{
    "objects": [
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "title": "Description [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [], \"params\": {\"fontSize\": 12, \"markdown\": \"![Santa Icon](https://raw.githubusercontent.com/google/santa/master/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png)\\n\\nGoogle Santa is a binary whitelisting/blacklisting system for macOS that monitors process executions.\", \"openLinksInNewTab\": false}, \"title\": \"Description [Filebeat Santa] ECS\", \"type\": \"markdown\"}"
            },
            "id": "dad521d0-ff69-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:31:14.285Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "title": "Decisions [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [], \"params\": {\"axis_formatter\": \"number\", \"axis_position\": \"left\", \"axis_scale\": \"normal\", \"filter\": \"event.module:santa AND event.dataset:log\", \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"index_pattern\": \"filebeat-*\", \"interval\": \"auto\", \"series\": [{\"axis_position\": \"right\", \"chart_type\": \"line\", \"color\": \"#68BC00\", \"fill\": 0.5, \"formatter\": \"number\", \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"label\": \"Decision\", \"line_width\": 1, \"metrics\": [{\"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\", \"type\": \"count\"}], \"point_size\": 1, \"separate_axis\": 0, \"split_mode\": \"terms\", \"stacked\": \"none\", \"terms_field\": \"santa.decision\"}], \"show_grid\": 1, \"show_legend\": 1, \"time_field\": \"@timestamp\", \"type\": \"timeseries\"}, \"title\": \"Decisions [Filebeat Santa] ECS\", \"type\": \"metrics\"}"
            },
            "id": "1579d690-ff6b-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:40:02.169Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
                "title": "Total Events [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"enabled\": true, \"id\": \"1\", \"params\": {\"customLabel\": \"Total Events\"}, \"schema\": \"metric\", \"type\": \"count\"}], \"params\": {\"addLegend\": false, \"addTooltip\": true, \"metric\": {\"colorSchema\": \"Green to Red\", \"colorsRange\": [{\"from\": 0, \"to\": 10000}], \"invertColors\": false, \"labels\": {\"show\": true}, \"metricColorMode\": \"None\", \"percentageMode\": false, \"style\": {\"bgColor\": false, \"bgFill\": \"#000\", \"fontSize\": 60, \"labelColor\": false, \"subText\": \"\"}, \"useRanges\": false}, \"type\": \"metric\"}, \"title\": \"Total Events [Filebeat Santa] ECS\", \"type\": \"metric\"}"
            },
            "id": "51677b80-ff6b-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:41:42.712Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
                "title": "Decision and Reason [Filebeat Santa] ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"ALLOW\": \"#7EB26D\"}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"enabled\": true, \"id\": \"1\", \"params\": {}, \"schema\": \"metric\", \"type\": \"count\"}, {\"enabled\": true, \"id\": \"2\", \"params\": {\"customLabel\": \"Decision\", \"field\": \"santa.decision\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"order\": \"desc\", \"orderBy\": \"1\", \"otherBucket\": false, \"otherBucketLabel\": \"Other\", \"size\": 5}, \"schema\": \"segment\", \"type\": \"terms\"}, {\"enabled\": true, \"id\": \"3\", \"params\": {\"customLabel\": \"Reason\", \"field\": \"santa.reason\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"order\": \"desc\", \"orderBy\": \"1\", \"otherBucket\": false, \"otherBucketLabel\": \"Other\", \"size\": 5}, \"schema\": \"segment\", \"type\": \"terms\"}], \"params\": {\"addLegend\": true, \"addTooltip\": true, \"isDonut\": true, \"labels\": {\"last_level\": true, \"show\": false, \"truncate\": 100, \"values\": true}, \"legendPosition\": \"right\", \"type\": \"pie\"}, \"title\": \"Decision and Reason [Filebeat Santa] ECS\", \"type\": \"pie\"}"
            },
            "id": "30962fe0-ff6c-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:47:57.150Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
                "title": "Num of Hosts Reporting [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"enabled\": true, \"id\": \"1\", \"params\": {\"customLabel\": \"Hosts Reporting\", \"field\": \"agent.hostname\"}, \"schema\": \"metric\", \"type\": \"cardinality\"}], \"params\": {\"addLegend\": false, \"addTooltip\": true, \"metric\": {\"colorSchema\": \"Green to Red\", \"colorsRange\": [{\"from\": 0, \"to\": 10000}], \"invertColors\": false, \"labels\": {\"show\": true}, \"metricColorMode\": \"None\", \"percentageMode\": false, \"style\": {\"bgColor\": false, \"bgFill\": \"#000\", \"fontSize\": 60, \"labelColor\": false, \"subText\": \"\"}, \"useRanges\": false}, \"type\": \"metric\"}, \"title\": \"Num of Hosts Reporting [Filebeat Santa] ECS\", \"type\": \"metric\"}"
            },
            "id": "b06c0460-ff6c-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:51:31.622Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
                "title": "Code Signers [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"enabled\": true, \"id\": \"1\", \"params\": {}, \"schema\": \"metric\", \"type\": \"count\"}, {\"enabled\": true, \"id\": \"2\", \"params\": {\"field\": \"certificate.common_name\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"order\": \"desc\", \"orderBy\": \"1\", \"otherBucket\": false, \"otherBucketLabel\": \"Other\", \"size\": 5}, \"schema\": \"segment\", \"type\": \"terms\"}], \"params\": {\"maxFontSize\": 39, \"minFontSize\": 12, \"orientation\": \"single\", \"scale\": \"linear\", \"showLabel\": true}, \"title\": \"Code Signers [Filebeat Santa] ECS\", \"type\": \"tagcloud\"}"
            },
            "id": "11858000-ff6d-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:57:58.885Z",
            "version": 2
        },
        {
            "attributes": {
                "columns": [
                    "agent.hostname",
                    "process.executable",
                    "user.name",
                    "certificate.common_name"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [{\"$state\": {\"store\": \"appState\"}, \"meta\": {\"alias\": null, \"disabled\": false, \"index\": \"filebeat-*\", \"key\": \"event.module\", \"negate\": false, \"params\": {\"query\": \"santa\", \"type\": \"phrase\"}, \"type\": \"phrase\", \"value\": \"santa\"}, \"query\": {\"match\": {\"event.module\": {\"query\": \"santa\", \"type\": \"phrase\"}}}}, {\"$state\": {\"store\": \"appState\"}, \"meta\": {\"alias\": null, \"disabled\": false, \"index\": \"filebeat-*\", \"key\": \"event.dataset\", \"negate\": false, \"params\": {\"query\": \"log\", \"type\": \"phrase\"}, \"type\": \"phrase\", \"value\": \"log\"}, \"query\": {\"match\": {\"event.dataset\": {\"query\": \"log\", \"type\": \"phrase\"}}}}], \"highlightAll\": true, \"index\": \"filebeat-*\", \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"version\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "Santa Logs Search [Filebeat Santa] ECS",
                "version": 1
            },
            "id": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "search",
            "updated_at": "2018-12-14T06:57:11.037Z",
            "version": 2
        },
        {
            "attributes": {
                "description": "Process executions on macOS monitored by Google Santa.",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "optionsJSON": "{\"darkTheme\": false, \"hidePanelTitles\": false, \"useMargins\": true}",
                "panelsJSON": "[{\"embeddableConfig\": {}, \"gridData\": {\"h\": 12, \"i\": \"1\", \"w\": 10, \"x\": 0, \"y\": 0}, \"id\": \"dad521d0-ff69-11e8-93c5-d5ecd1b3e307-ecs\", \"panelIndex\": \"1\", \"type\": \"visualization\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"embeddableConfig\": {}, \"gridData\": {\"h\": 12, \"i\": \"2\", \"w\": 38, \"x\": 10, \"y\": 0}, \"id\": \"1579d690-ff6b-11e8-93c5-d5ecd1b3e307-ecs\", \"panelIndex\": \"2\", \"type\": \"visualization\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"embeddableConfig\": {}, \"gridData\": {\"h\": 10, \"i\": \"3\", \"w\": 10, \"x\": 8, \"y\": 12}, \"id\": \"51677b80-ff6b-11e8-93c5-d5ecd1b3e307-ecs\", \"panelIndex\": \"3\", \"type\": \"visualization\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"embeddableConfig\": {}, \"gridData\": {\"h\": 10, \"i\": \"4\", \"w\": 12, \"x\": 36, \"y\": 12}, \"id\": \"30962fe0-ff6c-11e8-93c5-d5ecd1b3e307-ecs\", \"panelIndex\": \"4\", \"type\": \"visualization\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"embeddableConfig\": {}, \"gridData\": {\"h\": 10, \"i\": \"5\", \"w\": 8, \"x\": 0, \"y\": 12}, \"id\": \"b06c0460-ff6c-11e8-93c5-d5ecd1b3e307-ecs\", \"panelIndex\": \"5\", \"type\": \"visualization\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"embeddableConfig\": {}, \"gridData\": {\"h\": 10, \"i\": \"6\", \"w\": 18, \"x\": 18, \"y\": 12}, \"id\": \"11858000-ff6d-11e8-93c5-d5ecd1b3e307-ecs\", \"panelIndex\": \"6\", \"type\": \"visualization\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"embeddableConfig\": {}, \"gridData\": {\"h\": 10, \"i\": \"7\", \"w\": 48, \"x\": 0, \"y\": 22}, \"id\": \"6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs\", \"panelIndex\": \"7\", \"type\": \"search\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}]",
                "timeRestore": false,
                "title": "[Filebeat Santa] Overview ECS",
                "version": 1
            },
            "id": "161855f0-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "dashboard",
            "updated_at": "2018-12-14T06:58:23.367Z",
            "version": 5
        }
    ],
    "version": "7.0.0-alpha1-SNAPSHOT"
}