{
    "objects": [
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "d19e8485-7df5-47ce-8009-9dc3c42bcf17-ecs",
                "title": "Unique FQDNs per eTLD+1 ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"Count\": \"#1F78C1\", \"Unique count of dns.question.name\": \"#E0752D\"}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"enabled\": true, \"id\": \"1\", \"params\": {\"customLabel\": \"Unique Subdomain Count\", \"field\": \"dns.question.name\"}, \"schema\": \"metric\", \"type\": \"cardinality\"}, {\"enabled\": true, \"id\": \"2\", \"params\": {\"customLabel\": \"Domains\", \"field\": \"dns.question.etld_plus_one\", \"order\": \"desc\", \"orderBy\": \"1\", \"size\": 20}, \"schema\": \"segment\", \"type\": \"terms\"}], \"listeners\": {}, \"params\": {\"addLegend\": true, \"addTimeMarker\": false, \"addTooltip\": true, \"defaultYExtents\": true, \"legendPosition\": \"right\", \"mode\": \"grouped\", \"scale\": \"linear\", \"setYExtents\": false, \"shareYAxis\": true, \"times\": [], \"yAxis\": {}}, \"title\": \"Unique FQDNs per eTLD+1 ECS\", \"type\": \"histogram\"}"
            },
            "id": "Unique-FQDNs-per-eTLD 1-ecs",
            "type": "visualization",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "d19e8485-7df5-47ce-8009-9dc3c42bcf17-ecs",
                "title": "Unique FQDNs per eTLD+1 Table ECS",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"enabled\": true, \"id\": \"1\", \"params\": {\"customLabel\": \"\"}, \"schema\": \"metric\", \"type\": \"count\"}, {\"enabled\": true, \"id\": \"2\", \"params\": {\"customLabel\": \"ETLD+1\", \"field\": \"dns.question.etld_plus_one\", \"order\": \"desc\", \"orderBy\": \"1\", \"size\": 20}, \"schema\": \"bucket\", \"type\": \"terms\"}, {\"enabled\": true, \"id\": \"3\", \"params\": {\"customLabel\": \"Unique Domains\", \"field\": \"dns.question.name\"}, \"schema\": \"metric\", \"type\": \"cardinality\"}], \"listeners\": {}, \"params\": {\"perPage\": 10, \"showMeticsAtAllLevels\": false, \"showPartialRows\": false, \"showTotal\": false, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"totalFunc\": \"sum\"}, \"title\": \"Unique FQDNs per eTLD+1 Table ECS\", \"type\": \"table\"}"
            },
            "id": "Unique-FQDNs-per-eTLD 1-Table-ecs",
            "type": "visualization",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"query\": {\"language\": \"kuery\", \"query\": \"\"}}"
                },
                "savedSearchId": "d19e8485-7df5-47ce-8009-9dc3c42bcf17-ecs",
                "title": "Bytes Transferred per Domain ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"Bytes In\": \"#F2C96D\", \"Bytes Out\": \"#629E51\", \"Count\": \"#1F78C1\", \"Unique count of dns.question.name\": \"#E0752D\"}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"enabled\": true, \"id\": \"1\", \"params\": {\"customLabel\": \"Bytes Out\", \"field\": \"destination.bytes\"}, \"schema\": \"metric\", \"type\": \"sum\"}, {\"enabled\": true, \"id\": \"2\", \"params\": {\"customLabel\": \"Domains\", \"field\": \"dns.question.etld_plus_one\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"order\": \"desc\", \"orderBy\": \"1\", \"otherBucket\": false, \"otherBucketLabel\": \"Other\", \"size\": 20}, \"schema\": \"segment\", \"type\": \"terms\"}, {\"enabled\": true, \"id\": \"3\", \"params\": {\"customLabel\": \"Bytes In\", \"field\": \"source.bytes\"}, \"schema\": \"metric\", \"type\": \"sum\"}], \"params\": {\"addLegend\": true, \"addTimeMarker\": false, \"addTooltip\": true, \"categoryAxes\": [{\"id\": \"CategoryAxis-1\", \"labels\": {\"show\": true, \"truncate\": 100}, \"position\": \"bottom\", \"scale\": {\"type\": \"linear\"}, \"show\": true, \"style\": {}, \"title\": {}, \"type\": \"category\"}], \"defaultYExtents\": true, \"grid\": {\"categoryLines\": false, \"style\": {\"color\": \"#eee\"}}, \"legendPosition\": \"right\", \"mode\": \"grouped\", \"scale\": \"linear\", \"seriesParams\": [{\"data\": {\"id\": \"1\", \"label\": \"Bytes Out\"}, \"mode\": \"normal\", \"show\": \"true\", \"type\": \"histogram\", \"valueAxis\": \"ValueAxis-1\"}, {\"data\": {\"id\": \"3\", \"label\": \"Bytes In\"}, \"mode\": \"normal\", \"show\": true, \"type\": \"histogram\", \"valueAxis\": \"ValueAxis-1\"}], \"setYExtents\": false, \"shareYAxis\": true, \"times\": [], \"type\": \"histogram\", \"valueAxes\": [{\"id\": \"ValueAxis-1\", \"labels\": {\"filter\": false, \"rotate\": 0, \"show\": true, \"truncate\": 100}, \"name\": \"LeftAxis-1\", \"position\": \"left\", \"scale\": {\"defaultYExtents\": true, \"mode\": \"grouped\", \"setYExtents\": false, \"type\": \"linear\"}, \"show\": true, \"style\": {}, \"title\": {\"text\": \"Count\"}, \"type\": \"value\"}], \"yAxis\": {}}, \"title\": \"Bytes Transferred per Domain ECS\", \"type\": \"histogram\"}"
            },
            "id": "Bytes-Transferred-per-Domain-ecs",
            "type": "visualization",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"index\": \"packetbeat-*\", \"query\": {\"language\": \"kuery\", \"query\": \"type:dns\"}}"
                },
                "title": "Top Domains by Data Volume ECS",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"enabled\": true, \"id\": \"1\", \"params\": {\"customLabel\": \"Bytes In\", \"field\": \"source.bytes\"}, \"schema\": \"metric\", \"type\": \"sum\"}, {\"enabled\": true, \"id\": \"2\", \"params\": {\"customLabel\": \"ETLD+1\", \"field\": \"dns.question.etld_plus_one\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"order\": \"desc\", \"orderBy\": \"3\", \"otherBucket\": false, \"otherBucketLabel\": \"Other\", \"size\": 20}, \"schema\": \"bucket\", \"type\": \"terms\"}, {\"enabled\": true, \"id\": \"3\", \"params\": {\"customLabel\": \"Bytes Out\", \"field\": \"destination.bytes\"}, \"schema\": \"metric\", \"type\": \"sum\"}], \"params\": {\"perPage\": 10, \"showMetricsAtAllLevels\": false, \"showPartialRows\": false, \"showTotal\": false, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"totalFunc\": \"sum\"}, \"title\": \"Top Domains by Data Volume ECS\", \"type\": \"table\"}"
            },
            "id": "dc743240-1665-11e7-a6de-cbac1a3d0a7d-ecs",
            "type": "visualization",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        },
        {
            "attributes": {
                "columns": [
                    "server.ip",
                    "destination.ip",
                    "dns.question.name",
                    "status"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [{\"$state\": {\"store\": \"appState\"}, \"meta\": {\"alias\": null, \"disabled\": false, \"index\": \"packetbeat-*\", \"key\": \"network.protocol\", \"negate\": false, \"params\": {\"query\": \"dns\", \"type\": \"phrase\"}, \"type\": \"phrase\", \"value\": \"dns\"}, \"query\": {\"match\": {\"network.protocol\": {\"query\": \"dns\", \"type\": \"phrase\"}}}}], \"highlight\": {\"fields\": {\"*\": {}}, \"fragment_size\": 2147483647, \"post_tags\": [\"@/kibana-highlighted-field@\"], \"pre_tags\": [\"@kibana-highlighted-field@\"], \"require_field_match\": false}, \"highlightAll\": true, \"index\": \"packetbeat-*\", \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"version\": true}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "DNS Protocol [Packetbeat] ECS",
                "version": 1
            },
            "id": "d19e8485-7df5-47ce-8009-9dc3c42bcf17-ecs",
            "type": "search",
            "updated_at": "2019-01-18T23:49:24.089Z",
            "version": 2
        },
        {
            "attributes": {
                "description": "Detecting tunneling over DNS.",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": [], \"highlightAll\": true, \"query\": {\"language\": \"kuery\", \"query\": \"NOT dns.question.type:PTR\"}, \"version\": true}"
                },
                "optionsJSON": "{\"darkTheme\": false}",
                "panelsJSON": "[{\"embeddableConfig\": {\"spy\": {\"mode\": {\"fill\": false, \"name\": null}}, \"vis\": {\"colors\": {\"Count\": \"#1F78C1\", \"Unique Subdomain Count\": \"#EF843C\", \"Unique count of dns.question.name\": \"#E0752D\"}, \"legendOpen\": false}}, \"gridData\": {\"h\": 20, \"i\": \"1\", \"w\": 48, \"x\": 0, \"y\": 0}, \"id\": \"Unique-FQDNs-per-eTLD 1-ecs\", \"panelIndex\": \"1\", \"type\": \"visualization\", \"version\": \"7.0.0-SNAPSHOT\"}, {\"embeddableConfig\": {\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}, \"gridData\": {\"h\": 20, \"i\": \"2\", \"w\": 24, \"x\": 0, \"y\": 35}, \"id\": \"Unique-FQDNs-per-eTLD 1-Table-ecs\", \"panelIndex\": \"2\", \"type\": \"visualization\", \"version\": \"7.0.0-SNAPSHOT\"}, {\"embeddableConfig\": {\"vis\": {\"legendOpen\": false}}, \"gridData\": {\"h\": 15, \"i\": \"4\", \"w\": 48, \"x\": 0, \"y\": 20}, \"id\": \"Bytes-Transferred-per-Domain-ecs\", \"panelIndex\": \"4\", \"type\": \"visualization\", \"version\": \"7.0.0-SNAPSHOT\"}, {\"embeddableConfig\": {\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}, \"gridData\": {\"h\": 20, \"i\": \"5\", \"w\": 24, \"x\": 24, \"y\": 35}, \"id\": \"dc743240-1665-11e7-a6de-cbac1a3d0a7d-ecs\", \"panelIndex\": \"5\", \"type\": \"visualization\", \"version\": \"7.0.0-SNAPSHOT\"}]",
                "timeRestore": false,
                "title": "[Packetbeat] DNS Tunneling ECS",
                "version": 1
            },
            "id": "DNS-Unique-Domains-ecs",
            "type": "dashboard",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        }
    ],
    "version": "7.0.0-SNAPSHOT"
}