{
  "visState": "{\n  \"title\": \"Socket Syscalls Time Series [Auditbeat Auditd]\",\n  \"type\": \"metrics\",\n  \"params\": {\n    \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\",\n    \"type\": \"timeseries\",\n    \"series\": [\n      {\n        \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\",\n        \"color\": \"#68BC00\",\n        \"split_mode\": \"terms\",\n        \"metrics\": [\n          {\n            \"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\",\n            \"type\": \"count\"\n          }\n        ],\n        \"seperate_axis\": 0,\n        \"axis_position\": \"right\",\n        \"formatter\": \"number\",\n        \"chart_type\": \"line\",\n        \"line_width\": 1,\n        \"point_size\": 1,\n        \"fill\": 0.5,\n        \"stacked\": \"none\",\n        \"terms_field\": \"auditd.data.syscall\",\n        \"label\": \"syscall\"\n      }\n    ],\n    \"time_field\": \"@timestamp\",\n    \"index_pattern\": \"auditbeat-*\",\n    \"interval\": \"auto\",\n    \"axis_position\": \"left\",\n    \"axis_formatter\": \"number\",\n    \"show_legend\": 1,\n    \"show_grid\": 1,\n    \"filter\": \"auditd.summary.object.type:socket\",\n    \"legend_position\": \"left\",\n    \"bar_color_rules\": [\n      {\n        \"id\": \"2cebb0c0-c252-11e7-8a68-93ffe9ec5950\"\n      }\n    ],\n    \"gauge_color_rules\": [\n      {\n        \"id\": \"6c891740-c252-11e7-8a68-93ffe9ec5950\"\n      }\n    ],\n    \"gauge_width\": 10,\n    \"gauge_inner_width\": 10,\n    \"gauge_style\": \"half\",\n    \"background_color_rules\": [\n      {\n        \"id\": \"95b603d0-c252-11e7-8a68-93ffe9ec5950\"\n      }\n    ]\n  },\n  \"aggs\": []\n}", 
  "description": "", 
  "title": "Socket Syscalls Time Series [Auditbeat Auditd]", 
  "uiStateJSON": "{}", 
  "version": 1, 
  "kibanaSavedObjectMeta": {
    "searchSourceJSON": "{}"
  }
}