{
    "objects": [
        {
            "attributes": {
                "columns": [
                    "osquery.result.columns.path",
                    "osquery.result.columns.type",
                    "osquery.result.columns.flags"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"index\": \"filebeat-*\", \"filter\": [{\"query\": {\"match\": {\"osquery.result.name\": {\"query\": \"pack_it-compliance_mounts\", \"type\": \"phrase\"}}}, \"meta\": {\"disabled\": false, \"value\": \"pack_it-compliance_mounts\", \"negate\": false, \"params\": {\"query\": \"pack_it-compliance_mounts\", \"type\": \"phrase\"}, \"key\": \"osquery.result.name\", \"index\": \"filebeat-*\", \"type\": \"phrase\", \"alias\": null}, \"$state\": {\"store\": \"appState\"}}], \"highlightAll\": true, \"version\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "Mounts [Filebeat Osquery] ECS",
                "version": 1
            },
            "id": "7a9482d0-eb00-11e7-8f04-51231daa5b05-ecs",
            "type": "search",
            "updated_at": "2018-01-08T17:35:32.102Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "savedSearchId": "7a9482d0-eb00-11e7-8f04-51231daa5b05-ecs",
                "title": "Mounts by type [Filebeat Osquery] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\", \"params\": {}, \"enabled\": true}, {\"type\": \"terms\", \"id\": \"2\", \"schema\": \"segment\", \"params\": {\"order\": \"desc\", \"orderBy\": \"1\", \"field\": \"osquery.result.columns.path\", \"size\": 10}, \"enabled\": true}, {\"type\": \"terms\", \"id\": \"3\", \"schema\": \"segment\", \"params\": {\"order\": \"desc\", \"orderBy\": \"1\", \"field\": \"osquery.result.columns.type\", \"size\": 5}, \"enabled\": true}], \"type\": \"pie\", \"params\": {\"isDonut\": true, \"addLegend\": true, \"addTooltip\": true, \"legendPosition\": \"right\", \"type\": \"pie\", \"labels\": {\"show\": false, \"truncate\": 100, \"last_level\": true, \"values\": true}}, \"title\": \"Mounts by type [Filebeat Osquery] ECS\"}"
            },
            "id": "a9fd8bb0-eb01-11e7-8f04-51231daa5b05-ecs",
            "type": "visualization",
            "updated_at": "2018-01-08T17:35:32.102Z",
            "version": 1
        },
        {
            "attributes": {
                "columns": [
                    "osquery.result.columns.name",
                    "osquery.result.columns.version",
                    "osquery.result.columns.revision"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"index\": \"filebeat-*\", \"filter\": [{\"query\": {\"match\": {\"osquery.result.name\": {\"query\": \"pack_it-compliance_deb_packages\", \"type\": \"phrase\"}}}, \"meta\": {\"disabled\": false, \"value\": \"pack_it-compliance_deb_packages\", \"negate\": false, \"params\": {\"query\": \"pack_it-compliance_deb_packages\", \"type\": \"phrase\"}, \"key\": \"osquery.result.name\", \"index\": \"filebeat-*\", \"type\": \"phrase\", \"alias\": null}, \"$state\": {\"store\": \"appState\"}}], \"highlightAll\": true, \"version\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "DEB packages installed [Filebeat Osquery] ECS",
                "version": 1
            },
            "id": "3824b080-eb02-11e7-8f04-51231daa5b05-ecs",
            "type": "search",
            "updated_at": "2018-01-08T17:35:32.102Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "savedSearchId": "b5d6baa0-eb02-11e7-8f04-51231daa5b05-ecs",
                "title": "OS versions [Filebeat Osquery] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"type\": \"cardinality\", \"id\": \"1\", \"schema\": \"metric\", \"params\": {\"field\": \"osquery.result.host_identifier\"}, \"enabled\": true}, {\"type\": \"terms\", \"id\": \"4\", \"schema\": \"segment\", \"params\": {\"order\": \"desc\", \"orderBy\": \"1\", \"field\": \"osquery.result.columns.platform_like\", \"size\": 5}, \"enabled\": true}, {\"type\": \"terms\", \"id\": \"2\", \"schema\": \"segment\", \"params\": {\"order\": \"desc\", \"orderBy\": \"1\", \"field\": \"osquery.result.columns.name\", \"size\": 5}, \"enabled\": true}, {\"type\": \"terms\", \"id\": \"3\", \"schema\": \"segment\", \"params\": {\"order\": \"desc\", \"orderBy\": \"1\", \"field\": \"osquery.result.columns.version\", \"size\": 5}, \"enabled\": true}], \"type\": \"pie\", \"params\": {\"isDonut\": true, \"addLegend\": true, \"addTooltip\": true, \"legendPosition\": \"right\", \"type\": \"pie\", \"labels\": {\"show\": false, \"truncate\": 100, \"last_level\": true, \"values\": true}}, \"title\": \"OS versions [Filebeat Osquery] ECS\"}"
            },
            "id": "1da1ed30-eb03-11e7-8f04-51231daa5b05-ecs",
            "type": "visualization",
            "updated_at": "2018-01-08T17:35:32.102Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [{\"query\": {\"match\": {\"osquery.result.columns.status\": {\"query\": \"Live\", \"type\": \"phrase\"}}}, \"meta\": {\"disabled\": false, \"value\": \"Live\", \"negate\": false, \"params\": {\"query\": \"Live\", \"type\": \"phrase\"}, \"key\": \"osquery.result.columns.status\", \"index\": \"filebeat-*\", \"type\": \"phrase\", \"alias\": null}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "savedSearchId": "f59e21e0-eb03-11e7-8f04-51231daa5b05-ecs",
                "title": "Number of Kernel modules [Filebeat Osquery] ECS",
                "uiStateJSON": "{\"vis\": {\"defaultColors\": {\"0 - 100\": \"rgb(0,104,55)\"}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"type\": \"cardinality\", \"id\": \"1\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Live Kernel modules\", \"field\": \"osquery.result.columns.name\"}, \"enabled\": true}], \"type\": \"gauge\", \"params\": {\"addTooltip\": true, \"isDisplayWarning\": false, \"gauge\": {\"verticalSplit\": false, \"gaugeColorMode\": \"Labels\", \"invertColors\": false, \"orientation\": \"vertical\", \"labels\": {\"show\": true, \"color\": \"black\"}, \"colorsRange\": [{\"from\": 0, \"to\": 100}], \"percentageMode\": false, \"extendRange\": true, \"scale\": {\"show\": true, \"labels\": false, \"color\": \"#333\"}, \"backStyle\": \"Full\", \"style\": {\"bgMask\": false, \"fontSize\": 60, \"labelColor\": true, \"bgFill\": \"#eee\", \"bgColor\": false, \"width\": 0.9, \"bgWidth\": 0.9, \"subText\": \"\", \"mask\": false, \"maskBars\": 50}, \"gaugeType\": \"Arc\", \"gaugeStyle\": \"Full\", \"type\": \"meter\", \"colorSchema\": \"Green to Red\"}, \"addLegend\": true, \"type\": \"gauge\"}, \"title\": \"Number of Kernel modules [Filebeat Osquery] ECS\"}"
            },
            "id": "240f3630-eb05-11e7-8f04-51231daa5b05-ecs",
            "type": "visualization",
            "updated_at": "2018-01-08T17:35:32.102Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{}"
                },
                "title": "Navigation [Filebeat Osquery] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [], \"type\": \"markdown\", \"params\": {\"fontSize\": 10, \"markdown\": \"[Compilance](#/dashboard/69f5ae20-eb02-11e7-8f04-51231daa5b05-ecs) | [OSSEC Rootkit](#/dashboard/c0a7ce90-f4aa-11e7-8647-534bb4c21040-ecs)\"}, \"title\": \"Navigation [Filebeat Osquery] ECS\"}"
            },
            "id": "2d6e0760-f4ab-11e7-8647-534bb4c21040-ecs",
            "type": "visualization",
            "updated_at": "2018-01-08T19:41:10.264Z",
            "version": 3
        },
        {
            "attributes": {
                "columns": [
                    "osquery.result.name"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"index\": \"filebeat-*\", \"filter\": [{\"query\": {\"match\": {\"osquery.result.name\": {\"query\": \"pack_it-compliance_os_version\", \"type\": \"phrase\"}}}, \"meta\": {\"disabled\": false, \"value\": \"pack_it-compliance_os_version\", \"negate\": false, \"params\": {\"query\": \"pack_it-compliance_os_version\", \"type\": \"phrase\"}, \"key\": \"osquery.result.name\", \"index\": \"filebeat-*\", \"type\": \"phrase\", \"alias\": null}, \"$state\": {\"store\": \"appState\"}}], \"highlightAll\": true, \"version\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "OS versions [Filebeat Osquery] ECS",
                "version": 1
            },
            "id": "b5d6baa0-eb02-11e7-8f04-51231daa5b05-ecs",
            "type": "search",
            "updated_at": "2018-01-08T17:35:32.102Z",
            "version": 1
        },
        {
            "attributes": {
                "columns": [
                    "osquery.result.name",
                    "osquery.result.columns.name",
                    "osquery.result.columns.status"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"index\": \"filebeat-*\", \"filter\": [{\"query\": {\"match\": {\"osquery.result.name\": {\"query\": \"pack_it-compliance_kernel_modules\", \"type\": \"phrase\"}}}, \"meta\": {\"disabled\": false, \"value\": \"pack_it-compliance_kernel_modules\", \"negate\": false, \"params\": {\"query\": \"pack_it-compliance_kernel_modules\", \"type\": \"phrase\"}, \"key\": \"osquery.result.name\", \"index\": \"filebeat-*\", \"type\": \"phrase\", \"alias\": null}, \"$state\": {\"store\": \"appState\"}}], \"highlightAll\": true, \"version\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "Kernel modules [Filebeat Osquery] ECS",
                "version": 1
            },
            "id": "f59e21e0-eb03-11e7-8f04-51231daa5b05-ecs",
            "type": "search",
            "updated_at": "2018-01-08T17:35:32.102Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "Dashboard for visualizing the data collected by the Osquery compliance pack.",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"highlightAll\": true, \"version\": true}"
                },
                "optionsJSON": "{\"darkTheme\": false, \"useMargins\": true, \"hidePanelTitles\": false}",
                "panelsJSON": "[{\"version\": \"6.2.4\", \"id\": \"7a9482d0-eb00-11e7-8f04-51231daa5b05-ecs\", \"gridData\": {\"y\": 6, \"w\": 6, \"i\": \"1\", \"x\": 6, \"h\": 4}, \"panelIndex\": \"1\", \"type\": \"search\"}, {\"version\": \"6.2.4\", \"id\": \"a9fd8bb0-eb01-11e7-8f04-51231daa5b05-ecs\", \"gridData\": {\"y\": 1, \"w\": 7, \"i\": \"2\", \"x\": 5, \"h\": 5}, \"panelIndex\": \"2\", \"type\": \"visualization\"}, {\"version\": \"6.2.4\", \"id\": \"3824b080-eb02-11e7-8f04-51231daa5b05-ecs\", \"gridData\": {\"y\": 6, \"w\": 6, \"i\": \"3\", \"x\": 0, \"h\": 4}, \"panelIndex\": \"3\", \"type\": \"search\"}, {\"version\": \"6.2.4\", \"id\": \"1da1ed30-eb03-11e7-8f04-51231daa5b05-ecs\", \"gridData\": {\"y\": 1, \"w\": 5, \"i\": \"4\", \"x\": 0, \"h\": 3}, \"panelIndex\": \"4\", \"type\": \"visualization\"}, {\"id\": \"240f3630-eb05-11e7-8f04-51231daa5b05-ecs\", \"gridData\": {\"y\": 4, \"w\": 5, \"i\": \"5\", \"x\": 0, \"h\": 2}, \"embeddableConfig\": {\"vis\": {\"defaultColors\": {\"0 - 100\": \"rgb(0,104,55)\"}, \"legendOpen\": false}}, \"type\": \"visualization\", \"panelIndex\": \"5\", \"version\": \"6.2.4\"}, {\"version\": \"6.1.0-SNAPSHOT\", \"id\": \"2d6e0760-f4ab-11e7-8647-534bb4c21040-ecs\", \"gridData\": {\"y\": 0, \"w\": 12, \"i\": \"6\", \"x\": 0, \"h\": 1}, \"panelIndex\": \"6\", \"type\": \"visualization\"}]",
                "timeRestore": false,
                "title": "[Filebeat Osquery] Compliance pack ECS",
                "uiStateJSON": "{\"P-5\": {\"vis\": {\"defaultColors\": {\"0 - 100\": \"rgb(0,104,55)\"}}}}",
                "version": 1
            },
            "id": "69f5ae20-eb02-11e7-8f04-51231daa5b05-ecs",
            "type": "dashboard",
            "updated_at": "2018-01-08T19:42:15.406Z",
            "version": 2
        }
    ],
    "version": "6.1.0-SNAPSHOT"
}