{
    "objects": [
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "d19e8485-7df5-47ce-8009-9dc3c42bcf17-ecs",
                "title": "Unique FQDNs per eTLD+1 ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"Count\": \"#1F78C1\", \"Unique count of dns.question.name\": \"#E0752D\"}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"enabled\": true, \"params\": {\"field\": \"dns.question.name\", \"customLabel\": \"Unique Subdomain Count\"}, \"id\": \"1\", \"type\": \"cardinality\"}, {\"schema\": \"segment\", \"enabled\": true, \"params\": {\"size\": 20, \"orderBy\": \"1\", \"field\": \"dns.question.etld_plus_one\", \"customLabel\": \"Domains\", \"order\": \"desc\"}, \"id\": \"2\", \"type\": \"terms\"}], \"title\": \"Unique FQDNs per eTLD+1 ECS\", \"type\": \"histogram\", \"params\": {\"defaultYExtents\": true, \"legendPosition\": \"right\", \"addTooltip\": true, \"mode\": \"grouped\", \"setYExtents\": false, \"yAxis\": {}, \"addLegend\": true, \"addTimeMarker\": false, \"shareYAxis\": true, \"times\": [], \"scale\": \"linear\"}, \"listeners\": {}}"
            },
            "id": "Unique-FQDNs-per-eTLD 1-ecs",
            "type": "visualization",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"filter\": []}"
                },
                "savedSearchId": "d19e8485-7df5-47ce-8009-9dc3c42bcf17-ecs",
                "title": "Unique FQDNs per eTLD+1 Table ECS",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"enabled\": true, \"params\": {\"customLabel\": \"\"}, \"id\": \"1\", \"type\": \"count\"}, {\"schema\": \"bucket\", \"enabled\": true, \"params\": {\"size\": 20, \"orderBy\": \"1\", \"field\": \"dns.question.etld_plus_one\", \"customLabel\": \"ETLD+1\", \"order\": \"desc\"}, \"id\": \"2\", \"type\": \"terms\"}, {\"schema\": \"metric\", \"enabled\": true, \"params\": {\"field\": \"dns.question.name\", \"customLabel\": \"Unique Domains\"}, \"id\": \"3\", \"type\": \"cardinality\"}], \"title\": \"Unique FQDNs per eTLD+1 Table ECS\", \"type\": \"table\", \"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showTotal\": false, \"showPartialRows\": false, \"totalFunc\": \"sum\", \"showMeticsAtAllLevels\": false}, \"listeners\": {}}"
            },
            "id": "Unique-FQDNs-per-eTLD 1-Table-ecs",
            "type": "visualization",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "savedSearchId": "d19e8485-7df5-47ce-8009-9dc3c42bcf17-ecs",
                "title": "Bytes Transferred per Domain ECS",
                "uiStateJSON": "{\"vis\": {\"colors\": {\"Count\": \"#1F78C1\", \"Bytes In\": \"#F2C96D\", \"Unique count of dns.question.name\": \"#E0752D\", \"Bytes Out\": \"#629E51\"}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"enabled\": true, \"params\": {\"field\": \"destination.bytes\", \"customLabel\": \"Bytes Out\"}, \"id\": \"1\", \"type\": \"sum\"}, {\"schema\": \"segment\", \"enabled\": true, \"params\": {\"orderBy\": \"1\", \"size\": 20, \"field\": \"dns.question.etld_plus_one\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false, \"missingBucket\": false, \"otherBucketLabel\": \"Other\", \"customLabel\": \"Domains\"}, \"id\": \"2\", \"type\": \"terms\"}, {\"schema\": \"metric\", \"enabled\": true, \"params\": {\"field\": \"source.bytes\", \"customLabel\": \"Bytes In\"}, \"id\": \"3\", \"type\": \"sum\"}], \"title\": \"Bytes Transferred per Domain ECS\", \"params\": {\"mode\": \"grouped\", \"valueAxes\": [{\"show\": true, \"id\": \"ValueAxis-1\", \"title\": {\"text\": \"Count\"}, \"name\": \"LeftAxis-1\", \"labels\": {\"truncate\": 100, \"rotate\": 0, \"show\": true, \"filter\": false}, \"style\": {}, \"type\": \"value\", \"position\": \"left\", \"scale\": {\"defaultYExtents\": true, \"mode\": \"grouped\", \"type\": \"linear\", \"setYExtents\": false}}], \"setYExtents\": false, \"addLegend\": true, \"addTimeMarker\": false, \"shareYAxis\": true, \"defaultYExtents\": true, \"legendPosition\": \"right\", \"times\": [], \"addTooltip\": true, \"seriesParams\": [{\"mode\": \"normal\", \"valueAxis\": \"ValueAxis-1\", \"type\": \"histogram\", \"show\": \"true\", \"data\": {\"label\": \"Bytes Out\", \"id\": \"1\"}}, {\"mode\": \"normal\", \"valueAxis\": \"ValueAxis-1\", \"type\": \"histogram\", \"show\": true, \"data\": {\"label\": \"Bytes In\", \"id\": \"3\"}}], \"type\": \"histogram\", \"yAxis\": {}, \"categoryAxes\": [{\"show\": true, \"id\": \"CategoryAxis-1\", \"title\": {}, \"labels\": {\"truncate\": 100, \"show\": true}, \"style\": {}, \"type\": \"category\", \"position\": \"bottom\", \"scale\": {\"type\": \"linear\"}}], \"grid\": {\"style\": {\"color\": \"#eee\"}, \"categoryLines\": false}, \"scale\": \"linear\"}, \"type\": \"histogram\"}"
            },
            "id": "Bytes-Transferred-per-Domain-ecs",
            "type": "visualization",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"index\": \"packetbeat-*\", \"query\": {\"query\": \"type:dns\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Top Domains by Data Volume ECS",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"aggs\": [{\"schema\": \"metric\", \"enabled\": true, \"params\": {\"field\": \"source.bytes\", \"customLabel\": \"Bytes In\"}, \"id\": \"1\", \"type\": \"sum\"}, {\"schema\": \"bucket\", \"enabled\": true, \"params\": {\"orderBy\": \"3\", \"size\": 20, \"field\": \"dns.question.etld_plus_one\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false, \"missingBucket\": false, \"otherBucketLabel\": \"Other\", \"customLabel\": \"ETLD+1\"}, \"id\": \"2\", \"type\": \"terms\"}, {\"schema\": \"metric\", \"enabled\": true, \"params\": {\"field\": \"destination.bytes\", \"customLabel\": \"Bytes Out\"}, \"id\": \"3\", \"type\": \"sum\"}], \"title\": \"Top Domains by Data Volume ECS\", \"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}, \"showMetricsAtAllLevels\": false, \"showTotal\": false, \"showPartialRows\": false, \"totalFunc\": \"sum\", \"perPage\": 10}, \"type\": \"table\"}"
            },
            "id": "dc743240-1665-11e7-a6de-cbac1a3d0a7d-ecs",
            "type": "visualization",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        },
        {
            "attributes": {
                "columns": [
                    "server.ip",
                    "destination.ip",
                    "dns.question.name",
                    "status"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"index\": \"packetbeat-*\", \"version\": true, \"highlightAll\": true, \"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"highlight\": {\"fragment_size\": 2147483647, \"pre_tags\": [\"@kibana-highlighted-field@\"], \"fields\": {\"*\": {}}, \"require_field_match\": false, \"post_tags\": [\"@/kibana-highlighted-field@\"]}, \"filter\": [{\"query\": {\"match\": {\"network.protocol\": {\"query\": \"dns\", \"type\": \"phrase\"}}}, \"meta\": {\"index\": \"packetbeat-*\", \"negate\": false, \"key\": \"network.protocol\", \"type\": \"phrase\", \"params\": {\"query\": \"dns\", \"type\": \"phrase\"}, \"value\": \"dns\", \"alias\": null, \"disabled\": false}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "sort": [
                    "@timestamp",
                    "desc"
                ],
                "title": "DNS Protocol [Packetbeat] ECS",
                "version": 1
            },
            "id": "d19e8485-7df5-47ce-8009-9dc3c42bcf17-ecs",
            "type": "search",
            "updated_at": "2019-01-18T23:49:24.089Z",
            "version": 2
        },
        {
            "attributes": {
                "description": "Detecting tunneling over DNS.",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"version\": true, \"query\": {\"query\": \"NOT dns.question.type:PTR\", \"language\": \"kuery\"}, \"highlightAll\": true, \"filter\": []}"
                },
                "optionsJSON": "{\"darkTheme\": false}",
                "panelsJSON": "[{\"version\": \"7.0.0-SNAPSHOT\", \"panelIndex\": \"1\", \"gridData\": {\"h\": 20, \"w\": 48, \"i\": \"1\", \"x\": 0, \"y\": 0}, \"embeddableConfig\": {\"spy\": {\"mode\": {\"name\": null, \"fill\": false}}, \"vis\": {\"legendOpen\": false, \"colors\": {\"Count\": \"#1F78C1\", \"Unique count of dns.question.name\": \"#E0752D\", \"Unique Subdomain Count\": \"#EF843C\"}}}, \"id\": \"Unique-FQDNs-per-eTLD 1-ecs\", \"type\": \"visualization\"}, {\"version\": \"7.0.0-SNAPSHOT\", \"panelIndex\": \"2\", \"gridData\": {\"h\": 20, \"w\": 24, \"i\": \"2\", \"x\": 0, \"y\": 35}, \"embeddableConfig\": {\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}, \"id\": \"Unique-FQDNs-per-eTLD 1-Table-ecs\", \"type\": \"visualization\"}, {\"version\": \"7.0.0-SNAPSHOT\", \"panelIndex\": \"4\", \"gridData\": {\"h\": 15, \"w\": 48, \"i\": \"4\", \"x\": 0, \"y\": 20}, \"embeddableConfig\": {\"vis\": {\"legendOpen\": false}}, \"id\": \"Bytes-Transferred-per-Domain-ecs\", \"type\": \"visualization\"}, {\"version\": \"7.0.0-SNAPSHOT\", \"panelIndex\": \"5\", \"gridData\": {\"h\": 20, \"w\": 24, \"i\": \"5\", \"x\": 24, \"y\": 35}, \"embeddableConfig\": {\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}, \"id\": \"dc743240-1665-11e7-a6de-cbac1a3d0a7d-ecs\", \"type\": \"visualization\"}]",
                "timeRestore": false,
                "title": "[Packetbeat] DNS Tunneling ECS",
                "version": 1
            },
            "id": "DNS-Unique-Domains-ecs",
            "type": "dashboard",
            "updated_at": "2019-01-18T23:49:23.036Z",
            "version": 1
        }
    ],
    "version": "7.0.0-SNAPSHOT"
}