{
    "objects": [
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"language\": \"kuery\", \"query\": \"system.auth.ssh.event:Accepted\"}, \"index\": \"filebeat-*\", \"filter\": [], \"highlightAll\": true}"
                },
                "title": "Successful SSH logins [Filebeat System] ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"Accepted\": \"#3F6833\", \"password\": \"#BF1B00\", \"Failed\": \"#F9934E\", \"publickey\": \"#629E51\", \"Invalid\": \"#447EBC\"}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"customInterval\": \"2h\", \"interval\": \"auto\", \"min_doc_count\": 1, \"field\": \"@timestamp\", \"extended_bounds\": {}}, \"enabled\": true, \"type\": \"date_histogram\", \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"system.auth.ssh.method\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"3\", \"schema\": \"group\"}], \"type\": \"histogram\", \"params\": {\"defaultYExtents\": false, \"times\": [], \"scale\": \"linear\", \"addTooltip\": true, \"addTimeMarker\": false, \"mode\": \"stacked\", \"legendPosition\": \"right\", \"addLegend\": true, \"setYExtents\": false}, \"title\": \"Successful SSH logins ECS\", \"listeners\": {}}"
            },
            "id": "d16bb400-f9cc-11e6-8115-a7c18106d86a-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"index\": \"filebeat-*\", \"filter\": [], \"highlightAll\": true}"
                },
                "title": "SSH login attempts [Filebeat System] ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"Accepted\": \"#3F6833\", \"Failed\": \"#F9934E\", \"Invalid\": \"#447EBC\"}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"customInterval\": \"2h\", \"interval\": \"auto\", \"min_doc_count\": 1, \"field\": \"@timestamp\", \"extended_bounds\": {}}, \"enabled\": true, \"type\": \"date_histogram\", \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"system.auth.ssh.event\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"3\", \"schema\": \"group\"}], \"type\": \"histogram\", \"params\": {\"defaultYExtents\": false, \"times\": [], \"scale\": \"linear\", \"addTooltip\": true, \"addTimeMarker\": false, \"mode\": \"stacked\", \"legendPosition\": \"right\", \"addLegend\": true, \"setYExtents\": false}, \"title\": \"SSH login attempts ECS\", \"listeners\": {}}"
            },
            "id": "78b74f30-f9cd-11e6-8115-a7c18106d86a-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"language\": \"kuery\", \"query\": \"system.auth.ssh.event:Failed OR system.auth.ssh.event:Invalid\"}, \"index\": \"filebeat-*\", \"filter\": [], \"highlightAll\": true}"
                },
                "title": "SSH users of failed login attempts [Filebeat System] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"user.name\", \"size\": 50, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"2\", \"schema\": \"segment\"}], \"type\": \"tagcloud\", \"params\": {\"maxFontSize\": 72, \"orientation\": \"single\", \"scale\": \"linear\", \"minFontSize\": 18}, \"title\": \"SSH users of failed login attempts ECS\", \"listeners\": {}}"
            },
            "id": "341ffe70-f9ce-11e6-8115-a7c18106d86a-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"language\": \"kuery\", \"query\": \"system.auth.ssh.event:Failed OR system.auth.ssh.event:Invalid\"}, \"index\": \"filebeat-*\", \"filter\": [], \"highlightAll\": true}"
                },
                "title": "SSH failed login attempts source locations [Filebeat System] ECS",
                "uiStateJSON": "{\"mapCenter\": [17.602139123350838, 69.697265625], \"mapZoom\": 2}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"autoPrecision\": true, \"precision\": 2, \"field\": \"source.geo.location\"}, \"enabled\": true, \"type\": \"geohash_grid\", \"id\": \"2\", \"schema\": \"segment\"}], \"type\": \"tile_map\", \"params\": {\"isDesaturated\": true, \"mapCenter\": [15, 5], \"mapType\": \"Shaded Circle Markers\", \"mapZoom\": 2, \"heatBlur\": 15, \"heatRadius\": 25, \"heatMinOpacity\": 0.1, \"heatMaxZoom\": 16, \"heatNormalizeData\": true, \"addTooltip\": true, \"wms\": {\"enabled\": false, \"url\": \"https://basemap.nationalmap.gov/arcgis/services/USGSTopo/MapServer/WMSServer\", \"options\": {\"attribution\": \"Maps provided by USGS\", \"styles\": \"\", \"version\": \"1.3.0\", \"transparent\": true, \"layers\": \"0\", \"format\": \"image/png\"}}, \"legendPosition\": \"bottomright\"}, \"title\": \"SSH failed login attempts source locations ECS\", \"listeners\": {}}"
            },
            "id": "3cec3eb0-f9d3-11e6-8a3e-2b904044ea1d-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "columns": [
                    "system.auth.ssh.event",
                    "system.auth.ssh.method",
                    "user.name",
                    "source.ip",
                    "source.geo.country_iso_code"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"language\": \"kuery\", \"query\": \"event.dataset:system.auth AND system.auth.ssh.event:*\"}, \"index\": \"filebeat-*\", \"filter\": [], \"highlightAll\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "SSH login attempts [Filebeat System] ECS",
                "version": 1
            },
            "id": "62439dc0-f9c9-11e6-a747-6121780e0414-ecs",
            "type": "search",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{}"
                },
                "title": "Dashboards [Filebeat System] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [], \"type\": \"markdown\", \"params\": {\"markdown\": \"[Syslog](#/dashboard/Filebeat-syslog-dashboard-ecs) | [Sudo commands](#/dashboard/277876d0-fa2c-11e6-bbd3-29c986c96e5a-ecs) | [SSH logins](#/dashboard/5517a150-f9ce-11e6-8115-a7c18106d86a-ecs) | [New users and groups](#/dashboard/0d3f2380-fa78-11e6-ae9b-81e5311e8cab-ecs)\", \"fontSize\": 12}, \"title\": \"Dashboards [Filebeat System] ECS\"}"
            },
            "id": "327417e0-8462-11e7-bab8-bd2f0fb42c54-ecs",
            "type": "visualization",
            "version": 1
        },
        {
            "attributes": {
                "description": "SSH dashboard for the System module in Filebeat",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"version\": true, \"filter\": [], \"highlightAll\": true}"
                },
                "optionsJSON": "{\"darkTheme\": false}",
                "panelsJSON": "[{\"col\": 1, \"id\": \"d16bb400-f9cc-11e6-8115-a7c18106d86a-ecs\", \"size_y\": 3, \"panelIndex\": 1, \"type\": \"visualization\", \"size_x\": 12, \"row\": 5}, {\"col\": 1, \"id\": \"78b74f30-f9cd-11e6-8115-a7c18106d86a-ecs\", \"size_y\": 3, \"panelIndex\": 2, \"type\": \"visualization\", \"size_x\": 12, \"row\": 2}, {\"col\": 1, \"id\": \"341ffe70-f9ce-11e6-8115-a7c18106d86a-ecs\", \"size_y\": 4, \"panelIndex\": 3, \"type\": \"visualization\", \"size_x\": 6, \"row\": 8}, {\"col\": 7, \"id\": \"3cec3eb0-f9d3-11e6-8a3e-2b904044ea1d-ecs\", \"size_y\": 4, \"panelIndex\": 4, \"type\": \"visualization\", \"size_x\": 6, \"row\": 8}, {\"sort\": [\"@timestamp\", \"desc\"], \"columns\": [\"system.auth.ssh.event\", \"system.auth.ssh.method\", \"user.name\", \"source.ip\", \"source.geo.country_iso_code\"], \"col\": 1, \"id\": \"62439dc0-f9c9-11e6-a747-6121780e0414-ecs\", \"size_y\": 3, \"panelIndex\": 5, \"type\": \"search\", \"size_x\": 12, \"row\": 12}, {\"col\": 1, \"id\": \"327417e0-8462-11e7-bab8-bd2f0fb42c54-ecs\", \"size_y\": 1, \"panelIndex\": 6, \"type\": \"visualization\", \"size_x\": 12, \"row\": 1}]",
                "timeRestore": false,
                "title": "[Filebeat System] SSH login attempts ECS",
                "uiStateJSON": "{\"P-4\": {\"mapCenter\": [39.774769485295465, 23.203125], \"mapBounds\": {\"top_left\": {\"lon\": -27.94921875, \"lat\": 60.50052541051131}, \"bottom_right\": {\"lon\": 74.53125, \"lat\": 10.31491928581316}}, \"mapCollar\": {\"top_left\": {\"lon\": -79.189455, \"lat\": 85.593335}, \"bottom_right\": {\"lon\": 125.771485, \"lat\": -14.777884999999998}, \"zoom\": 3}, \"mapZoom\": 3}}",
                "version": 1
            },
            "id": "5517a150-f9ce-11e6-8115-a7c18106d86a-ecs",
            "type": "dashboard",
            "version": 7
        }
    ],
    "version": "6.0.0-beta1-SNAPSHOT"
}