{
    "objects": [
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "8030c1b0-fa77-11e6-ae9b-81e5311e8cab-ecs",
                "title": "New users [Filebeat System] ECS",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"host.hostname\", \"customLabel\": \"Host\", \"order\": \"desc\", \"size\": 5}, \"enabled\": true, \"type\": \"terms\", \"id\": \"2\", \"schema\": \"bucket\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"user.name\", \"customLabel\": \"User\", \"order\": \"desc\", \"size\": 5}, \"enabled\": true, \"type\": \"terms\", \"id\": \"3\", \"schema\": \"bucket\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"user.id\", \"customLabel\": \"UID\", \"order\": \"desc\", \"size\": 5}, \"enabled\": true, \"type\": \"terms\", \"id\": \"4\", \"schema\": \"bucket\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"group.id\", \"customLabel\": \"GID\", \"order\": \"desc\", \"size\": 5}, \"enabled\": true, \"type\": \"terms\", \"id\": \"5\", \"schema\": \"bucket\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"system.auth.useradd.home\", \"customLabel\": \"Home\", \"order\": \"desc\", \"size\": 5}, \"enabled\": true, \"type\": \"terms\", \"id\": \"6\", \"schema\": \"bucket\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"system.auth.useradd.shell\", \"customLabel\": \"Shell\", \"order\": \"desc\", \"size\": 5}, \"enabled\": true, \"type\": \"terms\", \"id\": \"7\", \"schema\": \"bucket\"}], \"type\": \"table\", \"params\": {\"totalFunc\": \"sum\", \"showMeticsAtAllLevels\": false, \"showPartialRows\": false, \"perPage\": 10, \"showTotal\": false, \"sort\": {\"direction\": null, \"columnIndex\": null}}, \"title\": \"New users ECS\", \"listeners\": {}}"
            },
            "id": "f398d2f0-fa77-11e6-ae9b-81e5311e8cab-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "8030c1b0-fa77-11e6-ae9b-81e5311e8cab-ecs",
                "title": "New users over time [Filebeat System] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"customInterval\": \"2h\", \"interval\": \"auto\", \"min_doc_count\": 1, \"field\": \"@timestamp\", \"extended_bounds\": {}}, \"enabled\": true, \"type\": \"date_histogram\", \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"user.name\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"3\", \"schema\": \"group\"}], \"type\": \"histogram\", \"params\": {\"defaultYExtents\": false, \"times\": [], \"scale\": \"linear\", \"addTooltip\": true, \"addTimeMarker\": false, \"mode\": \"stacked\", \"legendPosition\": \"bottom\", \"addLegend\": true, \"setYExtents\": false}, \"title\": \"New users over time ECS\", \"listeners\": {}}"
            },
            "id": "5dd15c00-fa78-11e6-ae9b-81e5311e8cab-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "8030c1b0-fa77-11e6-ae9b-81e5311e8cab-ecs",
                "title": "New users by shell [Filebeat System] ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"/bin/false\": \"#508642\", \"/sbin/nologin\": \"#7EB26D\", \"/bin/bash\": \"#E24D42\"}, \"legendOpen\": true}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"system.auth.useradd.shell\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"user.name\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"3\", \"schema\": \"segment\"}], \"type\": \"pie\", \"params\": {\"isDonut\": false, \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\"}, \"title\": \"New users by shell ECS\", \"listeners\": {}}"
            },
            "id": "e121b140-fa78-11e6-a1df-a78bd7504d38-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "8030c1b0-fa77-11e6-ae9b-81e5311e8cab-ecs",
                "title": "New users by home directory [Filebeat System] ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"/bin/false\": \"#508642\", \"/sbin/nologin\": \"#7EB26D\", \"/bin/bash\": \"#E24D42\", \"/nonexistent\": \"#629E51\"}, \"legendOpen\": true}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"system.auth.useradd.home\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"user.name\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"3\", \"schema\": \"segment\"}], \"type\": \"pie\", \"params\": {\"isDonut\": false, \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\"}, \"title\": \"New users by home directory ECS\", \"listeners\": {}}"
            },
            "id": "d56ee420-fa79-11e6-a1df-a78bd7504d38-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "eb0039f0-fa7f-11e6-a1df-a78bd7504d38-ecs",
                "title": "New groups [Filebeat System] ECS",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"group.name\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"2\", \"schema\": \"bucket\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"group.id\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"3\", \"schema\": \"bucket\"}], \"type\": \"table\", \"params\": {\"totalFunc\": \"sum\", \"showMeticsAtAllLevels\": false, \"showPartialRows\": false, \"perPage\": 10, \"showTotal\": false, \"sort\": {\"direction\": null, \"columnIndex\": null}}, \"title\": \"New groups ECS\", \"listeners\": {}}"
            },
            "id": "12667040-fa80-11e6-a1df-a78bd7504d38-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "eb0039f0-fa7f-11e6-a1df-a78bd7504d38-ecs",
                "title": "New groups over time [Filebeat System] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [{\"params\": {}, \"enabled\": true, \"type\": \"count\", \"id\": \"1\", \"schema\": \"metric\"}, {\"params\": {\"customInterval\": \"2h\", \"interval\": \"auto\", \"min_doc_count\": 1, \"field\": \"@timestamp\", \"extended_bounds\": {}}, \"enabled\": true, \"type\": \"date_histogram\", \"id\": \"2\", \"schema\": \"segment\"}, {\"params\": {\"orderBy\": \"1\", \"field\": \"group.name\", \"size\": 5, \"order\": \"desc\"}, \"enabled\": true, \"type\": \"terms\", \"id\": \"3\", \"schema\": \"group\"}], \"type\": \"histogram\", \"params\": {\"defaultYExtents\": false, \"times\": [], \"scale\": \"linear\", \"addTooltip\": true, \"addTimeMarker\": false, \"mode\": \"stacked\", \"legendPosition\": \"bottom\", \"addLegend\": true, \"setYExtents\": false}, \"title\": \"New groups over time ECS\", \"listeners\": {}}"
            },
            "id": "346bb290-fa80-11e6-a1df-a78bd7504d38-ecs",
            "type": "visualization",
            "version": 2
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{}"
                },
                "title": "Dashboards [Filebeat System] ECS",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"aggs\": [], \"type\": \"markdown\", \"params\": {\"markdown\": \"[Syslog](#/dashboard/Filebeat-syslog-dashboard-ecs) | [Sudo commands](#/dashboard/277876d0-fa2c-11e6-bbd3-29c986c96e5a-ecs) | [SSH logins](#/dashboard/5517a150-f9ce-11e6-8115-a7c18106d86a-ecs) | [New users and groups](#/dashboard/0d3f2380-fa78-11e6-ae9b-81e5311e8cab-ecs)\", \"fontSize\": 12}, \"title\": \"Dashboards [Filebeat System] ECS\"}"
            },
            "id": "327417e0-8462-11e7-bab8-bd2f0fb42c54-ecs",
            "type": "visualization",
            "version": 1
        },
        {
            "attributes": {
                "columns": [
                    "user.name",
                    "user.id",
                    "group.id",
                    "system.auth.useradd.home",
                    "system.auth.useradd.shell"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"language\": \"kuery\", \"query\": \"system.auth.useradd:*\"}, \"index\": \"filebeat-*\", \"filter\": [], \"highlightAll\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "useradd logs [Filebeat System] ECS",
                "version": 1
            },
            "id": "8030c1b0-fa77-11e6-ae9b-81e5311e8cab-ecs",
            "type": "search",
            "version": 2
        },
        {
            "attributes": {
                "columns": [
                    "group.name",
                    "group.id"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"language\": \"kuery\", \"query\": \"system.auth.groupadd:*\"}, \"index\": \"filebeat-*\", \"filter\": [], \"highlightAll\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "groupadd logs [Filebeat System] ECS",
                "version": 1
            },
            "id": "eb0039f0-fa7f-11e6-a1df-a78bd7504d38-ecs",
            "type": "search",
            "version": 2
        },
        {
            "attributes": {
                "description": "New users and groups dashboard for the System module in Filebeat",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"version\": true, \"filter\": [], \"highlightAll\": true}"
                },
                "optionsJSON": "{\"darkTheme\": false}",
                "panelsJSON": "[{\"col\": 1, \"id\": \"f398d2f0-fa77-11e6-ae9b-81e5311e8cab-ecs\", \"size_y\": 3, \"panelIndex\": 1, \"type\": \"visualization\", \"size_x\": 6, \"row\": 2}, {\"col\": 7, \"id\": \"5dd15c00-fa78-11e6-ae9b-81e5311e8cab-ecs\", \"size_y\": 3, \"panelIndex\": 2, \"type\": \"visualization\", \"size_x\": 6, \"row\": 2}, {\"col\": 1, \"id\": \"e121b140-fa78-11e6-a1df-a78bd7504d38-ecs\", \"size_y\": 3, \"panelIndex\": 3, \"type\": \"visualization\", \"size_x\": 6, \"row\": 5}, {\"col\": 7, \"id\": \"d56ee420-fa79-11e6-a1df-a78bd7504d38-ecs\", \"size_y\": 3, \"panelIndex\": 4, \"type\": \"visualization\", \"size_x\": 6, \"row\": 5}, {\"col\": 1, \"id\": \"12667040-fa80-11e6-a1df-a78bd7504d38-ecs\", \"size_y\": 3, \"panelIndex\": 5, \"type\": \"visualization\", \"size_x\": 6, \"row\": 8}, {\"col\": 7, \"id\": \"346bb290-fa80-11e6-a1df-a78bd7504d38-ecs\", \"size_y\": 3, \"panelIndex\": 6, \"type\": \"visualization\", \"size_x\": 6, \"row\": 8}, {\"col\": 1, \"id\": \"327417e0-8462-11e7-bab8-bd2f0fb42c54-ecs\", \"size_y\": 1, \"panelIndex\": 7, \"type\": \"visualization\", \"size_x\": 12, \"row\": 1}]",
                "timeRestore": false,
                "title": "[Filebeat System] New users and groups ECS",
                "uiStateJSON": "{\"P-1\": {\"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}, \"P-5\": {\"vis\": {\"params\": {\"sort\": {\"direction\": null, \"columnIndex\": null}}}}}",
                "version": 1
            },
            "id": "0d3f2380-fa78-11e6-ae9b-81e5311e8cab-ecs",
            "type": "dashboard",
            "version": 6
        }
    ],
    "version": "6.0.0-beta1-SNAPSHOT"
}