{
    "objects": [
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{}"
                },
                "title": "Event Actions [Auditbeat Auditd] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [], \"params\": {\"background_color_rules\": [{\"id\": \"58c95a20-c1bd-11e7-938f-ab0645b6c431\"}], \"series\": [{\"color\": \"#68BC00\", \"chart_type\": \"line\", \"label\": \"Actions\", \"formatter\": \"number\", \"line_width\": 1, \"metrics\": [{\"id\": \"6b9fb2d0-c1bc-11e7-938f-ab0645b6c431\", \"type\": \"count\"}], \"stacked\": \"none\", \"fill\": 0.5, \"terms_field\": \"event.action\", \"axis_position\": \"right\", \"seperate_axis\": 0, \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"point_size\": 1, \"split_mode\": \"terms\"}], \"filter\": \"event.module:auditd\", \"gauge_color_rules\": [{\"id\": \"5d20a650-c1bd-11e7-938f-ab0645b6c431\"}], \"axis_formatter\": \"number\", \"index_pattern\": \"auditbeat-*\", \"time_field\": \"@timestamp\", \"gauge_inner_width\": 10, \"axis_position\": \"left\", \"legend_position\": \"left\", \"type\": \"timeseries\", \"gauge_width\": 10, \"bar_color_rules\": [{\"id\": \"5bfc71a0-c1bd-11e7-938f-ab0645b6c431\"}], \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"show_grid\": 1, \"interval\": \"auto\", \"show_legend\": 1, \"gauge_style\": \"half\"}, \"title\": \"Event Actions [Auditbeat Auditd] ECS\", \"type\": \"metrics\"}"
            },
            "id": "97680df0-c1c0-11e7-8995-936807a28b16-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T22:11:01.438Z",
            "version": 3
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"index\": \"auditbeat-*\"}"
                },
                "savedSearchId": "0f10c430-c1c3-11e7-8995-936807a28b16-ecs",
                "title": "Event Categories [Auditbeat Auditd] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"id\": \"1\", \"params\": {}, \"enabled\": true, \"type\": \"count\"}, {\"schema\": \"segment\", \"id\": \"2\", \"params\": {\"field\": \"event.category\", \"order\": \"desc\", \"size\": 5, \"orderBy\": \"1\", \"customLabel\": \"Category\"}, \"enabled\": true, \"type\": \"terms\"}, {\"schema\": \"segment\", \"id\": \"3\", \"params\": {\"field\": \"event.action\", \"order\": \"desc\", \"size\": 20, \"orderBy\": \"1\", \"customLabel\": \"Action\"}, \"enabled\": true, \"type\": \"terms\"}], \"params\": {\"addTooltip\": true, \"type\": \"pie\", \"legendPosition\": \"right\", \"addLegend\": true, \"isDonut\": true}, \"title\": \"Event Categories [Auditbeat Auditd] ECS\", \"type\": \"pie\"}"
            },
            "id": "08679220-c25a-11e7-8692-232bd1143e8a-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T22:54:10.330Z",
            "version": 4
        },
        {
            "attributes": {
                "columns": [
                    "agent.hostname",
                    "auditd.summary.actor.primary",
                    "auditd.summary.actor.secondary",
                    "event.action",
                    "auditd.summary.object.type",
                    "auditd.summary.object.primary",
                    "auditd.summary.object.secondary",
                    "auditd.summary.how",
                    "auditd.result"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"version\": true, \"highlightAll\": true, \"filter\": [{\"meta\": {\"value\": \"auditd\", \"key\": \"event.module\", \"params\": {\"query\": \"auditd\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"event.module\": {\"query\": \"auditd\", \"type\": \"phrase\"}}}}], \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"index\": \"auditbeat-*\"}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "Audit Event Table [Auditbeat Auditd] ECS",
                "version": 1
            },
            "id": "0f10c430-c1c3-11e7-8995-936807a28b16-ecs",
            "type": "search",
            "updated_at": "2018-01-16T22:51:24.572Z",
            "version": 4
        },
        {
            "attributes": {
                "description": "Summary of Linux kernel audit events.",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"version\": true, \"highlightAll\": true, \"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "optionsJSON": "{\"darkTheme\": false, \"useMargins\": false}",
                "panelsJSON": "[{\"id\": \"97680df0-c1c0-11e7-8995-936807a28b16-ecs\", \"gridData\": {\"x\": 0, \"w\": 7, \"h\": 3, \"y\": 0, \"i\": \"1\"}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"1\"}, {\"id\": \"08679220-c25a-11e7-8692-232bd1143e8a-ecs\", \"gridData\": {\"x\": 7, \"w\": 5, \"h\": 3, \"y\": 0, \"i\": \"4\"}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"4\"}, {\"id\": \"0f10c430-c1c3-11e7-8995-936807a28b16-ecs\", \"gridData\": {\"x\": 0, \"w\": 12, \"h\": 5, \"y\": 3, \"i\": \"5\"}, \"version\": \"6.2.4\", \"type\": \"search\", \"panelIndex\": \"5\"}]",
                "timeRestore": false,
                "title": "[Auditbeat Auditd] Overview ECS",
                "version": 1
            },
            "id": "c0ac2c00-c1c0-11e7-8995-936807a28b16-ecs",
            "type": "dashboard",
            "updated_at": "2018-01-16T22:55:17.775Z",
            "version": 5
        }
    ],
    "version": "6.2.4"
}