{
    "objects": [
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                }, 
                "savedSearchId": "b6f321e0-fa25-11e6-bbd3-29c986c96e5a-ecs", 
                "title": "Sudo commands by user [Filebeat System] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"histogram\", \"listeners\": {}, \"params\": {\"scale\": \"linear\", \"legendPosition\": \"right\", \"addTimeMarker\": false, \"addLegend\": true, \"mode\": \"stacked\", \"defaultYExtents\": false, \"setYExtents\": false, \"addTooltip\": true, \"times\": []}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"customInterval\": \"2h\", \"field\": \"@timestamp\", \"interval\": \"auto\", \"min_doc_count\": 1, \"extended_bounds\": {}}, \"type\": \"date_histogram\", \"enabled\": true, \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"user.name\", \"order\": \"desc\", \"size\": 5}, \"type\": \"terms\", \"enabled\": true, \"id\": \"3\", \"schema\": \"group\"}], \"title\": \"Sudo commands by user ECS\"}"
            }, 
            "id": "5c7af030-fa2a-11e6-bbd3-29c986c96e5a-ecs", 
            "type": "visualization", 
            "version": 2
        }, 
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"index\": \"filebeat-*\", \"highlightAll\": true, \"query\": {\"query\": \"system.auth.sudo.error:*\", \"language\": \"kuery\"}}"
                }, 
                "title": "Sudo errors [Filebeat System] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"histogram\", \"listeners\": {}, \"params\": {\"scale\": \"linear\", \"legendPosition\": \"right\", \"addTimeMarker\": false, \"addLegend\": true, \"mode\": \"stacked\", \"defaultYExtents\": false, \"setYExtents\": false, \"addTooltip\": true, \"times\": []}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"customInterval\": \"2h\", \"field\": \"@timestamp\", \"interval\": \"auto\", \"min_doc_count\": 1, \"extended_bounds\": {}}, \"type\": \"date_histogram\", \"enabled\": true, \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"system.auth.sudo.error\", \"order\": \"desc\", \"size\": 5}, \"type\": \"terms\", \"enabled\": true, \"id\": \"3\", \"schema\": \"group\"}], \"title\": \"Sudo errors ECS\"}"
            }, 
            "id": "51164310-fa2b-11e6-bbd3-29c986c96e5a-ecs", 
            "type": "visualization", 
            "version": 2
        }, 
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                }, 
                "savedSearchId": "b6f321e0-fa25-11e6-bbd3-29c986c96e5a-ecs", 
                "title": "Top sudo commands [Filebeat System] ECS", 
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}", 
                "version": 1, 
                "visState": "{\"type\": \"table\", \"listeners\": {}, \"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\", \"showTotal\": false, \"showMeticsAtAllLevels\": false}, \"aggs\": [{\"params\": {}, \"type\": \"count\", \"enabled\": true, \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"system.auth.sudo.command\", \"order\": \"desc\", \"size\": 5}, \"type\": \"terms\", \"enabled\": true, \"id\": \"2\", \"schema\": \"bucket\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"user.name\", \"order\": \"desc\", \"size\": 5}, \"type\": \"terms\", \"enabled\": true, \"id\": \"3\", \"schema\": \"bucket\"}], \"title\": \"Top sudo commands ECS\"}"
            }, 
            "id": "dc589770-fa2b-11e6-bbd3-29c986c96e5a-ecs", 
            "type": "visualization", 
            "version": 2
        }, 
        {
            "attributes": {
                "description": "", 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{}"
                }, 
                "title": "Dashboards [Filebeat System] ECS", 
                "uiStateJSON": "{}", 
                "version": 1, 
                "visState": "{\"type\": \"markdown\", \"params\": {\"markdown\": \"[Syslog](#/dashboard/Filebeat-syslog-dashboard-ecs) | [Sudo commands](#/dashboard/277876d0-fa2c-11e6-bbd3-29c986c96e5a-ecs) | [SSH logins](#/dashboard/5517a150-f9ce-11e6-8115-a7c18106d86a-ecs) | [New users and groups](#/dashboard/0d3f2380-fa78-11e6-ae9b-81e5311e8cab-ecs)\", \"fontSize\": 12}, \"aggs\": [], \"title\": \"Dashboards [Filebeat System] ECS\"}"
            }, 
            "id": "327417e0-8462-11e7-bab8-bd2f0fb42c54-ecs", 
            "type": "visualization", 
            "version": 1
        }, 
        {
            "attributes": {
                "columns": [
                    "user.name", 
                    "system.auth.sudo.user", 
                    "system.auth.sudo.pwd", 
                    "system.auth.sudo.command"
                ], 
                "description": "", 
                "hits": 0, 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"index\": \"filebeat-*\", \"highlightAll\": true, \"query\": {\"query\": \"system.auth.sudo:*\", \"language\": \"kuery\"}}"
                }, 
                "sort": [
                    "@timestamp", 
                    "desc"
                ], 
                "title": "Sudo commands [Filebeat System] ECS", 
                "version": 1
            }, 
            "id": "b6f321e0-fa25-11e6-bbd3-29c986c96e5a-ecs", 
            "type": "search", 
            "version": 2
        }, 
        {
            "attributes": {
                "description": "Sudo commands dashboard from the Filebeat System module", 
                "hits": 0, 
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"version\": true, \"highlightAll\": true}"
                }, 
                "optionsJSON": "{\"darkTheme\": false}", 
                "panelsJSON": "[{\"type\": \"visualization\", \"id\": \"5c7af030-fa2a-11e6-bbd3-29c986c96e5a-ecs\", \"size_x\": 12, \"size_y\": 4, \"panelIndex\": 1, \"col\": 1, \"row\": 6}, {\"type\": \"visualization\", \"id\": \"51164310-fa2b-11e6-bbd3-29c986c96e5a-ecs\", \"size_x\": 12, \"size_y\": 3, \"panelIndex\": 2, \"col\": 1, \"row\": 10}, {\"type\": \"visualization\", \"id\": \"dc589770-fa2b-11e6-bbd3-29c986c96e5a-ecs\", \"size_x\": 12, \"size_y\": 4, \"panelIndex\": 3, \"col\": 1, \"row\": 2}, {\"type\": \"visualization\", \"id\": \"327417e0-8462-11e7-bab8-bd2f0fb42c54-ecs\", \"size_x\": 12, \"size_y\": 1, \"panelIndex\": 4, \"col\": 1, \"row\": 1}]", 
                "timeRestore": false, 
                "title": "[Filebeat System] Sudo commands ECS", 
                "uiStateJSON": "{\"P-3\": {\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}}", 
                "version": 1
            }, 
            "id": "277876d0-fa2c-11e6-bbd3-29c986c96e5a-ecs", 
            "type": "dashboard", 
            "version": 6
        }
    ], 
    "version": "6.0.0-beta1-SNAPSHOT"
}