{
    "objects": [
        {
            "attributes": {
                "description": "Uses Simple Metric Visualizations",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "optionsJSON": "{\"useMargins\": true, \"hidePanelTitles\": false}",
                "panelsJSON": "[{\"panelIndex\": \"22\", \"title\": \"\", \"gridData\": {\"y\": 0, \"w\": 17, \"i\": \"22\", \"x\": 0, \"h\": 22}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_0\"}, {\"panelIndex\": \"23\", \"title\": \"Group Management Actions [Winlogbeat Security]\", \"gridData\": {\"y\": 0, \"w\": 22, \"i\": \"23\", \"x\": 17, \"h\": 22}, \"embeddableConfig\": {\"vis\": {\"legendOpen\": false}}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_1\"}, {\"panelIndex\": \"25\", \"title\": \"Event Codes [Winlogbeat Security]\", \"gridData\": {\"y\": 0, \"w\": 9, \"i\": \"25\", \"x\": 39, \"h\": 22}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_2\"}, {\"panelIndex\": \"35\", \"title\": \"Actions performed over Groups [Winlogbeat Security]\", \"gridData\": {\"y\": 22, \"w\": 26, \"i\": \"35\", \"x\": 0, \"h\": 21}, \"embeddableConfig\": {\"vis\": {\"legendOpen\": false, \"defaultColors\": {\"1 - 2\": \"rgb(198,219,239)\", \"0 - 1\": \"rgb(247,251,255)\", \"2 - 3\": \"rgb(107,174,214)\", \"3 - 4\": \"rgb(33,113,181)\"}}}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_3\"}, {\"panelIndex\": \"36\", \"title\": \"Group Creation Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 52, \"w\": 9, \"i\": \"36\", \"x\": 0, \"h\": 13}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_4\"}, {\"panelIndex\": \"37\", \"title\": \"Group Changes Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 52, \"w\": 9, \"i\": \"37\", \"x\": 9, \"h\": 13}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_5\"}, {\"panelIndex\": \"38\", \"title\": \"Group Deletion Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 52, \"w\": 9, \"i\": \"38\", \"x\": 18, \"h\": 13}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_6\"}, {\"panelIndex\": \"39\", \"title\": \"Users Added to Group Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 72, \"w\": 16, \"i\": \"39\", \"x\": 0, \"h\": 14}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_7\"}, {\"panelIndex\": \"40\", \"title\": \"Users Removed From Group Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 72, \"w\": 17, \"i\": \"40\", \"x\": 16, \"h\": 14}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_8\"}, {\"panelIndex\": \"42\", \"title\": \"Group Membership Enumeration Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 72, \"w\": 15, \"i\": \"42\", \"x\": 33, \"h\": 14}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_9\"}, {\"panelIndex\": \"43\", \"title\": \"Logon Details  [Winlogbeat Security]\", \"gridData\": {\"y\": 43, \"w\": 21, \"i\": \"43\", \"x\": 27, \"h\": 22}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_10\"}, {\"panelIndex\": \"44\", \"title\": \"\", \"gridData\": {\"y\": 65, \"w\": 16, \"i\": \"44\", \"x\": 0, \"h\": 7}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_11\"}, {\"panelIndex\": \"45\", \"title\": \"\", \"gridData\": {\"y\": 43, \"w\": 9, \"i\": \"45\", \"x\": 18, \"h\": 9}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_12\"}, {\"panelIndex\": \"46\", \"title\": \"\", \"gridData\": {\"y\": 43, \"w\": 9, \"i\": \"46\", \"x\": 0, \"h\": 9}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_13\"}, {\"panelIndex\": \"47\", \"title\": \"\", \"gridData\": {\"y\": 43, \"w\": 9, \"i\": \"47\", \"x\": 9, \"h\": 9}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_14\"}, {\"panelIndex\": \"48\", \"title\": \"\", \"gridData\": {\"y\": 65, \"w\": 17, \"i\": \"48\", \"x\": 16, \"h\": 7}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_15\"}, {\"panelIndex\": \"49\", \"title\": \"\", \"gridData\": {\"y\": 65, \"w\": 15, \"i\": \"49\", \"x\": 33, \"h\": 7}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_16\"}, {\"panelIndex\": \"50\", \"version\": \"7.3.1\", \"gridData\": {\"y\": 22, \"w\": 22, \"i\": \"50\", \"x\": 26, \"h\": 21}, \"embeddableConfig\": {}, \"panelRefName\": \"panel_17\"}, {\"panelIndex\": \"51\", \"version\": \"7.3.1\", \"gridData\": {\"y\": 86, \"w\": 48, \"i\": \"51\", \"x\": 0, \"h\": 21}, \"embeddableConfig\": {}, \"panelRefName\": \"panel_18\"}]",
                "timeRestore": false,
                "title": "[Winlogbeat Security] Group Management Events - Simple Metrics",
                "version": 1
            },
            "id": "01c54730-fee6-11e9-8405-516218e3d268",
            "migrationVersion": {
                "dashboard": "7.3.0"
            },
            "references": [
                {
                    "id": "6f0f2ea0-f414-11e9-8405-516218e3d268",
                    "name": "panel_0",
                    "type": "visualization"
                },
                {
                    "id": "b01aaea0-f415-11e9-8405-516218e3d268",
                    "name": "panel_1",
                    "type": "visualization"
                },
                {
                    "id": "11b5c0e0-f417-11e9-8405-516218e3d268",
                    "name": "panel_2",
                    "type": "visualization"
                },
                {
                    "id": "b948eaf0-f49c-11e9-8405-516218e3d268",
                    "name": "panel_3",
                    "type": "visualization"
                },
                {
                    "id": "98884120-f49d-11e9-8405-516218e3d268",
                    "name": "panel_4",
                    "type": "visualization"
                },
                {
                    "id": "9e534190-f49d-11e9-8405-516218e3d268",
                    "name": "panel_5",
                    "type": "visualization"
                },
                {
                    "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268",
                    "name": "panel_6",
                    "type": "visualization"
                },
                {
                    "id": "ce867840-f49e-11e9-8405-516218e3d268",
                    "name": "panel_7",
                    "type": "visualization"
                },
                {
                    "id": "fee83900-f49f-11e9-8405-516218e3d268",
                    "name": "panel_8",
                    "type": "visualization"
                },
                {
                    "id": "bc165210-f4b8-11e9-8405-516218e3d268",
                    "name": "panel_9",
                    "type": "visualization"
                },
                {
                    "id": "7e178c80-fee1-11e9-8405-516218e3d268",
                    "name": "panel_10",
                    "type": "search"
                },
                {
                    "id": "a13bf640-fee8-11e9-8405-516218e3d268",
                    "name": "panel_11",
                    "type": "visualization"
                },
                {
                    "id": "5eeaafd0-fee7-11e9-8405-516218e3d268",
                    "name": "panel_12",
                    "type": "visualization"
                },
                {
                    "id": "f42f3b20-fee6-11e9-8405-516218e3d268",
                    "name": "panel_13",
                    "type": "visualization"
                },
                {
                    "id": "b5f38780-fee6-11e9-8405-516218e3d268",
                    "name": "panel_14",
                    "type": "visualization"
                },
                {
                    "id": "1b5f17d0-feea-11e9-8405-516218e3d268",
                    "name": "panel_15",
                    "type": "visualization"
                },
                {
                    "id": "0f2f5280-feeb-11e9-8405-516218e3d268",
                    "name": "panel_16",
                    "type": "visualization"
                },
                {
                    "id": "24954800-fef0-11e9-8405-516218e3d268",
                    "name": "panel_17",
                    "type": "visualization"
                },
                {
                    "id": "9066d5b0-fef2-11e9-8405-516218e3d268",
                    "name": "panel_18",
                    "type": "search"
                }
            ],
            "type": "dashboard",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI0LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Group Management Events [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Events [Winlogbeat Security]\", \"params\": {\"fontSize\": 10, \"openLinksInNewTab\": false, \"markdown\": \"# **Group Management Events**\\n\\n#### This dashboard shows information about Group Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description|Event | Description\\n-- | --|--|--\\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \\n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \\n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \\n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \\n|4758|A security-enabled universal group was deleted.| 4764|A group\\\\'s type was changed.|\\n|4799|A security-enabled local group membership was enumerated.|\"}, \"type\": \"markdown\", \"aggs\": []}"
            },
            "id": "6f0f2ea0-f414-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI1LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4764\", \"4799\", \"4727\", \"4737\", \"4728\", \"4729\", \"4730\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\"], \"value\": \"4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Management Events - Event Actions - Donut [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Events - Event Actions - Donut [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"type\": \"pie\", \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}], \"metric\": {\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 1, \"aggType\": \"count\"}}, \"isDonut\": true, \"labels\": {\"last_level\": true, \"values\": true, \"truncate\": 100, \"show\": true}, \"addLegend\": true, \"legendPosition\": \"right\"}, \"type\": \"pie\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"otherBucket\": false}}]}"
            },
            "id": "b01aaea0-f415-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI2LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4727\", \"4728\", \"4729\", \"4730\", \"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4737\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\", \"4764\", \"4799\"], \"value\": \"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Management Events - Event Actions - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Events - Event Actions - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 2, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"customLabel\": \"Event Action\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"event.code\", \"missingBucket\": false, \"customLabel\": \"Event Code\", \"otherBucketLabel\": \"Other\", \"size\": 10, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "11b5c0e0-f417-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI3LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4727\", \"4728\", \"4729\", \"4730\", \"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4737\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\", \"4764\", \"4799\"], \"value\": \"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Management Events - Groups vs Actions - Heatmap [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"defaultColors\": {\"1 - 2\": \"rgb(198,219,239)\", \"0 - 1\": \"rgb(247,251,255)\", \"2 - 3\": \"rgb(107,174,214)\", \"3 - 4\": \"rgb(33,113,181)\"}}}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Events - Groups vs Actions - Heatmap [Winlogbeat Security]\", \"params\": {\"valueAxes\": [{\"scale\": {\"type\": \"linear\", \"defaultYExtents\": false}, \"id\": \"ValueAxis-1\", \"labels\": {\"color\": \"black\", \"show\": true, \"overwriteColor\": false, \"rotate\": 0}, \"type\": \"value\", \"show\": false}], \"type\": \"heatmap\", \"legendPosition\": \"right\", \"addLegend\": true, \"addTooltip\": true, \"colorSchema\": \"Blues\", \"percentageMode\": false, \"dimensions\": {\"x\": {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, \"y\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 2, \"aggType\": \"count\"}], \"series\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}]}, \"invertColors\": false, \"enableHover\": false, \"colorsNumber\": 4, \"colorsRange\": [], \"setColorRange\": false, \"times\": []}, \"type\": \"heatmap\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 15, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"group\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"otherBucket\": false}}]}"
            },
            "id": "b948eaf0-f49c-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI4LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4731\", \"4727\", \"4754\"], \"value\": \"4731, 4727, 4754\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Groups Created - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Groups Created - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 4, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "98884120-f49d-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI5LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4735\", \"4737\", \"4755\"], \"value\": \"4735, 4737, 4755\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Changes - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Group Changes - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 4, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "9e534190-f49d-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzMwLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4734\", \"4730\", \"4758\"], \"value\": \"4734, 4730, 4758\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Groups Deleted - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Groups Deleted - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 4, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzMxLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4732\", \"4728\", \"4756\"], \"value\": \"4732, 4728, 4756\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Added - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Added - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 4, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 5, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.MemberName\", \"missingBucket\": false, \"customLabel\": \"User\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 10, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"6\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performed by Logon ID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "ce867840-f49e-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzMyLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4733\", \"4729\", \"4757\"], \"value\": \"4733, 4729, 4757\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Removed from Group - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Removed from Group - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 4, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 5, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.MemberName\", \"missingBucket\": false, \"customLabel\": \"User\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 10, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"6\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performed by Logon ID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "fee83900-f49f-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzMzLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4799\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4799\"], \"value\": \"4799\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Enumeration [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Group Enumeration [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 4, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Creator\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Creator LogonID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "bc165210-f4b8-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzM0LDFd"
        },
        {
            "attributes": {
                "columns": [
                    "user.name",
                    "source.domain",
                    "source.ip",
                    "winlog.logon.id",
                    "winlog.logon.type"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"highlightAll\": true, \"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"version\": true, \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4624\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4624\"], \"value\": \"4624\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "sort": [
                    [
                        "@timestamp",
                        "desc"
                    ]
                ],
                "title": "Logon Details [Winlogbeat Security]",
                "version": 1
            },
            "id": "7e178c80-fee1-11e9-8405-516218e3d268",
            "migrationVersion": {
                "search": "7.4.0"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "search",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzkyLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4732\", \"4728\", \"4756\"], \"value\": \"4732, 4728, 4756\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Added - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Added - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": true, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"Background\", \"invertColors\": false, \"colorSchema\": \"Reds\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Users Added to Groups\"}}]}"
            },
            "id": "a13bf640-fee8-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzM2LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4734\", \"4730\", \"4758\"], \"value\": \"4734, 4730, 4758\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Groups Deleted- Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Groups Deleted- Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": true, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"Background\", \"invertColors\": false, \"colorSchema\": \"Greens\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Groups Deleted\"}}]}"
            },
            "id": "5eeaafd0-fee7-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzM3LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4731\", \"4727\", \"4754\"], \"value\": \"4731, 4727, 4754\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Groups Created - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Groups Created - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": true, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"Background\", \"invertColors\": false, \"colorSchema\": \"Reds\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Groups Created\"}}]}"
            },
            "id": "f42f3b20-fee6-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzM4LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4735\", \"4737\", \"4755\", \"4764\"], \"value\": \"4735, 4737, 4755, 4764\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Groups Changes - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Groups Changes - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": true, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"Background\", \"invertColors\": false, \"colorSchema\": \"Greys\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Groups Changed\"}}]}"
            },
            "id": "b5f38780-fee6-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzM5LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4733\", \"4727\", \"4729\"], \"value\": \"4733, 4727, 4729\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Removed from Group  - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Removed from Group  - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": true, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"Background\", \"invertColors\": false, \"colorSchema\": \"Greens\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Users Removed from  Groups\"}}]}"
            },
            "id": "1b5f17d0-feea-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzQwLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4799\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4799\"}, \"value\": \"4799\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Membership Enumeration  - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Group Membership Enumeration  - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": true, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"Background\", \"invertColors\": true, \"colorSchema\": \"Blues\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Group Membership Enumerated\"}}]}"
            },
            "id": "0f2f5280-feeb-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzQxLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4737\", \"4764\", \"4799\", \"4727\", \"4728\", \"4729\", \"4730\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\"], \"value\": \"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Management Action Distribution over Time [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Action Distribution over Time [Winlogbeat Security]\", \"params\": {\"valueAxes\": [{\"scale\": {\"mode\": \"normal\", \"type\": \"linear\"}, \"style\": {}, \"position\": \"left\", \"type\": \"value\", \"title\": {\"text\": \"Count\"}, \"id\": \"ValueAxis-1\", \"labels\": {\"truncate\": 100, \"show\": true, \"filter\": false, \"rotate\": 0}, \"show\": true, \"name\": \"LeftAxis-1\"}], \"type\": \"histogram\", \"legendPosition\": \"bottom\", \"addLegend\": true, \"addTimeMarker\": false, \"addTooltip\": true, \"seriesParams\": [{\"type\": \"histogram\", \"drawLinesBetweenPoints\": true, \"mode\": \"stacked\", \"data\": {\"id\": \"1\", \"label\": \"Count\"}, \"valueAxis\": \"ValueAxis-1\", \"show\": \"true\", \"showCircles\": true}], \"dimensions\": {\"x\": {\"params\": {\"bounds\": {\"min\": \"2019-10-05T09:56:42.142Z\", \"max\": \"2019-11-04T10:56:42.142Z\"}, \"interval\": \"PT12H\", \"format\": \"YYYY-MM-DD HH:mm\", \"date\": true}, \"format\": {\"id\": \"date\", \"params\": {\"pattern\": \"YYYY-MM-DD HH:mm\"}}, \"accessor\": 0, \"aggType\": \"date_histogram\"}, \"y\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}], \"series\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}]}, \"categoryAxes\": [{\"scale\": {\"type\": \"linear\"}, \"style\": {}, \"position\": \"bottom\", \"type\": \"category\", \"title\": {}, \"id\": \"CategoryAxis-1\", \"labels\": {\"truncate\": 100, \"show\": true, \"filter\": true}, \"show\": true}], \"grid\": {\"categoryLines\": false}, \"labels\": {\"show\": true}, \"times\": []}, \"type\": \"histogram\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"date_histogram\", \"schema\": \"segment\", \"params\": {\"extended_bounds\": {}, \"field\": \"@timestamp\", \"interval\": \"auto\", \"timeRange\": {\"to\": \"now\", \"from\": \"now-30d\"}, \"useNormalizedEsInterval\": true, \"min_doc_count\": 1, \"drop_partials\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"group\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"otherBucket\": false}}]}"
            },
            "id": "24954800-fef0-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzQyLDFd"
        },
        {
            "attributes": {
                "columns": [
                    "event.action",
                    "group.name",
                    "group.domain",
                    "winlog.event_data.SubjectUserName",
                    "user.domain",
                    "host.name"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"highlightAll\": true, \"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"version\": true, \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4737\", \"4764\", \"4799\", \"4727\", \"4728\", \"4729\", \"4730\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\"], \"value\": \"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "sort": [
                    [
                        "@timestamp",
                        "desc"
                    ]
                ],
                "title": "Group Management Details - Search View [Winlogbeat Security]",
                "version": 1
            },
            "id": "9066d5b0-fef2-11e9-8405-516218e3d268",
            "migrationVersion": {
                "search": "7.4.0"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "search",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzQzLDFd"
        }
    ],
    "version": "7.5.2"
}