{
    "objects": [
        {
            "attributes": {
                "description": "Command executions",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "d382f5b0-c1c6-11e7-8995-936807a28b16-ecs",
                "title": "Error Codes [Auditbeat Auditd] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"id\": \"1\", \"params\": {}, \"enabled\": true, \"type\": \"count\"}, {\"schema\": \"segment\", \"id\": \"2\", \"params\": {\"field\": \"auditd.data.exit\", \"order\": \"desc\", \"orderBy\": \"1\", \"size\": 10, \"exclude\": \"0\"}, \"enabled\": true, \"type\": \"terms\"}], \"params\": {\"addTooltip\": true, \"type\": \"pie\", \"legendPosition\": \"right\", \"addLegend\": true, \"isDonut\": true}, \"title\": \"Error Codes [Auditbeat Auditd] ECS\", \"type\": \"pie\"}"
            },
            "id": "20a8e8d0-c1c8-11e7-8995-936807a28b16-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T22:10:23.921Z",
            "version": 4
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"index\": \"auditbeat-*\"}"
                },
                "title": "Primary Username Tag Cloud [Auditbeat Auditd] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"id\": \"1\", \"params\": {}, \"enabled\": true, \"type\": \"count\"}, {\"schema\": \"segment\", \"id\": \"2\", \"params\": {\"field\": \"auditd.summary.actor.primary\", \"order\": \"desc\", \"orderBy\": \"1\", \"size\": 10}, \"enabled\": true, \"type\": \"terms\"}], \"params\": {\"orientation\": \"single\", \"minFontSize\": 18, \"scale\": \"linear\", \"maxFontSize\": 45}, \"title\": \"Primary Username Tag Cloud [Auditbeat Auditd] ECS\", \"type\": \"tagcloud\"}"
            },
            "id": "f81a6de0-c1c1-11e7-8995-936807a28b16-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T22:12:18.730Z",
            "version": 3
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "d382f5b0-c1c6-11e7-8995-936807a28b16-ecs",
                "title": "Exe Name Tag Cloud [Auditbeat Auditd] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"id\": \"1\", \"params\": {}, \"enabled\": true, \"type\": \"count\"}, {\"schema\": \"segment\", \"id\": \"2\", \"params\": {\"field\": \"process.executable\", \"order\": \"desc\", \"orderBy\": \"1\", \"size\": 10}, \"enabled\": true, \"type\": \"terms\"}], \"params\": {\"orientation\": \"single\", \"minFontSize\": 14, \"scale\": \"linear\", \"maxFontSize\": 45}, \"title\": \"Exe Name Tag Cloud [Auditbeat Auditd] ECS\", \"type\": \"tagcloud\"}"
            },
            "id": "2efac370-c1ca-11e7-8995-936807a28b16-ecs",
            "type": "visualization",
            "updated_at": "2018-01-16T22:57:41.411Z",
            "version": 4
        },
        {
            "attributes": {
                "columns": [
                    "agent.hostname",
                    "process.args",
                    "auditd.summary.actor.primary",
                    "auditd.summary.actor.secondary",
                    "process.executable"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"version\": true, \"highlightAll\": true, \"filter\": [{\"meta\": {\"value\": \"auditd\", \"key\": \"event.module\", \"params\": {\"query\": \"auditd\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"event.module\": {\"query\": \"auditd\", \"type\": \"phrase\"}}}}, {\"meta\": {\"value\": \"executed\", \"key\": \"event.action\", \"params\": {\"query\": \"executed\", \"type\": \"phrase\"}, \"disabled\": false, \"index\": \"auditbeat-*\", \"negate\": false, \"alias\": null, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}, \"query\": {\"match\": {\"event.action\": {\"query\": \"executed\", \"type\": \"phrase\"}}}}], \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"index\": \"auditbeat-*\"}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "Process Executions [Auditbeat Auditd] ECS",
                "version": 1
            },
            "id": "d382f5b0-c1c6-11e7-8995-936807a28b16-ecs",
            "type": "search",
            "updated_at": "2018-01-16T22:26:35.050Z",
            "version": 5
        },
        {
            "attributes": {
                "description": "Overview of kernel executions",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"version\": true, \"highlightAll\": true, \"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "optionsJSON": "{\"darkTheme\": false, \"useMargins\": false}",
                "panelsJSON": "[{\"id\": \"20a8e8d0-c1c8-11e7-8995-936807a28b16-ecs\", \"gridData\": {\"x\": 4, \"w\": 4, \"h\": 3, \"y\": 0, \"i\": \"1\"}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"1\"}, {\"id\": \"f81a6de0-c1c1-11e7-8995-936807a28b16-ecs\", \"gridData\": {\"x\": 8, \"w\": 4, \"h\": 3, \"y\": 0, \"i\": \"3\"}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"3\"}, {\"id\": \"2efac370-c1ca-11e7-8995-936807a28b16-ecs\", \"gridData\": {\"x\": 0, \"w\": 4, \"h\": 3, \"y\": 0, \"i\": \"5\"}, \"version\": \"6.2.4\", \"type\": \"visualization\", \"panelIndex\": \"5\"}, {\"id\": \"d382f5b0-c1c6-11e7-8995-936807a28b16-ecs\", \"gridData\": {\"x\": 0, \"w\": 12, \"h\": 5, \"y\": 3, \"i\": \"6\"}, \"version\": \"6.2.4\", \"type\": \"search\", \"panelIndex\": \"6\"}]",
                "timeRestore": false,
                "title": "[Auditbeat Auditd] Executions ECS",
                "version": 1
            },
            "id": "7de391b0-c1ca-11e7-8995-936807a28b16-ecs",
            "type": "dashboard",
            "updated_at": "2018-01-16T22:58:11.243Z",
            "version": 5
        }
    ],
    "version": "6.2.4"
}