{
    "objects": [
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"query\": \"\", \"language\": \"kuery\"}}"
                }, 
                "savedSearchId": "13dd22f0-86cc-11e8-b59d-21efb914e65c-ecs", 
                "title": "Activity Types over Time [Filebeat Suricata] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"histogram\", \"params\": {\"seriesParams\": [{\"showCircles\": true, \"show\": \"true\", \"data\": {\"id\": \"1\", \"label\": \"Count\"}, \"mode\": \"stacked\", \"drawLinesBetweenPoints\": true, \"valueAxis\": \"ValueAxis-1\", \"type\": \"histogram\"}], \"type\": \"histogram\", \"categoryAxes\": [{\"style\": {}, \"scale\": {\"type\": \"linear\"}, \"show\": true, \"title\": {}, \"labels\": {\"truncate\": 100, \"show\": true}, \"position\": \"bottom\", \"type\": \"category\", \"id\": \"CategoryAxis-1\"}], \"legendPosition\": \"right\", \"addTimeMarker\": false, \"addLegend\": true, \"grid\": {\"style\": {\"color\": \"#eee\"}, \"categoryLines\": false}, \"times\": [], \"addTooltip\": true, \"valueAxes\": [{\"style\": {}, \"scale\": {\"type\": \"linear\", \"mode\": \"normal\"}, \"name\": \"LeftAxis-1\", \"show\": true, \"title\": {\"text\": \"Count\"}, \"labels\": {\"filter\": false, \"rotate\": 0, \"truncate\": 100, \"show\": true}, \"position\": \"left\", \"type\": \"value\", \"id\": \"ValueAxis-1\"}]}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"customInterval\": \"2h\", \"field\": \"@timestamp\", \"interval\": \"auto\", \"min_doc_count\": 1, \"extended_bounds\": {}}, \"type\": \"date_histogram\", \"enabled\": true, \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"field\": \"suricata.eve.event_type\", \"otherBucketLabel\": \"Other\", \"otherBucket\": false, \"order\": \"desc\", \"size\": 20}, \"type\": \"terms\", \"enabled\": true, \"id\": \"3\", \"schema\": \"group\"}], \"title\": \"Activity Types over Time [Filebeat Suricata] ECS\"}"
            }, 
            "id": "c7d46c60-86da-11e8-b59d-21efb914e65c-ecs", 
            "type": "visualization", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }, 
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"query\": \"\", \"language\": \"kuery\"}}"
                }, 
                "savedSearchId": "13dd22f0-86cc-11e8-b59d-21efb914e65c-ecs", 
                "title": "Event Types [Filebeat Suricata] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"pie\", \"params\": {\"isDonut\": true, \"addTooltip\": true, \"labels\": {\"values\": true, \"last_level\": true, \"truncate\": 100, \"show\": false}, \"legendPosition\": \"bottom\", \"addLegend\": true, \"type\": \"pie\"}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"field\": \"suricata.eve.event_type\", \"otherBucketLabel\": \"Other\", \"otherBucket\": false, \"order\": \"desc\", \"size\": 20}, \"type\": \"terms\", \"enabled\": true, \"id\": \"2\", \"schema\": \"segment\"}], \"title\": \"Event Types [Filebeat Suricata] ECS\"}"
            }, 
            "id": "0a0aa630-86db-11e8-b59d-21efb914e65c-ecs", 
            "type": "visualization", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }, 
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"query\": \"\", \"language\": \"kuery\"}}"
                }, 
                "savedSearchId": "13dd22f0-86cc-11e8-b59d-21efb914e65c-ecs", 
                "title": "Top Application Protocols [Filebeat Suricata] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"pie\", \"params\": {\"isDonut\": true, \"addTooltip\": true, \"labels\": {\"values\": true, \"last_level\": true, \"truncate\": 100, \"show\": false}, \"legendPosition\": \"bottom\", \"addLegend\": true, \"type\": \"pie\"}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"field\": \"network.protocol\", \"otherBucketLabel\": \"Other\", \"otherBucket\": false, \"order\": \"desc\", \"size\": 10}, \"type\": \"terms\", \"enabled\": true, \"id\": \"2\", \"schema\": \"segment\"}], \"title\": \"Top Application Protocols [Filebeat Suricata] ECS\"}"
            }, 
            "id": "728f64c0-86db-11e8-b59d-21efb914e65c-ecs", 
            "type": "visualization", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }, 
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"query\": \"\", \"language\": \"kuery\"}}"
                }, 
                "savedSearchId": "13dd22f0-86cc-11e8-b59d-21efb914e65c-ecs", 
                "title": "Top Hosts Generating Events [Filebeat Suricata] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"histogram\", \"params\": {\"seriesParams\": [{\"showCircles\": true, \"show\": \"true\", \"data\": {\"id\": \"1\", \"label\": \"Count\"}, \"mode\": \"stacked\", \"drawLinesBetweenPoints\": true, \"valueAxis\": \"ValueAxis-1\", \"type\": \"histogram\"}], \"type\": \"histogram\", \"categoryAxes\": [{\"style\": {}, \"scale\": {\"type\": \"linear\"}, \"show\": true, \"title\": {}, \"labels\": {\"truncate\": 100, \"show\": true}, \"position\": \"bottom\", \"type\": \"category\", \"id\": \"CategoryAxis-1\"}], \"legendPosition\": \"right\", \"addTimeMarker\": false, \"addLegend\": true, \"grid\": {\"style\": {\"color\": \"#eee\"}, \"categoryLines\": false}, \"times\": [], \"addTooltip\": true, \"valueAxes\": [{\"style\": {}, \"scale\": {\"type\": \"linear\", \"mode\": \"normal\"}, \"name\": \"LeftAxis-1\", \"show\": true, \"title\": {\"text\": \"Count\"}, \"labels\": {\"filter\": false, \"rotate\": 0, \"truncate\": 100, \"show\": true}, \"position\": \"left\", \"type\": \"value\", \"id\": \"ValueAxis-1\"}]}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"customInterval\": \"2h\", \"field\": \"@timestamp\", \"interval\": \"auto\", \"min_doc_count\": 1, \"extended_bounds\": {}}, \"type\": \"date_histogram\", \"enabled\": true, \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"field\": \"host.name\", \"otherBucketLabel\": \"Other\", \"otherBucket\": false, \"order\": \"desc\", \"size\": 10}, \"type\": \"terms\", \"enabled\": true, \"id\": \"3\", \"schema\": \"group\"}], \"title\": \"Top Hosts Generating Events [Filebeat Suricata] ECS\"}"
            }, 
            "id": "9d5b5b50-86db-11e8-b59d-21efb914e65c-ecs", 
            "type": "visualization", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }, 
        {
            "attributes": {
                "columns": [
                    "host.name", 
                    "suricata.eve.event_type", 
                    "suricata.eve.flow_id", 
                    "network.transport", 
                    "source.ip", 
                    "source.port", 
                    "destination.ip", 
                    "destination.port", 
                    "destination.geo.region_name", 
                    "destination.geo.country_iso_code"
                ], 
                "description": "", 
                "hits": 0, 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [{\"query\": {\"match\": {\"suricata.eve.event_type\": {\"query\": \"stats\", \"type\": \"phrase\"}}}, \"meta\": {\"index\": \"filebeat-*\", \"value\": \"stats\", \"disabled\": false, \"alias\": null, \"params\": {\"query\": \"stats\", \"type\": \"phrase\"}, \"key\": \"suricata.eve.event_type\", \"negate\": true, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}}, {\"query\": {\"match\": {\"event.module\": {\"query\": \"suricata\", \"type\": \"phrase\"}}}, \"meta\": {\"index\": \"filebeat-*\", \"value\": \"suricata\", \"disabled\": false, \"alias\": null, \"params\": {\"query\": \"suricata\", \"type\": \"phrase\"}, \"key\": \"event.module\", \"negate\": false, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}}], \"index\": \"filebeat-*\", \"version\": true, \"highlightAll\": true, \"query\": {\"query\": \"\", \"language\": \"kuery\"}}"
                }, 
                "sort": [
                    "@timestamp", 
                    "desc"
                ], 
                "title": "Events [Filebeat Suricata] ECS", 
                "version": 1
            }, 
            "id": "13dd22f0-86cc-11e8-b59d-21efb914e65c-ecs", 
            "type": "search", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }, 
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"query\": \"\", \"language\": \"kuery\"}}"
                }, 
                "savedSearchId": "13dd22f0-86cc-11e8-b59d-21efb914e65c-ecs", 
                "title": "Top Connection Source Countries [Filebeat Suricata] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"tagcloud\", \"params\": {\"maxFontSize\": 72, \"showLabel\": true, \"minFontSize\": 18, \"orientation\": \"single\", \"scale\": \"linear\"}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"missingBucket\": false, \"customLabel\": \"Top Connection Source Countries\", \"missingBucketLabel\": \"Missing\", \"field\": \"source.geo.country_iso_code\", \"otherBucketLabel\": \"Other\", \"otherBucket\": false, \"order\": \"desc\", \"size\": 10}, \"type\": \"terms\", \"enabled\": true, \"id\": \"2\", \"schema\": \"segment\"}], \"title\": \"Top Connection Source Countries [Filebeat Suricata] ECS\"}"
            }, 
            "id": "5f99eb50-86dc-11e8-b59d-21efb914e65c-ecs", 
            "type": "visualization", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }, 
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"query\": \"\", \"language\": \"kuery\"}}"
                }, 
                "savedSearchId": "13dd22f0-86cc-11e8-b59d-21efb914e65c-ecs", 
                "title": "Top Connection Destination Countries [Filebeat Suricata] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"tagcloud\", \"params\": {\"maxFontSize\": 72, \"showLabel\": true, \"minFontSize\": 18, \"orientation\": \"single\", \"scale\": \"linear\"}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"missingBucket\": false, \"customLabel\": \"Top Connection Destination Countries\", \"missingBucketLabel\": \"Missing\", \"field\": \"destination.geo.country_iso_code\", \"otherBucketLabel\": \"Other\", \"otherBucket\": false, \"order\": \"desc\", \"size\": 10}, \"type\": \"terms\", \"enabled\": true, \"id\": \"2\", \"schema\": \"segment\"}], \"title\": \"Top Connection Destination Countries [Filebeat Suricata] ECS\"}"
            }, 
            "id": "8e7f88d0-86dc-11e8-b59d-21efb914e65c-ecs", 
            "type": "visualization", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }, 
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"query\": \"\", \"language\": \"kuery\"}}"
                }, 
                "savedSearchId": "13dd22f0-86cc-11e8-b59d-21efb914e65c-ecs", 
                "title": "Top Network Protocols [Filebeat Suricata] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"pie\", \"params\": {\"isDonut\": true, \"addTooltip\": true, \"labels\": {\"values\": true, \"last_level\": true, \"truncate\": 100, \"show\": false}, \"legendPosition\": \"bottom\", \"addLegend\": true, \"type\": \"pie\"}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"field\": \"network.transport\", \"otherBucketLabel\": \"Other\", \"otherBucket\": false, \"order\": \"desc\", \"size\": 10}, \"type\": \"terms\", \"enabled\": true, \"id\": \"2\", \"schema\": \"segment\"}], \"title\": \"Top Network Protocols [Filebeat Suricata] ECS\"}"
            }, 
            "id": "0a363820-86dd-11e8-b59d-21efb914e65c-ecs", 
            "type": "visualization", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }, 
        {
            "attributes": {
                "columns": [
                    "host.name", 
                    "suricata.eve.stats.detect.alert", 
                    "suricata.eve.stats.app_layer.flow.dns_udp", 
                    "suricata.eve.stats.app_layer.flow.tls", 
                    "suricata.eve.stats.app_layer.flow.http", 
                    "suricata.eve.stats.app_layer.flow.ssh", 
                    "suricata.eve.stats.tcp.sessions"
                ], 
                "description": "", 
                "hits": 0, 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [{\"query\": {\"match\": {\"suricata.eve.event_type\": {\"query\": \"stats\", \"type\": \"phrase\"}}}, \"meta\": {\"index\": \"filebeat-*\", \"value\": \"stats\", \"disabled\": false, \"alias\": null, \"params\": {\"query\": \"stats\", \"type\": \"phrase\"}, \"key\": \"suricata.eve.event_type\", \"negate\": false, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}}, {\"query\": {\"match\": {\"event.module\": {\"query\": \"suricata\", \"type\": \"phrase\"}}}, \"meta\": {\"index\": \"filebeat-*\", \"value\": \"suricata\", \"disabled\": false, \"alias\": null, \"params\": {\"query\": \"suricata\", \"type\": \"phrase\"}, \"key\": \"event.module\", \"negate\": false, \"type\": \"phrase\"}, \"$state\": {\"store\": \"appState\"}}], \"index\": \"filebeat-*\", \"version\": true, \"highlightAll\": true, \"query\": {\"query\": \"\", \"language\": \"kuery\"}}"
                }, 
                "sort": [
                    "@timestamp", 
                    "desc"
                ], 
                "title": "Host Stats [Filebeat Suricata] ECS", 
                "version": 1
            }, 
            "id": "d57a2db0-86ca-11e8-b59d-21efb914e65c-ecs", 
            "type": "search", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }, 
        {
            "attributes": {
                "description": "Overview of the Surcata events dashboard.", 
                "hits": 0, 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"version\": true, \"highlightAll\": true}"
                }, 
                "optionsJSON": "{\"useMargins\": true, \"darkTheme\": false, \"hidePanelTitles\": false}", 
                "panelsJSON": "[{\"gridData\": {\"i\": \"1\", \"h\": 10, \"y\": 0, \"w\": 48, \"x\": 0}, \"embeddableConfig\": {}, \"panelIndex\": \"1\", \"version\": \"6.3.0\", \"type\": \"visualization\", \"id\": \"c7d46c60-86da-11e8-b59d-21efb914e65c-ecs\"}, {\"gridData\": {\"i\": \"2\", \"h\": 14, \"y\": 20, \"w\": 9, \"x\": 0}, \"embeddableConfig\": {}, \"panelIndex\": \"2\", \"version\": \"6.3.0\", \"type\": \"visualization\", \"id\": \"0a0aa630-86db-11e8-b59d-21efb914e65c-ecs\"}, {\"gridData\": {\"i\": \"3\", \"h\": 14, \"y\": 20, \"w\": 11, \"x\": 19}, \"embeddableConfig\": {}, \"panelIndex\": \"3\", \"version\": \"6.3.0\", \"type\": \"visualization\", \"id\": \"728f64c0-86db-11e8-b59d-21efb914e65c-ecs\"}, {\"gridData\": {\"i\": \"4\", \"h\": 10, \"y\": 10, \"w\": 48, \"x\": 0}, \"embeddableConfig\": {}, \"panelIndex\": \"4\", \"version\": \"6.3.0\", \"type\": \"visualization\", \"id\": \"9d5b5b50-86db-11e8-b59d-21efb914e65c-ecs\"}, {\"gridData\": {\"i\": \"5\", \"h\": 19, \"y\": 34, \"w\": 48, \"x\": 0}, \"embeddableConfig\": {}, \"panelIndex\": \"5\", \"version\": \"6.3.0\", \"type\": \"search\", \"id\": \"13dd22f0-86cc-11e8-b59d-21efb914e65c-ecs\"}, {\"gridData\": {\"i\": \"6\", \"h\": 14, \"y\": 20, \"w\": 9, \"x\": 30}, \"embeddableConfig\": {}, \"panelIndex\": \"6\", \"version\": \"6.3.0\", \"type\": \"visualization\", \"id\": \"5f99eb50-86dc-11e8-b59d-21efb914e65c-ecs\"}, {\"gridData\": {\"i\": \"7\", \"h\": 14, \"y\": 20, \"w\": 9, \"x\": 39}, \"embeddableConfig\": {}, \"panelIndex\": \"7\", \"version\": \"6.3.0\", \"type\": \"visualization\", \"id\": \"8e7f88d0-86dc-11e8-b59d-21efb914e65c-ecs\"}, {\"gridData\": {\"i\": \"8\", \"h\": 14, \"y\": 20, \"w\": 10, \"x\": 9}, \"embeddableConfig\": {}, \"panelIndex\": \"8\", \"version\": \"6.3.0\", \"type\": \"visualization\", \"id\": \"0a363820-86dd-11e8-b59d-21efb914e65c-ecs\"}, {\"gridData\": {\"i\": \"9\", \"h\": 16, \"y\": 53, \"w\": 48, \"x\": 0}, \"embeddableConfig\": {}, \"panelIndex\": \"9\", \"version\": \"6.3.0\", \"type\": \"search\", \"id\": \"d57a2db0-86ca-11e8-b59d-21efb914e65c-ecs\"}]", 
                "timeRestore": false, 
                "title": "[Filebeat Suricata] Events Overview ECS", 
                "version": 1
            }, 
            "id": "78289c40-86da-11e8-b59d-21efb914e65c-ecs", 
            "type": "dashboard", 
            "updated_at": "2018-11-07T22:56:24.962Z", 
            "version": 1
        }
    ], 
    "version": "6.4.3"
}