{
    "objects": [
        {
            "attributes": {
                "description": "Includes Visual Builder Metric\nInterval size 90 days",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "optionsJSON": "{\"useMargins\": true, \"hidePanelTitles\": false}",
                "panelsJSON": "[{\"panelIndex\": \"22\", \"title\": \"\", \"gridData\": {\"y\": 0, \"w\": 17, \"i\": \"22\", \"x\": 0, \"h\": 20}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_0\"}, {\"panelIndex\": \"23\", \"title\": \"Group Managment Actions [Winlogbeat Security]\", \"gridData\": {\"y\": 0, \"w\": 21, \"i\": \"23\", \"x\": 17, \"h\": 20}, \"embeddableConfig\": {\"vis\": {\"legendOpen\": false}}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_1\"}, {\"panelIndex\": \"25\", \"title\": \"Event Codes [Winlogbeat Security]\", \"gridData\": {\"y\": 0, \"w\": 10, \"i\": \"25\", \"x\": 38, \"h\": 20}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_2\"}, {\"panelIndex\": \"29\", \"title\": \"\", \"gridData\": {\"y\": 61, \"w\": 16, \"i\": \"29\", \"x\": 0, \"h\": 7}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_3\"}, {\"panelIndex\": \"30\", \"title\": \"\", \"gridData\": {\"y\": 41, \"w\": 9, \"i\": \"30\", \"x\": 18, \"h\": 7}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_4\"}, {\"panelIndex\": \"31\", \"title\": \"\", \"gridData\": {\"y\": 41, \"w\": 9, \"i\": \"31\", \"x\": 0, \"h\": 7}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_5\"}, {\"panelIndex\": \"32\", \"title\": \"\", \"gridData\": {\"y\": 41, \"w\": 9, \"i\": \"32\", \"x\": 9, \"h\": 7}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_6\"}, {\"panelIndex\": \"33\", \"title\": \"\", \"gridData\": {\"y\": 61, \"w\": 17, \"i\": \"33\", \"x\": 16, \"h\": 7}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_7\"}, {\"panelIndex\": \"34\", \"title\": \"\", \"gridData\": {\"y\": 61, \"w\": 15, \"i\": \"34\", \"x\": 33, \"h\": 7}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_8\"}, {\"panelIndex\": \"35\", \"title\": \"Actions performed over Groups [Winlogbeat Security]\", \"gridData\": {\"y\": 20, \"w\": 27, \"i\": \"35\", \"x\": 0, \"h\": 21}, \"embeddableConfig\": {\"vis\": {\"legendOpen\": false, \"defaultColors\": {\"1 - 2\": \"rgb(198,219,239)\", \"0 - 1\": \"rgb(247,251,255)\", \"2 - 3\": \"rgb(107,174,214)\", \"3 - 4\": \"rgb(33,113,181)\"}}}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_9\"}, {\"panelIndex\": \"36\", \"title\": \"Group Creation Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 48, \"w\": 9, \"i\": \"36\", \"x\": 0, \"h\": 13}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_10\"}, {\"panelIndex\": \"37\", \"title\": \"Group Changes Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 48, \"w\": 9, \"i\": \"37\", \"x\": 9, \"h\": 13}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_11\"}, {\"panelIndex\": \"38\", \"title\": \"Group Deletion Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 48, \"w\": 9, \"i\": \"38\", \"x\": 18, \"h\": 13}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_12\"}, {\"panelIndex\": \"39\", \"title\": \"Users Added to Group  Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 68, \"w\": 16, \"i\": \"39\", \"x\": 0, \"h\": 14}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_13\"}, {\"panelIndex\": \"40\", \"title\": \"Users Removed From Group Summary [Winlogbeat Security]\", \"gridData\": {\"y\": 68, \"w\": 17, \"i\": \"40\", \"x\": 16, \"h\": 14}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_14\"}, {\"panelIndex\": \"42\", \"title\": \"Group Enumeration - Table [Winlogbeat Security]\", \"gridData\": {\"y\": 68, \"w\": 15, \"i\": \"42\", \"x\": 33, \"h\": 14}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_15\"}, {\"panelIndex\": \"43\", \"title\": \"Logon Details  [Winlogbeat Security]\", \"gridData\": {\"y\": 41, \"w\": 21, \"i\": \"43\", \"x\": 27, \"h\": 20}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_16\"}, {\"panelIndex\": \"44\", \"version\": \"7.3.1\", \"gridData\": {\"y\": 20, \"w\": 21, \"i\": \"44\", \"x\": 27, \"h\": 21}, \"embeddableConfig\": {}, \"panelRefName\": \"panel_17\"}, {\"panelIndex\": \"45\", \"title\": \"Group Management Operations Details [Winlogbeat Security]\", \"gridData\": {\"y\": 82, \"w\": 48, \"i\": \"45\", \"x\": 0, \"h\": 22}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_18\"}]",
                "timeRestore": false,
                "title": "[Winlogbeat Security] Group Management Events",
                "version": 1
            },
            "id": "bb858830-f412-11e9-8405-516218e3d268",
            "migrationVersion": {
                "dashboard": "7.3.0"
            },
            "references": [
                {
                    "id": "6f0f2ea0-f414-11e9-8405-516218e3d268",
                    "name": "panel_0",
                    "type": "visualization"
                },
                {
                    "id": "b01aaea0-f415-11e9-8405-516218e3d268",
                    "name": "panel_1",
                    "type": "visualization"
                },
                {
                    "id": "11b5c0e0-f417-11e9-8405-516218e3d268",
                    "name": "panel_2",
                    "type": "visualization"
                },
                {
                    "id": "ffebe440-f419-11e9-8405-516218e3d268",
                    "name": "panel_3",
                    "type": "visualization"
                },
                {
                    "id": "e22c6f40-f498-11e9-8405-516218e3d268",
                    "name": "panel_4",
                    "type": "visualization"
                },
                {
                    "id": "ee292bc0-f499-11e9-8405-516218e3d268",
                    "name": "panel_5",
                    "type": "visualization"
                },
                {
                    "id": "400b63e0-f49a-11e9-8405-516218e3d268",
                    "name": "panel_6",
                    "type": "visualization"
                },
                {
                    "id": "a5f664c0-f49a-11e9-8405-516218e3d268",
                    "name": "panel_7",
                    "type": "visualization"
                },
                {
                    "id": "546febc0-f49b-11e9-8405-516218e3d268",
                    "name": "panel_8",
                    "type": "visualization"
                },
                {
                    "id": "b948eaf0-f49c-11e9-8405-516218e3d268",
                    "name": "panel_9",
                    "type": "visualization"
                },
                {
                    "id": "98884120-f49d-11e9-8405-516218e3d268",
                    "name": "panel_10",
                    "type": "visualization"
                },
                {
                    "id": "9e534190-f49d-11e9-8405-516218e3d268",
                    "name": "panel_11",
                    "type": "visualization"
                },
                {
                    "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268",
                    "name": "panel_12",
                    "type": "visualization"
                },
                {
                    "id": "ce867840-f49e-11e9-8405-516218e3d268",
                    "name": "panel_13",
                    "type": "visualization"
                },
                {
                    "id": "fee83900-f49f-11e9-8405-516218e3d268",
                    "name": "panel_14",
                    "type": "visualization"
                },
                {
                    "id": "bc165210-f4b8-11e9-8405-516218e3d268",
                    "name": "panel_15",
                    "type": "visualization"
                },
                {
                    "id": "7e178c80-fee1-11e9-8405-516218e3d268",
                    "name": "panel_16",
                    "type": "search"
                },
                {
                    "id": "24954800-fef0-11e9-8405-516218e3d268",
                    "name": "panel_17",
                    "type": "visualization"
                },
                {
                    "id": "9066d5b0-fef2-11e9-8405-516218e3d268",
                    "name": "panel_18",
                    "type": "search"
                }
            ],
            "type": "dashboard",
            "updated_at": "2020-02-04T20:38:59.746Z",
            "version": "WzQsMV0="
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Group Management Events - Description [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Events - Description [Winlogbeat Security]\", \"params\": {\"fontSize\": 10, \"openLinksInNewTab\": false, \"markdown\": \"# **Group Management Events**\\n\\n#### This dashboard shows information about Group Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description|Event | Description\\n-- | --|--|--\\n|4727|A security-enabled global group was created.|4728|A member was added to a security-enabled global group.| \\n|4729|A member was removed from a security-enabled global group.|4730|A security-enabled global group was deleted.| \\n|4731|A security-enabled local group was created.|4732|A member was added to a security-enabled local group.|\\n|4733|A member was removed from a security-enabled local group.|4734|A security-enabled local group was deleted.|\\n|4735|A security-enabled local group was changed.|4737|A security-enabled global group was changed.|\\n|4754|A security-enabled universal group was created.| 4755|A security-enabled universal group was changed.| \\n|4756|A member was added to a security-enabled universal group.|4757|A member was removed from a security-enabled universal group.| \\n|4758|A security-enabled universal group was deleted.| 4764|A group\\\\'s type was changed.|\\n|4799|A security-enabled local group membership was enumerated.|\"}, \"type\": \"markdown\", \"aggs\": []}"
            },
            "id": "6f0f2ea0-f414-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI1LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4764\", \"4799\", \"4727\", \"4737\", \"4728\", \"4729\", \"4730\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\"], \"value\": \"4731, 4732, 4733, 4734, 4735, 4764, 4799, 4727, 4737, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Management Events - Event Actions - Donut [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Events - Event Actions - Donut [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"type\": \"pie\", \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}], \"metric\": {\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 1, \"aggType\": \"count\"}}, \"isDonut\": true, \"labels\": {\"last_level\": true, \"values\": true, \"truncate\": 100, \"show\": true}, \"addLegend\": true, \"legendPosition\": \"right\"}, \"type\": \"pie\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"otherBucket\": false}}]}"
            },
            "id": "b01aaea0-f415-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI2LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4727\", \"4728\", \"4729\", \"4730\", \"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4737\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\", \"4764\", \"4799\"], \"value\": \"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Management Events - Event Actions - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Events - Event Actions - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 2, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"customLabel\": \"Event Action\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"event.code\", \"missingBucket\": false, \"customLabel\": \"Event Code\", \"otherBucketLabel\": \"Other\", \"size\": 10, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "11b5c0e0-f417-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI3LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Users Added - Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Added - Metric [Winlogbeat Security]\", \"params\": {\"type\": \"metric\", \"axis_position\": \"left\", \"axis_formatter\": \"number\", \"default_index_pattern\": \"winlogbeat-*\", \"series\": [{\"chart_type\": \"line\", \"separate_axis\": 0, \"label\": \"Users Added to Group\", \"formatter\": \"number\", \"axis_position\": \"right\", \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"metrics\": [{\"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\", \"type\": \"count\"}], \"point_size\": 1, \"color\": \"#68BC00\", \"split_mode\": \"everything\", \"stacked\": \"none\", \"fill\": 0.5, \"line_width\": 1}], \"interval\": \"90d\", \"time_field\": \"\", \"background_color_rules\": [{\"id\": \"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\", \"value\": 1, \"background_color\": \"rgba(128,137,0,1)\", \"operator\": \"gt\"}, {\"id\": \"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\", \"value\": 3, \"background_color\": \"rgba(211,49,21,1)\", \"operator\": \"gte\"}], \"show_legend\": 1, \"filter\": {\"query\": \"event.code:4732 OR event.code:4728 OR event.code:4756\", \"language\": \"kuery\"}, \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"axis_scale\": \"normal\", \"drop_last_bucket\": 0, \"index_pattern\": \"winlogbeat-*\", \"default_timefield\": \"@timestamp\", \"show_grid\": 1}, \"type\": \"metrics\", \"aggs\": []}"
            },
            "id": "ffebe440-f419-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [],
            "type": "visualization",
            "updated_at": "2020-02-04T20:38:59.746Z",
            "version": "WzgsMV0="
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Groups Deleted - Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Groups Deleted - Metric [Winlogbeat Security]\", \"params\": {\"type\": \"metric\", \"axis_position\": \"left\", \"axis_formatter\": \"number\", \"default_index_pattern\": \"winlogbeat-*\", \"series\": [{\"chart_type\": \"line\", \"separate_axis\": 0, \"label\": \"Groups Deleted\", \"formatter\": \"number\", \"axis_position\": \"right\", \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"metrics\": [{\"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\", \"type\": \"count\"}], \"point_size\": 1, \"color\": \"#68BC00\", \"split_mode\": \"everything\", \"stacked\": \"none\", \"fill\": 0.5, \"line_width\": 1}], \"interval\": \"90d\", \"time_field\": \"\", \"background_color_rules\": [{\"id\": \"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\", \"value\": 0, \"background_color\": \"rgba(200,201,197,1)\", \"operator\": \"lte\"}, {\"id\": \"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\", \"value\": 0, \"background_color\": \"rgba(153,172,99,1)\", \"operator\": \"gt\"}], \"show_legend\": 1, \"filter\": {\"query\": \"event.code:4734 OR event.code:4730 OR event.code:4758\", \"language\": \"kuery\"}, \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"axis_scale\": \"normal\", \"drop_last_bucket\": 0, \"index_pattern\": \"winlogbeat-*\", \"default_timefield\": \"@timestamp\", \"show_grid\": 1}, \"type\": \"metrics\", \"aggs\": []}"
            },
            "id": "e22c6f40-f498-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [],
            "type": "visualization",
            "updated_at": "2020-02-04T20:38:59.746Z",
            "version": "WzksMV0="
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Groups Created - Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Groups Created - Metric [Winlogbeat Security]\", \"params\": {\"type\": \"metric\", \"axis_position\": \"left\", \"axis_formatter\": \"number\", \"default_index_pattern\": \"winlogbeat-*\", \"series\": [{\"chart_type\": \"line\", \"separate_axis\": 0, \"label\": \"Groups Created\", \"formatter\": \"number\", \"axis_position\": \"right\", \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"metrics\": [{\"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\", \"type\": \"count\"}], \"point_size\": 1, \"color\": \"#68BC00\", \"split_mode\": \"everything\", \"stacked\": \"none\", \"fill\": 0.5, \"line_width\": 1}], \"interval\": \"90d\", \"time_field\": \"\", \"background_color_rules\": [{\"id\": \"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\", \"value\": 0, \"background_color\": \"rgba(200,201,197,1)\", \"operator\": \"lte\"}, {\"id\": \"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\", \"value\": 0, \"background_color\": \"rgba(244,78,59,1)\", \"operator\": \"gt\"}], \"show_legend\": 1, \"filter\": {\"query\": \"event.code:4731 OR event.code:4727 OR event.code:\\\"4754\\\" \", \"language\": \"kuery\"}, \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"axis_scale\": \"normal\", \"drop_last_bucket\": 0, \"index_pattern\": \"winlogbeat-*\", \"default_timefield\": \"@timestamp\", \"show_grid\": 1}, \"type\": \"metrics\", \"aggs\": []}"
            },
            "id": "ee292bc0-f499-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [],
            "type": "visualization",
            "updated_at": "2020-02-04T20:38:59.746Z",
            "version": "WzEwLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Groups Changed - Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Groups Changed - Metric [Winlogbeat Security]\", \"params\": {\"type\": \"metric\", \"axis_position\": \"left\", \"axis_formatter\": \"number\", \"default_index_pattern\": \"winlogbeat-*\", \"series\": [{\"chart_type\": \"line\", \"separate_axis\": 0, \"label\": \"Groups Changed\", \"formatter\": \"number\", \"axis_position\": \"right\", \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"metrics\": [{\"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\", \"type\": \"count\"}], \"point_size\": 1, \"color\": \"#68BC00\", \"split_mode\": \"everything\", \"stacked\": \"none\", \"fill\": 0.5, \"line_width\": 1}], \"interval\": \"60d\", \"time_field\": \"\", \"background_color_rules\": [{\"id\": \"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\", \"value\": 0, \"background_color\": \"rgba(200,201,197,1)\", \"operator\": \"lte\"}, {\"id\": \"a7d935e0-f497-11e9-928e-8f5fd2b6c66e\", \"value\": 0, \"background_color\": \"rgba(252,196,0,1)\", \"operator\": \"gt\"}], \"show_legend\": 1, \"filter\": {\"query\": \"event.code:4735 OR event.code:4737 OR event.code:\\\"4755\\\" OR event.code:\\\"4764\\\"  \", \"language\": \"kuery\"}, \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"axis_scale\": \"normal\", \"drop_last_bucket\": 0, \"index_pattern\": \"winlogbeat-*\", \"default_timefield\": \"@timestamp\", \"show_grid\": 1}, \"type\": \"metrics\", \"aggs\": []}"
            },
            "id": "400b63e0-f49a-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [],
            "type": "visualization",
            "updated_at": "2020-02-04T20:38:59.746Z",
            "version": "WzExLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Users Removed - Table [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Removed - Table [Winlogbeat Security]\", \"params\": {\"type\": \"metric\", \"axis_position\": \"left\", \"axis_formatter\": \"number\", \"default_index_pattern\": \"winlogbeat-*\", \"series\": [{\"chart_type\": \"line\", \"separate_axis\": 0, \"label\": \"Users Removed from Group\", \"formatter\": \"number\", \"axis_position\": \"right\", \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"metrics\": [{\"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\", \"type\": \"count\"}], \"point_size\": 1, \"color\": \"#68BC00\", \"split_mode\": \"everything\", \"stacked\": \"none\", \"fill\": 0.5, \"line_width\": 1}], \"interval\": \"90d\", \"time_field\": \"\", \"background_color_rules\": [{\"id\": \"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\", \"value\": 0, \"background_color\": \"rgba(176,188,0,1)\", \"operator\": \"gt\"}], \"show_legend\": 1, \"filter\": {\"query\": \"event.code:4733 OR event.code:4727 OR event.code:4729\", \"language\": \"kuery\"}, \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"axis_scale\": \"normal\", \"drop_last_bucket\": 0, \"index_pattern\": \"winlogbeat-*\", \"default_timefield\": \"@timestamp\", \"show_grid\": 1}, \"type\": \"metrics\", \"aggs\": []}"
            },
            "id": "a5f664c0-f49a-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [],
            "type": "visualization",
            "updated_at": "2020-02-04T20:38:59.746Z",
            "version": "WzEyLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "Groups Enumeration - Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Groups Enumeration - Metric [Winlogbeat Security]\", \"params\": {\"type\": \"metric\", \"axis_position\": \"left\", \"axis_formatter\": \"number\", \"default_index_pattern\": \"winlogbeat-*\", \"series\": [{\"chart_type\": \"line\", \"separate_axis\": 0, \"label\": \"Group Membership Enumeration\", \"formatter\": \"number\", \"axis_position\": \"right\", \"id\": \"61ca57f1-469d-11e7-af02-69e470af7417\", \"metrics\": [{\"id\": \"61ca57f2-469d-11e7-af02-69e470af7417\", \"type\": \"count\"}], \"point_size\": 1, \"color\": \"#68BC00\", \"split_mode\": \"everything\", \"stacked\": \"none\", \"fill\": 0.5, \"line_width\": 1}], \"interval\": \"90d\", \"time_field\": \"\", \"background_color_rules\": [{\"id\": \"bfcaced0-f419-11e9-928e-8f5fd2b6c66e\", \"value\": 0, \"background_color\": \"rgba(159,5,0,1)\", \"operator\": \"gt\"}], \"show_legend\": 1, \"filter\": {\"query\": \"event.code:4799\", \"language\": \"kuery\"}, \"id\": \"61ca57f0-469d-11e7-af02-69e470af7417\", \"axis_scale\": \"normal\", \"drop_last_bucket\": 0, \"index_pattern\": \"winlogbeat-*\", \"default_timefield\": \"@timestamp\", \"show_grid\": 1}, \"type\": \"metrics\", \"aggs\": []}"
            },
            "id": "546febc0-f49b-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [],
            "type": "visualization",
            "updated_at": "2020-02-04T20:38:59.746Z",
            "version": "WzEzLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4727\", \"4728\", \"4729\", \"4730\", \"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4737\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\", \"4764\", \"4799\"], \"value\": \"4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, 4799\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Management Events - Groups vs Actions - Heatmap [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"defaultColors\": {\"1 - 2\": \"rgb(198,219,239)\", \"0 - 1\": \"rgb(247,251,255)\", \"2 - 3\": \"rgb(107,174,214)\", \"3 - 4\": \"rgb(33,113,181)\"}}}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Events - Groups vs Actions - Heatmap [Winlogbeat Security]\", \"params\": {\"valueAxes\": [{\"scale\": {\"type\": \"linear\", \"defaultYExtents\": false}, \"id\": \"ValueAxis-1\", \"labels\": {\"color\": \"black\", \"show\": true, \"overwriteColor\": false, \"rotate\": 0}, \"type\": \"value\", \"show\": false}], \"type\": \"heatmap\", \"legendPosition\": \"right\", \"addLegend\": true, \"addTooltip\": true, \"colorSchema\": \"Blues\", \"percentageMode\": false, \"dimensions\": {\"x\": {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, \"y\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 2, \"aggType\": \"count\"}], \"series\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}]}, \"invertColors\": false, \"enableHover\": false, \"colorsNumber\": 4, \"colorsRange\": [], \"setColorRange\": false, \"times\": []}, \"type\": \"heatmap\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 15, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"group\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"otherBucket\": false}}]}"
            },
            "id": "b948eaf0-f49c-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI4LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4731\", \"4727\", \"4754\"], \"value\": \"4731, 4727, 4754\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Groups Created - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Groups Created - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 4, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "98884120-f49d-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzI5LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4735\", \"4737\", \"4755\"], \"value\": \"4735, 4737, 4755\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Changes - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Group Changes - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 4, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "9e534190-f49d-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzMwLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4734\", \"4730\", \"4758\"], \"value\": \"4734, 4730, 4758\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Groups Deleted - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Groups Deleted - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 4, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "bb9cf7a0-f49d-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzMxLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4732\", \"4728\", \"4756\"], \"value\": \"4732, 4728, 4756\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Added - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Added - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 4, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 5, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.MemberName\", \"missingBucket\": false, \"customLabel\": \"User\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 10, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"6\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performed by Logon ID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "ce867840-f49e-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzMyLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4733\", \"4729\", \"4757\"], \"value\": \"4733, 4729, 4757\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Removed from Group - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Removed from Group - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 4, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 5, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.MemberName\", \"missingBucket\": false, \"customLabel\": \"User\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 10, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"6\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performed by Logon ID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "fee83900-f49f-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzMzLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4799\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4799\"], \"value\": \"4799\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Enumeration - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Group Enumeration - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 3, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 4, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 5, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.name\", \"missingBucket\": false, \"customLabel\": \"Group\", \"otherBucketLabel\": \"Other\", \"size\": 20, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"group.domain\", \"missingBucket\": false, \"customLabel\": \"Domain\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": false, \"customLabel\": \"Creator\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Creator LogonID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "bc165210-f4b8-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzM0LDFd"
        },
        {
            "attributes": {
                "columns": [
                    "user.name",
                    "source.domain",
                    "source.ip",
                    "winlog.logon.id",
                    "winlog.logon.type"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"highlightAll\": true, \"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"version\": true, \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4624\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4624\"], \"value\": \"4624\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "sort": [
                    [
                        "@timestamp",
                        "desc"
                    ]
                ],
                "title": "Logon Details [Winlogbeat Security]",
                "version": 1
            },
            "id": "7e178c80-fee1-11e9-8405-516218e3d268",
            "migrationVersion": {
                "search": "7.4.0"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "search",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzkyLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4737\", \"4764\", \"4799\", \"4727\", \"4728\", \"4729\", \"4730\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\"], \"value\": \"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Group Management Action Distribution over Time [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Group Management Action Distribution over Time [Winlogbeat Security]\", \"params\": {\"valueAxes\": [{\"scale\": {\"mode\": \"normal\", \"type\": \"linear\"}, \"style\": {}, \"position\": \"left\", \"type\": \"value\", \"title\": {\"text\": \"Count\"}, \"id\": \"ValueAxis-1\", \"labels\": {\"truncate\": 100, \"show\": true, \"filter\": false, \"rotate\": 0}, \"show\": true, \"name\": \"LeftAxis-1\"}], \"type\": \"histogram\", \"legendPosition\": \"bottom\", \"addLegend\": true, \"addTimeMarker\": false, \"addTooltip\": true, \"seriesParams\": [{\"type\": \"histogram\", \"drawLinesBetweenPoints\": true, \"mode\": \"stacked\", \"data\": {\"id\": \"1\", \"label\": \"Count\"}, \"valueAxis\": \"ValueAxis-1\", \"show\": \"true\", \"showCircles\": true}], \"dimensions\": {\"x\": {\"params\": {\"bounds\": {\"min\": \"2019-10-05T09:56:42.142Z\", \"max\": \"2019-11-04T10:56:42.142Z\"}, \"interval\": \"PT12H\", \"format\": \"YYYY-MM-DD HH:mm\", \"date\": true}, \"format\": {\"id\": \"date\", \"params\": {\"pattern\": \"YYYY-MM-DD HH:mm\"}}, \"accessor\": 0, \"aggType\": \"date_histogram\"}, \"y\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}], \"series\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}]}, \"categoryAxes\": [{\"scale\": {\"type\": \"linear\"}, \"style\": {}, \"position\": \"bottom\", \"type\": \"category\", \"title\": {}, \"id\": \"CategoryAxis-1\", \"labels\": {\"truncate\": 100, \"show\": true, \"filter\": true}, \"show\": true}], \"grid\": {\"categoryLines\": false}, \"labels\": {\"show\": true}, \"times\": []}, \"type\": \"histogram\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"date_histogram\", \"schema\": \"segment\", \"params\": {\"extended_bounds\": {}, \"field\": \"@timestamp\", \"interval\": \"auto\", \"timeRange\": {\"to\": \"now\", \"from\": \"now-30d\"}, \"useNormalizedEsInterval\": true, \"min_doc_count\": 1, \"drop_partials\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"group\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"otherBucket\": false}}]}"
            },
            "id": "24954800-fef0-11e9-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzQyLDFd"
        },
        {
            "attributes": {
                "columns": [
                    "event.action",
                    "group.name",
                    "group.domain",
                    "winlog.event_data.SubjectUserName",
                    "user.domain",
                    "host.name"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"highlightAll\": true, \"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"version\": true, \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4731\"}}, {\"match_phrase\": {\"event.code\": \"4732\"}}, {\"match_phrase\": {\"event.code\": \"4733\"}}, {\"match_phrase\": {\"event.code\": \"4734\"}}, {\"match_phrase\": {\"event.code\": \"4735\"}}, {\"match_phrase\": {\"event.code\": \"4737\"}}, {\"match_phrase\": {\"event.code\": \"4764\"}}, {\"match_phrase\": {\"event.code\": \"4799\"}}, {\"match_phrase\": {\"event.code\": \"4727\"}}, {\"match_phrase\": {\"event.code\": \"4728\"}}, {\"match_phrase\": {\"event.code\": \"4729\"}}, {\"match_phrase\": {\"event.code\": \"4730\"}}, {\"match_phrase\": {\"event.code\": \"4754\"}}, {\"match_phrase\": {\"event.code\": \"4755\"}}, {\"match_phrase\": {\"event.code\": \"4756\"}}, {\"match_phrase\": {\"event.code\": \"4757\"}}, {\"match_phrase\": {\"event.code\": \"4758\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4731\", \"4732\", \"4733\", \"4734\", \"4735\", \"4737\", \"4764\", \"4799\", \"4727\", \"4728\", \"4729\", \"4730\", \"4754\", \"4755\", \"4756\", \"4757\", \"4758\"], \"value\": \"4731, 4732, 4733, 4734, 4735, 4737, 4764, 4799, 4727, 4728, 4729, 4730, 4754, 4755, 4756, 4757, 4758\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "sort": [
                    [
                        "@timestamp",
                        "desc"
                    ]
                ],
                "title": "Group Management Details - Search View [Winlogbeat Security]",
                "version": 1
            },
            "id": "9066d5b0-fef2-11e9-8405-516218e3d268",
            "migrationVersion": {
                "search": "7.4.0"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "search",
            "updated_at": "2020-02-04T20:39:00.715Z",
            "version": "WzQzLDFd"
        }
    ],
    "version": "7.5.2"
}