{
    "objects": [
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [{\"meta\": {\"value\": \"0\", \"key\": \"auditd.summary.object.secondary\", \"params\": {\"query\": \"0\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"apply\": true, \"negate\": true, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"auditd.summary.object.secondary\": {\"query\": \"0\", \"type\": \"phrase\"}}}}], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "b4c93470-c240-11e7-8692-232bd1143e8a-ecs",
                "title": "Bind (non-ephemeral) [Auditbeat Auditd] ECS",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"id\": \"1\", \"params\": {}, \"enabled\": true, \"type\": \"count\"}, {\"schema\": \"bucket\", \"id\": \"2\", \"params\": {\"field\": \"auditd.summary.how\", \"order\": \"desc\", \"size\": 50, \"orderBy\": \"_term\", \"customLabel\": \"Exe\"}, \"enabled\": true, \"type\": \"terms\"}, {\"schema\": \"bucket\", \"id\": \"3\", \"params\": {\"field\": \"auditd.summary.object.primary\", \"order\": \"desc\", \"size\": 10, \"orderBy\": \"_term\", \"customLabel\": \"Address\"}, \"enabled\": true, \"type\": \"terms\"}, {\"schema\": \"bucket\", \"id\": \"4\", \"params\": {\"field\": \"auditd.summary.object.secondary\", \"order\": \"desc\", \"size\": 10, \"orderBy\": \"_term\", \"customLabel\": \"Port\"}, \"enabled\": true, \"type\": \"terms\"}], \"params\": {\"totalFunc\": \"sum\", \"perPage\": 10, \"showTotal\": false, \"showPartialRows\": false, \"sort\": {\"direction\": null, \"columnIndex\": null}, \"showMeticsAtAllLevels\": false}, \"title\": \"Bind (non-ephemeral) [Auditbeat Auditd] ECS\", \"type\": \"table\"}"
            },
            "id": "faf882f0-c242-11e7-8692-232bd1143e8a-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T22:08:02.522Z",
            "version": 3
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "5438b030-c246-11e7-8692-232bd1143e8a-ecs",
                "title": "Connect [Auditbeat Auditd] ECS",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"id\": \"1\", \"params\": {}, \"enabled\": true, \"type\": \"count\"}, {\"schema\": \"bucket\", \"id\": \"2\", \"params\": {\"field\": \"process.executable\", \"order\": \"desc\", \"size\": 50, \"orderBy\": \"1\", \"customLabel\": \"Exe\"}, \"enabled\": true, \"type\": \"terms\"}, {\"schema\": \"bucket\", \"id\": \"3\", \"params\": {\"field\": \"auditd.summary.object.primary\", \"order\": \"desc\", \"size\": 10, \"orderBy\": \"1\", \"customLabel\": \"Address\"}, \"enabled\": true, \"type\": \"terms\"}, {\"schema\": \"bucket\", \"id\": \"4\", \"params\": {\"field\": \"auditd.summary.object.secondary\", \"order\": \"desc\", \"size\": 5, \"orderBy\": \"1\", \"customLabel\": \"Port\"}, \"enabled\": true, \"type\": \"terms\"}], \"params\": {\"totalFunc\": \"sum\", \"perPage\": 10, \"showTotal\": false, \"showPartialRows\": false, \"sort\": {\"direction\": null, \"columnIndex\": null}, \"showMeticsAtAllLevels\": false}, \"title\": \"Connect [Auditbeat Auditd] ECS\", \"type\": \"table\"}"
            },
            "id": "ea483730-c246-11e7-8692-232bd1143e8a-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T23:24:16.851Z",
            "version": 4
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "e8734160-c24c-11e7-8692-232bd1143e8a-ecs",
                "title": "Accept / Recvfrom Unique Address Table [Auditbeat Auditd] ECS",
                "uiStateJSON": "{\"spy\": {\"mode\": {\"name\": null, \"fill\": false}}, \"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"id\": \"1\", \"params\": {\"field\": \"auditd.summary.object.primary\", \"customLabel\": \"Unique Addresses\"}, \"enabled\": true, \"type\": \"cardinality\"}, {\"schema\": \"bucket\", \"id\": \"2\", \"params\": {\"field\": \"process.executable\", \"order\": \"desc\", \"size\": 50, \"orderBy\": \"1\", \"customLabel\": \"Exe\"}, \"enabled\": true, \"type\": \"terms\"}, {\"schema\": \"bucket\", \"id\": \"3\", \"params\": {\"field\": \"auditd.data.syscall\", \"order\": \"desc\", \"size\": 5, \"orderBy\": \"1\", \"customLabel\": \"Syscall\"}, \"enabled\": true, \"type\": \"terms\"}], \"params\": {\"totalFunc\": \"sum\", \"perPage\": 10, \"showTotal\": false, \"showPartialRows\": false, \"sort\": {\"direction\": null, \"columnIndex\": null}, \"showMeticsAtAllLevels\": false}, \"title\": \"Accept / Recvfrom Unique Address Table [Auditbeat Auditd] ECS\", \"type\": \"table\"}"
            },
            "id": "ceb91de0-c250-11e7-8692-232bd1143e8a-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T22:16:51.535Z",
            "version": 5
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{}"
                },
                "title": "Socket Syscalls Time Series [Auditbeat Auditd] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [], \"params\": {\"background_color_rules\": [{\"id\": \"95b603d0-c252-11e7-8a68-93ffe9ec5950\"}], \"series\": [{\"color\": \"#68BC00\", \"chart_type\": \"line\", \"label\": \"syscall\", \"formatter\": \"number\", \"line_width\": 1, \"metrics\": [{\"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\", \"type\": \"count\"}], \"stacked\": \"none\", \"fill\": 0.5, \"terms_field\": \"auditd.data.syscall\", \"axis_position\": \"right\", \"seperate_axis\": 0, \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"point_size\": 1, \"split_mode\": \"terms\"}], \"filter\": \"auditd.summary.object.type:socket\", \"gauge_color_rules\": [{\"id\": \"6c891740-c252-11e7-8a68-93ffe9ec5950\"}], \"axis_formatter\": \"number\", \"index_pattern\": \"auditbeat-*\", \"time_field\": \"@timestamp\", \"gauge_inner_width\": 10, \"axis_position\": \"left\", \"legend_position\": \"left\", \"type\": \"timeseries\", \"gauge_width\": 10, \"bar_color_rules\": [{\"id\": \"2cebb0c0-c252-11e7-8a68-93ffe9ec5950\"}], \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"show_grid\": 1, \"interval\": \"auto\", \"show_legend\": 1, \"gauge_style\": \"half\"}, \"title\": \"Socket Syscalls Time Series [Auditbeat Auditd] ECS\", \"type\": \"metrics\"}"
            },
            "id": "b21e0c70-c252-11e7-8692-232bd1143e8a-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T22:13:38.857Z",
            "version": 3
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"index\": \"auditbeat-*\"}"
                },
                "title": "Socket Families [Auditbeat Auditd] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"id\": \"1\", \"params\": {}, \"enabled\": true, \"type\": \"count\"}, {\"schema\": \"segment\", \"id\": \"2\", \"params\": {\"field\": \"auditd.data.socket.family\", \"order\": \"desc\", \"size\": 10, \"orderBy\": \"1\", \"customLabel\": \"Socket Family\"}, \"enabled\": true, \"type\": \"terms\"}, {\"schema\": \"segment\", \"id\": \"3\", \"params\": {\"field\": \"auditd.data.syscall\", \"order\": \"desc\", \"size\": 10, \"orderBy\": \"1\", \"customLabel\": \"Syscall\"}, \"enabled\": true, \"type\": \"terms\"}], \"params\": {\"addTooltip\": true, \"type\": \"pie\", \"legendPosition\": \"left\", \"addLegend\": true, \"isDonut\": true}, \"title\": \"Socket Families [Auditbeat Auditd] ECS\", \"type\": \"pie\"}"
            },
            "id": "a8e20450-c256-11e7-8692-232bd1143e8a-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T22:12:51.655Z",
            "version": 3
        },
        {
            "attributes": {
                "columns": [
                    "agent.hostname",
                    "auditd.summary.how",
                    "auditd.summary.object.primary",
                    "auditd.summary.object.secondary",
                    "auditd.data.socket.family",
                    "auditd.result"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"version\": true, \"highlightAll\": true, \"filter\": [{\"meta\": {\"value\": \"auditd\", \"key\": \"event.module\", \"params\": {\"query\": \"auditd\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"event.module\": {\"query\": \"auditd\", \"type\": \"phrase\"}}}}, {\"meta\": {\"value\": \"bind\", \"key\": \"auditd.data.syscall\", \"params\": {\"query\": \"bind\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"auditd.data.syscall\": {\"query\": \"bind\", \"type\": \"phrase\"}}}}, {\"meta\": {\"value\": \"netlink\", \"key\": \"auditd.data.socket.family\", \"params\": {\"query\": \"netlink\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": true, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"auditd.data.socket.family\": {\"query\": \"netlink\", \"type\": \"phrase\"}}}}], \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"index\": \"auditbeat-*\"}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "Socket Binds [Auditbeat Auditd] ECS",
                "version": 1
            },
            "id": "b4c93470-c240-11e7-8692-232bd1143e8a-ecs",
            "type": "search",
            "updated_at": "2018-01-16T23:05:58.935Z",
            "version": 5
        },
        {
            "attributes": {
                "columns": [
                    "agent.hostname",
                    "auditd.summary.how",
                    "auditd.summary.object.primary",
                    "auditd.summary.object.secondary",
                    "auditd.data.socket.family",
                    "auditd.result",
                    "auditd.data.exit"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"version\": true, \"highlightAll\": true, \"filter\": [{\"meta\": {\"value\": \"auditd\", \"key\": \"event.module\", \"params\": {\"query\": \"auditd\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"event.module\": {\"query\": \"auditd\", \"type\": \"phrase\"}}}}, {\"meta\": {\"value\": \"connected-to\", \"key\": \"event.action\", \"params\": {\"query\": \"connected-to\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"event.action\": {\"query\": \"connected-to\", \"type\": \"phrase\"}}}}, {\"meta\": {\"value\": \"exists\", \"key\": \"auditd.summary.object.primary\", \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"exists\"}, \"$state\": {\"store\": \"appState\"}, \"exists\": {\"field\": \"auditd.summary.object.primary\"}}], \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"index\": \"auditbeat-*\"}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "Socket Connects [Auditbeat Auditd] ECS",
                "version": 1
            },
            "id": "5438b030-c246-11e7-8692-232bd1143e8a-ecs",
            "type": "search",
            "updated_at": "2018-01-16T23:09:43.937Z",
            "version": 5
        },
        {
            "attributes": {
                "columns": [
                    "agent.hostname",
                    "auditd.summary.how",
                    "auditd.summary.object.primary",
                    "auditd.summary.object.secondary",
                    "auditd.data.socket.family",
                    "event.action"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"version\": true, \"highlightAll\": true, \"filter\": [{\"meta\": {\"value\": \"auditd\", \"key\": \"event.module\", \"params\": {\"query\": \"auditd\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"event.module\": {\"query\": \"auditd\", \"type\": \"phrase\"}}}}, {\"meta\": {\"value\": \"socket\", \"key\": \"auditd.summary.object.type\", \"params\": {\"query\": \"socket\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"auditd.summary.object.type\": {\"query\": \"socket\", \"type\": \"phrase\"}}}}, {\"meta\": {\"value\": \"exists\", \"key\": \"auditd.summary.object.primary\", \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"exists\"}, \"$state\": {\"store\": \"appState\"}, \"exists\": {\"field\": \"auditd.summary.object.primary\"}}, {\"meta\": {\"value\": \"{\\\"terms\\\":{\\\"auditd.data.syscall\\\":[\\\"accept\\\",\\\"accept4\\\",\\\"recvfrom\\\",\\\"recvmsg\\\"]}}\", \"key\": \"query\", \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"custom\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"terms\": {\"auditd.data.syscall\": [\"accept\", \"accept4\", \"recvfrom\", \"recvmsg\"]}}}], \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"index\": \"auditbeat-*\"}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "Socket Accept / Recvfrom [Auditbeat Auditd] ECS",
                "version": 1
            },
            "id": "e8734160-c24c-11e7-8692-232bd1143e8a-ecs",
            "type": "search",
            "updated_at": "2018-01-16T23:20:51.403Z",
            "version": 4
        },
        {
            "attributes": {
                "description": "Summary of socket related syscall events.",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"version\": true, \"highlightAll\": true, \"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "optionsJSON": "{\"darkTheme\": false, \"useMargins\": false}",
                "panelsJSON": "[{\"embeddableConfig\": {\"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"1\", \"id\": \"faf882f0-c242-11e7-8692-232bd1143e8a-ecs\", \"gridData\": {\"x\": 6, \"w\": 6, \"h\": 4, \"y\": 3, \"i\": \"1\"}}, {\"embeddableConfig\": {\"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"2\", \"id\": \"ea483730-c246-11e7-8692-232bd1143e8a-ecs\", \"gridData\": {\"x\": 0, \"w\": 6, \"h\": 5, \"y\": 7, \"i\": \"2\"}}, {\"embeddableConfig\": {\"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"3\", \"id\": \"ceb91de0-c250-11e7-8692-232bd1143e8a-ecs\", \"gridData\": {\"x\": 6, \"w\": 6, \"h\": 5, \"y\": 7, \"i\": \"3\"}}, {\"id\": \"b21e0c70-c252-11e7-8692-232bd1143e8a-ecs\", \"gridData\": {\"x\": 0, \"w\": 12, \"h\": 3, \"y\": 0, \"i\": \"4\"}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"4\"}, {\"id\": \"a8e20450-c256-11e7-8692-232bd1143e8a-ecs\", \"gridData\": {\"x\": 0, \"w\": 6, \"h\": 4, \"y\": 3, \"i\": \"5\"}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"5\"}]",
                "timeRestore": false,
                "title": "[Auditbeat Auditd] Sockets ECS",
                "version": 1
            },
            "id": "693a5f40-c243-11e7-8692-232bd1143e8a-ecs",
            "type": "dashboard",
            "updated_at": "2018-01-16T23:24:37.521Z",
            "version": 4
        }
    ],
    "version": "6.2.4"
}