrics": [
136 + {
137 + "id": "1",
138 + "type": "count"
139 + }
140 + ],
141 + "query": "",
142 + "refId": "A",
143 + "timeField": "timestamp"
144 + }
145 + ],
146 + "title": "THREATS CLASSIFICATION",
147 + "type": "piechart"
148 + },
149 + {
150 + "datasource": {
151 + "type": "grafana-opensearch-datasource",
152 + "uid": "replace_datasource_uid"
153 + },
154 + "fieldConfig": {
155 + "defaults": {
156 + "color": {
157 + "mode": "thresholds"
158 + },
159 + "custom": {
160 + "align": "auto",
161 + "cellOptions": {
162 + "type": "auto"
163 + },
164 + "inspect": false
165 + },
166 + "mappings": [],
167 + "thresholds": {
168 + "mode": "absolute",
169 + "steps": [
170 + {
171 + "color": "orange",
172 + "value": null
173 + }
174 + ]
175 + }
176 + },
177 + "overrides": [
178 + {
179 + "matcher": {
180 + "id": "byName",
181 + "options": "Time"
182 + },
183 + "properties": [
184 + {
185 + "id": "displayName",
186 + "value": "Time"
187 + },
188 + {
189 + "id": "unit",
190 + "value": "time: YYYY-MM-DD HH:mm:ss"
191 + },
192 + {
193 + "id": "custom.align"
194 + }
195 + ]
196 + },
197 + {
198 + "matcher": {
199 + "id": "byName",
200 + "options": "Count"
201 + },
202 + "properties": [
203 + {
204 + "id": "displayName",
205 + "value": "EVENTS"
206 + },
207 + {
208 + "id": "unit",
209 + "value": "short"
210 + },
211 + {
212 + "id": "decimals",
213 + "value": -1
214 + },
215 + {
216 + "id": "custom.cellOptions",
217 + "value": {
218 + "type": "color-background"
219 + }
220 + },
221 + {
222 + "id": "custom.align"
223 + },
224 + {
225 + "id": "thresholds",
226 + "value": {
227 + "mode": "absolute",
228 + "steps": [
229 + {
230 + "color": "dark-orange",
231 + "value": null
232 + }
233 + ]
234 + }
235 + }
236 + ]
237 + },
238 + {
239 + "matcher": {
240 + "id": "byName",
241 + "options": "data_groupName"
242 + },
243 + "properties": [
244 + {
245 + "id": "displayName",
246 + "value": "ALERTS BY TYPE"
247 + },
248 + {
249 + "id": "unit",
250 + "value": "short"
251 + },
252 + {
253 + "id": "decimals",
254 + "value": -1
255 + },
256 + {
257 + "id": "custom.cellOptions",
258 + "value": {
259 + "type": "color-background"
260 + }
261 + },
262 + {
263 + "id": "custom.align"
264 + }
265 + ]
266 + }
267 + ]
268 + },
269 + "gridPos": {
270 + "h": 7,
271 + "w": 7,
272 + "x": 4,
273 + "y": 0
274 + },
275 + "id": 57,
276 + "options": {
277 + "cellHeight": "sm",
278 + "footer": {
279 + "countRows": false,
280 + "fields": "",
281 + "reducer": [
282 + "sum"
283 + ],
284 + "show": false
285 + },
286 + "showHeader": true
287 + },
288 + "pluginVersion": "10.2.0",
289 + "targets": [
290 + {
291 + "bucketAggs": [
292 + {
293 + "fake": true,
294 + "field": "data_group",
295 + "id": "4",
296 + "settings": {
297 + "min_doc_count": 1,
298 + "order": "desc",
299 + "orderBy": "_count",
300 + "size": "0"
301 + },
302 + "type": "terms"
303 + }
304 + ],
305 + "datasource": {
306 + "type": "grafana-opensearch-datasource",
307 + "uid": "replace_datasource_uid"
308 + },
309 + "metrics": [
310 + {
311 + "field": "select field",
312 + "id": "1",
313 + "type": "count"
314 + }
315 + ],
316 + "query": "",
317 + "refId": "A",
318 + "timeField": "timestamp"
319 + }
320 + ],
321 + "title": "ALERTS BY POLICY GROUP",
322 + "transformations": [
323 + {
324 + "id": "organize",
325 + "options": {
326 + "excludeByName": {},
327 + "indexByName": {},
328 + "renameByName": {
329 + "data_group": "GROUP"
330 + }
331 + }
332 + }
333 + ],
334 + "type": "table"
335 + },
336 + {
337 + "datasource": {
338 + "type": "grafana-opensearch-datasource",
339 + "uid": "replace_datasource_uid"
340 + },
341 + "fieldConfig": {
342 + "defaults": {
343 + "color": {
344 + "mode": "thresholds"
345 + },
346 + "custom": {
347 + "align": "auto",
348 + "cellOptions": {
349 + "type": "auto"
350 + },
351 + "inspect": false
352 + },
353 + "mappings": [],
354 + "thresholds": {
355 + "mode": "absolute",
356 + "steps": [
357 + {
358 + "color": "orange",
359 + "value": null
360 + }
361 + ]
362 + }
363 + },
364 + "overrides": [
365 + {
366 + "matcher": {
367 + "id": "byName",
368 + "options": "Time"
369 + },
370 + "properties": [
371 + {
372 + "id": "displayName",
373 + "value": "Time"
374 + },
375 + {
376 + "id": "unit",
377 + "value": "time: YYYY-MM-DD HH:mm:ss"
378 + },
379 + {
380 + "id": "custom.align"
381 + }
382 + ]
383 + },
384 + {
385 + "matcher": {
386 + "id": "byName",
387 + "options": "Count"
388 + },
389 + "properties": [
390 + {
391 + "id": "displayName",
392 + "value": "EVENTS"
393 + },
394 + {
395 + "id": "unit",
396 + "value": "short"
397 + },
398 + {
399 + "id": "decimals",
400 + "value": -1
401 + },
402 + {
403 + "id": "custom.cellOptions",
404 + "value": {
405 + "type": "color-background"
406 + }
407 + },
408 + {
409 + "id": "custom.align"
410 + },
411 + {
412 + "id": "thresholds",
413 + "value": {
414 + "mode": "absolute",
415 + "steps": [
416 + {
417 + "color": "dark-orange",
418 + "value": null
419 + }
420 + ]
421 + }
422 + }
423 + ]
424 + },
425 + {
426 + "matcher": {
427 + "id": "byName",
428 + "options": "data_groupName"
429 + },
430 + "properties": [
431 + {
432 + "id": "displayName",
433 + "value": "ALERTS BY TYPE"
434 + },
435 + {
436 + "id": "unit",
437 + "value": "short"
438 + },
439 + {
440 + "id": "decimals",
441 + "value": -1
442 + },
443 + {
444 + "id": "custom.cellOptions",
445 + "value": {
446 + "type": "color-background"
447 + }
448 + },
449 + {
450 + "id": "custom.align"
451 + }
452 + ]
453 + }
454 + ]
455 + },
456 + "gridPos": {
457 + "h": 7,
458 + "w": 7,
459 + "x": 11,
460 + "y": 0
461 + },
462 + "id": 55,
463 + "options": {
464 + "cellHeight": "sm",
465 + "footer": {
466 + "countRows": false,
467 + "fields": "",
468 + "reducer": [
469 + "sum"
470 + ],
471 + "show": false
472 + },
473 + "showHeader": true
474 + },
475 + "pluginVersion": "10.2.0",
476 + "targets": [
477 + {
478 + "bucketAggs": [
479 + {
480 + "fake": true,
481 + "field": "cat",
482 + "id": "4",
483 + "settings": {
484 + "min_doc_count": 1,
485 + "order": "desc",
486 + "orderBy": "_term",
487 + "size": "0"
488 + },
489 + "type": "terms"
490 + }
491 + ],
492 + "datasource": {
493 + "type": "grafana-opensearch-datasource",
494 + "uid": "replace_datasource_uid"
495 + },
496 + "metrics": [
497 + {
498 + "field": "select field",
499 + "id": "1",
500 + "type": "count"
501 + }
502 + ],
503 + "query": "",
504 + "refId": "A",
505 + "timeField": "timestamp"
506 + }
507 + ],
508 + "title": "ALERTS BY CATEGOTY",
509 + "transformations": [
510 + {
511 + "id": "merge",
512 + "options": {
513 + "reducers": []
514 + }
515 + }
516 + ],
517 + "type": "table"
518 + },
519 + {
520 + "datasource": {
521 + "type": "grafana-opensearch-datasource",
522 + "uid": "replace_datasource_uid"
523 + },
524 + "fieldConfig": {
525 + "defaults": {
526 + "color": {
527 + "mode": "thresholds"
528 + },
529 + "custom": {
530 + "align": "auto",
531 + "cellOptions": {
532 + "type": "auto"
533 + },
534 + "inspect": false
535 + },
536 + "mappings": [],
537 + "thresholds": {
538 + "mode": "absolute",
539 + "steps": [
540 + {
541 + "color": "orange",
542 + "value": null
543 + }
544 + ]
545 + }
546 + },
547 + "overrides": [
548 + {
549 + "matcher": {
550 + "id": "byName",
551 + "options": "Time"
552 + },
553 + "properties": [
554 + {
555 + "id": "displayName",
556 + "value": "Time"
557 + },
558 + {
559 + "id": "unit",
560 + "value": "time: YYYY-MM-DD HH:mm:ss"
561 + },
562 + {
563 + "id": "custom.align"
564 + }
565 + ]
566 + },
567 + {
568 + "matcher": {
569 + "id": "byName",
570 + "options": "Count"
571 + },
572 + "properties": [
573 + {
574 + "id": "displayName",
575 + "value": "EVENTS"
576 + },
577 + {
578 + "id": "unit",
579 + "value": "short"
580 + },
581 + {
582 + "id": "decimals",
583 + "value": -1
584 + },
585 + {
586 + "id": "custom.cellOptions",
587 + "value": {
588 + "type": "color-background"
589 + }
590 + },
591 + {
592 + "id": "custom.align"
593 + },
594 + {
595 + "id": "thresholds",
596 + "value": {
597 + "mode": "absolute",
598 + "steps": [
599 + {
600 + "color": "dark-orange",
601 + "value": null
602 + }
603 + ]
604 + }
605 + }
606 + ]
607 + },
608 + {
609 + "matcher": {
610 + "id": "byName",
611 + "options": "data_groupName"
612 + },
613 + "properties": [
614 + {
615 + "id": "displayName",
616 + "value": "ALERTS BY TYPE"
617 + },
618 + {
619 + "id": "unit",
620 + "value": "short"
621 + },
622 + {
623 + "id": "decimals",
624 + "value": -1
625 + },
626 + {
627 + "id": "custom.cellOptions",
628 + "value": {
629 + "type": "color-background"
630 + }
631 + },
632 + {
633 + "id": "custom.align"
634 + }
635 + ]
636 + }
637 + ]
638 + },
639 + "gridPos": {
640 + "h": 7,
641 + "w": 6,
642 + "x": 18,
643 + "y": 0
644 + },
645 + "id": 56,
646 + "options": {
647 + "cellHeight": "sm",
648 + "footer": {
649 + "countRows": false,
650 + "fields": "",
651 + "reducer": [
652 + "sum"
653 + ],
654 + "show": false
655 + },
656 + "showHeader": true
657 + },
658 + "pluginVersion": "10.2.0",
659 + "targets": [
660 + {
661 + "bucketAggs": [
662 + {
663 + "fake": true,
664 + "field": "data_computerName",
665 + "id": "4",
666 + "settings": {
667 + "min_doc_count": 1,
668 + "order": "desc",
669 + "orderBy": "_count",
670 + "size": "0"
671 + },
672 + "type": "terms"
673 + }
674 + ],
675 + "datasource": {
676 + "type": "grafana-opensearch-datasource",
677 + "uid": "replace_datasource_uid"
678 + },
679 + "metrics": [
680 + {
681 + "field": "select field",
682 + "id": "1",
683 + "type": "count"
684 + }
685 + ],
686 + "query": "",
687 + "refId": "A",
688 + "timeField": "timestamp"
689 + }
690 + ],
691 + "title": "ALERTS BY AGENT",
692 + "transformations": [
693 + {
694 + "id": "organize",
695 + "options": {
696 + "excludeByName": {},
697 + "indexByName": {},
698 + "renameByName": {
699 + "data_computerName": "COMPUTER"
700 + }
701 + }
702 + }
703 + ],
704 + "type": "table"
705 + },
706 + {
707 + "datasource": {
708 + "type": "grafana-opensearch-datasource",
709 + "uid": "replace_datasource_uid"
710 + },
711 + "fieldConfig": {
712 + "defaults": {
713 + "mappings": [
714 + {
715 + "options": {
716 + "match": "null",
717 + "result": {
718 + "text": "N/A"
719 + }
720 + },
721 + "type": "special"
722 + }
723 + ],
724 + "thresholds": {
725 + "mode": "absolute",
726 + "steps": [
727 + {
728 + "color": "blue",
729 + "value": null
730 + }
731 + ]
732 + },
733 + "unit": "none"
734 + },
735 + "overrides": []
736 + },
737 + "gridPos": {
738 + "h": 5,
739 + "w": 4,
740 + "x": 0,
741 + "y": 7
742 + },
743 + "id": 45,
744 + "links": [],
745 + "maxDataPoints": 100,
746 + "options": {
747 + "colorMode": "value",
748 + "graphMode": "none",
749 + "justifyMode": "auto",
750 + "orientation": "horizontal",
751 + "reduceOptions": {
752 + "calcs": [
753 + "max"
754 + ],
755 + "fields": "",
756 + "values": false
757 + },
758 + "text": {},
759 + "textMode": "auto"
760 + },
761 + "pluginVersion": "10.2.0",
762 + "targets": [
763 + {
764 + "bucketAggs": [
765 + {
766 + "$$hashKey": "object:235",
767 + "field": "timestamp",
768 + "id": "2",
769 + "settings": {
770 + "interval": "365d",
771 + "min_doc_count": 0,
772 + "trimEdges": 0
773 + },
774 + "type": "date_histogram"
775 + }
776 + ],
777 + "datasource": {
778 + "type": "grafana-opensearch-datasource",
779 + "uid": "replace_datasource_uid"
780 + },
781 + "metrics": [
782 + {
783 + "$$hashKey": "object:233",
784 + "field": "data_computerName",
785 + "id": "1",
786 + "meta": {},
787 + "settings": {},
788 + "type": "cardinality"
789 + }
790 + ],
791 + "query": "eventSeverity:$eventSeverity",
792 + "refId": "A",
793 + "timeField": "timestamp"
794 + }
795 + ],
796 + "title": "AGENTS",
797 + "type": "stat"
798 + },
799 + {
800 + "datasource": {
801 + "type": "grafana-opensearch-datasource",
802 + "uid": "replace_datasource_uid"
803 + },
804 + "fieldConfig": {
805 + "defaults": {
806 + "color": {
807 + "mode": "palette-classic"
808 + },
809 + "custom": {
810 + "axisBorderShow": false,
811 + "axisCenteredZero": false,
812 + "axisColorMode": "text",
813 + "axisLabel": "",
814 + "axisPlacement": "auto",
815 + "barAlignment": 0,
816 + "drawStyle": "line",
817 + "fillOpacity": 0,
818 + "gradientMode": "none",
819 + "hideFrom": {
820 + "legend": false,
821 + "tooltip": false,
822 + "viz": false
823 + },
824 + "insertNulls": false,
825 + "lineInterpolation": "linear",
826 + "lineWidth": 1,
827 + "pointSize": 5,
828 + "scaleDistribution": {
829 + "type": "linear"
830 + },
831 + "showPoints": "auto",
832 + "spanNulls": false,
833 + "stacking": {
834 + "group": "A",
835 + "mode": "normal"
836 + },
837 + "thresholdsStyle": {
838 + "mode": "off"
839 + }
840 + },
841 + "mappings": [],
842 + "thresholds": {
843 + "mode": "absolute",
844 + "steps": [
845 + {
846 + "color": "green",
847 + "value": null
848 + },
849 + {
850 + "color": "red",
851 + "value": 80
852 + }
853 + ]
854 + }
855 + },
856 + "overrides": []
857 + },
858 + "gridPos": {
859 + "h": 11,
860 + "w": 20,
861 + "x": 4,
862 + "y": 7
863 + },
864 + "id": 49,
865 + "options": {
866 + "legend": {
867 + "calcs": [],
868 + "displayMode": "table",
869 + "placement": "right",
870 + "showLegend": true
871 + },
872 + "tooltip": {
873 + "mode": "single",
874 + "sort": "none"
875 + }
876 + },
877 + "targets": [
878 + {
879 + "alias": "",
880 + "bucketAggs": [
881 + {
882 + "field": "data_computerName",
883 + "id": "3",
884 + "settings": {
885 + "min_doc_count": "1",
886 + "order": "desc",
887 + "orderBy": "_term",
888 + "size": "10"
889 + },
890 + "type": "terms"
891 + },
892 + {
893 + "field": "timestamp",
894 + "id": "2",
895 + "settings": {
896 + "interval": "auto"
897 + },
898 + "type": "date_histogram"
899 + }
900 + ],
901 + "datasource": {
902 + "type": "grafana-opensearch-datasource",
903 + "uid": "replace_datasource_uid"
904 + },
905 + "metrics": [
906 + {
907 + "id": "1",
908 + "type": "count"
909 + }
910 + ],
911 + "query": "eventSeverity:$eventSeverity",
912 + "refId": "A",
913 + "timeField": "timestamp"
914 + }
915 + ],
916 + "title": "TOP 10 AGENTS - HISTOGRAM",
917 + "transparent": true,
918 + "type": "timeseries"
919 + },
920 + {
921 + "datasource": {
922 + "type": "grafana-opensearch-datasource",
923 + "uid": "replace_datasource_uid"
924 + },
925 + "fieldConfig": {
926 + "defaults": {
927 + "mappings": [
928 + {
929 + "options": {
930 + "match": "null",
931 + "result": {
932 + "text": "N/A"
933 + }
934 + },
935 + "type": "special"
936 + }
937 + ],
938 + "thresholds": {
939 + "mode": "absolute",
940 + "steps": [
941 + {
942 + "color": "orange",
943 + "value": null
944 + }
945 + ]
946 + },
947 + "unit": "locale"
948 + },
949 + "overrides": []
950 + },
951 + "gridPos": {
952 + "h": 6,
953 + "w": 4,
954 + "x": 0,
955 + "y": 12
956 + },
957 + "id": 18,
958 + "links": [],
959 + "options": {
960 + "colorMode": "value",
961 + "graphMode": "area",
962 + "justifyMode": "auto",
963 + "orientation": "horizontal",
964 + "reduceOptions": {
965 + "calcs": [
966 + "sum"
967 + ],
968 + "fields": "",
969 + "values": false
970 + },
971 + "text": {},
972 + "textMode": "auto"
973 + },
974 + "pluginVersion": "10.2.0",
975 + "targets": [
976 + {
977 + "bucketAggs": [
978 + {
979 + "$$hashKey": "object:331",
980 + "field": "timestamp",
981 + "id": "2",
982 + "settings": {
983 + "interval": "auto",
984 + "min_doc_count": 0,
985 + "trimEdges": 0
986 + },
987 + "type": "date_histogram"
988 + }
989 + ],
990 + "datasource": {
991 + "type": "grafana-opensearch-datasource",
992 + "uid": "replace_datasource_uid"
993 + },
994 + "metrics": [
995 + {
996 + "$$hashKey": "object:329",
997 + "field": "select field",
998 + "id": "1",
999 + "type": "count"
1000 + }
1001 + ],
1002 + "query": "eventSeverity:$eventSeverity",
1003 + "refId": "A",
1004 + "timeField": "timestamp"
1005 + }
1006 + ],
1007 + "title": "EVENTS (TOTAL)",
1008 + "type": "stat"
1009 + },
1010 + {
1011 + "datasource": {
1012 + "type": "grafana-opensearch-datasource",
1013 + "uid": "replace_datasource_uid"
1014 + },
1015 + "fieldConfig": {
1016 + "defaults": {
1017 + "color": {
1018 + "mode": "palette-classic"
1019 + },
1020 + "custom": {
1021 + "hideFrom": {
1022 + "legend": false,
1023 + "tooltip": false,
1024 + "viz": false
1025 + }
1026 + },
1027 + "decimals": 0,
1028 + "mappings": [],
1029 + "unit": "short"
1030 + },
1031 + "overrides": [
1032 + {
1033 + "matcher": {
1034 + "id": "byName",
1035 + "options": "1"
1036 + },
1037 + "properties": [
1038 + {
1039 + "id": "color",
1040 + "value": {
1041 + "fixedColor": "#C8F2C2",
1042 + "mode": "fixed"
1043 + }
1044 + }
1045 + ]
1046 + },
1047 + {
1048 + "matcher": {
1049 + "id": "byName",
1050 + "options": "2"
1051 + },
1052 + "properties": [
1053 + {
1054 + "id": "color",
1055 + "value": {
1056 + "fixedColor": "#96D98D",
1057 + "mode": "fixed"
1058 + }
1059 + }
1060 + ]
1061 + },
1062 + {
1063 + "matcher": {
1064 + "id": "byName",
1065 + "options": "3"
1066 + },
1067 + "properties": [
1068 + {
1069 + "id": "color",
1070 + "value": {
1071 + "fixedColor": "#56A64B",
1072 + "mode": "fixed"
1073 + }
1074 + }
1075 + ]
1076 + },
1077 + {
1078 + "matcher": {
1079 + "id": "byName",
1080 + "options": "4"
1081 + },
1082 + "properties": [
1083 + {
1084 + "id": "color",
1085 + "value": {
1086 + "fixedColor": "#37872D",
1087 + "mode": "fixed"
1088 + }
1089 + }
1090 + ]
1091 + },
1092 + {
1093 + "matcher": {
1094 + "id": "byName",
1095 + "options": "5"
1096 + },
1097 + "properties": [
1098 + {
1099 + "id": "color",
1100 + "value": {
1101 + "fixedColor": "#FFF899",
1102 + "mode": "fixed"
1103 + }
1104 + }
1105 + ]
1106 + },
1107 + {
1108 + "matcher": {
1109 + "id": "byName",
1110 + "options": "7"
1111 + },
1112 + "properties": [
1113 + {
1114 + "id": "color",
1115 + "value": {
1116 + "fixedColor": "#F2CC0C",
1117 + "mode": "fixed"
1118 + }
1119 + }
1120 + ]
1121 + },
1122 + {
1123 + "matcher": {
1124 + "id": "byName",
1125 + "options": "9"
1126 + },
1127 + "properties": [
1128 + {
1129 + "id": "color",
1130 + "value": {
1131 + "fixedColor": "#FF9830",
1132 + "mode": "fixed"
1133 + }
1134 + }
1135 + ]
1136 + },
1137 + {
1138 + "matcher": {
1139 + "id": "byName",
1140 + "options": "10"
1141 + },
1142 + "properties": [
1143 + {
1144 + "id": "color",
1145 + "value": {
1146 + "fixedColor": "#FF9830",
1147 + "mode": "fixed"
1148 + }
1149 + }
1150 + ]
1151 + },
1152 + {
1153 + "matcher": {
1154 + "id": "byName",
1155 + "options": "12"
1156 + },
1157 + "properties": [
1158 + {
1159 + "id": "color",
1160 + "value": {
1161 + "fixedColor": "#F2495C",
1162 + "mode": "fixed"
1163 + }
1164 + }
1165 + ]
1166 + },
1167 + {
1168 + "matcher": {
1169 + "id": "byName",
1170 + "options": "13"
1171 + },
1172 + "properties": [
1173 + {
1174 + "id": "color",
1175 + "value": {
1176 + "fixedColor": "#FF7383",
1177 + "mode": "fixed"
1178 + }
1179 + }
1180 + ]
1181 + }
1182 + ]
1183 + },
1184 + "gridPos": {
1185 + "h": 12,
1186 + "w": 6,
1187 + "x": 0,
1188 + "y": 18
1189 + },
1190 + "id": 23,
1191 + "links": [],
1192 + "maxDataPoints": 3,
1193 + "options": {
1194 + "displayLabels": [],
1195 + "legend": {
1196 + "calcs": [],
1197 + "displayMode": "table",
1198 + "placement": "right",
1199 + "showLegend": true,
1200 + "values": [
1201 + "value",
1202 + "percent"
1203 + ]
1204 + },
1205 + "pieType": "donut",
1206 + "reduceOptions": {
1207 + "calcs": [
1208 + "sum"
1209 + ],
1210 + "fields": "",
1211 + "values": false
1212 + },
1213 + "text": {},
1214 + "tooltip": {
1215 + "mode": "single",
1216 + "sort": "none"
1217 + }
1218 + },
1219 + "targets": [
1220 + {
1221 + "bucketAggs": [
1222 + {
1223 + "$$hashKey": "object:235",
1224 + "fake": true,
1225 + "field": "eventSeverity",
1226 + "id": "3",
1227 + "settings": {
1228 + "min_doc_count": 1,
1229 + "order": "desc",
1230 + "orderBy": "_count",
1231 + "size": "10"
1232 + },
1233 + "type": "terms"
1234 + },
1235 + {
1236 + "$$hashKey": "object:236",
1237 + "field": "timestamp",
1238 + "id": "2",
1239 + "settings": {
1240 + "interval": "auto",
1241 + "min_doc_count": 0,
1242 + "trimEdges": 0
1243 + },
1244 + "type": "date_histogram"
1245 + }
1246 + ],
1247 + "datasource": {
1248 + "type": "grafana-opensearch-datasource",
1249 + "uid": "replace_datasource_uid"
1250 + },
1251 + "metrics": [
1252 + {
1253 + "$$hashKey": "object:233",
1254 + "field": "select field",
1255 + "id": "1",
1256 + "meta": {},
1257 + "settings": {},
1258 + "type": "count"
1259 + }
1260 + ],
1261 + "query": "eventSeverity:$eventSeverity",
1262 + "refId": "A",
1263 + "timeField": "timestamp"
1264 + }
1265 + ],
1266 + "title": "SECURITY EVENTS BY ALERT LEVEL",
1267 + "type": "piechart"
1268 + },
1269 + {
1270 + "datasource": {
1271 + "type": "grafana-opensearch-datasource",
1272 + "uid": "replace_datasource_uid"
1273 + },
1274 + "fieldConfig": {
1275 + "defaults": {
1276 + "color": {
1277 + "mode": "palette-classic"
1278 + },
1279 + "custom": {
1280 + "axisBorderShow": false,
1281 + "axisCenteredZero": false,
1282 + "axisColorMode": "text",
1283 + "axisLabel": "",
1284 + "axisPlacement": "auto",
1285 + "barAlignment": 0,
1286 + "drawStyle": "line",
1287 + "fillOpacity": 0,
1288 + "gradientMode": "none",
1289 + "hideFrom": {
1290 + "legend": false,
1291 + "tooltip": false,
1292 + "viz": false
1293 + },
1294 + "insertNulls": false,
1295 + "lineInterpolation": "linear",
1296 + "lineWidth": 1,
1297 + "pointSize": 5,
1298 + "scaleDistribution": {
1299 + "type": "linear"
1300 + },
1301 + "showPoints": "auto",
1302 + "spanNulls": false,
1303 + "stacking": {
1304 + "group": "A",
1305 + "mode": "normal"
1306 + },
1307 + "thresholdsStyle": {
1308 + "mode": "off"
1309 + }
1310 + },
1311 + "mappings": [],
1312 + "thresholds": {
1313 + "mode": "absolute",
1314 + "steps": [
1315 + {
1316 + "color": "green",
1317 + "value": null
1318 + },
1319 + {
1320 + "color": "red",
1321 + "value": 80
1322 + }
1323 + ]
1324 + }
1325 + },
1326 + "overrides": [
1327 + {
1328 + "matcher": {
1329 + "id": "byName",
1330 + "options": "10"
1331 + },
1332 + "properties": [
1333 + {
1334 + "id": "color",
1335 + "value": {
1336 + "fixedColor": "orange",
1337 + "mode": "fixed"
1338 + }
1339 + }
1340 + ]
1341 + }
1342 + ]
1343 + },
1344 + "gridPos": {
1345 + "h": 12,
1346 + "w": 18,
1347 + "x": 6,
1348 + "y": 18
1349 + },
1350 + "id": 50,
1351 + "options": {
1352 + "legend": {
1353 + "calcs": [],
1354 + "displayMode": "table",
1355 + "placement": "right",
1356 + "showLegend": true
1357 + },
1358 + "tooltip": {
1359 + "mode": "single",
1360 + "sort": "none"
1361 + }
1362 + },
1363 + "targets": [
1364 + {
1365 + "alias": "",
1366 + "bucketAggs": [
1367 + {
1368 + "field": "eventSeverity",
1369 + "id": "3",
1370 + "settings": {
1371 + "min_doc_count": "1",
1372 + "order": "desc",
1373 + "orderBy": "_count",
1374 + "size": "10"
1375 + },
1376 + "type": "terms"
1377 + },
1378 + {
1379 + "field": "timestamp",
1380 + "id": "2",
1381 + "settings": {
1382 + "interval": "auto"
1383 + },
1384 + "type": "date_histogram"
1385 + }
1386 + ],
1387 + "datasource": {
1388 + "type": "grafana-opensearch-datasource",
1389 + "uid": "replace_datasource_uid"
1390 + },
1391 + "metrics": [
1392 + {
1393 + "id": "1",
1394 + "type": "count"
1395 + }
1396 + ],
1397 + "query": "eventSeverity:$eventSeverity",
1398 + "refId": "A",
1399 + "timeField": "timestamp"
1400 + }
1401 + ],
1402 + "title": "EVENTS SEVERITY - HISTOGRAM",
1403 + "type": "timeseries"
1404 + },
1405 + {
1406 + "datasource": {
1407 + "type": "grafana-opensearch-datasource",
1408 + "uid": "replace_datasource_uid"
1409 + },
1410 + "fieldConfig": {
1411 + "defaults": {
1412 + "color": {
1413 + "mode": "palette-classic"
1414 + },
1415 + "custom": {
1416 + "hideFrom": {
1417 + "legend": false,
1418 + "tooltip": false,
1419 + "viz": false
1420 + }
1421 + },
1422 + "decimals": 0,
1423 + "mappings": [],
1424 + "unit": "short"
1425 + },
1426 + "overrides": [
1427 + {
1428 + "matcher": {
1429 + "id": "byName",
1430 + "options": "1"
1431 + },
1432 + "properties": [
1433 + {
1434 + "id": "color",
1435 + "value": {
1436 + "fixedColor": "#C8F2C2",
1437 + "mode": "fixed"
1438 + }
1439 + }
1440 + ]
1441 + },
1442 + {
1443 + "matcher": {
1444 + "id": "byName",
1445 + "options": "2"
1446 + },
1447 + "properties": [
1448 + {
1449 + "id": "color",
1450 + "value": {
1451 + "fixedColor": "#96D98D",
1452 + "mode": "fixed"
1453 + }
1454 + }
1455 + ]
1456 + },
1457 + {
1458 + "matcher": {
1459 + "id": "byName",
1460 + "options": "3"
1461 + },
1462 + "properties": [
1463 + {
1464 + "id": "color",
1465 + "value": {
1466 + "fixedColor": "#56A64B",
1467 + "mode": "fixed"
1468 + }
1469 + }
1470 + ]
1471 + },
1472 + {
1473 + "matcher": {
1474 + "id": "byName",
1475 + "options": "4"
1476 + },
1477 + "properties": [
1478 + {
1479 + "id": "color",
1480 + "value": {
1481 + "fixedColor": "#37872D",
1482 + "mode": "fixed"
1483 + }
1484 + }
1485 + ]
1486 + },
1487 + {
1488 + "matcher": {
1489 + "id": "byName",
1490 + "options": "5"
1491 + },
1492 + "properties": [
1493 + {
1494 + "id": "color",
1495 + "value": {
1496 + "fixedColor": "#FFF899",
1497 + "mode": "fixed"
1498 + }
1499 + }
1500 + ]
1501 + },
1502 + {
1503 + "matcher": {
1504 + "id": "byName",
1505 + "options": "7"
1506 + },
1507 + "properties": [
1508 + {
1509 + "id": "color",
1510 + "value": {
1511 + "fixedColor": "#F2CC0C",
1512 + "mode": "fixed"
1513 + }
1514 + }
1515 + ]
1516 + },
1517 + {
1518 + "matcher": {
1519 + "id": "byName",
1520 + "options": "9"
1521 + },
1522 + "properties": [
1523 + {
1524 + "id": "color",
1525 + "value": {
1526 + "fixedColor": "#FF9830",
1527 + "mode": "fixed"
1528 + }
1529 + }
1530 + ]
1531 + },
1532 + {
1533 + "matcher": {
1534 + "id": "byName",
1535 + "options": "10"
1536 + },
1537 + "properties": [
1538 + {
1539 + "id": "color",
1540 + "value": {
1541 + "fixedColor": "#FF9830",
1542 + "mode": "fixed"
1543 + }
1544 + }
1545 + ]
1546 + },
1547 + {
1548 + "matcher": {
1549 + "id": "byName",
1550 + "options": "12"
1551 + },
1552 + "properties": [
1553 + {
1554 + "id": "color",
1555 + "value": {
1556 + "fixedColor": "#F2495C",
1557 + "mode": "fixed"
1558 + }
1559 + }
1560 + ]
1561 + },
1562 + {
1563 + "matcher": {
1564 + "id": "byName",
1565 + "options": "13"
1566 + },
1567 + "properties": [
1568 + {
1569 + "id": "color",
1570 + "value": {
1571 + "fixedColor": "#FF7383",
1572 + "mode": "fixed"
1573 + }
1574 + }
1575 + ]
1576 + },
1577 + {
1578 + "matcher": {
1579 + "id": "byName",
1580 + "options": "MALWARE"
1581 + },
1582 + "properties": [
1583 + {
1584 + "id": "color",
1585 + "value": {
1586 + "fixedColor": "orange",
1587 + "mode": "fixed"
1588 + }
1589 + }
1590 + ]
1591 + }
1592 + ]
1593 + },
1594 + "gridPos": {
1595 + "h": 12,
1596 + "w": 6,
1597 + "x": 0,
1598 + "y": 30
1599 + },
1600 + "id": 52,
1601 + "links": [],
1602 + "maxDataPoints": 3,
1603 + "options": {
1604 + "displayLabels": [],
1605 + "legend": {
1606 + "calcs": [],
1607 + "displayMode": "table",
1608 + "placement": "right",
1609 + "showLegend": true,
1610 + "values": [
1611 + "value",
1612 + "percent"
1613 + ]
1614 + },
1615 + "pieType": "donut",
1616 + "reduceOptions": {
1617 + "calcs": [
1618 + "sum"
1619 + ],
1620 + "fields": "",
1621 + "values": false
1622 + },
1623 + "text": {},
1624 + "tooltip": {
1625 + "mode": "single",
1626 + "sort": "none"
1627 + }
1628 + },
1629 + "targets": [
1630 + {
1631 + "bucketAggs": [
1632 + {
1633 + "$$hashKey": "object:235",
1634 + "fake": true,
1635 + "field": "cat",
1636 + "id": "3",
1637 + "settings": {
1638 + "min_doc_count": 1,
1639 + "order": "desc",
1640 + "orderBy": "_count",
1641 + "size": "10"
1642 + },
1643 + "type": "terms"
1644 + },
1645 + {
1646 + "$$hashKey": "object:236",
1647 + "field": "timestamp",
1648 + "id": "2",
1649 + "settings": {
1650 + "interval": "auto",
1651 + "min_doc_count": 0,
1652 + "trimEdges": 0
1653 + },
1654 + "type": "date_histogram"
1655 + }
1656 + ],
1657 + "datasource": {
1658 + "type": "grafana-opensearch-datasource",
1659 + "uid": "replace_datasource_uid"
1660 + },
1661 + "metrics": [
1662 + {
1663 + "$$hashKey": "object:233",
1664 + "field": "select field",
1665 + "id": "1",
1666 + "meta": {},
1667 + "settings": {},
1668 + "type": "count"
1669 + }
1670 + ],
1671 + "query": "eventSeverity:$eventSeverity",
1672 + "refId": "A",
1673 + "timeField": "timestamp"
1674 + }
1675 + ],
1676 + "title": "SECURITY EVENTS BY CATEGORY",
1677 + "type": "piechart"
1678 + },
1679 + {
1680 + "datasource": {
1681 + "type": "grafana-opensearch-datasource",
1682 + "uid": "replace_datasource_uid"
1683 + },
1684 + "fieldConfig": {
1685 + "defaults": {
1686 + "color": {
1687 + "mode": "palette-classic"
1688 + },
1689 + "custom": {
1690 + "hideFrom": {
1691 + "legend": false,
1692 + "tooltip": false,
1693 + "viz": false
1694 + }
1695 + },
1696 + "decimals": 0,
1697 + "mappings": [],
1698 + "unit": "short"
1699 + },
1700 + "overrides": [
1701 + {
1702 + "matcher": {
1703 + "id": "byName",
1704 + "options": "1"
1705 + },
1706 + "properties": [
1707 + {
1708 + "id": "color",
1709 + "value": {
1710 + "fixedColor": "#C8F2C2",
1711 + "mode": "fixed"
1712 + }
1713 + }
1714 + ]
1715 + },
1716 + {
1717 + "matcher": {
1718 + "id": "byName",
1719 + "options": "2"
1720 + },
1721 + "properties": [
1722 + {
1723 + "id": "color",
1724 + "value": {
1725 + "fixedColor": "#96D98D",
1726 + "mode": "fixed"
1727 + }
1728 + }
1729 + ]
1730 + },
1731 + {
1732 + "matcher": {
1733 + "id": "byName",
1734 + "options": "3"
1735 + },
1736 + "properties": [
1737 + {
1738 + "id": "color",
1739 + "value": {
1740 + "fixedColor": "#56A64B",
1741 + "mode": "fixed"
1742 + }
1743 + }
1744 + ]
1745 + },
1746 + {
1747 + "matcher": {
1748 + "id": "byName",
1749 + "options": "4"
1750 + },
1751 + "properties": [
1752 + {
1753 + "id": "color",
1754 + "value": {
1755 + "fixedColor": "#37872D",
1756 + "mode": "fixed"
1757 + }
1758 + }
1759 + ]
1760 + },
1761 + {
1762 + "matcher": {
1763 + "id": "byName",
1764 + "options": "5"
1765 + },
1766 + "properties": [
1767 + {
1768 + "id": "color",
1769 + "value": {
1770 + "fixedColor": "#FFF899",
1771 + "mode": "fixed"
1772 + }
1773 + }
1774 + ]
1775 + },
1776 + {
1777 + "matcher": {
1778 + "id": "byName",
1779 + "options": "7"
1780 + },
1781 + "properties": [
1782 + {
1783 + "id": "color",
1784 + "value": {
1785 + "fixedColor": "#F2CC0C",
1786 + "mode": "fixed"
1787 + }
1788 + }
1789 + ]
1790 + },
1791 + {
1792 + "matcher": {
1793 + "id": "byName",
1794 + "options": "9"
1795 + },
1796 + "properties": [
1797 + {
1798 + "id": "color",
1799 + "value": {
1800 + "fixedColor": "#FF9830",
1801 + "mode": "fixed"
1802 + }
1803 + }
1804 + ]
1805 + },
1806 + {
1807 + "matcher": {
1808 + "id": "byName",
1809 + "options": "10"
1810 + },
1811 + "properties": [
1812 + {
1813 + "id": "color",
1814 + "value": {
1815 + "fixedColor": "#FF9830",
1816 + "mode": "fixed"
1817 + }
1818 + }
1819 + ]
1820 + },
1821 + {
1822 + "matcher": {
1823 + "id": "byName",
1824 + "options": "12"
1825 + },
1826 + "properties": [
1827 + {
1828 + "id": "color",
1829 + "value": {
1830 + "fixedColor": "#F2495C",
1831 + "mode": "fixed"
1832 + }
1833 + }
1834 + ]
1835 + },
1836 + {
1837 + "matcher": {
1838 + "id": "byName",
1839 + "options": "13"
1840 + },
1841 + "properties": [
1842 + {
1843 + "id": "color",
1844 + "value": {
1845 + "fixedColor": "#FF7383",
1846 + "mode": "fixed"
1847 + }
1848 + }
1849 + ]
1850 + },
1851 + {
1852 + "matcher": {
1853 + "id": "byName",
1854 + "options": "MALWARE"
1855 + },
1856 + "properties": [
1857 + {
1858 + "id": "color",
1859 + "value": {
1860 + "fixedColor": "orange",
1861 + "mode": "fixed"
1862 + }
1863 + }
1864 + ]
1865 + }
1866 + ]
1867 + },
1868 + "gridPos": {
1869 + "h": 12,
1870 + "w": 6,
1871 + "x": 6,
1872 + "y": 30
1873 + },
1874 + "id": 53,
1875 + "links": [],
1876 + "maxDataPoints": 3,
1877 + "options": {
1878 + "displayLabels": [],
1879 + "legend": {
1880 + "calcs": [],
1881 + "displayMode": "table",
1882 + "placement": "right",
1883 + "showLegend": true,
1884 + "values": [
1885 + "value",
1886 + "percent"
1887 + ]
1888 + },
1889 + "pieType": "donut",
1890 + "reduceOptions": {
1891 + "calcs": [
1892 + "sum"
1893 + ],
1894 + "fields": "",
1895 + "values": false
1896 + },
1897 + "text": {},
1898 + "tooltip": {
1899 + "mode": "single",
1900 + "sort": "none"
1901 + }
1902 + },
1903 + "targets": [
1904 + {
1905 + "bucketAggs": [
1906 + {
1907 + "$$hashKey": "object:235",
1908 + "fake": true,
1909 + "field": "siteName",
1910 + "id": "3",
1911 + "settings": {
1912 + "min_doc_count": 1,
1913 + "order": "desc",
1914 + "orderBy": "_count",
1915 + "size": "10"
1916 + },
1917 + "type": "terms"
1918 + },
1919 + {
1920 + "$$hashKey": "object:236",
1921 + "field": "timestamp",
1922 + "id": "2",
1923 + "settings": {
1924 + "interval": "auto",
1925 + "min_doc_count": 0,
1926 + "trimEdges": 0
1927 + },
1928 + "type": "date_histogram"
1929 + }
1930 + ],
1931 + "datasource": {
1932 + "type": "grafana-opensearch-datasource",
1933 + "uid": "replace_datasource_uid"
1934 + },
1935 + "metrics": [
1936 + {
1937 + "$$hashKey": "object:233",
1938 + "field": "select field",
1939 + "id": "1",
1940 + "meta": {},
1941 + "settings": {},
1942 + "type": "count"
1943 + }
1944 + ],
1945 + "query": "eventSeverity:$eventSeverity",
1946 + "refId": "A",
1947 + "timeField": "timestamp"
1948 + }
1949 + ],
1950 + "title": "SECURITY EVENTS BY SITE",
1951 + "type": "piechart"
1952 + },
1953 + {
1954 + "datasource": {
1955 + "type": "grafana-opensearch-datasource",
1956 + "uid": "replace_datasource_uid"
1957 + },
1958 + "fieldConfig": {
1959 + "defaults": {
1960 + "color": {
1961 + "mode": "thresholds"
1962 + },
1963 + "custom": {
1964 + "align": "auto",
1965 + "cellOptions": {
1966 + "type": "auto"
1967 + },
1968 + "inspect": false
1969 + },
1970 + "decimals": 0,
1971 + "mappings": [],
1972 + "thresholds": {
1973 + "mode": "absolute",
1974 + "steps": [
1975 + {
1976 + "color": "green",
1977 + "value": null
1978 + },
1979 + {
1980 + "color": "red",
1981 + "value": 80
1982 + }
1983 + ]
1984 + },
1985 + "unit": "short"
1986 + },
1987 + "overrides": [
1988 + {
1989 + "matcher": {
1990 + "id": "byName",
1991 + "options": "FILE PATH"
1992 + },
1993 + "properties": [
1994 + {
1995 + "id": "custom.width",
1996 + "value": 895
1997 + }
1998 + ]
1999 + }
2000 + ]
2001 + },
2002 + "gridPos": {
2003 + "h": 12,
2004 + "w": 12,
2005 + "x": 12,
2006 + "y": 30
2007 + },
2008 + "id": 54,
2009 + "links": [],
2010 + "maxDataPoints": 3,
2011 + "options": {
2012 + "cellHeight": "sm",
2013 + "footer": {
2014 + "countRows": false,
2015 + "fields": "",
2016 + "reducer": [
2017 + "sum"
2018 + ],
2019 + "show": false
2020 + },
2021 + "showHeader": true,
2022 + "sortBy": []
2023 + },
2024 + "pluginVersion": "10.2.0",
2025 + "targets": [
2026 + {
2027 + "bucketAggs": [
2028 + {
2029 + "$$hashKey": "object:235",
2030 + "fake": true,
2031 + "field": "data_filePath",
2032 + "id": "3",
2033 + "settings": {
2034 + "min_doc_count": 1,
2035 + "order": "desc",
2036 + "orderBy": "_count",
2037 + "size": "10"
2038 + },
2039 + "type": "terms"
2040 + }
2041 + ],
2042 + "datasource": {
2043 + "type": "grafana-opensearch-datasource",
2044 + "uid": "replace_datasource_uid"
2045 + },
2046 + "metrics": [
2047 + {
2048 + "$$hashKey": "object:233",
2049 + "field": "select field",
2050 + "id": "1",
2051 + "meta": {},
2052 + "settings": {},
2053 + "type": "count"
2054 + }
2055 + ],
2056 + "query": "eventSeverity:$eventSeverity",
2057 + "refId": "A",
2058 + "timeField": "timestamp"
2059 + }
2060 + ],
2061 + "title": "FILE PATHS",
2062 + "transformations": [
2063 + {
2064 + "id": "organize",
2065 + "options": {
2066 + "excludeByName": {},
2067 + "indexByName": {},
2068 + "renameByName": {
2069 + "data_filePath": "FILE PATH"
2070 + }
2071 + }
2072 + }
2073 + ],
2074 + "type": "table"
2075 + },
2076 + {
2077 + "datasource": {
2078 + "type": "grafana-opensearch-datasource",
2079 + "uid": "replace_datasource_uid"
2080 + },
2081 + "fieldConfig": {
2082 + "defaults": {
2083 + "color": {
2084 + "mode": "thresholds"
2085 + },
2086 + "custom": {
2087 + "align": "auto",
2088 + "cellOptions": {
2089 + "type": "auto"
2090 + },
2091 + "inspect": false
2092 + },
2093 + "decimals": 2,
2094 + "displayName": "",
2095 + "mappings": [],
2096 + "thresholds": {
2097 + "mode": "absolute",
2098 + "steps": [
2099 + {
2100 + "color": "green",
2101 + "value": null
2102 + },
2103 + {
2104 + "color": "red",
2105 + "value": 80
2106 + }
2107 + ]
2108 + },
2109 + "unit": "short"
2110 + },
2111 + "overrides": [
2112 + {
2113 + "matcher": {
2114 + "id": "byName",
2115 + "options": "Time"
2116 + },
2117 + "properties": [
2118 + {
2119 + "id": "displayName",
2120 + "value": "Time"
2121 + },
2122 + {
2123 + "id": "unit",
2124 + "value": "time: YYYY-MM-DD HH:mm:ss"
2125 + },
2126 + {
2127 + "id": "custom.align"
2128 + }
2129 + ]
2130 + },
2131 + {
2132 + "matcher": {
2133 + "id": "byName",
2134 + "options": "Count"
2135 + },
2136 + "properties": [
2137 + {
2138 + "id": "displayName",
2139 + "value": "Events"
2140 + },
2141 + {
2142 + "id": "unit",
2143 + "value": "short"
2144 + },
2145 + {
2146 + "id": "decimals",
2147 + "value": -1
2148 + },
2149 + {
2150 + "id": "custom.align"
2151 + }
2152 + ]
2153 + },
2154 + {
2155 + "matcher": {
2156 + "id": "byName",
2157 + "options": "data_groupName"
2158 + },
2159 + "properties": [
2160 + {
2161 + "id": "displayName",
2162 + "value": "Rule Groups"
2163 + },
2164 + {
2165 + "id": "unit",
2166 + "value": "short"
2167 + },
2168 + {
2169 + "id": "decimals",
2170 + "value": 2
2171 + },
2172 + {
2173 + "id": "custom.align"
2174 + },
2175 + {
2176 + "id": "mappings",
2177 + "value": [
2178 + {
2179 + "options": {
2180 + "SENTINELONE, agent_flooding": {
2181 + "index": 33,
2182 + "text": "SENTINELONE Agent - Event Queue Flooding"
2183 + },
2184 + "apache, web, modsecurity": {
2185 + "index": 7,
2186 + "text": "Apache ModSec"
2187 + },
2188 + "dnsstat, dnsstat_alert": {
2189 + "index": 47,
2190 + "text": "Domain Stats - Alert"
2191 + },
2192 + "dnsstat, dnsstat_error": {
2193 + "index": 41,
2194 + "text": "Domain Stats - Entry Not found in RDAP"
2195 + },
2196 + "docker, docker-error": {
2197 + "index": 43,
2198 + "text": "Docker Error"
2199 + },
2200 + "linux, docker, falco": {
2201 + "index": 56,
2202 + "text": "Linux Docker: Container Event"
2203 + },
2204 + "linux, packetbeat, dns": {
2205 + "index": 58,
2206 + "text": "Linux - DNS Request"
2207 + },
2208 + "linux, packetbeat, http": {
2209 + "index": 73,
2210 + "text": "Linux Packetbeat - HTTP Connection"
2211 + },
2212 + "linux, packetbeat, tls": {
2213 + "index": 72,
2214 + "text": "Linux Packetbeat - HTTPS Connection"
2215 + },
2216 + "linux, sysmon, sysmon_event1": {
2217 + "index": 3,
2218 + "text": "Linux Sysmon - Process Started"
2219 + },
2220 + "linux, sysmon, sysmon_event3": {
2221 + "index": 2,
2222 + "text": "Linux Sysmon - Network Connection"
2223 + },
2224 + "linux, sysmon, sysmon_event5": {
2225 + "index": 1,
2226 + "text": "Linux Sysmon - Process Terminated"
2227 + },
2228 + "linux, sysmon, sysmon_event9": {
2229 + "index": 46,
2230 + "text": "Linux Sysmon - RawAccessRead"
2231 + },
2232 + "linux, sysmon, sysmon_event_11": {
2233 + "index": 4,
2234 + "text": "Linux Sysmon - FileCreate"
2235 + },
2236 + "linux, sysmon, sysmon_event_16": {
2237 + "index": 6,
2238 + "text": "Linux Sysmon - Sysmon Config Changed"
2239 + },
2240 + "linux, sysmon, sysmon_event_23": {
2241 + "index": 5,
2242 + "text": "Linux Sysmon - File Removed"
2243 + },
2244 + "local, systemd": {
2245 + "index": 74,
2246 + "text": "Linux Systemd"
2247 + },
2248 + "openvpn, authentication_success": {
2249 + "index": 68,
2250 + "text": "OpenVPN Client - Auth Success"
2251 + },
2252 + "ossec": {
2253 + "index": 15,
2254 + "text": "OSSEC Event"
2255 + },
2256 + "ossec, rootcheck": {
2257 + "index": 19,
2258 + "text": "OSSEC - Rootcheck"
2259 + },
2260 + "ossec, syscheck, syscheck_entry_added, syscheck_file": {
2261 + "index": 9,
2262 + "text": "Syscheck - File Added"
2263 + },
2264 + "ossec, syscheck, syscheck_entry_added, syscheck_registry": {
2265 + "index": 39,
2266 + "text": "Syscheck - Windows Registry (Entry Added)"
2267 + },
2268 + "ossec, syscheck, syscheck_entry_deleted, syscheck_file": {
2269 + "index": 52,
2270 + "text": "Syscheck - File Deleted"
2271 + },
2272 + "ossec, syscheck, syscheck_entry_deleted, syscheck_registry": {
2273 + "index": 45,
2274 + "text": "Syscheck - Windows Registry (Entry Deleted)"
2275 + },
2276 + "ossec, syscheck, syscheck_entry_modified, syscheck_file": {
2277 + "index": 14,
2278 + "text": "Syscheck - File Modified"
2279 + },
2280 + "ossec, syscheck, syscheck_entry_modified, syscheck_registry": {
2281 + "index": 30,
2282 + "text": "Syscheck - Windows Registry (Entry Modified)"
2283 + },
2284 + "pam, syslog": {
2285 + "index": 18,
2286 + "text": "Linux PAM"
2287 + },
2288 + "pam, syslog, authentication_failed": {
2289 + "index": 67,
2290 + "text": "Linux PAM - Auth Failed"
2291 + },
2292 + "pam, syslog, authentication_success": {
2293 + "index": 12,
2294 + "text": "Linux PAM - Auth Success"
2295 + },
2296 + "sca": {
2297 + "index": 17,
2298 + "text": "Security Config Assessment"
2299 + },
2300 + "syslog, adduser": {
2301 + "index": 54,
2302 + "text": "Linux - User Added"
2303 + },
2304 + "syslog, dpkg": {
2305 + "index": 11,
2306 + "text": "Lunux dpkg"
2307 + },
2308 + "syslog, dpkg, config_changed": {
2309 + "index": 10,
2310 + "text": "Linux dpkg - Config Changed"
2311 + },
2312 + "syslog, errors, service_availability": {
2313 + "index": 75,
2314 + "text": "Linux Syslog - System Error"
2315 + },
2316 + "syslog, linuxkernel": {
2317 + "index": 57,
2318 + "text": "Linux - Kernel Event"
2319 + },
2320 + "syslog, linuxkernel, promisc": {
2321 + "index": 29,
2322 + "text": "Linux Kernel - Promisc. Interface"
2323 + },
2324 + "syslog, sshd, authentication_success": {
2325 + "index": 13,
2326 + "text": "SSH - Auth Success"
2327 + },
2328 + "syslog, sshd, recon": {
2329 + "index": 51,
2330 + "text": "Linux - SSH Daemon Alert"
2331 + },
2332 + "syslog, sudo": {
2333 + "index": 16,
2334 + "text": "Lunux - Sudo"
2335 + },
2336 + "threat_intel, alienvault, otx_alert": {
2337 + "index": 63,
2338 + "text": "Threat Intel - AlienVault OTX IoC Alert"
2339 + },
2340 + "threat_intel, misp, misp_alert": {
2341 + "index": 40,
2342 + "text": "Threat Intel - MISP IoC Alert"
2343 + },
2344 + "threat_intel, opencti, opencti_alert": {
2345 + "index": 62,
2346 + "text": "Threat Intel - OpenCTI IoC Alert"
2347 + },
2348 + "threat_intel, opencti, opencti_error": {
2349 + "index": 64,
2350 + "text": "Threat Intel - OpenCTI API Error"
2351 + },
2352 + "usb": {
2353 + "index": 69,
2354 + "text": "USB Port Event"
2355 + },
2356 + "vulnerability-detector": {
2357 + "index": 0,
2358 + "text": "Vulnerability Detector"
2359 + },
2360 + "vulnerability-detector, snyk": {
2361 + "index": 55,
2362 + "text": "Vulnerability Detector - Docker Images"
2363 + },
2364 + "windows, inventory": {
2365 + "index": 27,
2366 + "text": "Windows Agent Inventory"
2367 + },
2368 + "windows, sysmon, sysmon_event1, windows_sysmon_event1": {
2369 + "index": 48,
2370 + "text": "Windows Sysmon - Process Started"
2371 + },
2372 + "windows, sysmon, sysmon_event1, windows_sysmon_event1, sysmon_anomaly": {
2373 + "index": 77,
2374 + "text": "Windows Sysmon - Process Started Anomaly"
2375 + },
2376 + "windows, sysmon, sysmon_event2": {
2377 + "index": 78,
2378 + "text": "Windows Sysmon - A Process changed File Creation Time"
2379 + },
2380 + "windows, sysmon, sysmon_event3": {
2381 + "index": 36,
2382 + "text": "Windows Sysmon - Network Connection"
2383 + },
2384 + "windows, sysmon, sysmon_event3, sysmon_anomaly": {
2385 + "index": 76,
2386 + "text": "Windows Sysmon - Network Connection Anomaly"
2387 + },
2388 + "windows, sysmon, sysmon_event7": {
2389 + "index": 25,
2390 + "text": "Windows Sysmon - DLL SideLoading"
2391 + },
2392 + "windows, sysmon, sysmon_event_10": {
2393 + "index": 32,
2394 + "text": "Windows Sysmon - Process Injection"
2395 + },
2396 + "windows, sysmon, sysmon_event_11": {
2397 + "index": 20,
2398 + "text": "Windows Sysmon - FileCreate"
2399 + },
2400 + "windows, sysmon, sysmon_event_12": {
2401 + "index": 23,
2402 + "text": "Windows Sysmon - RegistryEvent (Object create and delete)"
2403 + },
2404 + "windows, sysmon, sysmon_event_13": {
2405 + "index": 24,
2406 + "text": "Windows Sysmon - RegistryEvent (ValueSet)"
2407 + },
2408 + "windows, sysmon, sysmon_event_15": {
2409 + "index": 61,
2410 + "text": "Windows Sysmon - FileCreateStreamHash"
2411 + },
2412 + "windows, sysmon, sysmon_event_17": {
2413 + "index": 70,
2414 + "text": "Windows Sysmon - Pipe Created"
2415 + },
2416 + "windows, sysmon, sysmon_event_22": {
2417 + "index": 38,
2418 + "text": "Windows Sysmon - DNS Request"
2419 + },
2420 + "windows, sysmon, sysmon_event_23": {
2421 + "index": 28,
2422 + "text": "Windows Sysmon - File Removed"
2423 + },
2424 + "windows, sysmon, sysmon_event_25": {
2425 + "index": 71,
2426 + "text": "Windows Sysmon - Process Tampering"
2427 + },
2428 + "windows, sysmon, sysmon_process-anomalies": {
2429 + "index": 53,
2430 + "text": "Windows Sysmon - Process Anomalies"
2431 + },
2432 + "windows, system_error": {
2433 + "index": 49,
2434 + "text": "Windows - System Error"
2435 + },
2436 + "windows, windows_application": {
2437 + "index": 31,
2438 + "text": "WinEvtLogs - Application"
2439 + },
2440 + "windows, windows_application, system_error": {
2441 + "index": 59,
2442 + "text": "WinEvtLogs - Application Error"
2443 + },
2444 + "windows, windows_autoruns": {
2445 + "index": 37,
2446 + "text": "Windows Persistent Footholds"
2447 + },
2448 + "windows, windows_defender": {
2449 + "index": 35,
2450 + "text": "Windows Defender"
2451 + },
2452 + "windows, windows_firewall, firewall": {
2453 + "index": 60,
2454 + "text": "Windows - Windows Firewall"
2455 + },
2456 + "windows, windows_logonsessions": {
2457 + "index": 26,
2458 + "text": "Windows Logon Sessions (Snapshot)"
2459 + },
2460 + "windows, windows_powershell": {
2461 + "index": 50,
2462 + "text": "Windows - PowerShell"
2463 + },
2464 + "windows, windows_security": {
2465 + "index": 22,
2466 + "text": "WinEvtLogs - Security"
2467 + },
2468 + "windows, windows_security, authentication_failed": {
2469 + "index": 65,
2470 + "text": "Windows - Failed Authentication"
2471 + },
2472 + "windows, windows_security, authentication_success": {
2473 + "index": 21,
2474 + "text": "Windows - Successful Auths"
2475 + },
2476 + "windows, windows_sigcheck": {
2477 + "index": 42,
2478 + "text": "Windows Exec Analysis"
2479 + },
2480 + "windows, windows_system": {
2481 + "index": 44,
2482 + "text": "WinEvtLogs - System"
2483 + },
2484 + "windows, windows_system, policy_changed": {
2485 + "index": 34,
2486 + "text": "Windows Group Policy"
2487 + },
2488 + "windows, windows_system, system_error": {
2489 + "index": 66,
2490 + "text": "Windows - System Error"
2491 + },
2492 + "yara": {
2493 + "index": 8,
2494 + "text": "Yara Malware Scanner"
2495 + }
2496 + },
2497 + "type": "value"
2498 + }
2499 + ]
2500 + },
2501 + {
2502 + "id": "links",
2503 + "value": [
2504 + {
2505 + "targetBlank": true,
2506 + "title": "VIEW EVENTS",
2507 + "url": "https://grafana.company.local/explore?left=%5B%22now-1h%22,%22now%22,%22SENTINELONE%22,%7B%22refId%22:%22A%22,%22query%22:%22data_groupName:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
2508 + }
2509 + ]
2510 + }
2511 + ]
2512 + },
2513 + {
2514 + "matcher": {
2515 + "id": "byName",
2516 + "options": "Rule Groups"
2517 + },
2518 + "properties": [
2519 + {
2520 + "id": "custom.width",
2521 + "value": 302
2522 + }
2523 + ]
2524 + }
2525 + ]
2526 + },
2527 + "gridPos": {
2528 + "h": 14,
2529 + "w": 6,
2530 + "x": 0,
2531 + "y": 42
2532 + },
2533 + "id": 24,
2534 + "links": [],
2535 + "options": {
2536 + "cellHeight": "sm",
2537 + "footer": {
2538 + "countRows": false,
2539 + "fields": "",
2540 + "reducer": [
2541 + "sum"
2542 + ],
2543 + "show": false
2544 + },
2545 + "showHeader": true,
2546 + "sortBy": []
2547 + },
2548 + "pluginVersion": "10.2.0",
2549 + "targets": [
2550 + {
2551 + "bucketAggs": [
2552 + {
2553 + "$$hashKey": "object:332",
2554 + "field": "data_groupName",
2555 + "id": "2",
2556 + "settings": {
2557 + "min_doc_count": 1,
2558 + "order": "desc",
2559 + "orderBy": "_count",
2560 + "size": "0"
2561 + },
2562 + "type": "terms"
2563 + }
2564 + ],
2565 + "datasource": {
2566 + "type": "grafana-opensearch-datasource",
2567 + "uid": "replace_datasource_uid"
2568 + },
2569 + "metrics": [
2570 + {
2571 + "$$hashKey": "object:330",
2572 + "field": "select field",
2573 + "id": "1",
2574 + "meta": {},
2575 + "settings": {},
2576 + "type": "count"
2577 + }
2578 + ],
2579 + "query": "eventSeverity:$eventSeverity",
2580 + "refId": "A",
2581 + "timeField": "timestamp"
2582 + }
2583 + ],
2584 + "title": "EVENTS BY GROUP",
2585 + "transformations": [
2586 + {
2587 + "id": "merge",
2588 + "options": {
2589 + "reducers": []
2590 + }
2591 + }
2592 + ],
2593 + "type": "table"
2594 + },
2595 + {
2596 + "datasource": {
2597 + "type": "grafana-opensearch-datasource",
2598 + "uid": "replace_datasource_uid"
2599 + },
2600 + "fieldConfig": {
2601 + "defaults": {
2602 + "color": {
2603 + "mode": "palette-classic"
2604 + },
2605 + "custom": {
2606 + "axisBorderShow": false,
2607 + "axisCenteredZero": false,
2608 + "axisColorMode": "text",
2609 + "axisLabel": "",
2610 + "axisPlacement": "auto",
2611 + "barAlignment": -1,
2612 + "drawStyle": "line",
2613 + "fillOpacity": 0,
2614 + "gradientMode": "none",
2615 + "hideFrom": {
2616 + "legend": false,
2617 + "tooltip": false,
2618 + "viz": false
2619 + },
2620 + "insertNulls": false,
2621 + "lineInterpolation": "linear",
2622 + "lineWidth": 1,
2623 + "pointSize": 5,
2624 + "scaleDistribution": {
2625 + "type": "linear"
2626 + },
2627 + "showPoints": "auto",
2628 + "spanNulls": false,
2629 + "stacking": {
2630 + "group": "A",
2631 + "mode": "normal"
2632 + },
2633 + "thresholdsStyle": {
2634 + "mode": "off"
2635 + }
2636 + },
2637 + "mappings": [],
2638 + "thresholds": {
2639 + "mode": "absolute",
2640 + "steps": [
2641 + {
2642 + "color": "green",
2643 + "value": null
2644 + },
2645 + {
2646 + "color": "red",
2647 + "value": 80
2648 + }
2649 + ]
2650 + }
2651 + },
2652 + "overrides": []
2653 + },
2654 + "gridPos": {
2655 + "h": 14,
2656 + "w": 18,
2657 + "x": 6,
2658 + "y": 42
2659 + },
2660 + "id": 51,
2661 + "options": {
2662 + "legend": {
2663 + "calcs": [],
2664 + "displayMode": "table",
2665 + "placement": "right",
2666 + "showLegend": true
2667 + },
2668 + "tooltip": {
2669 + "mode": "single",
2670 + "sort": "none"
2671 + }
2672 + },
2673 + "targets": [
2674 + {
2675 + "alias": "",
2676 + "bucketAggs": [
2677 + {
2678 + "field": "data_groupName",
2679 + "id": "3",
2680 + "settings": {
2681 + "min_doc_count": "1",
2682 + "order": "desc",
2683 + "orderBy": "_count",
2684 + "size": "10"
2685 + },
2686 + "type": "terms"
2687 + },
2688 + {
2689 + "field": "timestamp",
2690 + "id": "2",
2691 + "settings": {
2692 + "interval": "auto"
2693 + },
2694 + "type": "date_histogram"
2695 + }
2696 + ],
2697 + "datasource": {
2698 + "type": "grafana-opensearch-datasource",
2699 + "uid": "replace_datasource_uid"
2700 + },
2701 + "metrics": [
2702 + {
2703 + "id": "1",
2704 + "type": "count"
2705 + }
2706 + ],
2707 + "query": "eventSeverity:$eventSeverity",
2708 + "refId": "A",
2709 + "timeField": "timestamp"
2710 + }
2711 + ],
2712 + "title": "EVENTS BY ALERT GROUP (TOP 10) - HISTOGRAM",
2713 + "transparent": true,
2714 + "type": "timeseries"
2715 + },
2716 + {
2717 + "datasource": {
2718 + "type": "grafana-opensearch-datasource",
2719 + "uid": "replace_datasource_uid"
2720 + },
2721 + "fieldConfig": {
2722 + "defaults": {
2723 + "color": {
2724 + "mode": "thresholds"
2725 + },
2726 + "custom": {
2727 + "align": "auto",
2728 + "cellOptions": {
2729 + "type": "auto"
2730 + },
2731 + "filterable": true,
2732 + "inspect": false
2733 + },
2734 + "mappings": [],
2735 + "thresholds": {
2736 + "mode": "absolute",
2737 + "steps": [
2738 + {
2739 + "color": "green",
2740 + "value": null
2741 + },
2742 + {
2743 + "color": "red",
2744 + "value": 80
2745 + }
2746 + ]
2747 + }
2748 + },
2749 + "overrides": [
2750 + {
2751 + "matcher": {
2752 + "id": "byName",
2753 + "options": "timestamp"
2754 + },
2755 + "properties": [
2756 + {
2757 + "id": "displayName",
2758 + "value": "Date/Time"
2759 + },
2760 + {
2761 + "id": "unit",
2762 + "value": "time: YYYY-MM-DD HH:mm:ss"
2763 + },
2764 + {
2765 + "id": "custom.align"
2766 + }
2767 + ]
2768 + },
2769 + {
2770 + "matcher": {
2771 + "id": "byName",
2772 + "options": "data_computerName"
2773 + },
2774 + "properties": [
2775 + {
2776 + "id": "displayName",
2777 + "value": "AGENT"
2778 + },
2779 + {
2780 + "id": "unit",
2781 + "value": "short"
2782 + },
2783 + {
2784 + "id": "decimals",
2785 + "value": 2
2786 + },
2787 + {
2788 + "id": "custom.align"
2789 + }
2790 + ]
2791 + },
2792 + {
2793 + "matcher": {
2794 + "id": "byName",
2795 + "options": "agent_ip"
2796 + },
2797 + "properties": [
2798 + {
2799 + "id": "displayName",
2800 + "value": "IP ADDRESS"
2801 + },
2802 + {
2803 + "id": "unit",
2804 + "value": "short"
2805 + },
2806 + {
2807 + "id": "decimals",
2808 + "value": 2
2809 + },
2810 + {
2811 + "id": "custom.align"
2812 + }
2813 + ]
2814 + },
2815 + {
2816 + "matcher": {
2817 + "id": "byName",
2818 + "options": "rule_description"
2819 + },
2820 + "properties": [
2821 + {
2822 + "id": "displayName",
2823 + "value": "RULE DESCRIPTION"
2824 + },
2825 + {
2826 + "id": "unit",
2827 + "value": "short"
2828 + },
2829 + {
2830 + "id": "decimals",
2831 + "value": 2
2832 + },
2833 + {
2834 + "id": "custom.align"
2835 + }
2836 + ]
2837 + },
2838 + {
2839 + "matcher": {
2840 + "id": "byName",
2841 + "options": "Date/Time"
2842 + },
2843 + "properties": [
2844 + {
2845 + "id": "custom.width",
2846 + "value": 242
2847 + }
2848 + ]
2849 + },
2850 + {
2851 + "matcher": {
2852 + "id": "byName",
2853 + "options": "AGENT"
2854 + },
2855 + "properties": [
2856 + {
2857 + "id": "custom.width",
2858 + "value": 160
2859 + }
2860 + ]
2861 + },
2862 + {
2863 + "matcher": {
2864 + "id": "byName",
2865 + "options": "MITRE TACTIC"
2866 + },
2867 + "properties": [
2868 + {
2869 + "id": "custom.width",
2870 + "value": 332
2871 + }
2872 + ]
2873 + },
2874 + {
2875 + "matcher": {
2876 + "id": "byName",
2877 + "options": "RULE LEVEL"
2878 + },
2879 + "properties": [
2880 + {
2881 + "id": "custom.width",
2882 + "value": 122
2883 + }
2884 + ]
2885 + },
2886 + {
2887 + "matcher": {
2888 + "id": "byName",
2889 + "options": "IP ADDRESS"
2890 + },
2891 + "properties": [
2892 + {
2893 + "id": "custom.width",
2894 + "value": 163
2895 + }
2896 + ]
2897 + },
2898 + {
2899 + "matcher": {
2900 + "id": "byName",
2901 + "options": "MITRE TECHNIQUE"
2902 + },
2903 + "properties": [
2904 + {
2905 + "id": "custom.width",
2906 + "value": 312
2907 + }
2908 + ]
2909 + },
2910 + {
2911 + "matcher": {
2912 + "id": "byName",
2913 + "options": "rule_id"
2914 + },
2915 + "properties": [
2916 + {
2917 + "id": "custom.width",
2918 + "value": 96
2919 + }
2920 + ]
2921 + },
2922 + {
2923 + "matcher": {
2924 + "id": "byName",
2925 + "options": "EVENT ID"
2926 + },
2927 + "properties": [
2928 + {
2929 + "id": "links",
2930 + "value": [
2931 + {
2932 + "targetBlank": true,
2933 + "title": "VIEW EVENT DETAILS",
2934 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SENTINELONE%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
2935 + }
2936 + ]
2937 + }
2938 + ]
2939 + },
2940 + {
2941 + "matcher": {
2942 + "id": "byName",
2943 + "options": "IP ADD"
2944 + },
2945 + "properties": [
2946 + {
2947 + "id": "custom.width",
2948 + "value": 176
2949 + }
2950 + ]
2951 + },
2952 + {
2953 + "matcher": {
2954 + "id": "byName",
2955 + "options": "EVENT CATEGORY"
2956 + },
2957 + "properties": [
2958 + {
2959 + "id": "custom.width",
2960 + "value": 209
2961 + }
2962 + ]
2963 + },
2964 + {
2965 + "matcher": {
2966 + "id": "byName",
2967 + "options": "USER"
2968 + },
2969 + "properties": [
2970 + {
2971 + "id": "custom.width",
2972 + "value": 218
2973 + }
2974 + ]
2975 + },
2976 + {
2977 + "matcher": {
2978 + "id": "byName",
2979 + "options": "threatClassification"
2980 + },
2981 + "properties": [
2982 + {
2983 + "id": "custom.width",
2984 + "value": 214
2985 + }
2986 + ]
2987 + },
2988 + {
2989 + "matcher": {
2990 + "id": "byName",
2991 + "options": "DESCRIPTION"
2992 + },
2993 + "properties": [
2994 + {
2995 + "id": "custom.width",
2996 + "value": 688
2997 + }
2998 + ]
2999 + }
3000 + ]
3001 + },
3002 + "gridPos": {
3003 + "h": 16,
3004 + "w": 24,
3005 + "x": 0,
3006 + "y": 56
3007 + },
3008 + "id": 27,
3009 + "options": {
3010 + "cellHeight": "sm",
3011 + "footer": {
3012 + "countRows": false,
3013 + "fields": "",
3014 + "reducer": [
3015 + "sum"
3016 + ],
3017 + "show": false
3018 + },
3019 + "showHeader": true,
3020 + "sortBy": []
3021 + },
3022 + "pluginVersion": "10.2.0",
3023 + "targets": [
3024 + {
3025 + "bucketAggs": [],
3026 + "datasource": {
3027 + "type": "grafana-opensearch-datasource",
3028 + "uid": "replace_datasource_uid"
3029 + },
3030 + "metrics": [
3031 + {
3032 + "id": "1",
3033 + "settings": {
3034 + "size": "250"
3035 + },
3036 + "type": "raw_data"
3037 + }
3038 + ],
3039 + "query": "eventSeverity:$eventSeverity",
3040 + "refId": "A",
3041 + "timeField": "timestamp"
3042 + }
3043 + ],
3044 + "title": "EVENTS",
3045 + "transformations": [
3046 + {
3047 + "id": "filterFieldsByName",
3048 + "options": {
3049 + "include": {
3050 + "names": [
3051 + "timestamp",
3052 + "_id",
3053 + "cat",
3054 + "data_computerName",
3055 + "data_username",
3056 + "deviceAddress",
3057 + "deviceAddress_city_name",
3058 + "eventDesc",
3059 + "eventSeverity",
3060 + "fileName",
3061 + "threatClassification",
3062 + "threatConfidenceLevel"
3063 + ]
3064 + }
3065 + }
3066 + },
3067 + {
3068 + "id": "organize",
3069 + "options": {
3070 + "excludeByName": {
3071 + "@metadata_beat": true,
3072 + "@metadata_type": true,
3073 + "@metadata_version": true,
3074 + "IMPHASH": true,
3075 + "MD5": true,
3076 + "SHA1": true,
3077 + "SHA256": true,
3078 + "_id": false,
3079 + "_index": true,
3080 + "_type": true,
3081 + "accountId": true,
3082 + "accountName": true,
3083 + "activityId": true,
3084 + "activityType": true,
3085 + "activityUuid": true,
3086 + "agentId": true,
3087 + "agentUpdatedVersion": true,
3088 + "agent_ephemeral_id": true,
3089 + "agent_hostname": true,
3090 + "agent_id": true,
3091 + "agent_ip_city_name": true,
3092 + "agent_ip_country_code": true,
3093 + "agent_ip_geolocation": true,
3094 + "agent_type": true,
3095 + "agent_version": true,
3096 + "application_name": true,
3097 + "beats_type": true,
3098 + "collector_node_id": true,
3099 + "comments": true,
3100 + "createdAt": true,
3101 + "data_accountName": true,
3102 + "data_alert_action": true,
3103 + "data_alert_category": true,
3104 + "data_alert_gid": true,
3105 + "data_alert_rev": true,
3106 + "data_alert_severity": true,
3107 + "data_alert_signature": true,
3108 + "data_alert_signature_id": true,
3109 + "data_app_proto": true,
3110 + "data_audit_auid": true,
3111 + "data_audit_command": true,
3112 + "data_audit_euid": true,
3113 + "data_audit_exe": true,
3114 + "data_audit_gid": true,
3115 + "data_audit_id": true,
3116 + "data_audit_pid": true,
3117 + "data_audit_res": true,
3118 + "data_audit_session": true,
3119 + "data_audit_type": true,
3120 + "data_audit_uid": true,
3121 + "data_computerName": false,
3122 + "data_confidenceLevel": true,
3123 + "data_createdAt": true,
3124 + "data_description": true,
3125 + "data_dest_ip": true,
3126 + "data_dest_port": true,
3127 + "data_downloadUrl": true,
3128 + "data_dstuser": true,
3129 + "data_event_type": true,
3130 + "data_exclusionType": true,
3131 + "data_extra_data": true,
3132 + "data_file": true,
3133 + "data_fileContentHash": true,
3134 + "data_fileDisplayName": true,
3135 + "data_fileName": true,
3136 + "data_filePath": true,
3137 + "data_flow_bytes_toclient": true,
3138 + "data_flow_bytes_toserver": true,
3139 + "data_flow_id": true,
3140 + "data_flow_pkts_toclient": true,
3141 + "data_flow_pkts_toserver": true,
3142 + "data_flow_start": true,
3143 + "data_fullScopeDetails": true,
3144 + "data_fullScopeDetailsPath": true,
3145 + "data_globalStatus": true,
3146 + "data_groupName": true,
3147 + "data_http_http_content_type": true,
3148 + "data_http_http_port": true,
3149 + "data_http_length": true,
3150 + "data_http_status": true,
3151 + "data_http_url": true,
3152 + "data_id": true,
3153 + "data_in_iface": true,
3154 + "data_majorVersion": true,
3155 + "data_metadata_flowbits": true,
3156 + "data_metadata_flowints_http_anomaly_count": true,
3157 + "data_metadata_flowints_tcp_retransmission_count": true,
3158 + "data_minorVersion": true,
3159 + "data_osArch": true,
3160 + "data_osFamily": true,
3161 + "data_osquery_action": true,
3162 + "data_osquery_calendarTime": true,
3163 + "data_osquery_columns_address": true,
3164 + "data_osquery_columns_address_city_name": true,
3165 + "data_osquery_columns_address_country_code": true,
3166 + "data_osquery_columns_address_geolocation": true,
3167 + "data_osquery_columns_cmdline": true,
3168 + "data_osquery_columns_cwd": true,
3169 + "data_osquery_columns_description": true,
3170 + "data_osquery_columns_directory": true,
3171 + "data_osquery_columns_disk_bytes_read": true,
3172 + "data_osquery_columns_disk_bytes_written": true,
3173 + "data_osquery_columns_egid": true,
3174 + "data_osquery_columns_euid": true,
3175 + "data_osquery_columns_family": true,
3176 + "data_osquery_columns_fd": true,
3177 + "data_osquery_columns_gid": true,
3178 + "data_osquery_columns_gid_signed": true,
3179 + "data_osquery_columns_host": true,
3180 + "data_osquery_columns_interface": true,
3181 + "data_osquery_columns_local_address": true,
3182 + "data_osquery_columns_local_address_city_name": true,
3183 + "data_osquery_columns_local_address_country_code": true,
3184 + "data_osquery_columns_local_address_geolocation": true,
3185 + "data_osquery_columns_local_port": true,
3186 + "data_osquery_columns_mac": true,
3187 + "data_osquery_columns_name": true,
3188 + "data_osquery_columns_net_namespace": true,
3189 + "data_osquery_columns_nice": true,
3190 + "data_osquery_columns_on_disk": true,
3191 + "data_osquery_columns_parent": true,
3192 + "data_osquery_columns_path": true,
3193 + "data_osquery_columns_pgroup": true,
3194 + "data_osquery_columns_pid": true,
3195 + "data_osquery_columns_port": true,
3196 + "data_osquery_columns_protocol": true,
3197 + "data_osquery_columns_remote_address": true,
3198 + "data_osquery_columns_remote_address_city_name": true,
3199 + "data_osquery_columns_remote_address_country_code": true,
3200 + "data_osquery_columns_remote_address_geolocation": true,
3201 + "data_osquery_columns_remote_port": true,
3202 + "data_osquery_columns_resident_size": true,
3203 + "data_osquery_columns_root": true,
3204 + "data_osquery_columns_sgid": true,
3205 + "data_osquery_columns_shell": true,
3206 + "data_osquery_columns_socket": true,
3207 + "data_osquery_columns_start_time": true,
3208 + "data_osquery_columns_state": true,
3209 + "data_osquery_columns_suid": true,
3210 + "data_osquery_columns_system_time": true,
3211 + "data_osquery_columns_threads": true,
3212 + "data_osquery_columns_time_utc": true,
3213 + "data_osquery_columns_total_size": true,
3214 + "data_osquery_columns_tty": true,
3215 + "data_osquery_columns_type": true,
3216 + "data_osquery_columns_uid": true,
3217 + "data_osquery_columns_uid_signed": true,
3218 + "data_osquery_columns_user": true,
3219 + "data_osquery_columns_user_time": true,
3220 + "data_osquery_columns_username": true,
3221 + "data_osquery_columns_wired_size": true,
3222 + "data_osquery_counter": true,
3223 + "data_osquery_decorations_host_uuid": true,
3224 + "data_osquery_decorations_hostname": true,
3225 + "data_osquery_epoch": true,
3226 + "data_osquery_hostIdentifier": true,
3227 + "data_osquery_name": true,
3228 + "data_osquery_numerics": true,
3229 + "data_osquery_unixTime": true,
3230 + "data_packageId": true,
3231 + "data_platformType": true,
3232 + "data_proto": true,
3233 + "data_sca_check_command": true,
3234 + "data_sca_check_compliance_cis": true,
3235 + "data_sca_check_compliance_cis_csc": true,
3236 + "data_sca_check_compliance_gdpr_IV": true,
3237 + "data_sca_check_compliance_gpg_13": true,
3238 + "data_sca_check_compliance_hipaa": true,
3239 + "data_sca_check_compliance_nist_800_53": true,
3240 + "data_sca_check_compliance_pci_dss": true,
3241 + "data_sca_check_compliance_tsc": true,
3242 + "data_sca_check_description": true,
3243 + "data_sca_check_id": true,
3244 + "data_sca_check_previous_result": true,
3245 + "data_sca_check_rationale": true,
3246 + "data_sca_check_remediation": true,
3247 + "data_sca_check_result": true,
3248 + "data_sca_check_title": true,
3249 + "data_sca_description": true,
3250 + "data_sca_failed": true,
3251 + "data_sca_file": true,
3252 + "data_sca_invalid": true,
3253 + "data_sca_passed": true,
3254 + "data_sca_policy": true,
3255 + "data_sca_policy_id": true,
3256 + "data_sca_scan_id": true,
3257 + "data_sca_score": true,
3258 + "data_sca_total_checks": true,
3259 + "data_sca_type": true,
3260 + "data_scanType": true,
3261 + "data_scopeLevel": true,
3262 + "data_scopeName": true,
3263 + "data_script": true,
3264 + "data_secured": true,
3265 + "data_siteName": true,
3266 + "data_src_ip": true,
3267 + "data_src_ip_city_name": true,
3268 + "data_src_ip_country_code": true,
3269 + "data_src_ip_geolocation": true,
3270 + "data_src_port": true,
3271 + "data_srcip": true,
3272 + "data_srcip_city_name": true,
3273 + "data_srcip_country_code": true,
3274 + "data_srcip_geolocation": true,
3275 + "data_srcuser": true,
3276 + "data_status": true,
3277 + "data_threatClassification": true,
3278 + "data_timestamp": true,
3279 + "data_title": true,
3280 + "data_tls_session_resumed": true,
3281 + "data_tls_version": true,
3282 + "data_totalNewDevices": true,
3283 + "data_tx_id": true,
3284 + "data_type": true,
3285 + "data_unknown": true,
3286 + "data_unsecured": true,
3287 + "data_unsupported": true,
3288 + "data_value": true,
3289 + "data_version": true,
3290 + "data_version_city_name": true,
3291 + "data_version_country_code": true,
3292 + "data_version_geolocation": true,
3293 + "data_win_eventXML_binaryData": true,
3294 + "data_win_eventXML_binaryDataSize": true,
3295 + "data_win_eventXML_param1": true,
3296 + "data_win_eventdata_authenticationPackageName": true,
3297 + "data_win_eventdata_callTrace": true,
3298 + "data_win_eventdata_commandLine": true,
3299 + "data_win_eventdata_company": true,
3300 + "data_win_eventdata_creationUtcTime": true,
3301 + "data_win_eventdata_currentDirectory": true,
3302 + "data_win_eventdata_description": true,
3303 + "data_win_eventdata_destinationHostname": true,
3304 + "data_win_eventdata_destinationIp": true,
3305 + "data_win_eventdata_destinationIp_city_name": true,
3306 + "data_win_eventdata_destinationIp_country_code": true,
3307 + "data_win_eventdata_destinationIp_geolocation": true,
3308 + "data_win_eventdata_destinationIsIpv6": true,
3309 + "data_win_eventdata_destinationPort": true,
3310 + "data_win_eventdata_destinationPortName": true,
3311 + "data_win_eventdata_details": true,
3312 + "data_win_eventdata_elevatedToken": true,
3313 + "data_win_eventdata_eventType": true,
3314 + "data_win_eventdata_fileVersion": true,
3315 + "data_win_eventdata_fileVersion_city_name": true,
3316 + "data_win_eventdata_fileVersion_country_code": true,
3317 + "data_win_eventdata_fileVersion_geolocation": true,
3318 + "data_win_eventdata_grantedAccess": true,
3319 + "data_win_eventdata_hashes": true,
3320 + "data_win_eventdata_image": true,
3321 + "data_win_eventdata_imageLoaded": true,
3322 + "data_win_eventdata_impersonationLevel": true,
3323 + "data_win_eventdata_initiated": true,
3324 + "data_win_eventdata_integrityLevel": true,
3325 + "data_win_eventdata_ipAddress": true,
3326 + "data_win_eventdata_ipPort": true,
3327 + "data_win_eventdata_keyLength": true,
3328 + "data_win_eventdata_logonGuid": true,
3329 + "data_win_eventdata_logonId": true,
3330 + "data_win_eventdata_logonProcessName": true,
3331 + "data_win_eventdata_logonType": true,
3332 + "data_win_eventdata_originalFileName": true,
3333 + "data_win_eventdata_param1": true,
3334 + "data_win_eventdata_param2": true,
3335 + "data_win_eventdata_param3": true,
3336 + "data_win_eventdata_param4": true,
3337 + "data_win_eventdata_parentCommandLine": true,
3338 + "data_win_eventdata_parentImage": true,
3339 + "data_win_eventdata_parentProcessGuid": true,
3340 + "data_win_eventdata_parentProcessId": true,
3341 + "data_win_eventdata_processGuid": true,
3342 + "data_win_eventdata_processId": true,
3343 + "data_win_eventdata_processName": true,
3344 + "data_win_eventdata_product": true,
3345 + "data_win_eventdata_protocol": true,
3346 + "data_win_eventdata_queryName": true,
3347 + "data_win_eventdata_queryResults": true,
3348 + "data_win_eventdata_queryStatus": true,
3349 + "data_win_eventdata_ruleName": true,
3350 + "data_win_eventdata_serviceName": true,
3351 + "data_win_eventdata_serviceSid": true,
3352 + "data_win_eventdata_signature": true,
3353 + "data_win_eventdata_signatureStatus": true,
3354 + "data_win_eventdata_signed": true,
3355 + "data_win_eventdata_sourceHostname": true,
3356 + "data_win_eventdata_sourceImage": true,
3357 + "data_win_eventdata_sourceIp": true,
3358 + "data_win_eventdata_sourceIp_city_name": true,
3359 + "data_win_eventdata_sourceIp_country_code": true,
3360 + "data_win_eventdata_sourceIp_geolocation": true,
3361 + "data_win_eventdata_sourceIsIpv6": true,
3362 + "data_win_eventdata_sourcePort": true,
3363 + "data_win_eventdata_sourceProcessGUID": true,
3364 + "data_win_eventdata_sourceProcessId": true,
3365 + "data_win_eventdata_sourceThreadId": true,
3366 + "data_win_eventdata_status": true,
3367 + "data_win_eventdata_subjectDomainName": true,
3368 + "data_win_eventdata_subjectLogonId": true,
3369 + "data_win_eventdata_subjectUserName": true,
3370 + "data_win_eventdata_subjectUserSid": true,
3371 + "data_win_eventdata_targetDomainName": true,
3372 + "data_win_eventdata_targetFilename": true,
3373 + "data_win_eventdata_targetImage": true,
3374 + "data_win_eventdata_targetLinkedLogonId": true,
3375 + "data_win_eventdata_targetLogonId": true,
3376 + "data_win_eventdata_targetObject": true,
3377 + "data_win_eventdata_targetProcessGUID": true,
3378 + "data_win_eventdata_targetProcessId": true,
3379 + "data_win_eventdata_targetUserName": true,
3380 + "data_win_eventdata_targetUserSid": true,
3381 + "data_win_eventdata_terminalSessionId": true,
3382 + "data_win_eventdata_ticketEncryptionType": true,
3383 + "data_win_eventdata_ticketOptions": true,
3384 + "data_win_eventdata_user": true,
3385 + "data_win_eventdata_utcTime": true,
3386 + "data_win_eventdata_virtualAccount": true,
3387 + "data_win_system_channel": true,
3388 + "data_win_system_computer": true,
3389 + "data_win_system_eventID": true,
3390 + "data_win_system_eventRecordID": true,
3391 + "data_win_system_eventSourceName": true,
3392 + "data_win_system_keywords": true,
3393 + "data_win_system_level": true,
3394 + "data_win_system_message": true,
3395 + "data_win_system_opcode": true,
3396 + "data_win_system_processID": true,
3397 + "data_win_system_providerGuid": true,
3398 + "data_win_system_providerName": true,
3399 + "data_win_system_severityValue": true,
3400 + "data_win_system_systemTime": true,
3401 + "data_win_system_task": true,
3402 + "data_win_system_threadID": true,
3403 + "data_win_system_version": true,
3404 + "decoder_name": true,
3405 + "decoder_parent": true,
3406 + "description": true,
3407 + "deviceAddress_city_name": true,
3408 + "deviceAddress_country_code": true,
3409 + "deviceAddress_geolocation": true,
3410 + "deviceHostFqdn": true,
3411 + "deviceHostName": true,
3412 + "dns_query": true,
3413 + "dns_query_threat_indicated": true,
3414 + "dst_ip": true,
3415 + "dst_ip_city_name": true,
3416 + "dst_ip_country_code": true,
3417 + "dst_ip_geolocation": true,
3418 + "dst_ip_threat_indicated": true,
3419 + "dst_port": true,
3420 + "ecs_version": true,
3421 + "error": true,
3422 + "eventID": true,
3423 + "event_hash": true,
3424 + "facility": true,
3425 + "facility_num": true,
3426 + "fileHashMd5": true,
3427 + "fileHashSha256": true,
3428 + "fileName": false,
3429 + "file_path": true,
3430 + "firewall_rule_name": true,
3431 + "full_log": false,
3432 + "gl2_accounted_message_size": true,
3433 + "gl2_message_id": true,
3434 + "gl2_remote_ip": true,
3435 + "gl2_remote_port": true,
3436 + "gl2_source_collector": true,
3437 + "gl2_source_input": true,
3438 + "gl2_source_node": true,
3439 + "groupId": true,
3440 + "groupName": true,
3441 + "hash": true,
3442 + "hash_md5": true,
3443 + "hash_sha1": true,
3444 + "hash_sha256": true,
3445 + "highlight": true,
3446 + "host_architecture": true,
3447 + "host_containerized": true,
3448 + "host_hostname": true,
3449 + "host_id": true,
3450 + "host_ip": true,
3451 + "host_mac": true,
3452 + "host_name": true,
3453 + "host_os_codename": true,
3454 + "host_os_kernel": true,
3455 + "host_os_name": true,
3456 + "host_os_platform": true,
3457 + "host_os_version": true,
3458 + "hostname": true,
3459 + "id": true,
3460 + "input_type": true,
3461 + "ip": true,
3462 + "ip_city_name": true,
3463 + "ip_country_code": true,
3464 + "ip_geolocation": true,
3465 + "level": true,
3466 + "location": true,
3467 + "log_file_path": true,
3468 + "log_offset": true,
3469 + "manager_name": true,
3470 + "message": true,
3471 + "module": true,
3472 + "notificationScope": true,
3473 + "originatorName": true,
3474 + "originatorVersion": true,
3475 + "originatorVersion_city_name": true,
3476 + "originatorVersion_country_code": true,
3477 + "originatorVersion_geolocation": true,
3478 + "osFamily": true,
3479 + "parent_process_cmd_line": true,
3480 + "parent_process_id": true,
3481 + "parent_process_image": true,
3482 + "pid": true,
3483 + "predecoder_hostname": true,
3484 + "predecoder_program_name": true,
3485 + "predecoder_timestamp": true,
3486 + "previous_log": true,
3487 + "previous_output": true,
3488 + "process_cmd_line": true,
3489 + "process_id": true,
3490 + "process_image": true,
3491 + "process_name": true,
3492 + "protocol": true,
3493 + "rt": true,
3494 + "rule_cis": true,
3495 + "rule_cis_csc": true,
3496 + "rule_firedtimes": true,
3497 + "rule_gdpr": true,
3498 + "rule_gdpr_IV": true,
3499 + "rule_gpg13": true,
3500 + "rule_gpg_13": true,
3501 + "rule_hipaa": true,
3502 + "rule_id": false,
3503 + "rule_info": true,
3504 + "rule_mail": true,
3505 + "rule_mitre_id": true,
3506 + "rule_mitre_tactic": false,
3507 + "rule_nist_800_53": true,
3508 + "rule_pci_dss": true,
3509 + "rule_tsc": true,
3510 + "scanType": true,
3511 + "scanid": true,
3512 + "secondaryDescription": true,
3513 + "secured": true,
3514 + "service": true,
3515 + "siteId": true,
3516 + "siteName": true,
3517 + "software_package": true,
3518 + "software_vendor": true,
3519 + "sort": true,
3520 + "source": true,
3521 + "sourceAgentId": true,
3522 + "sourceAgentUuid": true,
3523 + "sourceDnsDomain": true,
3524 + "sourceFqdn": true,
3525 + "sourceGroupId": true,
3526 + "sourceGroupName": true,
3527 + "sourceHostName": true,
3528 + "sourceIpAddresses_0": true,
3529 + "sourceIpAddresses_1": true,
3530 + "sourceIpAddresses_1_city_name": true,
3531 + "sourceIpAddresses_1_country_code": true,
3532 + "sourceIpAddresses_1_geolocation": true,
3533 + "sourceIpAddresses_2": true,
3534 + "sourceIpAddresses_2_city_name": true,
3535 + "sourceIpAddresses_2_country_code": true,
3536 + "sourceIpAddresses_2_geolocation": true,
3537 + "sourceIpAddresses_3": true,
3538 + "sourceIpAddresses_3_city_name": true,
3539 + "sourceIpAddresses_3_country_code": true,
3540 + "sourceIpAddresses_3_geolocation": true,
3541 + "sourceIpAddresses_4": true,
3542 + "sourceIpAddresses_4_city_name": true,
3543 + "sourceIpAddresses_4_country_code": true,
3544 + "sourceIpAddresses_4_geolocation": true,
3545 + "sourceIpAddresses_5": true,
3546 + "sourceMacAddresses_0": true,
3547 + "sourceMacAddresses_1": true,
3548 + "sourceMgmtPrecievedAddress": true,
3549 + "sourceMgmtPrecievedAddress_city_name": true,
3550 + "sourceMgmtPrecievedAddress_country_code": true,
3551 + "sourceMgmtPrecievedAddress_geolocation": true,
3552 + "sourceNetworkState": true,
3553 + "sourceOsRevision": true,
3554 + "sourceOsType": true,
3555 + "sourceThreatCount": true,
3556 + "sourceUserId": true,
3557 + "sourceUserName": true,
3558 + "source_city_name": true,
3559 + "source_country_code": true,
3560 + "source_geolocation": true,
3561 + "src_ip": true,
3562 + "src_ip_city_name": true,
3563 + "src_ip_country_code": true,
3564 + "src_ip_geolocation": true,
3565 + "src_port": true,
3566 + "streams": true,
3567 + "syscheck_attrs_after": true,
3568 + "syscheck_audit_effective_user_id": true,
3569 + "syscheck_audit_effective_user_name": true,
3570 + "syscheck_audit_group_id": true,
3571 + "syscheck_audit_group_name": true,
3572 + "syscheck_audit_login_user_id": true,
3573 + "syscheck_audit_login_user_name": true,
3574 + "syscheck_audit_process_cwd": true,
3575 + "syscheck_audit_process_id": true,
3576 + "syscheck_audit_process_name": true,
3577 + "syscheck_audit_process_parent_cwd": true,
3578 + "syscheck_audit_process_parent_name": true,
3579 + "syscheck_audit_process_ppid": true,
3580 + "syscheck_audit_user_id": true,
3581 + "syscheck_audit_user_name": true,
3582 + "syscheck_changed_attributes": true,
3583 + "syscheck_event": true,
3584 + "syscheck_gid_after": true,
3585 + "syscheck_gname_after": true,
3586 + "syscheck_hard_links": true,
3587 + "syscheck_inode_after": true,
3588 + "syscheck_inode_before": true,
3589 + "syscheck_md5_after": true,
3590 + "syscheck_md5_before": true,
3591 + "syscheck_mode": true,
3592 + "syscheck_mtime_after": true,
3593 + "syscheck_mtime_before": true,
3594 + "syscheck_path": true,
3595 + "syscheck_perm_after": true,
3596 + "syscheck_perm_before": true,
3597 + "syscheck_sha1_after": true,
3598 + "syscheck_sha1_before": true,
3599 + "syscheck_sha256_after": true,
3600 + "syscheck_sha256_before": true,
3601 + "syscheck_size_after": true,
3602 + "syscheck_size_before": true,
3603 + "syscheck_uid_after": true,
3604 + "syscheck_uname_after": true,
3605 + "syscheck_win_perm_after": true,
3606 + "syscheck_win_perm_after_0_allowed": true,
3607 + "syscheck_win_perm_after_0_name": true,
3608 + "syscheck_win_perm_after_1_allowed": true,
3609 + "syscheck_win_perm_after_1_name": true,
3610 + "syscheck_win_perm_after_2_allowed": true,
3611 + "syscheck_win_perm_after_2_name": true,
3612 + "syscheck_win_perm_after_3_allowed": true,
3613 + "syscheck_win_perm_after_3_name": true,
3614 + "syslog_customer": true,
3615 + "syslog_tag": true,
3616 + "syslog_type": true,
3617 + "sysmon_event_description": true,
3618 + "threatClassification": false,
3619 + "threatClassificationSource": true,
3620 + "threatClassifier": true,
3621 + "threatCommandLineArguments": true,
3622 + "threatConfidenceLevel": false,
3623 + "threatDetectingEngine": true,
3624 + "threatDetectionTime": true,
3625 + "threatID": true,
3626 + "threatId": true,
3627 + "threatIndicatorsList_0": true,
3628 + "threatIndicatorsList_1": true,
3629 + "threatIndicatorsList_10": true,
3630 + "threatIndicatorsList_11": true,
3631 + "threatIndicatorsList_12": true,
3632 + "threatIndicatorsList_13": true,
3633 + "threatIndicatorsList_14": true,
3634 + "threatIndicatorsList_15": true,
3635 + "threatIndicatorsList_16": true,
3636 + "threatIndicatorsList_17": true,
3637 + "threatIndicatorsList_18": true,
3638 + "threatIndicatorsList_19": true,
3639 + "threatIndicatorsList_2": true,
3640 + "threatIndicatorsList_20": true,
3641 + "threatIndicatorsList_21": true,
3642 + "threatIndicatorsList_22": true,
3643 + "threatIndicatorsList_23": true,
3644 + "threatIndicatorsList_24": true,
3645 + "threatIndicatorsList_25": true,
3646 + "threatIndicatorsList_26": true,
3647 + "threatIndicatorsList_27": true,
3648 + "threatIndicatorsList_28": true,
3649 + "threatIndicatorsList_29": true,
3650 + "threatIndicatorsList_3": true,
3651 + "threatIndicatorsList_30": true,
3652 + "threatIndicatorsList_31": true,
3653 + "threatIndicatorsList_32": true,
3654 + "threatIndicatorsList_33": true,
3655 + "threatIndicatorsList_34": true,
3656 + "threatIndicatorsList_35": true,
3657 + "threatIndicatorsList_36": true,
3658 + "threatIndicatorsList_37": true,
3659 + "threatIndicatorsList_38": true,
3660 + "threatIndicatorsList_39": true,
3661 + "threatIndicatorsList_4": true,
3662 + "threatIndicatorsList_40": true,
3663 + "threatIndicatorsList_41": true,
3664 + "threatIndicatorsList_42": true,
3665 + "threatIndicatorsList_43": true,
3666 + "threatIndicatorsList_44": true,
3667 + "threatIndicatorsList_45": true,
3668 + "threatIndicatorsList_46": true,
3669 + "threatIndicatorsList_47": true,
3670 + "threatIndicatorsList_48": true,
3671 + "threatIndicatorsList_49": true,
3672 + "threatIndicatorsList_5": true,
3673 + "threatIndicatorsList_50": true,
3674 + "threatIndicatorsList_51": true,
3675 + "threatIndicatorsList_52": true,
3676 + "threatIndicatorsList_53": true,
3677 + "threatIndicatorsList_54": true,
3678 + "threatIndicatorsList_55": true,
3679 + "threatIndicatorsList_56": true,
3680 + "threatIndicatorsList_6": true,
3681 + "threatIndicatorsList_7": true,
3682 + "threatIndicatorsList_8": true,
3683 + "threatIndicatorsList_9": true,
3684 + "threatMitigationStatus": true,
3685 + "threatMitigationStatusID": true,
3686 + "threatProcessUser": true,
3687 + "threatStoryline": true,
3688 + "threat_ids": true,
3689 + "threat_indicated": true,
3690 + "threat_names": true,
3691 + "time": true,
3692 + "timestamp": false,
3693 + "totalNewDevices": true,
3694 + "unknown": true,
3695 + "unsecured": true,
3696 + "unsupported": true,
3697 + "updatedAt": true,
3698 + "userId": true,
3699 + "user_name": true,
3700 + "vendor": true,
3701 + "win_registry_key": true,
3702 + "win_system_eventID": true,
3703 + "windows_auth_package": true,
3704 + "windows_domain": true,
3705 + "windows_event_id": true,
3706 + "windows_event_severity": true,
3707 + "windows_logon_type": true
3708 + },
3709 + "indexByName": {
3710 + "_id": 1,
3711 + "_index": 5,
3712 + "_type": 6,
3713 + "accountId": 7,
3714 + "accountName": 8,
3715 + "activityId": 9,
3716 + "activityType": 10,
3717 + "activityUuid": 11,
3718 + "agentId": 12,
3719 + "agentUpdatedVersion": 13,
3720 + "application_name": 14,
3721 + "cat": 15,
3722 + "comments": 16,
3723 + "createdAt": 17,
3724 + "data_accountName": 18,
3725 + "data_computerName": 2,
3726 + "data_confidenceLevel": 19,
3727 + "data_downloadUrl": 20,
3728 + "data_fileContentHash": 21,
3729 + "data_fileDisplayName": 22,
3730 + "data_filePath": 23,
3731 + "data_fullScopeDetails": 24,
3732 + "data_fullScopeDetailsPath": 25,
3733 + "data_globalStatus": 26,
3734 + "data_groupName": 27,
3735 + "data_scopeLevel": 28,
3736 + "data_scopeName": 29,
3737 + "data_siteName": 30,
3738 + "data_threatClassification": 31,
3739 + "data_username": 32,
3740 + "description": 33,
3741 + "deviceAddress": 3,
3742 + "deviceAddress_city_name": 34,
3743 + "deviceAddress_country_code": 35,
3744 + "deviceAddress_geolocation": 36,
3745 + "deviceHostFqdn": 37,
3746 + "deviceHostName": 38,
3747 + "eventDesc": 39,
3748 + "eventID": 40,
3749 + "eventSeverity": 4,
3750 + "facility": 41,
3751 + "facility_num": 42,
3752 + "fileHashMd5": 43,
3753 + "fileHashSha256": 44,
3754 + "fileName": 45,
3755 + "gl2_accounted_message_size": 46,
3756 + "gl2_message_id": 47,
3757 + "gl2_remote_ip": 48,
3758 + "gl2_remote_port": 49,
3759 + "gl2_source_input": 50,
3760 + "gl2_source_node": 51,
3761 + "groupId": 52,
3762 + "groupName": 53,
3763 + "hash": 54,
3764 + "highlight": 55,
3765 + "level": 56,
3766 + "message": 57,
3767 + "notificationScope": 58,
3768 + "originatorName": 59,
3769 + "originatorVersion": 60,
3770 + "osFamily": 61,
3771 + "process_id": 62,
3772 + "rt": 63,
3773 + "secondaryDescription": 64,
3774 + "siteId": 65,
3775 + "siteName": 66,
3776 + "sort": 67,
3777 + "source": 68,
3778 + "sourceAgentId": 69,
3779 + "sourceAgentUuid": 70,
3780 + "sourceDnsDomain": 71,
3781 + "sourceFqdn": 72,
3782 + "sourceGroupId": 73,
3783 + "sourceGroupName": 74,
3784 + "sourceHostName": 75,
3785 + "sourceIpAddresses_0": 76,
3786 + "sourceIpAddresses_1": 77,
3787 + "sourceMacAddresses_0": 78,
3788 + "sourceMacAddresses_1": 79,
3789 + "sourceMgmtPrecievedAddress": 80,
3790 + "sourceMgmtPrecievedAddress_city_name": 81,
3791 + "sourceMgmtPrecievedAddress_country_code": 82,
3792 + "sourceMgmtPrecievedAddress_geolocation": 83,
3793 + "sourceNetworkState": 84,
3794 + "sourceOsRevision": 85,
3795 + "sourceOsType": 86,
3796 + "sourceThreatCount": 87,
3797 + "source_city_name": 88,
3798 + "source_country_code": 89,
3799 + "source_geolocation": 90,
3800 + "streams": 91,
3801 + "syslog_customer": 92,
3802 + "syslog_type": 93,
3803 + "threatClassification": 94,
3804 + "threatClassificationSource": 95,
3805 + "threatClassifier": 96,
3806 + "threatCommandLineArguments": 97,
3807 + "threatConfidenceLevel": 98,
3808 + "threatDetectingEngine": 99,
3809 + "threatDetectionTime": 100,
3810 + "threatID": 101,
3811 + "threatId": 102,
3812 + "threatMitigationStatus": 103,
3813 + "threatMitigationStatusID": 104,
3814 + "threatProcessUser": 105,
3815 + "threatStoryline": 106,
3816 + "timestamp": 0,
3817 + "updatedAt": 107,
3818 + "userId": 108,
3819 + "vendor": 109
3820 + },
3821 + "renameByName": {
3822 + "_id": "EVENT ID",
3823 + "cat": "EVENT CATEGORY",
3824 + "data_computerName": "AGENT",
3825 + "data_username": "USER",
3826 + "deviceAddress": "IP ADD",
3827 + "eventDesc": "DESCRIPTION",
3828 + "eventSeverity": "SEVERITY",
3829 + "rule_id": "RULE ID",
3830 + "rule_mitre_tactic": "MITRE TACTIC",
3831 + "rule_mitre_technique": "MITRE TECHNIQUE",
3832 + "timestamp": "DATE/TIME"
3833 + }
3834 + }
3835 + }
3836 + ],
3837 + "transparent": true,
3838 + "type": "table"
3839 + }
3840 + ],
3841 + "refresh": "",
3842 + "schemaVersion": 38,
3843 + "tags": [
3844 + "EDR"
3845 + ],
3846 + "templating": {
3847 + "list": [
3848 + {
3849 + "datasource": {
3850 + "type": "grafana-opensearch-datasource",
3851 + "uid": "replace_datasource_uid"
3852 + },
3853 + "filters": [],
3854 + "hide": 0,
3855 + "label": "",
3856 + "name": "Filters",
3857 + "skipUrlSync": false,
3858 + "type": "adhoc"
3859 + },
3860 + {
3861 + "current": {
3862 + "selected": false,
3863 + "text": "All",
3864 + "value": "$__all"
3865 + },
3866 + "datasource": {
3867 + "type": "grafana-opensearch-datasource",
3868 + "uid": "replace_datasource_uid"
3869 + },
3870 + "definition": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"\"}",
3871 + "hide": 0,
3872 + "includeAll": true,
3873 + "label": "Event Severity",
3874 + "multi": false,
3875 + "name": "eventSeverity",
3876 + "options": [],
3877 + "query": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"\"}",
3878 + "refresh": 2,
3879 + "regex": "",
3880 + "skipUrlSync": false,
3881 + "sort": 0,
3882 + "type": "query"
3883 + }
3884 + ]
3885 + },
3886 + "time": {
3887 + "from": "now-24h",
3888 + "to": "now"
3889 + },
3890 + "timepicker": {
3891 + "refresh_intervals": [
3892 + "5s",
3893 + "10s",
3894 + "30s",
3895 + "1m",
3896 + "5m",
3897 + "15m",
3898 + "30m",
3899 + "1h",
3900 + "2h",
3901 + "1d"
3902 + ],
3903 + "time_options": [
3904 + "5m",
3905 + "15m",
3906 + "1h",
3907 + "6h",
3908 + "12h",
3909 + "24h",
3910 + "2d",
3911 + "7d",
3912 + "30d"
3913 + ]
3914 + },
3915 + "timezone": "",
3916 + "title": "EDR - SENTINELONE EPP - _SUMMARY",
3917 + "weekStart": ""
3918 +}
backend/app/connectors/grafana/dashboards/Sentinelone/sentinelone_epp_whitelistblacklist.json new
+1919
@@ -0,0 +1,1919 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "datasource",
8 + "uid": "grafana"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "editable": false,
25 + "fiscalYearStartMonth": 0,
26 + "graphTooltip": 0,
27 + "id": null,
28 + "links": [
29 + {
30 + "asDropdown": true,
31 + "icon": "external link",
32 + "includeVars": true,
33 + "keepTime": true,
34 + "tags": [
35 + "EDR"
36 + ],
37 + "targetBlank": true,
38 + "title": "",
39 + "type": "dashboards"
40 + }
41 + ],
42 + "liveNow": false,
43 + "panels": [
44 + {
45 + "datasource": {
46 + "type": "grafana-opensearch-datasource",
47 + "uid": "replace_datasource_uid"
48 + },
49 + "fieldConfig": {
50 + "defaults": {
51 + "mappings": [
52 + {
53 + "options": {
54 + "match": "null",
55 + "result": {
56 + "text": "N/A"
57 + }
58 + },
59 + "type": "special"
60 + }
61 + ],
62 + "thresholds": {
63 + "mode": "absolute",
64 + "steps": [
65 + {
66 + "color": "orange",
67 + "value": null
68 + }
69 + ]
70 + },
71 + "unit": "locale"
72 + },
73 + "overrides": []
74 + },
75 + "gridPos": {
76 + "h": 7,
77 + "w": 4,
78 + "x": 0,
79 + "y": 0
80 + },
81 + "id": 18,
82 + "options": {
83 + "colorMode": "value",
84 + "graphMode": "area",
85 + "justifyMode": "auto",
86 + "orientation": "horizontal",
87 + "reduceOptions": {
88 + "calcs": [
89 + "sum"
90 + ],
91 + "fields": "",
92 + "values": false
93 + },
94 + "showPercentChange": false,
95 + "text": {},
96 + "textMode": "auto",
97 + "wideLayout": true
98 + },
99 + "pluginVersion": "10.4.2",
100 + "targets": [
101 + {
102 + "bucketAggs": [
103 + {
104 + "$$hashKey": "object:331",
105 + "field": "timestamp",
106 + "id": "2",
107 + "settings": {
108 + "interval": "auto",
109 + "min_doc_count": 0,
110 + "trimEdges": 0
111 + },
112 + "type": "date_histogram"
113 + }
114 + ],
115 + "datasource": {
116 + "type": "grafana-opensearch-datasource",
117 + "uid": "replace_datasource_uid"
118 + },
119 + "metrics": [
120 + {
121 + "$$hashKey": "object:329",
122 + "field": "select field",
123 + "id": "1",
124 + "type": "count"
125 + }
126 + ],
127 + "query": "eventSeverity:$eventSeverity AND cat:WHITELISTBLACKLIST",
128 + "refId": "A",
129 + "timeField": "timestamp"
130 + }
131 + ],
132 + "title": "EVENTS (TOTAL)",
133 + "type": "stat"
134 + },
135 + {
136 + "datasource": {
137 + "type": "grafana-opensearch-datasource",
138 + "uid": "replace_datasource_uid"
139 + },
140 + "fieldConfig": {
141 + "defaults": {
142 + "color": {
143 + "mode": "thresholds"
144 + },
145 + "custom": {
146 + "align": "auto",
147 + "cellOptions": {
148 + "type": "auto"
149 + },
150 + "inspect": false
151 + },
152 + "mappings": [],
153 + "thresholds": {
154 + "mode": "absolute",
155 + "steps": [
156 + {
157 + "color": "orange",
158 + "value": null
159 + }
160 + ]
161 + }
162 + },
163 + "overrides": [
164 + {
165 + "matcher": {
166 + "id": "byName",
167 + "options": "Time"
168 + },
169 + "properties": [
170 + {
171 + "id": "displayName",
172 + "value": "Time"
173 + },
174 + {
175 + "id": "unit",
176 + "value": "time: YYYY-MM-DD HH:mm:ss"
177 + },
178 + {
179 + "id": "custom.align"
180 + }
181 + ]
182 + },
183 + {
184 + "matcher": {
185 + "id": "byName",
186 + "options": "Count"
187 + },
188 + "properties": [
189 + {
190 + "id": "displayName",
191 + "value": "EVENTS"
192 + },
193 + {
194 + "id": "unit",
195 + "value": "short"
196 + },
197 + {
198 + "id": "decimals",
199 + "value": -1
200 + },
201 + {
202 + "id": "custom.cellOptions",
203 + "value": {
204 + "type": "color-background"
205 + }
206 + },
207 + {
208 + "id": "custom.align"
209 + },
210 + {
211 + "id": "thresholds",
212 + "value": {
213 + "mode": "absolute",
214 + "steps": [
215 + {
216 + "color": "dark-orange",
217 + "value": null
218 + }
219 + ]
220 + }
221 + }
222 + ]
223 + },
224 + {
225 + "matcher": {
226 + "id": "byName",
227 + "options": "data_groupName"
228 + },
229 + "properties": [
230 + {
231 + "id": "displayName",
232 + "value": "ALERTS BY TYPE"
233 + },
234 + {
235 + "id": "unit",
236 + "value": "short"
237 + },
238 + {
239 + "id": "decimals",
240 + "value": -1
241 + },
242 + {
243 + "id": "custom.cellOptions",
244 + "value": {
245 + "type": "color-background"
246 + }
247 + },
248 + {
249 + "id": "custom.align"
250 + }
251 + ]
252 + }
253 + ]
254 + },
255 + "gridPos": {
256 + "h": 7,
257 + "w": 7,
258 + "x": 4,
259 + "y": 0
260 + },
261 + "id": 57,
262 + "options": {
263 + "cellHeight": "sm",
264 + "footer": {
265 + "countRows": false,
266 + "fields": "",
267 + "reducer": [
268 + "sum"
269 + ],
270 + "show": false
271 + },
272 + "showHeader": true
273 + },
274 + "pluginVersion": "10.4.2",
275 + "targets": [
276 + {
277 + "bucketAggs": [
278 + {
279 + "fake": true,
280 + "field": "data_scopeName",
281 + "id": "4",
282 + "settings": {
283 + "min_doc_count": 1,
284 + "order": "desc",
285 + "orderBy": "_count",
286 + "size": "0"
287 + },
288 + "type": "terms"
289 + }
290 + ],
291 + "datasource": {
292 + "type": "grafana-opensearch-datasource",
293 + "uid": "replace_datasource_uid"
294 + },
295 + "metrics": [
296 + {
297 + "field": "select field",
298 + "id": "1",
299 + "type": "count"
300 + }
301 + ],
302 + "query": "eventSeverity:$eventSeverity AND cat:WHITELISTBLACKLIST",
303 + "refId": "A",
304 + "timeField": "timestamp"
305 + }
306 + ],
307 + "title": "SCOPES",
308 + "transformations": [
309 + {
310 + "id": "organize",
311 + "options": {
312 + "excludeByName": {},
313 + "indexByName": {},
314 + "renameByName": {
315 + "data_group": "GROUP"
316 + }
317 + }
318 + }
319 + ],
320 + "type": "table"
321 + },
322 + {
323 + "datasource": {
324 + "type": "grafana-opensearch-datasource",
325 + "uid": "replace_datasource_uid"
326 + },
327 + "fieldConfig": {
328 + "defaults": {
329 + "color": {
330 + "mode": "palette-classic"
331 + },
332 + "custom": {
333 + "hideFrom": {
334 + "legend": false,
335 + "tooltip": false,
336 + "viz": false
337 + }
338 + },
339 + "decimals": 0,
340 + "mappings": [],
341 + "unit": "short"
342 + },
343 + "overrides": [
344 + {
345 + "matcher": {
346 + "id": "byName",
347 + "options": "1"
348 + },
349 + "properties": [
350 + {
351 + "id": "color",
352 + "value": {
353 + "fixedColor": "#C8F2C2",
354 + "mode": "fixed"
355 + }
356 + }
357 + ]
358 + },
359 + {
360 + "matcher": {
361 + "id": "byName",
362 + "options": "2"
363 + },
364 + "properties": [
365 + {
366 + "id": "color",
367 + "value": {
368 + "fixedColor": "#96D98D",
369 + "mode": "fixed"
370 + }
371 + }
372 + ]
373 + },
374 + {
375 + "matcher": {
376 + "id": "byName",
377 + "options": "3"
378 + },
379 + "properties": [
380 + {
381 + "id": "color",
382 + "value": {
383 + "fixedColor": "#56A64B",
384 + "mode": "fixed"
385 + }
386 + }
387 + ]
388 + },
389 + {
390 + "matcher": {
391 + "id": "byName",
392 + "options": "4"
393 + },
394 + "properties": [
395 + {
396 + "id": "color",
397 + "value": {
398 + "fixedColor": "#37872D",
399 + "mode": "fixed"
400 + }
401 + }
402 + ]
403 + },
404 + {
405 + "matcher": {
406 + "id": "byName",
407 + "options": "5"
408 + },
409 + "properties": [
410 + {
411 + "id": "color",
412 + "value": {
413 + "fixedColor": "#FFF899",
414 + "mode": "fixed"
415 + }
416 + }
417 + ]
418 + },
419 + {
420 + "matcher": {
421 + "id": "byName",
422 + "options": "7"
423 + },
424 + "properties": [
425 + {
426 + "id": "color",
427 + "value": {
428 + "fixedColor": "#F2CC0C",
429 + "mode": "fixed"
430 + }
431 + }
432 + ]
433 + },
434 + {
435 + "matcher": {
436 + "id": "byName",
437 + "options": "9"
438 + },
439 + "properties": [
440 + {
441 + "id": "color",
442 + "value": {
443 + "fixedColor": "#FF9830",
444 + "mode": "fixed"
445 + }
446 + }
447 + ]
448 + },
449 + {
450 + "matcher": {
451 + "id": "byName",
452 + "options": "10"
453 + },
454 + "properties": [
455 + {
456 + "id": "color",
457 + "value": {
458 + "fixedColor": "#FF9830",
459 + "mode": "fixed"
460 + }
461 + }
462 + ]
463 + },
464 + {
465 + "matcher": {
466 + "id": "byName",
467 + "options": "12"
468 + },
469 + "properties": [
470 + {
471 + "id": "color",
472 + "value": {
473 + "fixedColor": "#F2495C",
474 + "mode": "fixed"
475 + }
476 + }
477 + ]
478 + },
479 + {
480 + "matcher": {
481 + "id": "byName",
482 + "options": "13"
483 + },
484 + "properties": [
485 + {
486 + "id": "color",
487 + "value": {
488 + "fixedColor": "#FF7383",
489 + "mode": "fixed"
490 + }
491 + }
492 + ]
493 + }
494 + ]
495 + },
496 + "gridPos": {
497 + "h": 12,
498 + "w": 6,
499 + "x": 0,
500 + "y": 7
501 + },
502 + "id": 23,
503 + "maxDataPoints": 3,
504 + "options": {
505 + "displayLabels": [],
506 + "legend": {
507 + "calcs": [],
508 + "displayMode": "table",
509 + "placement": "right",
510 + "showLegend": true,
511 + "values": [
512 + "value",
513 + "percent"
514 + ]
515 + },
516 + "pieType": "donut",
517 + "reduceOptions": {
518 + "calcs": [
519 + "sum"
520 + ],
521 + "fields": "",
522 + "values": false
523 + },
524 + "text": {},
525 + "tooltip": {
526 + "mode": "single",
527 + "sort": "none"
528 + }
529 + },
530 + "targets": [
531 + {
532 + "bucketAggs": [
533 + {
534 + "$$hashKey": "object:235",
535 + "fake": true,
536 + "field": "eventSeverity",
537 + "id": "3",
538 + "settings": {
539 + "min_doc_count": 1,
540 + "order": "desc",
541 + "orderBy": "_count",
542 + "size": "10"
543 + },
544 + "type": "terms"
545 + },
546 + {
547 + "$$hashKey": "object:236",
548 + "field": "timestamp",
549 + "id": "2",
550 + "settings": {
551 + "interval": "auto",
552 + "min_doc_count": 0,
553 + "trimEdges": 0
554 + },
555 + "type": "date_histogram"
556 + }
557 + ],
558 + "datasource": {
559 + "type": "grafana-opensearch-datasource",
560 + "uid": "replace_datasource_uid"
561 + },
562 + "metrics": [
563 + {
564 + "$$hashKey": "object:233",
565 + "field": "select field",
566 + "id": "1",
567 + "meta": {},
568 + "settings": {},
569 + "type": "count"
570 + }
571 + ],
572 + "query": "eventSeverity:$eventSeverity AND cat:WHITELISTBLACKLIST",
573 + "refId": "A",
574 + "timeField": "timestamp"
575 + }
576 + ],
577 + "title": "SECURITY EVENTS BY ALERT LEVEL",
578 + "type": "piechart"
579 + },
580 + {
581 + "datasource": {
582 + "type": "grafana-opensearch-datasource",
583 + "uid": "replace_datasource_uid"
584 + },
585 + "fieldConfig": {
586 + "defaults": {
587 + "color": {
588 + "mode": "palette-classic"
589 + },
590 + "custom": {
591 + "axisBorderShow": false,
592 + "axisCenteredZero": false,
593 + "axisColorMode": "text",
594 + "axisLabel": "",
595 + "axisPlacement": "auto",
596 + "barAlignment": 0,
597 + "drawStyle": "line",
598 + "fillOpacity": 0,
599 + "gradientMode": "none",
600 + "hideFrom": {
601 + "legend": false,
602 + "tooltip": false,
603 + "viz": false
604 + },
605 + "insertNulls": false,
606 + "lineInterpolation": "linear",
607 + "lineWidth": 1,
608 + "pointSize": 5,
609 + "scaleDistribution": {
610 + "type": "linear"
611 + },
612 + "showPoints": "auto",
613 + "spanNulls": false,
614 + "stacking": {
615 + "group": "A",
616 + "mode": "normal"
617 + },
618 + "thresholdsStyle": {
619 + "mode": "off"
620 + }
621 + },
622 + "mappings": [],
623 + "thresholds": {
624 + "mode": "absolute",
625 + "steps": [
626 + {
627 + "color": "green",
628 + "value": null
629 + },
630 + {
631 + "color": "red",
632 + "value": 80
633 + }
634 + ]
635 + }
636 + },
637 + "overrides": [
638 + {
639 + "matcher": {
640 + "id": "byName",
641 + "options": "10"
642 + },
643 + "properties": [
644 + {
645 + "id": "color",
646 + "value": {
647 + "fixedColor": "orange",
648 + "mode": "fixed"
649 + }
650 + }
651 + ]
652 + }
653 + ]
654 + },
655 + "gridPos": {
656 + "h": 12,
657 + "w": 18,
658 + "x": 6,
659 + "y": 7
660 + },
661 + "id": 50,
662 + "options": {
663 + "legend": {
664 + "calcs": [],
665 + "displayMode": "table",
666 + "placement": "right",
667 + "showLegend": true
668 + },
669 + "tooltip": {
670 + "mode": "single",
671 + "sort": "none"
672 + }
673 + },
674 + "targets": [
675 + {
676 + "alias": "",
677 + "bucketAggs": [
678 + {
679 + "field": "eventSeverity",
680 + "id": "3",
681 + "settings": {
682 + "min_doc_count": "1",
683 + "order": "desc",
684 + "orderBy": "_count",
685 + "size": "10"
686 + },
687 + "type": "terms"
688 + },
689 + {
690 + "field": "timestamp",
691 + "id": "2",
692 + "settings": {
693 + "interval": "auto"
694 + },
695 + "type": "date_histogram"
696 + }
697 + ],
698 + "datasource": {
699 + "type": "grafana-opensearch-datasource",
700 + "uid": "replace_datasource_uid"
701 + },
702 + "metrics": [
703 + {
704 + "id": "1",
705 + "type": "count"
706 + }
707 + ],
708 + "query": "eventSeverity:$eventSeverity AND cat:WHITELISTBLACKLIST",
709 + "refId": "A",
710 + "timeField": "timestamp"
711 + }
712 + ],
713 + "title": "EVENTS SEVERITY - HISTOGRAM",
714 + "type": "timeseries"
715 + },
716 + {
717 + "datasource": {
718 + "type": "grafana-opensearch-datasource",
719 + "uid": "replace_datasource_uid"
720 + },
721 + "fieldConfig": {
722 + "defaults": {
723 + "color": {
724 + "mode": "thresholds"
725 + },
726 + "custom": {
727 + "align": "auto",
728 + "cellOptions": {
729 + "type": "auto"
730 + },
731 + "filterable": true,
732 + "inspect": false
733 + },
734 + "mappings": [],
735 + "thresholds": {
736 + "mode": "absolute",
737 + "steps": [
738 + {
739 + "color": "green",
740 + "value": null
741 + },
742 + {
743 + "color": "red",
744 + "value": 80
745 + }
746 + ]
747 + }
748 + },
749 + "overrides": [
750 + {
751 + "matcher": {
752 + "id": "byName",
753 + "options": "timestamp"
754 + },
755 + "properties": [
756 + {
757 + "id": "displayName",
758 + "value": "Date/Time"
759 + },
760 + {
761 + "id": "unit",
762 + "value": "time: YYYY-MM-DD HH:mm:ss"
763 + },
764 + {
765 + "id": "custom.align"
766 + }
767 + ]
768 + },
769 + {
770 + "matcher": {
771 + "id": "byName",
772 + "options": "data_computerName"
773 + },
774 + "properties": [
775 + {
776 + "id": "displayName",
777 + "value": "AGENT"
778 + },
779 + {
780 + "id": "unit",
781 + "value": "short"
782 + },
783 + {
784 + "id": "decimals",
785 + "value": 2
786 + },
787 + {
788 + "id": "custom.align"
789 + }
790 + ]
791 + },
792 + {
793 + "matcher": {
794 + "id": "byName",
795 + "options": "agent_ip"
796 + },
797 + "properties": [
798 + {
799 + "id": "displayName",
800 + "value": "IP ADDRESS"
801 + },
802 + {
803 + "id": "unit",
804 + "value": "short"
805 + },
806 + {
807 + "id": "decimals",
808 + "value": 2
809 + },
810 + {
811 + "id": "custom.align"
812 + }
813 + ]
814 + },
815 + {
816 + "matcher": {
817 + "id": "byName",
818 + "options": "rule_description"
819 + },
820 + "properties": [
821 + {
822 + "id": "displayName",
823 + "value": "RULE DESCRIPTION"
824 + },
825 + {
826 + "id": "unit",
827 + "value": "short"
828 + },
829 + {
830 + "id": "decimals",
831 + "value": 2
832 + },
833 + {
834 + "id": "custom.align"
835 + }
836 + ]
837 + },
838 + {
839 + "matcher": {
840 + "id": "byName",
841 + "options": "Date/Time"
842 + },
843 + "properties": [
844 + {
845 + "id": "custom.width",
846 + "value": 242
847 + }
848 + ]
849 + },
850 + {
851 + "matcher": {
852 + "id": "byName",
853 + "options": "AGENT"
854 + },
855 + "properties": [
856 + {
857 + "id": "custom.width",
858 + "value": 160
859 + }
860 + ]
861 + },
862 + {
863 + "matcher": {
864 + "id": "byName",
865 + "options": "MITRE TACTIC"
866 + },
867 + "properties": [
868 + {
869 + "id": "custom.width",
870 + "value": 332
871 + }
872 + ]
873 + },
874 + {
875 + "matcher": {
876 + "id": "byName",
877 + "options": "RULE LEVEL"
878 + },
879 + "properties": [
880 + {
881 + "id": "custom.width",
882 + "value": 122
883 + }
884 + ]
885 + },
886 + {
887 + "matcher": {
888 + "id": "byName",
889 + "options": "IP ADDRESS"
890 + },
891 + "properties": [
892 + {
893 + "id": "custom.width",
894 + "value": 163
895 + }
896 + ]
897 + },
898 + {
899 + "matcher": {
900 + "id": "byName",
901 + "options": "MITRE TECHNIQUE"
902 + },
903 + "properties": [
904 + {
905 + "id": "custom.width",
906 + "value": 312
907 + }
908 + ]
909 + },
910 + {
911 + "matcher": {
912 + "id": "byName",
913 + "options": "rule_id"
914 + },
915 + "properties": [
916 + {
917 + "id": "custom.width",
918 + "value": 96
919 + }
920 + ]
921 + },
922 + {
923 + "matcher": {
924 + "id": "byName",
925 + "options": "EVENT ID"
926 + },
927 + "properties": [
928 + {
929 + "id": "links",
930 + "value": [
931 + {
932 + "targetBlank": true,
933 + "title": "VIEW EVENT DETAILS",
934 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SENTINELONE%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
935 + }
936 + ]
937 + }
938 + ]
939 + },
940 + {
941 + "matcher": {
942 + "id": "byName",
943 + "options": "IP ADD"
944 + },
945 + "properties": [
946 + {
947 + "id": "custom.width",
948 + "value": 176
949 + }
950 + ]
951 + },
952 + {
953 + "matcher": {
954 + "id": "byName",
955 + "options": "EVENT CATEGORY"
956 + },
957 + "properties": [
958 + {
959 + "id": "custom.width",
960 + "value": 209
961 + }
962 + ]
963 + },
964 + {
965 + "matcher": {
966 + "id": "byName",
967 + "options": "USER"
968 + },
969 + "properties": [
970 + {
971 + "id": "custom.width",
972 + "value": 218
973 + }
974 + ]
975 + },
976 + {
977 + "matcher": {
978 + "id": "byName",
979 + "options": "threatClassification"
980 + },
981 + "properties": [
982 + {
983 + "id": "custom.width",
984 + "value": 214
985 + }
986 + ]
987 + },
988 + {
989 + "matcher": {
990 + "id": "byName",
991 + "options": "DESCRIPTION"
992 + },
993 + "properties": [
994 + {
995 + "id": "custom.width",
996 + "value": 688
997 + }
998 + ]
999 + }
1000 + ]
1001 + },
1002 + "gridPos": {
1003 + "h": 16,
1004 + "w": 24,
1005 + "x": 0,
1006 + "y": 19
1007 + },
1008 + "id": 27,
1009 + "options": {
1010 + "cellHeight": "sm",
1011 + "footer": {
1012 + "countRows": false,
1013 + "enablePagination": true,
1014 + "fields": "",
1015 + "reducer": [
1016 + "sum"
1017 + ],
1018 + "show": false
1019 + },
1020 + "showHeader": true,
1021 + "sortBy": []
1022 + },
1023 + "pluginVersion": "10.4.2",
1024 + "targets": [
1025 + {
1026 + "bucketAggs": [],
1027 + "datasource": {
1028 + "type": "grafana-opensearch-datasource",
1029 + "uid": "replace_datasource_uid"
1030 + },
1031 + "metrics": [
1032 + {
1033 + "id": "1",
1034 + "settings": {
1035 + "size": "250"
1036 + },
1037 + "type": "raw_data"
1038 + }
1039 + ],
1040 + "query": "eventSeverity:$eventSeverity AND cat:WHITELISTBLACKLIST",
1041 + "refId": "A",
1042 + "timeField": "timestamp"
1043 + }
1044 + ],
1045 + "title": "EVENTS",
1046 + "transformations": [
1047 + {
1048 + "id": "filterFieldsByName",
1049 + "options": {
1050 + "include": {
1051 + "names": [
1052 + "timestamp",
1053 + "_id",
1054 + "cat",
1055 + "data_computerName",
1056 + "data_username",
1057 + "deviceAddress",
1058 + "deviceAddress_city_name",
1059 + "eventDesc",
1060 + "eventSeverity",
1061 + "fileName",
1062 + "threatClassification",
1063 + "threatConfidenceLevel"
1064 + ]
1065 + }
1066 + }
1067 + },
1068 + {
1069 + "id": "organize",
1070 + "options": {
1071 + "excludeByName": {
1072 + "@metadata_beat": true,
1073 + "@metadata_type": true,
1074 + "@metadata_version": true,
1075 + "IMPHASH": true,
1076 + "MD5": true,
1077 + "SHA1": true,
1078 + "SHA256": true,
1079 + "_id": false,
1080 + "_index": true,
1081 + "_type": true,
1082 + "accountId": true,
1083 + "accountName": true,
1084 + "activityId": true,
1085 + "activityType": true,
1086 + "activityUuid": true,
1087 + "agentId": true,
1088 + "agentUpdatedVersion": true,
1089 + "agent_ephemeral_id": true,
1090 + "agent_hostname": true,
1091 + "agent_id": true,
1092 + "agent_ip_city_name": true,
1093 + "agent_ip_country_code": true,
1094 + "agent_ip_geolocation": true,
1095 + "agent_type": true,
1096 + "agent_version": true,
1097 + "application_name": true,
1098 + "beats_type": true,
1099 + "collector_node_id": true,
1100 + "comments": true,
1101 + "createdAt": true,
1102 + "data_accountName": true,
1103 + "data_alert_action": true,
1104 + "data_alert_category": true,
1105 + "data_alert_gid": true,
1106 + "data_alert_rev": true,
1107 + "data_alert_severity": true,
1108 + "data_alert_signature": true,
1109 + "data_alert_signature_id": true,
1110 + "data_app_proto": true,
1111 + "data_audit_auid": true,
1112 + "data_audit_command": true,
1113 + "data_audit_euid": true,
1114 + "data_audit_exe": true,
1115 + "data_audit_gid": true,
1116 + "data_audit_id": true,
1117 + "data_audit_pid": true,
1118 + "data_audit_res": true,
1119 + "data_audit_session": true,
1120 + "data_audit_type": true,
1121 + "data_audit_uid": true,
1122 + "data_computerName": false,
1123 + "data_confidenceLevel": true,
1124 + "data_createdAt": true,
1125 + "data_description": true,
1126 + "data_dest_ip": true,
1127 + "data_dest_port": true,
1128 + "data_downloadUrl": true,
1129 + "data_dstuser": true,
1130 + "data_event_type": true,
1131 + "data_exclusionType": true,
1132 + "data_extra_data": true,
1133 + "data_file": true,
1134 + "data_fileContentHash": true,
1135 + "data_fileDisplayName": true,
1136 + "data_fileName": true,
1137 + "data_filePath": true,
1138 + "data_flow_bytes_toclient": true,
1139 + "data_flow_bytes_toserver": true,
1140 + "data_flow_id": true,
1141 + "data_flow_pkts_toclient": true,
1142 + "data_flow_pkts_toserver": true,
1143 + "data_flow_start": true,
1144 + "data_fullScopeDetails": true,
1145 + "data_fullScopeDetailsPath": true,
1146 + "data_globalStatus": true,
1147 + "data_groupName": true,
1148 + "data_http_http_content_type": true,
1149 + "data_http_http_port": true,
1150 + "data_http_length": true,
1151 + "data_http_status": true,
1152 + "data_http_url": true,
1153 + "data_id": true,
1154 + "data_in_iface": true,
1155 + "data_majorVersion": true,
1156 + "data_metadata_flowbits": true,
1157 + "data_metadata_flowints_http_anomaly_count": true,
1158 + "data_metadata_flowints_tcp_retransmission_count": true,
1159 + "data_minorVersion": true,
1160 + "data_osArch": true,
1161 + "data_osFamily": true,
1162 + "data_osquery_action": true,
1163 + "data_osquery_calendarTime": true,
1164 + "data_osquery_columns_address": true,
1165 + "data_osquery_columns_address_city_name": true,
1166 + "data_osquery_columns_address_country_code": true,
1167 + "data_osquery_columns_address_geolocation": true,
1168 + "data_osquery_columns_cmdline": true,
1169 + "data_osquery_columns_cwd": true,
1170 + "data_osquery_columns_description": true,
1171 + "data_osquery_columns_directory": true,
1172 + "data_osquery_columns_disk_bytes_read": true,
1173 + "data_osquery_columns_disk_bytes_written": true,
1174 + "data_osquery_columns_egid": true,
1175 + "data_osquery_columns_euid": true,
1176 + "data_osquery_columns_family": true,
1177 + "data_osquery_columns_fd": true,
1178 + "data_osquery_columns_gid": true,
1179 + "data_osquery_columns_gid_signed": true,
1180 + "data_osquery_columns_host": true,
1181 + "data_osquery_columns_interface": true,
1182 + "data_osquery_columns_local_address": true,
1183 + "data_osquery_columns_local_address_city_name": true,
1184 + "data_osquery_columns_local_address_country_code": true,
1185 + "data_osquery_columns_local_address_geolocation": true,
1186 + "data_osquery_columns_local_port": true,
1187 + "data_osquery_columns_mac": true,
1188 + "data_osquery_columns_name": true,
1189 + "data_osquery_columns_net_namespace": true,
1190 + "data_osquery_columns_nice": true,
1191 + "data_osquery_columns_on_disk": true,
1192 + "data_osquery_columns_parent": true,
1193 + "data_osquery_columns_path": true,
1194 + "data_osquery_columns_pgroup": true,
1195 + "data_osquery_columns_pid": true,
1196 + "data_osquery_columns_port": true,
1197 + "data_osquery_columns_protocol": true,
1198 + "data_osquery_columns_remote_address": true,
1199 + "data_osquery_columns_remote_address_city_name": true,
1200 + "data_osquery_columns_remote_address_country_code": true,
1201 + "data_osquery_columns_remote_address_geolocation": true,
1202 + "data_osquery_columns_remote_port": true,
1203 + "data_osquery_columns_resident_size": true,
1204 + "data_osquery_columns_root": true,
1205 + "data_osquery_columns_sgid": true,
1206 + "data_osquery_columns_shell": true,
1207 + "data_osquery_columns_socket": true,
1208 + "data_osquery_columns_start_time": true,
1209 + "data_osquery_columns_state": true,
1210 + "data_osquery_columns_suid": true,
1211 + "data_osquery_columns_system_time": true,
1212 + "data_osquery_columns_threads": true,
1213 + "data_osquery_columns_time_utc": true,
1214 + "data_osquery_columns_total_size": true,
1215 + "data_osquery_columns_tty": true,
1216 + "data_osquery_columns_type": true,
1217 + "data_osquery_columns_uid": true,
1218 + "data_osquery_columns_uid_signed": true,
1219 + "data_osquery_columns_user": true,
1220 + "data_osquery_columns_user_time": true,
1221 + "data_osquery_columns_username": true,
1222 + "data_osquery_columns_wired_size": true,
1223 + "data_osquery_counter": true,
1224 + "data_osquery_decorations_host_uuid": true,
1225 + "data_osquery_decorations_hostname": true,
1226 + "data_osquery_epoch": true,
1227 + "data_osquery_hostIdentifier": true,
1228 + "data_osquery_name": true,
1229 + "data_osquery_numerics": true,
1230 + "data_osquery_unixTime": true,
1231 + "data_packageId": true,
1232 + "data_platformType": true,
1233 + "data_proto": true,
1234 + "data_sca_check_command": true,
1235 + "data_sca_check_compliance_cis": true,
1236 + "data_sca_check_compliance_cis_csc": true,
1237 + "data_sca_check_compliance_gdpr_IV": true,
1238 + "data_sca_check_compliance_gpg_13": true,
1239 + "data_sca_check_compliance_hipaa": true,
1240 + "data_sca_check_compliance_nist_800_53": true,
1241 + "data_sca_check_compliance_pci_dss": true,
1242 + "data_sca_check_compliance_tsc": true,
1243 + "data_sca_check_description": true,
1244 + "data_sca_check_id": true,
1245 + "data_sca_check_previous_result": true,
1246 + "data_sca_check_rationale": true,
1247 + "data_sca_check_remediation": true,
1248 + "data_sca_check_result": true,
1249 + "data_sca_check_title": true,
1250 + "data_sca_description": true,
1251 + "data_sca_failed": true,
1252 + "data_sca_file": true,
1253 + "data_sca_invalid": true,
1254 + "data_sca_passed": true,
1255 + "data_sca_policy": true,
1256 + "data_sca_policy_id": true,
1257 + "data_sca_scan_id": true,
1258 + "data_sca_score": true,
1259 + "data_sca_total_checks": true,
1260 + "data_sca_type": true,
1261 + "data_scanType": true,
1262 + "data_scopeLevel": true,
1263 + "data_scopeName": true,
1264 + "data_script": true,
1265 + "data_secured": true,
1266 + "data_siteName": true,
1267 + "data_src_ip": true,
1268 + "data_src_ip_city_name": true,
1269 + "data_src_ip_country_code": true,
1270 + "data_src_ip_geolocation": true,
1271 + "data_src_port": true,
1272 + "data_srcip": true,
1273 + "data_srcip_city_name": true,
1274 + "data_srcip_country_code": true,
1275 + "data_srcip_geolocation": true,
1276 + "data_srcuser": true,
1277 + "data_status": true,
1278 + "data_threatClassification": true,
1279 + "data_timestamp": true,
1280 + "data_title": true,
1281 + "data_tls_session_resumed": true,
1282 + "data_tls_version": true,
1283 + "data_totalNewDevices": true,
1284 + "data_tx_id": true,
1285 + "data_type": true,
1286 + "data_unknown": true,
1287 + "data_unsecured": true,
1288 + "data_unsupported": true,
1289 + "data_value": true,
1290 + "data_version": true,
1291 + "data_version_city_name": true,
1292 + "data_version_country_code": true,
1293 + "data_version_geolocation": true,
1294 + "data_win_eventXML_binaryData": true,
1295 + "data_win_eventXML_binaryDataSize": true,
1296 + "data_win_eventXML_param1": true,
1297 + "data_win_eventdata_authenticationPackageName": true,
1298 + "data_win_eventdata_callTrace": true,
1299 + "data_win_eventdata_commandLine": true,
1300 + "data_win_eventdata_company": true,
1301 + "data_win_eventdata_creationUtcTime": true,
1302 + "data_win_eventdata_currentDirectory": true,
1303 + "data_win_eventdata_description": true,
1304 + "data_win_eventdata_destinationHostname": true,
1305 + "data_win_eventdata_destinationIp": true,
1306 + "data_win_eventdata_destinationIp_city_name": true,
1307 + "data_win_eventdata_destinationIp_country_code": true,
1308 + "data_win_eventdata_destinationIp_geolocation": true,
1309 + "data_win_eventdata_destinationIsIpv6": true,
1310 + "data_win_eventdata_destinationPort": true,
1311 + "data_win_eventdata_destinationPortName": true,
1312 + "data_win_eventdata_details": true,
1313 + "data_win_eventdata_elevatedToken": true,
1314 + "data_win_eventdata_eventType": true,
1315 + "data_win_eventdata_fileVersion": true,
1316 + "data_win_eventdata_fileVersion_city_name": true,
1317 + "data_win_eventdata_fileVersion_country_code": true,
1318 + "data_win_eventdata_fileVersion_geolocation": true,
1319 + "data_win_eventdata_grantedAccess": true,
1320 + "data_win_eventdata_hashes": true,
1321 + "data_win_eventdata_image": true,
1322 + "data_win_eventdata_imageLoaded": true,
1323 + "data_win_eventdata_impersonationLevel": true,
1324 + "data_win_eventdata_initiated": true,
1325 + "data_win_eventdata_integrityLevel": true,
1326 + "data_win_eventdata_ipAddress": true,
1327 + "data_win_eventdata_ipPort": true,
1328 + "data_win_eventdata_keyLength": true,
1329 + "data_win_eventdata_logonGuid": true,
1330 + "data_win_eventdata_logonId": true,
1331 + "data_win_eventdata_logonProcessName": true,
1332 + "data_win_eventdata_logonType": true,
1333 + "data_win_eventdata_originalFileName": true,
1334 + "data_win_eventdata_param1": true,
1335 + "data_win_eventdata_param2": true,
1336 + "data_win_eventdata_param3": true,
1337 + "data_win_eventdata_param4": true,
1338 + "data_win_eventdata_parentCommandLine": true,
1339 + "data_win_eventdata_parentImage": true,
1340 + "data_win_eventdata_parentProcessGuid": true,
1341 + "data_win_eventdata_parentProcessId": true,
1342 + "data_win_eventdata_processGuid": true,
1343 + "data_win_eventdata_processId": true,
1344 + "data_win_eventdata_processName": true,
1345 + "data_win_eventdata_product": true,
1346 + "data_win_eventdata_protocol": true,
1347 + "data_win_eventdata_queryName": true,
1348 + "data_win_eventdata_queryResults": true,
1349 + "data_win_eventdata_queryStatus": true,
1350 + "data_win_eventdata_ruleName": true,
1351 + "data_win_eventdata_serviceName": true,
1352 + "data_win_eventdata_serviceSid": true,
1353 + "data_win_eventdata_signature": true,
1354 + "data_win_eventdata_signatureStatus": true,
1355 + "data_win_eventdata_signed": true,
1356 + "data_win_eventdata_sourceHostname": true,
1357 + "data_win_eventdata_sourceImage": true,
1358 + "data_win_eventdata_sourceIp": true,
1359 + "data_win_eventdata_sourceIp_city_name": true,
1360 + "data_win_eventdata_sourceIp_country_code": true,
1361 + "data_win_eventdata_sourceIp_geolocation": true,
1362 + "data_win_eventdata_sourceIsIpv6": true,
1363 + "data_win_eventdata_sourcePort": true,
1364 + "data_win_eventdata_sourceProcessGUID": true,
1365 + "data_win_eventdata_sourceProcessId": true,
1366 + "data_win_eventdata_sourceThreadId": true,
1367 + "data_win_eventdata_status": true,
1368 + "data_win_eventdata_subjectDomainName": true,
1369 + "data_win_eventdata_subjectLogonId": true,
1370 + "data_win_eventdata_subjectUserName": true,
1371 + "data_win_eventdata_subjectUserSid": true,
1372 + "data_win_eventdata_targetDomainName": true,
1373 + "data_win_eventdata_targetFilename": true,
1374 + "data_win_eventdata_targetImage": true,
1375 + "data_win_eventdata_targetLinkedLogonId": true,
1376 + "data_win_eventdata_targetLogonId": true,
1377 + "data_win_eventdata_targetObject": true,
1378 + "data_win_eventdata_targetProcessGUID": true,
1379 + "data_win_eventdata_targetProcessId": true,
1380 + "data_win_eventdata_targetUserName": true,
1381 + "data_win_eventdata_targetUserSid": true,
1382 + "data_win_eventdata_terminalSessionId": true,
1383 + "data_win_eventdata_ticketEncryptionType": true,
1384 + "data_win_eventdata_ticketOptions": true,
1385 + "data_win_eventdata_user": true,
1386 + "data_win_eventdata_utcTime": true,
1387 + "data_win_eventdata_virtualAccount": true,
1388 + "data_win_system_channel": true,
1389 + "data_win_system_computer": true,
1390 + "data_win_system_eventID": true,
1391 + "data_win_system_eventRecordID": true,
1392 + "data_win_system_eventSourceName": true,
1393 + "data_win_system_keywords": true,
1394 + "data_win_system_level": true,
1395 + "data_win_system_message": true,
1396 + "data_win_system_opcode": true,
1397 + "data_win_system_processID": true,
1398 + "data_win_system_providerGuid": true,
1399 + "data_win_system_providerName": true,
1400 + "data_win_system_severityValue": true,
1401 + "data_win_system_systemTime": true,
1402 + "data_win_system_task": true,
1403 + "data_win_system_threadID": true,
1404 + "data_win_system_version": true,
1405 + "decoder_name": true,
1406 + "decoder_parent": true,
1407 + "description": true,
1408 + "deviceAddress_city_name": true,
1409 + "deviceAddress_country_code": true,
1410 + "deviceAddress_geolocation": true,
1411 + "deviceHostFqdn": true,
1412 + "deviceHostName": true,
1413 + "dns_query": true,
1414 + "dns_query_threat_indicated": true,
1415 + "dst_ip": true,
1416 + "dst_ip_city_name": true,
1417 + "dst_ip_country_code": true,
1418 + "dst_ip_geolocation": true,
1419 + "dst_ip_threat_indicated": true,
1420 + "dst_port": true,
1421 + "ecs_version": true,
1422 + "error": true,
1423 + "eventID": true,
1424 + "event_hash": true,
1425 + "facility": true,
1426 + "facility_num": true,
1427 + "fileHashMd5": true,
1428 + "fileHashSha256": true,
1429 + "fileName": false,
1430 + "file_path": true,
1431 + "firewall_rule_name": true,
1432 + "full_log": false,
1433 + "gl2_accounted_message_size": true,
1434 + "gl2_message_id": true,
1435 + "gl2_remote_ip": true,
1436 + "gl2_remote_port": true,
1437 + "gl2_source_collector": true,
1438 + "gl2_source_input": true,
1439 + "gl2_source_node": true,
1440 + "groupId": true,
1441 + "groupName": true,
1442 + "hash": true,
1443 + "hash_md5": true,
1444 + "hash_sha1": true,
1445 + "hash_sha256": true,
1446 + "highlight": true,
1447 + "host_architecture": true,
1448 + "host_containerized": true,
1449 + "host_hostname": true,
1450 + "host_id": true,
1451 + "host_ip": true,
1452 + "host_mac": true,
1453 + "host_name": true,
1454 + "host_os_codename": true,
1455 + "host_os_kernel": true,
1456 + "host_os_name": true,
1457 + "host_os_platform": true,
1458 + "host_os_version": true,
1459 + "hostname": true,
1460 + "id": true,
1461 + "input_type": true,
1462 + "ip": true,
1463 + "ip_city_name": true,
1464 + "ip_country_code": true,
1465 + "ip_geolocation": true,
1466 + "level": true,
1467 + "location": true,
1468 + "log_file_path": true,
1469 + "log_offset": true,
1470 + "manager_name": true,
1471 + "message": true,
1472 + "module": true,
1473 + "notificationScope": true,
1474 + "originatorName": true,
1475 + "originatorVersion": true,
1476 + "originatorVersion_city_name": true,
1477 + "originatorVersion_country_code": true,
1478 + "originatorVersion_geolocation": true,
1479 + "osFamily": true,
1480 + "parent_process_cmd_line": true,
1481 + "parent_process_id": true,
1482 + "parent_process_image": true,
1483 + "pid": true,
1484 + "predecoder_hostname": true,
1485 + "predecoder_program_name": true,
1486 + "predecoder_timestamp": true,
1487 + "previous_log": true,
1488 + "previous_output": true,
1489 + "process_cmd_line": true,
1490 + "process_id": true,
1491 + "process_image": true,
1492 + "process_name": true,
1493 + "protocol": true,
1494 + "rt": true,
1495 + "rule_cis": true,
1496 + "rule_cis_csc": true,
1497 + "rule_firedtimes": true,
1498 + "rule_gdpr": true,
1499 + "rule_gdpr_IV": true,
1500 + "rule_gpg13": true,
1501 + "rule_gpg_13": true,
1502 + "rule_hipaa": true,
1503 + "rule_id": false,
1504 + "rule_info": true,
1505 + "rule_mail": true,
1506 + "rule_mitre_id": true,
1507 + "rule_mitre_tactic": false,
1508 + "rule_nist_800_53": true,
1509 + "rule_pci_dss": true,
1510 + "rule_tsc": true,
1511 + "scanType": true,
1512 + "scanid": true,
1513 + "secondaryDescription": true,
1514 + "secured": true,
1515 + "service": true,
1516 + "siteId": true,
1517 + "siteName": true,
1518 + "software_package": true,
1519 + "software_vendor": true,
1520 + "sort": true,
1521 + "source": true,
1522 + "sourceAgentId": true,
1523 + "sourceAgentUuid": true,
1524 + "sourceDnsDomain": true,
1525 + "sourceFqdn": true,
1526 + "sourceGroupId": true,
1527 + "sourceGroupName": true,
1528 + "sourceHostName": true,
1529 + "sourceIpAddresses_0": true,
1530 + "sourceIpAddresses_1": true,
1531 + "sourceIpAddresses_1_city_name": true,
1532 + "sourceIpAddresses_1_country_code": true,
1533 + "sourceIpAddresses_1_geolocation": true,
1534 + "sourceIpAddresses_2": true,
1535 + "sourceIpAddresses_2_city_name": true,
1536 + "sourceIpAddresses_2_country_code": true,
1537 + "sourceIpAddresses_2_geolocation": true,
1538 + "sourceIpAddresses_3": true,
1539 + "sourceIpAddresses_3_city_name": true,
1540 + "sourceIpAddresses_3_country_code": true,
1541 + "sourceIpAddresses_3_geolocation": true,
1542 + "sourceIpAddresses_4": true,
1543 + "sourceIpAddresses_4_city_name": true,
1544 + "sourceIpAddresses_4_country_code": true,
1545 + "sourceIpAddresses_4_geolocation": true,
1546 + "sourceIpAddresses_5": true,
1547 + "sourceMacAddresses_0": true,
1548 + "sourceMacAddresses_1": true,
1549 + "sourceMgmtPrecievedAddress": true,
1550 + "sourceMgmtPrecievedAddress_city_name": true,
1551 + "sourceMgmtPrecievedAddress_country_code": true,
1552 + "sourceMgmtPrecievedAddress_geolocation": true,
1553 + "sourceNetworkState": true,
1554 + "sourceOsRevision": true,
1555 + "sourceOsType": true,
1556 + "sourceThreatCount": true,
1557 + "sourceUserId": true,
1558 + "sourceUserName": true,
1559 + "source_city_name": true,
1560 + "source_country_code": true,
1561 + "source_geolocation": true,
1562 + "src_ip": true,
1563 + "src_ip_city_name": true,
1564 + "src_ip_country_code": true,
1565 + "src_ip_geolocation": true,
1566 + "src_port": true,
1567 + "streams": true,
1568 + "syscheck_attrs_after": true,
1569 + "syscheck_audit_effective_user_id": true,
1570 + "syscheck_audit_effective_user_name": true,
1571 + "syscheck_audit_group_id": true,
1572 + "syscheck_audit_group_name": true,
1573 + "syscheck_audit_login_user_id": true,
1574 + "syscheck_audit_login_user_name": true,
1575 + "syscheck_audit_process_cwd": true,
1576 + "syscheck_audit_process_id": true,
1577 + "syscheck_audit_process_name": true,
1578 + "syscheck_audit_process_parent_cwd": true,
1579 + "syscheck_audit_process_parent_name": true,
1580 + "syscheck_audit_process_ppid": true,
1581 + "syscheck_audit_user_id": true,
1582 + "syscheck_audit_user_name": true,
1583 + "syscheck_changed_attributes": true,
1584 + "syscheck_event": true,
1585 + "syscheck_gid_after": true,
1586 + "syscheck_gname_after": true,
1587 + "syscheck_hard_links": true,
1588 + "syscheck_inode_after": true,
1589 + "syscheck_inode_before": true,
1590 + "syscheck_md5_after": true,
1591 + "syscheck_md5_before": true,
1592 + "syscheck_mode": true,
1593 + "syscheck_mtime_after": true,
1594 + "syscheck_mtime_before": true,
1595 + "syscheck_path": true,
1596 + "syscheck_perm_after": true,
1597 + "syscheck_perm_before": true,
1598 + "syscheck_sha1_after": true,
1599 + "syscheck_sha1_before": true,
1600 + "syscheck_sha256_after": true,
1601 + "syscheck_sha256_before": true,
1602 + "syscheck_size_after": true,
1603 + "syscheck_size_before": true,
1604 + "syscheck_uid_after": true,
1605 + "syscheck_uname_after": true,
1606 + "syscheck_win_perm_after": true,
1607 + "syscheck_win_perm_after_0_allowed": true,
1608 + "syscheck_win_perm_after_0_name": true,
1609 + "syscheck_win_perm_after_1_allowed": true,
1610 + "syscheck_win_perm_after_1_name": true,
1611 + "syscheck_win_perm_after_2_allowed": true,
1612 + "syscheck_win_perm_after_2_name": true,
1613 + "syscheck_win_perm_after_3_allowed": true,
1614 + "syscheck_win_perm_after_3_name": true,
1615 + "syslog_customer": true,
1616 + "syslog_tag": true,
1617 + "syslog_type": true,
1618 + "sysmon_event_description": true,
1619 + "threatClassification": false,
1620 + "threatClassificationSource": true,
1621 + "threatClassifier": true,
1622 + "threatCommandLineArguments": true,
1623 + "threatConfidenceLevel": false,
1624 + "threatDetectingEngine": true,
1625 + "threatDetectionTime": true,
1626 + "threatID": true,
1627 + "threatId": true,
1628 + "threatIndicatorsList_0": true,
1629 + "threatIndicatorsList_1": true,
1630 + "threatIndicatorsList_10": true,
1631 + "threatIndicatorsList_11": true,
1632 + "threatIndicatorsList_12": true,
1633 + "threatIndicatorsList_13": true,
1634 + "threatIndicatorsList_14": true,
1635 + "threatIndicatorsList_15": true,
1636 + "threatIndicatorsList_16": true,
1637 + "threatIndicatorsList_17": true,
1638 + "threatIndicatorsList_18": true,
1639 + "threatIndicatorsList_19": true,
1640 + "threatIndicatorsList_2": true,
1641 + "threatIndicatorsList_20": true,
1642 + "threatIndicatorsList_21": true,
1643 + "threatIndicatorsList_22": true,
1644 + "threatIndicatorsList_23": true,
1645 + "threatIndicatorsList_24": true,
1646 + "threatIndicatorsList_25": true,
1647 + "threatIndicatorsList_26": true,
1648 + "threatIndicatorsList_27": true,
1649 + "threatIndicatorsList_28": true,
1650 + "threatIndicatorsList_29": true,
1651 + "threatIndicatorsList_3": true,
1652 + "threatIndicatorsList_30": true,
1653 + "threatIndicatorsList_31": true,
1654 + "threatIndicatorsList_32": true,
1655 + "threatIndicatorsList_33": true,
1656 + "threatIndicatorsList_34": true,
1657 + "threatIndicatorsList_35": true,
1658 + "threatIndicatorsList_36": true,
1659 + "threatIndicatorsList_37": true,
1660 + "threatIndicatorsList_38": true,
1661 + "threatIndicatorsList_39": true,
1662 + "threatIndicatorsList_4": true,
1663 + "threatIndicatorsList_40": true,
1664 + "threatIndicatorsList_41": true,
1665 + "threatIndicatorsList_42": true,
1666 + "threatIndicatorsList_43": true,
1667 + "threatIndicatorsList_44": true,
1668 + "threatIndicatorsList_45": true,
1669 + "threatIndicatorsList_46": true,
1670 + "threatIndicatorsList_47": true,
1671 + "threatIndicatorsList_48": true,
1672 + "threatIndicatorsList_49": true,
1673 + "threatIndicatorsList_5": true,
1674 + "threatIndicatorsList_50": true,
1675 + "threatIndicatorsList_51": true,
1676 + "threatIndicatorsList_52": true,
1677 + "threatIndicatorsList_53": true,
1678 + "threatIndicatorsList_54": true,
1679 + "threatIndicatorsList_55": true,
1680 + "threatIndicatorsList_56": true,
1681 + "threatIndicatorsList_6": true,
1682 + "threatIndicatorsList_7": true,
1683 + "threatIndicatorsList_8": true,
1684 + "threatIndicatorsList_9": true,
1685 + "threatMitigationStatus": true,
1686 + "threatMitigationStatusID": true,
1687 + "threatProcessUser": true,
1688 + "threatStoryline": true,
1689 + "threat_ids": true,
1690 + "threat_indicated": true,
1691 + "threat_names": true,
1692 + "time": true,
1693 + "timestamp": false,
1694 + "totalNewDevices": true,
1695 + "unknown": true,
1696 + "unsecured": true,
1697 + "unsupported": true,
1698 + "updatedAt": true,
1699 + "userId": true,
1700 + "user_name": true,
1701 + "vendor": true,
1702 + "win_registry_key": true,
1703 + "win_system_eventID": true,
1704 + "windows_auth_package": true,
1705 + "windows_domain": true,
1706 + "windows_event_id": true,
1707 + "windows_event_severity": true,
1708 + "windows_logon_type": true
1709 + },
1710 + "indexByName": {
1711 + "_id": 1,
1712 + "_index": 5,
1713 + "_type": 6,
1714 + "accountId": 7,
1715 + "accountName": 8,
1716 + "activityId": 9,
1717 + "activityType": 10,
1718 + "activityUuid": 11,
1719 + "agentId": 12,
1720 + "agentUpdatedVersion": 13,
1721 + "application_name": 14,
1722 + "cat": 15,
1723 + "comments": 16,
1724 + "createdAt": 17,
1725 + "data_accountName": 18,
1726 + "data_computerName": 2,
1727 + "data_confidenceLevel": 19,
1728 + "data_downloadUrl": 20,
1729 + "data_fileContentHash": 21,
1730 + "data_fileDisplayName": 22,
1731 + "data_filePath": 23,
1732 + "data_fullScopeDetails": 24,
1733 + "data_fullScopeDetailsPath": 25,
1734 + "data_globalStatus": 26,
1735 + "data_groupName": 27,
1736 + "data_scopeLevel": 28,
1737 + "data_scopeName": 29,
1738 + "data_siteName": 30,
1739 + "data_threatClassification": 31,
1740 + "data_username": 32,
1741 + "description": 33,
1742 + "deviceAddress": 3,
1743 + "deviceAddress_city_name": 34,
1744 + "deviceAddress_country_code": 35,
1745 + "deviceAddress_geolocation": 36,
1746 + "deviceHostFqdn": 37,
1747 + "deviceHostName": 38,
1748 + "eventDesc": 39,
1749 + "eventID": 40,
1750 + "eventSeverity": 4,
1751 + "facility": 41,
1752 + "facility_num": 42,
1753 + "fileHashMd5": 43,
1754 + "fileHashSha256": 44,
1755 + "fileName": 45,
1756 + "gl2_accounted_message_size": 46,
1757 + "gl2_message_id": 47,
1758 + "gl2_remote_ip": 48,
1759 + "gl2_remote_port": 49,
1760 + "gl2_source_input": 50,
1761 + "gl2_source_node": 51,
1762 + "groupId": 52,
1763 + "groupName": 53,
1764 + "hash": 54,
1765 + "highlight": 55,
1766 + "level": 56,
1767 + "message": 57,
1768 + "notificationScope": 58,
1769 + "originatorName": 59,
1770 + "originatorVersion": 60,
1771 + "osFamily": 61,
1772 + "process_id": 62,
1773 + "rt": 63,
1774 + "secondaryDescription": 64,
1775 + "siteId": 65,
1776 + "siteName": 66,
1777 + "sort": 67,
1778 + "source": 68,
1779 + "sourceAgentId": 69,
1780 + "sourceAgentUuid": 70,
1781 + "sourceDnsDomain": 71,
1782 + "sourceFqdn": 72,
1783 + "sourceGroupId": 73,
1784 + "sourceGroupName": 74,
1785 + "sourceHostName": 75,
1786 + "sourceIpAddresses_0": 76,
1787 + "sourceIpAddresses_1": 77,
1788 + "sourceMacAddresses_0": 78,
1789 + "sourceMacAddresses_1": 79,
1790 + "sourceMgmtPrecievedAddress": 80,
1791 + "sourceMgmtPrecievedAddress_city_name": 81,
1792 + "sourceMgmtPrecievedAddress_country_code": 82,
1793 + "sourceMgmtPrecievedAddress_geolocation": 83,
1794 + "sourceNetworkState": 84,
1795 + "sourceOsRevision": 85,
1796 + "sourceOsType": 86,
1797 + "sourceThreatCount": 87,
1798 + "source_city_name": 88,
1799 + "source_country_code": 89,
1800 + "source_geolocation": 90,
1801 + "streams": 91,
1802 + "syslog_customer": 92,
1803 + "syslog_type": 93,
1804 + "threatClassification": 94,
1805 + "threatClassificationSource": 95,
1806 + "threatClassifier": 96,
1807 + "threatCommandLineArguments": 97,
1808 + "threatConfidenceLevel": 98,
1809 + "threatDetectingEngine": 99,
1810 + "threatDetectionTime": 100,
1811 + "threatID": 101,
1812 + "threatId": 102,
1813 + "threatMitigationStatus": 103,
1814 + "threatMitigationStatusID": 104,
1815 + "threatProcessUser": 105,
1816 + "threatStoryline": 106,
1817 + "timestamp": 0,
1818 + "updatedAt": 107,
1819 + "userId": 108,
1820 + "vendor": 109
1821 + },
1822 + "renameByName": {
1823 + "_id": "EVENT ID",
1824 + "cat": "EVENT CATEGORY",
1825 + "data_computerName": "AGENT",
1826 + "data_username": "USER",
1827 + "deviceAddress": "IP ADD",
1828 + "eventDesc": "DESCRIPTION",
1829 + "eventSeverity": "SEVERITY",
1830 + "rule_id": "RULE ID",
1831 + "rule_mitre_tactic": "MITRE TACTIC",
1832 + "rule_mitre_technique": "MITRE TECHNIQUE",
1833 + "timestamp": "DATE/TIME"
1834 + }
1835 + }
1836 + }
1837 + ],
1838 + "transparent": true,
1839 + "type": "table"
1840 + }
1841 + ],
1842 + "refresh": "",
1843 + "schemaVersion": 39,
1844 + "tags": [
1845 + "EDR"
1846 + ],
1847 + "templating": {
1848 + "list": [
1849 + {
1850 + "datasource": {
1851 + "type": "grafana-opensearch-datasource",
1852 + "uid": "replace_datasource_uid"
1853 + },
1854 + "filters": [],
1855 + "hide": 0,
1856 + "label": "",
1857 + "name": "Filters",
1858 + "skipUrlSync": false,
1859 + "type": "adhoc"
1860 + },
1861 + {
1862 + "current": {
1863 + "selected": false,
1864 + "text": "All",
1865 + "value": "$__all"
1866 + },
1867 + "datasource": {
1868 + "type": "grafana-opensearch-datasource",
1869 + "uid": "replace_datasource_uid"
1870 + },
1871 + "definition": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:WHITELISTBLACKLIST\"}",
1872 + "hide": 0,
1873 + "includeAll": true,
1874 + "label": "Event Severity",
1875 + "multi": false,
1876 + "name": "eventSeverity",
1877 + "options": [],
1878 + "query": "{ \"find\": \"terms\", \"field\": \"eventSeverity\", \"query\": \"cat:WHITELISTBLACKLIST\"}",
1879 + "refresh": 2,
1880 + "regex": "",
1881 + "skipUrlSync": false,
1882 + "sort": 0,
1883 + "type": "query"
1884 + }
1885 + ]
1886 + },
1887 + "time": {
1888 + "from": "now-7d",
1889 + "to": "now"
1890 + },
1891 + "timepicker": {
1892 + "refresh_intervals": [
1893 + "5s",
1894 + "10s",
1895 + "30s",
1896 + "1m",
1897 + "5m",
1898 + "15m",
1899 + "30m",
1900 + "1h",
1901 + "2h",
1902 + "1d"
1903 + ],
1904 + "time_options": [
1905 + "5m",
1906 + "15m",
1907 + "1h",
1908 + "6h",
1909 + "12h",
1910 + "24h",
1911 + "2d",
1912 + "7d",
1913 + "30d"
1914 + ]
1915 + },
1916 + "timezone": "",
1917 + "title": "EDR - SENTINELONE EPP - WHITELISTBLACKLIST",
1918 + "weekStart": ""
1919 +}
backend/app/connectors/grafana/schema/dashboards.py
+11
@@ -126,6 +126,16 @@ class SonicwallDashboard(Enum):
126 SONICWALL_IPS = ("Sonicwall", "sonicwall_ips.json")
127
128
129 +class SentinelOneDashboard(Enum):
130 + SENTINELONE_EPP_ADMINISTRATIVE = ("Sentinelone", "sentinelone_epp_administrative.json")
131 + SENTINELONE_EPP_MITIGATION = ("Sentinelone", "sentinelone_epp_mitigation.json")
132 + SENTINELONE_EPP_RANGER = ("Sentinelone", "sentinelone_epp_ranger.json")
133 + SENTINELONE_EPP_WHITELISTBLACKLIST = ("Sentinelone", "sentinelone_epp_whitelistblacklist.json")
134 + SENTINELONE_EPP_MALWARE = ("Sentinelone", "sentinelone_epp_malware.json")
135 + SENTINELONE_EPP_OPERATIONS = ("Sentinelone", "sentinelone_epp_operations.json")
136 + SENTINELONE_EPP_SUMMARY = ("Sentinelone", "sentinelone_epp_summary.json")
137 +
138 +
139 class DashboardProvisionRequest(BaseModel):
140 dashboards: List[str] = Field(
141 ...,
@@ -163,6 +173,7 @@ class DashboardProvisionRequest(BaseModel):
173 + list(CatoDashboard)
174 + list(DefenderForEndpointDashboard)
175 + list(SonicwallDashboard)
176 + + list(SentinelOneDashboard)
177 }
178 if e not in valid_dashboards:
179 raise ValueError(f'Dashboard identifier "{e}" is not recognized.')
backend/app/connectors/grafana/services/dashboards.py
+2
@@ -19,6 +19,7 @@ from app.connectors.grafana.schema.dashboards import HuntressDashboard
19 from app.connectors.grafana.schema.dashboards import MimecastDashboard
20 from app.connectors.grafana.schema.dashboards import Office365Dashboard
21 from app.connectors.grafana.schema.dashboards import SapSiemDashboard
22 +from app.connectors.grafana.schema.dashboards import SentinelOneDashboard
23 from app.connectors.grafana.schema.dashboards import SonicwallDashboard
24 from app.connectors.grafana.schema.dashboards import WazuhDashboard
25 from app.connectors.grafana.utils.universal import create_grafana_client
@@ -193,6 +194,7 @@ async def provision_dashboards(
194 + list(CatoDashboard)
195 + list(DefenderForEndpointDashboard)
196 + list(SonicwallDashboard)
197 + + list(SentinelOneDashboard)
198 }
199
200 for dashboard_name in dashboard_request.dashboards:
backend/app/db/db_populate.py
+4
@@ -613,6 +613,7 @@ def get_available_network_connectors_list():
613 available_network_connectors = [
614 ("Fortinet", "Integrate Fortinet with SOCFortress."),
615 ("Sonicwall", "Integrate Sonicwall with SOCFortress."),
616 + ("Sentinelone", "Integrate Sentinelone with SOCFortress."),
617 # ... Add more available network_connectors as needed ...
618 ]
619
@@ -706,6 +707,9 @@ async def get_available_network_connectors_auth_keys_list(session: AsyncSession)
707 ("Sonicwall", "SYSLOG_PORT"),
708 ("Sonicwall", "TLS_CERT_FILE"),
709 ("Sonicwall", "TLS_KEY_FILE"),
710 + ("Sentinelone", "SYSLOG_PORT"),
711 + ("Sentinelone", "TLS_CERT_FILE"),
712 + ("Sentinelone", "TLS_KEY_FILE"),
713 # ... Add more available network_connectors auth keys as needed ...
714 ]
715 logger.info("Getting available network_connectors auth keys.")
backend/app/network_connectors/markdown/sentinelone.md new
+197
@@ -0,0 +1,197 @@
1 +# SentinelOne Syslog Forwarding
2 +
3 +This process involves configuring SentinelOne to send alerts and events to an external syslog server via TLS-encrypted connection.
4 +
5 +## Overview
6 +
7 +SentinelOne provides cloud-based endpoint protection and uses a syslog forwarder to send security events to your SIEM stack. The integration requires:
8 +
9 +- **TLS Encryption:** Secure, encrypted log forwarding from SentinelOne cloud endpoints
10 +- **Mutual Authentication:** Client certificate for TLS mutual authentication
11 +- **Cloud-to-Cloud:** Direct forwarding from SentinelOne cloud infrastructure to your SIEM stack
12 +
13 +For detailed instructions, refer to the [SentinelOne Syslog Forwarder Configuration Guide](https://socfortress.supportbench.net/article/sentinelone-syslog-forwarder-to-siem-stack).
14 +
15 +## Architecture
16 +
17 +```
18 +SentinelOne Cloud > TLS (Mutual Auth) > SIEM Stack
19 +```
20 +
21 +---
22 +
23 +## Step 1: Accessing SentinelOne Management Console
24 +
25 +Log in to your SentinelOne management console:
26 +
27 +- Open a web browser
28 +- Navigate to your SentinelOne console URL (e.g., `https://console.sentinelone.net`)
29 +- Enter your administrative credentials to log in
30 +
31 +## Step 2: Navigate to Integrations
32 +
33 +Once logged in, follow these steps to configure syslog forwarding:
34 +
35 +- **Navigate to Integrations**
36 + - Go to **Settings** > **Integrations** in the left-hand navigation menu
37 + - Look for the **Syslog** integration option
38 +
39 +## Step 3: Configure Syslog Forwarder
40 +
41 +Configure the syslog forwarder with the following parameters:
42 +
43 +- **Syslog Host Configuration**
44 + - **Host:** Enter the FQDN or IP address of your SIEM stack (e.g., `firehose.mycompany.com`)
45 + - **Port:** Enter the TCP port provided by SOCFortress staff (typically 6514 for TLS)
46 +
47 +- **Enable TLS Secure Connection**
48 + - Check the box to **Use TLS secure connection**
49 +
50 +- **Upload TLS Certificates**
51 +
52 + You will need to upload three certificate files (provided by SOCFortress via your Onehub account):
53 +
54 + 1. **Root CA Certificate** (`rootCA.mycompany.local.crt`)
55 + - The root Certificate Authority public key
56 +
57 + 2. **Client Certificate** (`syslog_client.mycompany.local.pem`)
58 + - The TLS client certificate public key
59 +
60 + 3. **Private Key** (`syslog_client.mycompany.local.key`)
61 + - The TLS client certificate private key
62 +
63 +- **Log Format**
64 + - Select **RFC-5424** as the syslog format
65 +
66 +## Step 4: Configure Firewall Rules
67 +
68 +Before testing connectivity, ensure proper firewall rules are in place:
69 +
70 +### Inbound Firewall Rules
71 +
72 +SentinelOne forwards alerts and events from their cloud endpoints. Configure the following firewall rules:
73 +
74 +#### Rule 1: SentinelOne Cloud to Edge Firewall
75 +
76 +| **SRC IP** | **DST IP** | **PORT** | **FIREWALL ACTION** | **DESCRIPTION** |
77 +|------------|------------|----------|---------------------|-----------------|
78 +| SentinelOne Cloud Endpoints | Your edge firewall's public IP | Provided by SOCFortress | Port Forward to Reverse Proxy (DMZ) | Allow Syslog Forwarder from SentinelOne |
79 +
80 +> **Note:** Contact SentinelOne support to determine the specific source IP addresses/cloud endpoints for your region.
81 +
82 +#### Rule 2: SIEM Stack DMZ to SIEM Stack Internal
83 +
84 +| **SRC IP** | **DST IP** | **PORT** | **FIREWALL ACTION** | **DESCRIPTION** |
85 +|------------|------------|----------|---------------------|-----------------|
86 +| HAProxy DMZ | Graylog Server (01/02) | Provided by SOCFortress | Allow | Allow Syslog traffic DMZ → Internal |
87 +
88 +## Step 5: Configure Event and Alert Forwarding
89 +
90 +Define which events and alerts should be forwarded to your SIEM:
91 +
92 +- **Navigate to Notifications**
93 + - Go to the **Notifications** tab in the Syslog integration settings
94 +
95 +- **Select Event Types**
96 +
97 + Choose the alerts and events to forward. Common selections include:
98 + - Threat Detections
99 + - Threat Mitigations
100 + - Agent Activity
101 + - Policy Changes
102 + - User Actions
103 + - System Events
104 + - And any other relevant security events
105 +
106 +- **Apply Configuration**
107 + - Click **Save** or **Apply** to activate the forwarding configuration
108 +
109 +## Step 6: Test the Connection
110 +
111 +After configuring all settings and firewall rules:
112 +
113 +- Click **Test Connection** in the SentinelOne syslog integration interface
114 +- Verify successful TLS handshake and authentication
115 +- Confirm test events are received in your SIEM stack
116 +
117 +## Step 7: Verify Log Reception
118 +
119 +Monitor your SIEM stack to ensure logs are being received:
120 +
121 +- Check that SentinelOne events appear in your log management system
122 +- Verify proper parsing and categorization of events
123 +- Confirm all selected event types are being forwarded
124 +- Monitor for any connection errors or certificate issues
125 +
126 +---
127 +
128 +## Additional Considerations
129 +
130 +- **Certificate Management**
131 + - Keep TLS certificates up to date and properly secured
132 + - Certificates must be in PEM format
133 + - Ensure certificate expiration dates are monitored
134 + - Plan for certificate renewal before expiration
135 +
136 +- **Source IP Addresses**
137 + - SentinelOne uses cloud endpoints that vary by region
138 + - Contact SentinelOne support for specific IP ranges for your deployment
139 + - Update firewall rules if SentinelOne changes their endpoint IPs
140 +
141 +- **High Availability**
142 + - Consider configuring backup syslog destinations if supported
143 + - Ensure redundant firewall paths for critical log forwarding
144 + - Monitor connection health and implement alerting for failures
145 +
146 +- **Log Volume**
147 + - Monitor the volume of logs being generated
148 + - Ensure your SIEM infrastructure can handle the load
149 + - Adjust event filtering if necessary to manage data volume
150 +
151 +- **Security**
152 + - TLS mutual authentication provides strong security
153 + - Protect private keys and restrict access
154 + - Regularly audit firewall rules for unauthorized changes
155 +
156 +- **Time Synchronization**
157 + - Ensure all systems (SentinelOne, SIEM stack) use synchronized time via NTP
158 + - Accurate timestamps are critical for security event correlation
159 +
160 +- **Testing**
161 + - Perform initial testing during a maintenance window
162 + - Verify all expected event types are being received
163 + - Test connection recovery after network interruptions
164 + - Validate TLS certificate authentication is working correctly
165 +
166 +- **Documentation**
167 + - Keep records of:
168 + - Certificate locations and expiration dates
169 + - Firewall rule configurations
170 + - Port assignments
171 + - Selected event types for forwarding
172 +
173 +---
174 +
175 +## Troubleshooting
176 +
177 +Common issues and solutions:
178 +
179 +- **Connection Failures**
180 + - Verify firewall rules allow traffic from SentinelOne cloud endpoints
181 + - Check that the destination port is correct and open
182 + - Ensure certificates are correctly uploaded and not expired
183 +
184 +- **Certificate Errors**
185 + - Verify certificate format is PEM
186 + - Ensure the certificate chain is complete (root CA + client cert)
187 + - Check that private key matches the client certificate
188 +
189 +- **Missing Events**
190 + - Confirm event types are selected in the Notifications tab
191 + - Verify SentinelOne agents are properly configured and reporting
192 + - Check SIEM stack for parsing or ingestion errors
193 +
194 +- **Performance Issues**
195 + - Monitor log volume and adjust retention policies
196 + - Consider implementing log filtering for high-volume event types
197 + - Ensure adequate resources on SIEM infrastructure
backend/app/stack_provisioning/graylog/routes/sentinelone.py new
+125
@@ -0,0 +1,125 @@
1 +from typing import Dict
2 +
3 +from fastapi import APIRouter
4 +from fastapi import Depends
5 +from fastapi import HTTPException
6 +from fastapi import Security
7 +from sqlalchemy.ext.asyncio import AsyncSession
8 +
9 +from app.auth.utils import AuthHandler
10 +from app.db.db_session import get_db
11 +from app.network_connectors.routes import find_customer_network_connector
12 +from app.network_connectors.routes import (
13 + get_customer_network_connectors_by_customer_code,
14 +)
15 +from app.network_connectors.schema import CustomerNetworkConnectors
16 +from app.network_connectors.schema import CustomerNetworkConnectorsResponse
17 +from app.stack_provisioning.graylog.schema.sentinelone import ProvisionSentinelOneKeys
18 +from app.stack_provisioning.graylog.schema.sentinelone import (
19 + ProvisionSentinelOneRequest,
20 +)
21 +from app.stack_provisioning.graylog.schema.sentinelone import (
22 + ProvisionSentinelOneResponse,
23 +)
24 +from app.stack_provisioning.graylog.schema.sentinelone import SentinelOneCustomerDetails
25 +from app.stack_provisioning.graylog.services.sentinelone import provision_sentinelone
26 +
27 +stack_provisioning_graylog_sentinelone_router = APIRouter()
28 +
29 +
30 +async def get_customer_integration_response(
31 + customer_code: str,
32 + session: AsyncSession,
33 +) -> CustomerNetworkConnectorsResponse:
34 + """
35 + Retrieves the integration response for a customer.
36 +
37 + Args:
38 + customer_code (str): The code of the customer.
39 + session (AsyncSession): The async session object for database operations.
40 +
41 + Returns:
42 + CustomerNetworkConnectorsResponse: The integration response for the customer.
43 +
44 + Raises:
45 + HTTPException: If the customer integration settings are not found.
46 + """
47 + customer_integration_response = await get_customer_network_connectors_by_customer_code(
48 + customer_code,
49 + session,
50 + )
51 + if customer_integration_response.available_network_connectors == []:
52 + raise HTTPException(
53 + status_code=404,
54 + detail="Customer integration settings not found.",
55 + )
56 + return customer_integration_response
57 +
58 +
59 +def extract_sentinelone_keys(
60 + customer_integration: CustomerNetworkConnectors,
61 +) -> Dict[str, str]:
62 + """
63 + Extracts the authentication keys for SentinelOne integration from the given customer integration.
64 +
65 + Args:
66 + customer_integration (CustomerNetworkConnectors): The customer integration object.
67 +
68 + Returns:
69 + Dict[str, str]: A dictionary containing the authentication keys for SentinelOne integration.
70 +
71 + Raises:
72 + HTTPException: If no authentication keys are found for SentinelOne integration.
73 + """
74 + sentinelone_keys = {}
75 + for subscription in customer_integration.network_connectors_subscriptions:
76 + if subscription.network_connectors_service.service_name == "Sentinelone":
77 + for auth_key in subscription.network_connectors_keys:
78 + sentinelone_keys[auth_key.auth_key_name] = auth_key.auth_value
79 + if not sentinelone_keys:
80 + raise HTTPException(
81 + status_code=404,
82 + detail="No auth keys found for SentinelOne integration. Please create auth keys for SentinelOne network connector.",
83 + )
84 + return sentinelone_keys
85 +
86 +
87 +@stack_provisioning_graylog_sentinelone_router.post(
88 + "/graylog/provision/sentinelone",
89 + response_model=ProvisionSentinelOneResponse,
90 + description="Provision SentinelOne for the customer.",
91 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
92 +)
93 +async def provision_sentinelone_route(
94 + provision_sentinelone_request: ProvisionSentinelOneRequest,
95 + session: AsyncSession = Depends(get_db),
96 +) -> ProvisionSentinelOneResponse:
97 + """
98 + Provision SentinelOne for the customer
99 + """
100 + customer_integration_response = await get_customer_integration_response(
101 + provision_sentinelone_request.customer_code,
102 + session,
103 + )
104 +
105 + customer_integration = await find_customer_network_connector(
106 + provision_sentinelone_request.customer_code,
107 + provision_sentinelone_request.integration_name,
108 + customer_integration_response,
109 + )
110 +
111 + sentinelone_keys = extract_sentinelone_keys(customer_integration)
112 +
113 + return await provision_sentinelone(
114 + customer_details=SentinelOneCustomerDetails(
115 + customer_code=provision_sentinelone_request.customer_code,
116 + customer_name=customer_integration.customer_name,
117 + tls_cert_file=sentinelone_keys["TLS_CERT_FILE"],
118 + tls_key_file=sentinelone_keys["TLS_KEY_FILE"],
119 + syslog_port=int(sentinelone_keys["SYSLOG_PORT"]),
120 + hot_data_retention=provision_sentinelone_request.hot_data_retention,
121 + index_replicas=provision_sentinelone_request.index_replicas,
122 + ),
123 + keys=ProvisionSentinelOneKeys(**sentinelone_keys),
124 + session=session,
125 + )
backend/app/stack_provisioning/graylog/schema/sentinelone.py new
+102
@@ -0,0 +1,102 @@
1 +from typing import Any
2 +from typing import Dict
3 +from typing import Optional
4 +
5 +from pydantic import BaseModel
6 +from pydantic import Field
7 +from pydantic import root_validator
8 +
9 +
10 +class ProvisionSentinelOneRequest(BaseModel):
11 + customer_code: str = Field(
12 + ...,
13 + description="The customer code.",
14 + examples=["00002"],
15 + )
16 + integration_name: str = Field(
17 + "Sentinelone",
18 + description="The integration name.",
19 + examples=["Sentinelone"],
20 + )
21 + tls_enabled: Optional[bool] = Field(
22 + True,
23 + description="TLS enabled for secure log forwarding.",
24 + examples=[True],
25 + )
26 + hot_data_retention: int = Field(
27 + ...,
28 + example=30,
29 + description="Number of days to retain hot data",
30 + )
31 + index_replicas: int = Field(
32 + ...,
33 + example=1,
34 + description="Number of replicas for the customer's Graylog instance",
35 + )
36 +
37 + # ensure the `integration_name` is always set to "Sentinelone"
38 + @root_validator(pre=True)
39 + def set_integration_name(cls, values: Dict[str, Any]) -> Dict[str, Any]:
40 + values["integration_name"] = "Sentinelone"
41 + return values
42 +
43 +
44 +class ProvisionSentinelOneResponse(BaseModel):
45 + success: bool
46 + message: str
47 +
48 +
49 +class ProvisionSentinelOneKeys(BaseModel):
50 + SYSLOG_PORT: str = Field(
51 + ...,
52 + description="The syslog port.",
53 + examples=["6514"],
54 + )
55 + TLS_CERT_FILE: str = Field(
56 + ...,
57 + description="The TLS certificate file path.",
58 + examples=["/etc/graylog/server/certs/SentinelOne_cert.pem"],
59 + )
60 + TLS_KEY_FILE: str = Field(
61 + ...,
62 + description="The TLS key file path.",
63 + examples=["/etc/graylog/server/certs/SentinelOne_key.key"],
64 + )
65 +
66 +
67 +class SentinelOneCustomerDetails(BaseModel):
68 + customer_name: str = Field(
69 + ...,
70 + description="The customer name.",
71 + examples=["Customer 1"],
72 + )
73 + customer_code: str = Field(
74 + ...,
75 + description="The customer code.",
76 + examples=["00002"],
77 + )
78 + syslog_port: int = Field(
79 + ...,
80 + description="The syslog port.",
81 + examples=[6514],
82 + )
83 + tls_cert_file: str = Field(
84 + ...,
85 + description="The TLS certificate file path.",
86 + examples=["/etc/graylog/server/certs/SentinelOne_cert.pem"],
87 + )
88 + tls_key_file: str = Field(
89 + ...,
90 + description="The TLS key file path.",
91 + examples=["/etc/graylog/server/certs/SentinelOne_key.key"],
92 + )
93 + hot_data_retention: int = Field(
94 + ...,
95 + example=30,
96 + description="Number of days to retain hot data",
97 + )
98 + index_replicas: int = Field(
99 + ...,
100 + example=1,
101 + description="Number of replicas for the customer's Graylog instance",
102 + )
backend/app/stack_provisioning/graylog/services/sentinelone.py new
+416
@@ -0,0 +1,416 @@
1 +import json
2 +from datetime import datetime
3 +
4 +from fastapi import HTTPException
5 +from loguru import logger
6 +from sqlalchemy.ext.asyncio import AsyncSession
7 +
8 +from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
9 +from app.connectors.grafana.schema.dashboards import SentinelOneDashboard
10 +from app.connectors.grafana.services.dashboards import provision_dashboards
11 +from app.connectors.grafana.utils.universal import create_grafana_client
12 +from app.connectors.graylog.services.collector import (
13 + get_content_pack_id_by_content_pack_name,
14 +)
15 +from app.connectors.graylog.services.collector import get_input_id_by_input_name
16 +from app.connectors.graylog.services.collector import get_stream_id_by_stream_name
17 +from app.connectors.graylog.services.streams import assign_stream_to_index
18 +from app.connectors.graylog.utils.universal import send_post_request
19 +from app.connectors.wazuh_indexer.services.monitoring import (
20 + output_shard_number_to_be_set_based_on_nodes,
21 +)
22 +from app.customer_provisioning.schema.grafana import GrafanaDatasource
23 +from app.customer_provisioning.schema.grafana import GrafanaDataSourceCreationResponse
24 +from app.customer_provisioning.schema.graylog import GraylogIndexSetCreationResponse
25 +from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineRequest
26 +from app.customer_provisioning.schema.graylog import TimeBasedIndexSet
27 +from app.customer_provisioning.services.grafana import create_grafana_folder
28 +from app.customer_provisioning.services.grafana import get_opensearch_version
29 +from app.customer_provisioning.services.graylog import connect_stream_to_pipeline
30 +from app.customer_provisioning.services.graylog import get_pipeline_id
31 +from app.customers.routes.customers import get_customer_meta
32 +from app.network_connectors.models.network_connectors import (
33 + CustomerNetworkConnectorsMeta,
34 +)
35 +from app.stack_provisioning.graylog.schema.provision import ContentPackKeywords
36 +from app.stack_provisioning.graylog.schema.provision import (
37 + ProvisionNetworkContentPackRequest,
38 +)
39 +from app.stack_provisioning.graylog.schema.sentinelone import ProvisionSentinelOneKeys
40 +from app.stack_provisioning.graylog.schema.sentinelone import (
41 + ProvisionSentinelOneResponse,
42 +)
43 +from app.stack_provisioning.graylog.schema.sentinelone import SentinelOneCustomerDetails
44 +from app.stack_provisioning.graylog.services.provision import (
45 + provision_content_pack_network_connector,
46 +)
47 +from app.stack_provisioning.graylog.services.utils import set_deployed_flag
48 +from app.utils import get_connector_attribute
49 +from app.utils import get_customer_meta_attribute
50 +
51 +
52 +#### ! GRAYLOG ! ####
53 +async def build_index_set_config(request: SentinelOneCustomerDetails) -> TimeBasedIndexSet:
54 + """
55 + Build the configuration for a time-based index set.
56 +
57 + Args:
58 + request (SentinelOneCustomerDetails): The request object containing customer information.
59 +
60 + Returns:
61 + TimeBasedIndexSet: The configured time-based index set.
62 + """
63 + return TimeBasedIndexSet(
64 + title=f"{request.customer_name} - SENTINELONE ALERTS AND EVENTS",
65 + description=f"{request.customer_name} - SENTINELONE ALERTS AND EVENTS",
66 + index_prefix=f"sentinelone-{request.customer_code}",
67 + rotation_strategy_class="org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategy",
68 + rotation_strategy={
69 + "type": "org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategyConfig",
70 + "rotation_period": "P1D",
71 + "rotate_empty_index_set": False,
72 + "max_rotation_period": None,
73 + },
74 + retention_strategy_class="org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy",
75 + retention_strategy={
76 + "type": "org.graylog2.indexer.retention.strategies.DeletionRetentionStrategyConfig",
77 + "max_number_of_indices": request.hot_data_retention,
78 + },
79 + creation_date=datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
80 + index_analyzer="standard",
81 + shards=await output_shard_number_to_be_set_based_on_nodes(),
82 + replicas=request.index_replicas,
83 + index_optimization_max_num_segments=1,
84 + index_optimization_disabled=False,
85 + writable=True,
86 + field_type_refresh_interval=5000,
87 + )
88 +
89 +
90 +# Function to send the POST request and handle the response
91 +async def send_index_set_creation_request(
92 + index_set: TimeBasedIndexSet,
93 +) -> GraylogIndexSetCreationResponse:
94 + """
95 + Sends a request to create an index set in Graylog.
96 +
97 + Args:
98 + index_set (TimeBasedIndexSet): The index set to be created.
99 +
100 + Returns:
101 + GraylogIndexSetCreationResponse: The response from Graylog after creating the index set.
102 + """
103 + json_index_set = json.dumps(index_set.dict())
104 + logger.info(f"json_index_set set: {json_index_set}")
105 + response_json = await send_post_request(
106 + endpoint="/api/system/indices/index_sets",
107 + data=index_set.dict(),
108 + )
109 + return GraylogIndexSetCreationResponse(**response_json)
110 +
111 +
112 +# Refactored create_index_set function
113 +async def create_index_set(
114 + request: SentinelOneCustomerDetails,
115 +) -> GraylogIndexSetCreationResponse:
116 + """
117 + Creates an index set for a new customer.
118 +
119 + Args:
120 + request (SentinelOneCustomerDetails): The request object containing the customer information.
121 +
122 + Returns:
123 + GraylogIndexSetCreationResponse: The response object containing the result of the index set creation.
124 + """
125 + logger.info(f"Creating index set for customer {request.customer_name}")
126 + index_set_config = await build_index_set_config(request)
127 + return await send_index_set_creation_request(index_set_config)
128 +
129 +
130 +async def provision_content_pack(customer_details: SentinelOneCustomerDetails):
131 + """
132 + Provisions a content pack for a customer.
133 +
134 + Args:
135 + customer_details (SentinelOneCustomerDetails): The details of the customer.
136 +
137 + Returns:
138 + ContentPack: The provisioned content pack.
139 + """
140 + return await provision_content_pack_network_connector(
141 + content_pack_request=ProvisionNetworkContentPackRequest(
142 + content_pack_name="SENTINELONE",
143 + keywords=ContentPackKeywords(
144 + customer_name=customer_details.customer_name,
145 + customer_code=customer_details.customer_code,
146 + syslog_port=customer_details.syslog_port,
147 + tls_cert_file=customer_details.tls_cert_file,
148 + tls_key_file=customer_details.tls_key_file,
149 + ),
150 + ),
151 + )
152 +
153 +
154 +async def get_stream_and_index_ids(customer_details: SentinelOneCustomerDetails):
155 + """
156 + Retrieves the stream ID and index ID for a given customer.
157 +
158 + Args:
159 + customer_details (SentinelOneCustomerDetails): The details of the customer.
160 +
161 + Returns:
162 + tuple: A tuple containing the stream ID and index ID.
163 + """
164 + stream_id = await get_stream_id_by_stream_name(stream_name=f"{customer_details.customer_name} - SENTINELONE ALERTS AND EVENTS")
165 + index_id = (await create_index_set(request=customer_details)).data.id
166 + content_pack_stream_id = await get_content_pack_id_by_content_pack_name(
167 + content_pack_name=f"{customer_details.customer_name}_SENTINELONE_STREAM",
168 + )
169 +
170 + content_pack_input_id = await get_content_pack_id_by_content_pack_name(
171 + content_pack_name=f"{customer_details.customer_name}_SENTINELONE_INPUT_SYSLOG_TLS",
172 + )
173 +
174 + return stream_id, index_id, content_pack_stream_id, content_pack_input_id
175 +
176 +
177 +#### ! GRAFANA ! ####
178 +async def create_grafana_datasource(
179 + customer_code: str,
180 + session: AsyncSession,
181 +) -> GrafanaDataSourceCreationResponse:
182 + """
183 + Creates a Grafana datasource for the specified customer.
184 +
185 + Args:
186 + customer_code (str): The customer code.
187 + session (AsyncSession): The async session.
188 +
189 + Returns:
190 + GrafanaDataSourceCreationResponse: The response containing the created datasource details.
191 + """
192 + logger.info("Creating Grafana datasource")
193 + grafana_client = await create_grafana_client("Grafana")
194 + # Switch to the newly created organization
195 + grafana_client.user.switch_actual_user_organisation(
196 + (await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id,
197 + )
198 + datasource_payload = GrafanaDatasource(
199 + name="SENTINELONE",
200 + type="grafana-opensearch-datasource",
201 + typeName="OpenSearch",
202 + access="proxy",
203 + url=await get_connector_attribute(
204 + connector_id=1,
205 + column_name="connector_url",
206 + session=session,
207 + ),
208 + database=f"sentinelone-{customer_code}*",
209 + basicAuth=True,
210 + basicAuthUser=await get_connector_attribute(
211 + connector_id=1,
212 + column_name="connector_username",
213 + session=session,
214 + ),
215 + secureJsonData={
216 + "basicAuthPassword": await get_connector_attribute(
217 + connector_id=1,
218 + column_name="connector_password",
219 + session=session,
220 + ),
221 + },
222 + isDefault=False,
223 + jsonData={
224 + "database": f"sentinelone-{customer_code}*",
225 + "flavor": "opensearch",
226 + "includeFrozen": False,
227 + "logLevelField": "severity",
228 + "logMessageField": "summary",
229 + "maxConcurrentShardRequests": 5,
230 + "pplEnabled": True,
231 + "timeField": "timestamp",
232 + "tlsSkipVerify": True,
233 + "version": await get_opensearch_version(),
234 + },
235 + readOnly=True,
236 + )
237 + results = grafana_client.datasource.create_datasource(
238 + datasource=datasource_payload.dict(),
239 + )
240 + return GrafanaDataSourceCreationResponse(**results)
241 +
242 +
243 +async def create_customer_network_connector_meta(
244 + customer_details,
245 + stream_id,
246 + index_id,
247 + content_pack_stream_id,
248 + content_pack_input_id,
249 + session,
250 +):
251 + """
252 + Create a CustomerNetworkConnectorsMeta object with the provided details.
253 +
254 + Args:
255 + customer_details (CustomerDetails): Details of the customer.
256 + stream_id (int): ID of the Graylog stream.
257 + index_id (int): ID of the Graylog index.
258 + content_pack_stream_id (int): ID of the content pack stream.
259 + content_pack_input_id (int): ID of the content pack input.
260 + session (Session): Database session.
261 +
262 + Returns:
263 + CustomerNetworkConnectorsMeta: The created CustomerNetworkConnectorsMeta object.
264 + """
265 + return CustomerNetworkConnectorsMeta(
266 + customer_code=customer_details.customer_code,
267 + network_connector_name="SENTINELONE",
268 + graylog_stream_id=stream_id,
269 + graylog_input_id=(await get_input_id_by_input_name(input_name=f"{customer_details.customer_name} - SENTINELONE ALERTS AND EVENTS")),
270 + graylog_pipeline_id=((await get_pipeline_id(subscription="SENTINELONE"))[0]),
271 + graylog_content_pack_input_id=content_pack_input_id,
272 + graylog_content_pack_stream_id=content_pack_stream_id,
273 + grafana_org_id=(
274 + await get_customer_meta_attribute(
275 + session=session,
276 + customer_code=customer_details.customer_code,
277 + column_name="customer_meta_grafana_org_id",
278 + )
279 + ),
280 + graylog_index_id=index_id,
281 + grafana_dashboard_folder_id=None,
282 + grafana_datasource_uid=None,
283 + )
284 +
285 +
286 +async def validate_grafana_organization_id(customer_code, session):
287 + """
288 + Validate the Grafana organization ID for the customer.
289 +
290 + Args:
291 + customer_code (str): The customer code.
292 + session (Session): Database session.
293 +
294 + Returns:
295 + int: The Grafana organization ID.
296 + """
297 + return await get_customer_meta_attribute(
298 + session=session,
299 + customer_code=customer_code,
300 + column_name="customer_meta_grafana_org_id",
301 + )
302 +
303 +
304 +async def provision_sentinelone(
305 + customer_details: SentinelOneCustomerDetails,
306 + keys: ProvisionSentinelOneKeys,
307 + session: AsyncSession,
308 +) -> ProvisionSentinelOneResponse:
309 + """
310 + Provisions a SentinelOne customer by performing the following steps:
311 + 1. Validates Grafana organization ID exists.
312 + 2. Provisions the content pack for the customer.
313 + 3. Retrieves the stream and index IDs for the customer.
314 + 4. Creates customer network connector metadata.
315 + 5. Assigns the stream to the index.
316 + 6. Retrieves the pipeline ID for the "SENTINELONE" subscription.
317 + 7. Connects the stream to the pipeline.
318 + 8. Creates Grafana datasource and dashboards.
319 + 9. Inserts the customer network connector metadata into the database.
320 + 10. Sets the deployed flag.
321 +
322 + Args:
323 + customer_details (SentinelOneCustomerDetails): The details of the SentinelOne customer.
324 + keys (ProvisionSentinelOneKeys): The keys required for provisioning.
325 + session (AsyncSession): The database session.
326 +
327 + Returns:
328 + ProvisionSentinelOneResponse: Response indicating success or failure.
329 + """
330 + if await validate_grafana_organization_id(customer_details.customer_code, session) is None:
331 + raise HTTPException(
332 + status_code=404,
333 + detail="Grafana organization ID not found. Please provision Grafana for the customer first.",
334 + )
335 +
336 + await provision_content_pack(customer_details)
337 + stream_id, index_id, content_pack_stream_id, content_pack_input_id = await get_stream_and_index_ids(customer_details)
338 + customer_network_connector_meta = await create_customer_network_connector_meta(
339 + customer_details,
340 + stream_id,
341 + index_id,
342 + content_pack_stream_id,
343 + content_pack_input_id,
344 + session,
345 + )
346 + await assign_stream_to_index(stream_id=stream_id, index_id=index_id)
347 + pipeline_id = await get_pipeline_id(subscription="SENTINELONE")
348 + await connect_stream_to_pipeline(stream_and_pipeline=StreamConnectionToPipelineRequest(stream_id=stream_id, pipeline_ids=pipeline_id))
349 +
350 + # Grafana Deployment
351 + customer_network_connector_meta.grafana_datasource_uid = (
352 + await create_grafana_datasource(
353 + customer_code=customer_details.customer_code,
354 + session=session,
355 + )
356 + ).datasource.uid
357 + grafana_folder = await create_grafana_folder(
358 + organization_id=(
359 + await get_customer_meta(
360 + customer_details.customer_code,
361 + session,
362 + )
363 + ).customer_meta.customer_meta_grafana_org_id,
364 + folder_title="SENTINELONE",
365 + )
366 + await provision_dashboards(
367 + DashboardProvisionRequest(
368 + dashboards=[dashboard.name for dashboard in SentinelOneDashboard],
369 + organizationId=(
370 + await get_customer_meta(
371 + customer_details.customer_code,
372 + session,
373 + )
374 + ).customer_meta.customer_meta_grafana_org_id,
375 + folderId=grafana_folder.id,
376 + datasourceUid=customer_network_connector_meta.grafana_datasource_uid,
377 + ),
378 + )
379 + customer_network_connector_meta.grafana_dashboard_folder_id = grafana_folder.uid
380 + await insert_into_customer_network_connectors_meta_table(
381 + customer_network_connectors_meta=customer_network_connector_meta,
382 + session=session,
383 + )
384 +
385 + await set_deployed_flag(
386 + customer_code=customer_details.customer_code,
387 + network_connector_service_name="Sentinelone",
388 + flag=True,
389 + session=session,
390 + )
391 +
392 + return ProvisionSentinelOneResponse(
393 + message="SentinelOne customer provisioned successfully",
394 + success=True,
395 + )
396 +
397 +
398 +async def insert_into_customer_network_connectors_meta_table(
399 + customer_network_connectors_meta: CustomerNetworkConnectorsMeta,
400 + session: AsyncSession,
401 +) -> None:
402 + """
403 + Insert the customer network connectors meta into the database.
404 +
405 + Args:
406 + customer_network_connectors_meta (CustomerNetworkConnectorsMeta): The customer network connectors meta to insert.
407 + session (AsyncSession): The async session object for database operations.
408 +
409 + Returns:
410 + None
411 + """
412 + logger.info("Inserting customer network connectors meta into the database")
413 + session.add(customer_network_connectors_meta)
414 + await session.commit()
415 + logger.info("Customer network connectors meta inserted successfully")
416 + return None
backend/app/stack_provisioning/graylog/templates/SOCFORTRESS_SENTINELONE_INPUT_SYSLOG_TLS.json new
+130
@@ -0,0 +1,130 @@
1 +{
2 + "v": 1,
3 + "id": "REPLACE_UUID_GLOBAL",
4 + "rev": 1,
5 + "name": "customer_name_SENTINELONE_INPUT_SYSLOG_TLS",
6 + "summary": "customer_name_SENTINELONE_INPUT_SYSLOG_TLS",
7 + "description": "",
8 + "vendor": "SOCFortress",
9 + "url": "",
10 + "parameters": [],
11 + "entities": [
12 + {
13 + "v": "1",
14 + "type": {
15 + "name": "input",
16 + "version": "1"
17 + },
18 + "id": "REPLACE_UUID_SPECIFIC",
19 + "data": {
20 + "title": {
21 + "@type": "string",
22 + "@value": "customer_name - SENTINELONE ALERTS AND EVENTS"
23 + },
24 + "configuration": {
25 + "tls_key_file": {
26 + "@type": "string",
27 + "@value": "/etc/graylog/server/certs/TLS_KEY_FILE"
28 + },
29 + "port": {
30 + "@type": "integer",
31 + "@value": "SYSLOG_PORT"
32 + },
33 + "tls_enable": {
34 + "@type": "boolean",
35 + "@value": true
36 + },
37 + "use_null_delimiter": {
38 + "@type": "boolean",
39 + "@value": false
40 + },
41 + "recv_buffer_size": {
42 + "@type": "integer",
43 + "@value": 1048576
44 + },
45 + "tcp_keepalive": {
46 + "@type": "boolean",
47 + "@value": false
48 + },
49 + "force_rdns": {
50 + "@type": "boolean",
51 + "@value": false
52 + },
53 + "allow_override_date": {
54 + "@type": "boolean",
55 + "@value": true
56 + },
57 + "tls_client_auth_cert_file": {
58 + "@type": "string",
59 + "@value": "/etc/graylog/server/certs/clients"
60 + },
61 + "bind_address": {
62 + "@type": "string",
63 + "@value": "0.0.0.0"
64 + },
65 + "tls_cert_file": {
66 + "@type": "string",
67 + "@value": "/etc/graylog/server/certs/TLS_CERT_FILE"
68 + },
69 + "expand_structured_data": {
70 + "@type": "boolean",
71 + "@value": false
72 + },
73 + "max_message_size": {
74 + "@type": "integer",
75 + "@value": 2097152
76 + },
77 + "store_full_message": {
78 + "@type": "boolean",
79 + "@value": false
80 + },
81 + "tls_client_auth": {
82 + "@type": "string",
83 + "@value": "required"
84 + },
85 + "timezone": {
86 + "@type": "string",
87 + "@value": "Europe/Madrid"
88 + },
89 + "charset_name": {
90 + "@type": "string",
91 + "@value": "UTF-8"
92 + },
93 + "number_worker_threads": {
94 + "@type": "integer",
95 + "@value": 8
96 + },
97 + "tls_key_password": {
98 + "@type": "string",
99 + "@value": ""
100 + }
101 + },
102 + "static_fields": {
103 + "syslog_type": {
104 + "@type": "string",
105 + "@value": "sentinelone"
106 + },
107 + "syslog_customer": {
108 + "@type": "string",
109 + "@value": "customer_code"
110 + }
111 + },
112 + "type": {
113 + "@type": "string",
114 + "@value": "org.graylog2.inputs.syslog.tcp.SyslogTCPInput"
115 + },
116 + "global": {
117 + "@type": "boolean",
118 + "@value": true
119 + },
120 + "extractors": []
121 + },
122 + "constraints": [
123 + {
124 + "type": "server-version",
125 + "version": ">=5.0.13+083613e"
126 + }
127 + ]
128 + }
129 + ]
130 +}
frontend/src/api/endpoints/networkConnectors.ts
+94 -75
@@ -3,98 +3,117 @@ import type { CustomerNetworkConnector, NetworkConnector } from "@/types/network
3 import { HttpClient } from "../httpClient"
4
5 export interface NewNetworkConnector {
6 - customer_code: string
7 - customer_name: string
8 - network_connector_name: string
9 - network_connector_auth_keys: {
10 - auth_key_name: string
11 - auth_value: string
12 - }[]
6 + customer_code: string
7 + customer_name: string
8 + network_connector_name: string
9 + network_connector_auth_keys: {
10 + auth_key_name: string
11 + auth_value: string
12 + }[]
13 }
14
15 export interface NewNetworkConnectorPayload extends NewNetworkConnector {
16 - network_connector_config: {
17 - auth_type: string
18 - config_key: string
19 - config_value: string
20 - }
16 + network_connector_config: {
17 + auth_type: string
18 + config_key: string
19 + config_value: string
20 + }
21 }
22
23 export interface FortinetProvision {
24 - tcp_enabled: boolean
25 - udp_enabled: boolean
26 - hot_data_retention: number
27 - index_replicas: number
24 + tcp_enabled: boolean
25 + udp_enabled: boolean
26 + hot_data_retention: number
27 + index_replicas: number
28 }
29
30 export interface FortinetProvisionPayload extends FortinetProvision {
31 - customer_code: string
32 - integration_name: string
31 + customer_code: string
32 + integration_name: string
33 }
34
35 export interface SonicwallProvision {
36 - tcp_enabled: boolean
37 - hot_data_retention: number
38 - index_replicas: number
36 + tcp_enabled: boolean
37 + hot_data_retention: number
38 + index_replicas: number
39 }
40
41 export interface SonicwallProvisionPayload extends SonicwallProvision {
42 - customer_code: string
43 - integration_name: string
42 + customer_code: string
43 + integration_name: string
44 +}
45 +
46 +export interface SentinelOneProvision {
47 + tls_enabled: boolean
48 + hot_data_retention: number
49 + index_replicas: number
50 +}
51 +
52 +export interface SentinelOneProvisionPayload extends SentinelOneProvision {
53 + customer_code: string
54 + integration_name: string
55 }
56
57 export default {
47 - // #region Network Connector
48 - getAvailableNetworkConnectors() {
49 - return HttpClient.get<FlaskBaseResponse & { network_connector_keys: NetworkConnector[] }>(
50 - `/network_connectors/available_network_connectors`
51 - )
52 - },
53 - getCustomerNetworkConnectors(customerCode: string) {
54 - return HttpClient.get<FlaskBaseResponse & { available_network_connectors: CustomerNetworkConnector[] }>(
55 - `/network_connectors/customer_network_connectors/${customerCode}`
56 - )
57 - },
58 - createNetworkConnector(props: NewNetworkConnector) {
59 - const payload: NewNetworkConnectorPayload = {
60 - ...props,
61 - network_connector_config: {
62 - auth_type: "Fortinet",
63 - config_key: "firewall",
64 - config_value: "not applicable"
65 - }
66 - }
67 - return HttpClient.post<FlaskBaseResponse>(`/network_connectors/create_network_connector`, payload)
68 - },
69 - deleteNetworkConnector(customerCode: string, networkConnectorName: string) {
70 - return HttpClient.delete<FlaskBaseResponse>(`/network_connectors/delete_network_connector`, {
71 - data: { customer_code: customerCode, network_connector_name: networkConnectorName }
72 - })
73 - },
74 - decommissionNetworkConnector(customerCode: string, networkConnectorName: string) {
75 - return HttpClient.post<FlaskBaseResponse>(`/stack_decommissioning/graylog/decommission/network_connector`, {
76 - customer_code: customerCode,
77 - network_connector: networkConnectorName
78 - })
79 - },
80 - // #endregion
58 + // #region Network Connector
59 + getAvailableNetworkConnectors() {
60 + return HttpClient.get<FlaskBaseResponse & { network_connector_keys: NetworkConnector[] }>(
61 + `/network_connectors/available_network_connectors`
62 + )
63 + },
64 + getCustomerNetworkConnectors(customerCode: string) {
65 + return HttpClient.get<FlaskBaseResponse & { available_network_connectors: CustomerNetworkConnector[] }>(
66 + `/network_connectors/customer_network_connectors/${customerCode}`
67 + )
68 + },
69 + createNetworkConnector(props: NewNetworkConnector) {
70 + const payload: NewNetworkConnectorPayload = {
71 + ...props,
72 + network_connector_config: {
73 + auth_type: "Fortinet",
74 + config_key: "firewall",
75 + config_value: "not applicable"
76 + }
77 + }
78 + return HttpClient.post<FlaskBaseResponse>(`/network_connectors/create_network_connector`, payload)
79 + },
80 + deleteNetworkConnector(customerCode: string, networkConnectorName: string) {
81 + return HttpClient.delete<FlaskBaseResponse>(`/network_connectors/delete_network_connector`, {
82 + data: { customer_code: customerCode, network_connector_name: networkConnectorName }
83 + })
84 + },
85 + decommissionNetworkConnector(customerCode: string, networkConnectorName: string) {
86 + return HttpClient.post<FlaskBaseResponse>(`/stack_decommissioning/graylog/decommission/network_connector`, {
87 + customer_code: customerCode,
88 + network_connector: networkConnectorName
89 + })
90 + },
91 + // #endregion
92
82 - // #region Provision
83 - fortinetProvision(customerCode: string, networkConnectorName: string, props: FortinetProvision) {
84 - const payload: FortinetProvisionPayload = {
85 - ...props,
86 - customer_code: customerCode,
87 - integration_name: networkConnectorName
88 - }
89 - return HttpClient.post<FlaskBaseResponse>(`/stack_provisioning/graylog/provision/fortinet`, payload)
90 - },
91 - sonicwallProvision(customerCode: string, networkConnectorName: string, props: SonicwallProvision) {
92 - const payload: SonicwallProvisionPayload = {
93 - ...props,
94 - customer_code: customerCode,
95 - integration_name: networkConnectorName
96 - }
97 - return HttpClient.post<FlaskBaseResponse>(`/stack_provisioning/graylog/provision/sonicwall`, payload)
98 - }
99 - // #endregion
93 + // #region Provision
94 + fortinetProvision(customerCode: string, networkConnectorName: string, props: FortinetProvision) {
95 + const payload: FortinetProvisionPayload = {
96 + ...props,
97 + customer_code: customerCode,
98 + integration_name: networkConnectorName
99 + }
100 + return HttpClient.post<FlaskBaseResponse>(`/stack_provisioning/graylog/provision/fortinet`, payload)
101 + },
102 + sonicwallProvision(customerCode: string, networkConnectorName: string, props: SonicwallProvision) {
103 + const payload: SonicwallProvisionPayload = {
104 + ...props,
105 + customer_code: customerCode,
106 + integration_name: networkConnectorName
107 + }
108 + return HttpClient.post<FlaskBaseResponse>(`/stack_provisioning/graylog/provision/sonicwall`, payload)
109 + },
110 + sentineloneProvision(customerCode: string, networkConnectorName: string, props: SentinelOneProvision) {
111 + const payload: SentinelOneProvisionPayload = {
112 + ...props,
113 + customer_code: customerCode,
114 + integration_name: networkConnectorName
115 + }
116 + return HttpClient.post<FlaskBaseResponse>(`/stack_provisioning/graylog/provision/sentinelone`, payload)
117 + }
118 + // #endregion
119 }
frontend/src/components/customers/networkConnectors/CustomerNetworkConnectorActions.vue
+103 -6
@@ -42,6 +42,20 @@
42 Deploy
43 </n-button>
44
45 + <n-button
46 + v-if="isSentinelOne && !networkConnector.deployed"
47 + :loading="loadingSentinelOneProvision"
48 + type="success"
49 + :size="size"
50 + secondary
51 + @click.stop="showSentinelOneForm = true"
52 + >
53 + <template #icon>
54 + <Icon :name="DeployIcon" />
55 + </template>
56 + Deploy
57 + </n-button>
58 +
59 <n-button
60 v-if="!hideDeleteButton"
61 :size="size"
@@ -119,20 +133,54 @@
133 </div>
134 </template>
135 </n-modal>
136 +
137 + <!-- SentinelOne Modal -->
138 + <n-modal
139 + v-model:show="showSentinelOneForm"
140 + preset="card"
141 + :style="{ maxWidth: 'min(420px, 90vw)', minHeight: 'min(300px, 90vh)', overflow: 'hidden' }"
142 + title="SentinelOne options"
143 + :bordered="false"
144 + content-class="flex flex-col"
145 + segmented
146 + >
147 + <n-spin v-model:show="loadingSentinelOneProvision">
148 + <SentinelOneForm v-model:options="sentinelOneOptions" />
149 + </n-spin>
150 +
151 + <template #footer>
152 + <div class="flex justify-end">
153 + <n-button
154 + :loading="loadingSentinelOneProvision"
155 + type="success"
156 + secondary
157 + :disabled="!isSentinelOneFormValid"
158 + @click.stop="sentinelOneProvision()"
159 + >
160 + <template #icon>
161 + <Icon :name="DeployIcon" />
162 + </template>
163 + Deploy
164 + </n-button>
165 + </div>
166 + </template>
167 + </n-modal>
168 </div>
169 </template>
170
171 <script setup lang="ts">
172 import type { Size } from "naive-ui/es/button/src/interface"
173 import type { FortinetModel } from "./provisions/FortinetForm.vue"
174 +import type { SentinelOneModel } from "./provisions/SentinelOneForm.vue"
175 import type { SonicwallModel } from "./provisions/SonicwallForm.vue"
129 -import type { FortinetProvision, SonicwallProvision } from "@/api/endpoints/networkConnectors"
176 +import type { FortinetProvision, SentinelOneProvision, SonicwallProvision } from "@/api/endpoints/networkConnectors"
177 import type { CustomerNetworkConnector } from "@/types/networkConnectors.d"
178 import { NButton, NModal, NSpin, useDialog, useMessage } from "naive-ui"
179 import { computed, h, ref, watch } from "vue"
180 import Api from "@/api"
181 import Icon from "@/components/common/Icon.vue"
182 import FortinetForm from "./provisions/FortinetForm.vue"
183 +import SentinelOneForm from "./provisions/SentinelOneForm.vue"
184 import SonicwallForm from "./provisions/SonicwallForm.vue"
185
186 const { networkConnector, hideDeleteButton, size } = defineProps<{
@@ -157,22 +205,27 @@ const dialog = useDialog()
205 const message = useMessage()
206 const loadingFortinetProvision = ref(false)
207 const loadingSonicwallProvision = ref(false)
208 +const loadingSentinelOneProvision = ref(false)
209 const loadingDelete = ref(false)
210 const loadingDecommission = ref(false)
162 -const loading = computed(() =>
163 - loadingFortinetProvision.value ||
164 - loadingSonicwallProvision.value ||
165 - loadingDecommission.value ||
166 - loadingDelete.value
211 +const loading = computed(
212 + () =>
213 + loadingFortinetProvision.value ||
214 + loadingSonicwallProvision.value ||
215 + loadingSentinelOneProvision.value ||
216 + loadingDecommission.value ||
217 + loadingDelete.value
218 )
219
220 const serviceName = computed(() => networkConnector.network_connector_service_name)
221 const customerCode = computed(() => networkConnector.customer_code)
222 const isFortinet = computed(() => serviceName.value === "Fortinet")
223 const isSonicwall = computed(() => serviceName.value === "Sonicwall")
224 +const isSentinelOne = computed(() => serviceName.value === "Sentinelone")
225
226 const showFortinetForm = ref(false)
227 const showSonicwallForm = ref(false)
228 +const showSentinelOneForm = ref(false)
229
230 const fortinetOptions = ref<FortinetModel>({
231 protocol: "tcp",
@@ -186,6 +239,12 @@ const sonicwallOptions = ref<SonicwallModel>({
239 index_replicas: 0
240 })
241
242 +const sentinelOneOptions = ref<SentinelOneModel>({
243 + protocol: "tls",
244 + hot_data_retention: 1,
245 + index_replicas: 0
246 +})
247 +
248 const isFortinetFormValid = computed(() => {
249 if (fortinetOptions.value.hot_data_retention === null) {
250 return false
@@ -206,6 +265,16 @@ const isSonicwallFormValid = computed(() => {
265 return true
266 })
267
268 +const isSentinelOneFormValid = computed(() => {
269 + if (sentinelOneOptions.value.hot_data_retention === null) {
270 + return false
271 + }
272 + if (sentinelOneOptions.value.index_replicas === null) {
273 + return false
274 + }
275 + return true
276 +})
277 +
278 watch(loading, val => {
279 if (val) {
280 emit("startLoading")
@@ -271,6 +340,34 @@ function sonicwallProvision() {
340 })
341 }
342
343 +function sentinelOneProvision() {
344 + loadingSentinelOneProvision.value = true
345 +
346 + const options: SentinelOneProvision = {
347 + tls_enabled: sentinelOneOptions.value.protocol === "tls",
348 + hot_data_retention: sentinelOneOptions.value.hot_data_retention,
349 + index_replicas: sentinelOneOptions.value.index_replicas
350 + }
351 +
352 + Api.networkConnectors
353 + .sentineloneProvision(customerCode.value, serviceName.value, options)
354 + .then(res => {
355 + if (res.data.success) {
356 + emit("deployed")
357 + showSentinelOneForm.value = false
358 + message.success(res.data?.message || "SentinelOne customer provisioned successfully.")
359 + } else {
360 + message.warning(res.data?.message || "An error occurred. Please try again later.")
361 + }
362 + })
363 + .catch(err => {
364 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
365 + })
366 + .finally(() => {
367 + loadingSentinelOneProvision.value = false
368 + })
369 +}
370 +
371 function handleDelete() {
372 dialog.warning({
373 title: "Confirm",
frontend/src/components/customers/networkConnectors/provisions/SentinelOneForm.vue new
+29
@@ -0,0 +1,29 @@
1 +<template>
2 + <n-form :model="model" label-placement="left" label-width="auto">
3 + <n-form-item label="Protocol" required>
4 + <n-radio-group v-model:value="model.protocol">
5 + <n-radio-button value="tcp">TCP</n-radio-button>
6 + </n-radio-group>
7 + </n-form-item>
8 +
9 + <n-form-item label="Hot Data Retention (days)" required>
10 + <n-input-number v-model:value="model.hot_data_retention" :min="1" :max="90" class="w-full" />
11 + </n-form-item>
12 +
13 + <n-form-item label="Index Replicas" required>
14 + <n-input-number v-model:value="model.index_replicas" :min="0" :max="3" class="w-full" />
15 + </n-form-item>
16 + </n-form>
17 +</template>
18 +
19 +<script setup lang="ts">
20 +import { NForm, NFormItem, NInputNumber, NRadioButton, NRadioGroup } from "naive-ui"
21 +
22 +export interface SentinelOneModel {
23 + protocol: "tcp"
24 + hot_data_retention: number
25 + index_replicas: number
26 +}
27 +
28 +const model = defineModel<SentinelOneModel>("options", { required: true })
29 +</script>