{
    "objects": [
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Description [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [], \"type\": \"markdown\", \"params\": {\"fontSize\": 12, \"openLinksInNewTab\": false, \"markdown\": \"![Santa Icon](https://raw.githubusercontent.com/google/santa/master/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png)\\n\\nGoogle Santa is a binary whitelisting/blacklisting system for macOS that monitors process executions.\"}, \"title\": \"Description [Filebeat Santa] ECS\"}"
            },
            "id": "dad521d0-ff69-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:31:14.285Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Decisions [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [], \"type\": \"metrics\", \"params\": {\"axis_scale\": \"normal\", \"show_grid\": 1, \"time_field\": \"@timestamp\", \"filter\": \"event.module:santa AND event.dataset:log\", \"interval\": \"auto\", \"show_legend\": 1, \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"axis_position\": \"left\", \"series\": [{\"separate_axis\": 0, \"terms_field\": \"santa.decision\", \"label\": \"Decision\", \"formatter\": \"number\", \"chart_type\": \"line\", \"fill\": 0.5, \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"color\": \"#68BC00\", \"split_mode\": \"terms\", \"point_size\": 1, \"metrics\": [{\"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\", \"type\": \"count\"}], \"stacked\": \"none\", \"axis_position\": \"right\", \"line_width\": 1}], \"axis_formatter\": \"number\", \"type\": \"timeseries\", \"index_pattern\": \"filebeat-*\"}, \"title\": \"Decisions [Filebeat Santa] ECS\"}"
            },
            "id": "1579d690-ff6b-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:40:02.169Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "savedSearchId": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
                "title": "Total Events [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Total Events\"}, \"enabled\": true}], \"type\": \"metric\", \"params\": {\"addTooltip\": true, \"metric\": {\"metricColorMode\": \"None\", \"percentageMode\": false, \"useRanges\": false, \"style\": {\"fontSize\": 60, \"subText\": \"\", \"labelColor\": false, \"bgFill\": \"#000\", \"bgColor\": false}, \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"from\": 0, \"to\": 10000}]}, \"addLegend\": false, \"type\": \"metric\"}, \"title\": \"Total Events [Filebeat Santa] ECS\"}"
            },
            "id": "51677b80-ff6b-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:41:42.712Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "savedSearchId": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
                "title": "Decision and Reason [Filebeat Santa] ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"ALLOW\": \"#7EB26D\"}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\", \"params\": {}, \"enabled\": true}, {\"type\": \"terms\", \"id\": \"2\", \"schema\": \"segment\", \"params\": {\"size\": 5, \"customLabel\": \"Decision\", \"otherBucket\": false, \"missingBucketLabel\": \"Missing\", \"order\": \"desc\", \"orderBy\": \"1\", \"otherBucketLabel\": \"Other\", \"field\": \"santa.decision\", \"missingBucket\": false}, \"enabled\": true}, {\"type\": \"terms\", \"id\": \"3\", \"schema\": \"segment\", \"params\": {\"size\": 5, \"customLabel\": \"Reason\", \"otherBucket\": false, \"missingBucketLabel\": \"Missing\", \"order\": \"desc\", \"orderBy\": \"1\", \"otherBucketLabel\": \"Other\", \"field\": \"santa.reason\", \"missingBucket\": false}, \"enabled\": true}], \"type\": \"pie\", \"params\": {\"isDonut\": true, \"addLegend\": true, \"addTooltip\": true, \"legendPosition\": \"right\", \"type\": \"pie\", \"labels\": {\"show\": false, \"truncate\": 100, \"last_level\": true, \"values\": true}}, \"title\": \"Decision and Reason [Filebeat Santa] ECS\"}"
            },
            "id": "30962fe0-ff6c-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:47:57.150Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "savedSearchId": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
                "title": "Num of Hosts Reporting [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"type\": \"cardinality\", \"id\": \"1\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Hosts Reporting\", \"field\": \"agent.hostname\"}, \"enabled\": true}], \"type\": \"metric\", \"params\": {\"addTooltip\": true, \"metric\": {\"metricColorMode\": \"None\", \"percentageMode\": false, \"useRanges\": false, \"style\": {\"fontSize\": 60, \"subText\": \"\", \"labelColor\": false, \"bgFill\": \"#000\", \"bgColor\": false}, \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"from\": 0, \"to\": 10000}]}, \"addLegend\": false, \"type\": \"metric\"}, \"title\": \"Num of Hosts Reporting [Filebeat Santa] ECS\"}"
            },
            "id": "b06c0460-ff6c-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:51:31.622Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "savedSearchId": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
                "title": "Code Signers [Filebeat Santa] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\", \"params\": {}, \"enabled\": true}, {\"type\": \"terms\", \"id\": \"2\", \"schema\": \"segment\", \"params\": {\"size\": 5, \"otherBucket\": false, \"missingBucketLabel\": \"Missing\", \"order\": \"desc\", \"orderBy\": \"1\", \"otherBucketLabel\": \"Other\", \"field\": \"certificate.common_name\", \"missingBucket\": false}, \"enabled\": true}], \"type\": \"tagcloud\", \"params\": {\"orientation\": \"single\", \"maxFontSize\": 39, \"showLabel\": true, \"scale\": \"linear\", \"minFontSize\": 12}, \"title\": \"Code Signers [Filebeat Santa] ECS\"}"
            },
            "id": "11858000-ff6d-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "visualization",
            "updated_at": "2018-12-14T06:57:58.885Z",
            "version": 2
        },
        {
            "attributes": {
                "columns": [
                    "agent.hostname",
                    "process.executable",
                    "user.name",
                    "certificate.common_name"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"index\": \"filebeat-*\", \"filter\": [{\"query\": {\"match\": {\"event.module\": {\"query\": \"santa\", \"type\": \"phrase\"}}}, \"meta\": {\"disabled\": false, \"value\": \"santa\", \"negate\": false, \"params\": {\"query\": \"santa\", \"type\": \"phrase\"}, \"key\": \"event.module\", \"index\": \"filebeat-*\", \"type\": \"phrase\", \"alias\": null}, \"$state\": {\"store\": \"appState\"}}, {\"query\": {\"match\": {\"event.dataset\": {\"query\": \"log\", \"type\": \"phrase\"}}}, \"meta\": {\"disabled\": false, \"value\": \"log\", \"negate\": false, \"params\": {\"query\": \"log\", \"type\": \"phrase\"}, \"key\": \"event.dataset\", \"index\": \"filebeat-*\", \"type\": \"phrase\", \"alias\": null}, \"$state\": {\"store\": \"appState\"}}], \"highlightAll\": true, \"version\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "Santa Logs Search [Filebeat Santa] ECS",
                "version": 1
            },
            "id": "6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "search",
            "updated_at": "2018-12-14T06:57:11.037Z",
            "version": 2
        },
        {
            "attributes": {
                "description": "Process executions on macOS monitored by Google Santa.",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "optionsJSON": "{\"darkTheme\": false, \"useMargins\": true, \"hidePanelTitles\": false}",
                "panelsJSON": "[{\"id\": \"dad521d0-ff69-11e8-93c5-d5ecd1b3e307-ecs\", \"gridData\": {\"y\": 0, \"w\": 10, \"i\": \"1\", \"x\": 0, \"h\": 12}, \"embeddableConfig\": {}, \"type\": \"visualization\", \"panelIndex\": \"1\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"id\": \"1579d690-ff6b-11e8-93c5-d5ecd1b3e307-ecs\", \"gridData\": {\"y\": 0, \"w\": 38, \"i\": \"2\", \"x\": 10, \"h\": 12}, \"embeddableConfig\": {}, \"type\": \"visualization\", \"panelIndex\": \"2\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"id\": \"51677b80-ff6b-11e8-93c5-d5ecd1b3e307-ecs\", \"gridData\": {\"y\": 12, \"w\": 10, \"i\": \"3\", \"x\": 8, \"h\": 10}, \"embeddableConfig\": {}, \"type\": \"visualization\", \"panelIndex\": \"3\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"id\": \"30962fe0-ff6c-11e8-93c5-d5ecd1b3e307-ecs\", \"gridData\": {\"y\": 12, \"w\": 12, \"i\": \"4\", \"x\": 36, \"h\": 10}, \"embeddableConfig\": {}, \"type\": \"visualization\", \"panelIndex\": \"4\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"id\": \"b06c0460-ff6c-11e8-93c5-d5ecd1b3e307-ecs\", \"gridData\": {\"y\": 12, \"w\": 8, \"i\": \"5\", \"x\": 0, \"h\": 10}, \"embeddableConfig\": {}, \"type\": \"visualization\", \"panelIndex\": \"5\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"id\": \"11858000-ff6d-11e8-93c5-d5ecd1b3e307-ecs\", \"gridData\": {\"y\": 12, \"w\": 18, \"i\": \"6\", \"x\": 18, \"h\": 10}, \"embeddableConfig\": {}, \"type\": \"visualization\", \"panelIndex\": \"6\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}, {\"id\": \"6d56a010-ff6a-11e8-93c5-d5ecd1b3e307-ecs\", \"gridData\": {\"y\": 22, \"w\": 48, \"i\": \"7\", \"x\": 0, \"h\": 10}, \"embeddableConfig\": {}, \"type\": \"search\", \"panelIndex\": \"7\", \"version\": \"7.0.0-alpha1-SNAPSHOT\"}]",
                "timeRestore": false,
                "title": "[Filebeat Santa] Overview ECS",
                "version": 1
            },
            "id": "161855f0-ff6a-11e8-93c5-d5ecd1b3e307-ecs",
            "type": "dashboard",
            "updated_at": "2018-12-14T06:58:23.367Z",
            "version": 5
        }
    ],
    "version": "7.0.0-alpha1-SNAPSHOT"
}