{
    "objects": [
        {
            "attributes": {
                "description": "Uses Simple Metric Visualizations",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "optionsJSON": "{\"useMargins\": true, \"hidePanelTitles\": false}",
                "panelsJSON": "[{\"panelIndex\": \"1\", \"title\": \"\", \"gridData\": {\"y\": 0, \"w\": 17, \"i\": \"1\", \"x\": 0, \"h\": 19}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_0\"}, {\"panelIndex\": \"2\", \"title\": \"User Management Actions [Winlogbeat Security]\", \"gridData\": {\"y\": 0, \"w\": 18, \"i\": \"2\", \"x\": 17, \"h\": 19}, \"embeddableConfig\": {\"vis\": {\"legendOpen\": false}}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_1\"}, {\"panelIndex\": \"3\", \"title\": \"Created Users [Winlogbeat Security]\", \"gridData\": {\"y\": 44, \"w\": 9, \"i\": \"3\", \"x\": 0, \"h\": 16}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_2\"}, {\"panelIndex\": \"4\", \"title\": \"Event Codes [Winlogbeat Security]\", \"gridData\": {\"y\": 0, \"w\": 13, \"i\": \"4\", \"x\": 35, \"h\": 19}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_3\"}, {\"panelIndex\": \"5\", \"title\": \"Enabled Users [Winlogbeat Security]\", \"gridData\": {\"y\": 44, \"w\": 9, \"i\": \"5\", \"x\": 9, \"h\": 16}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_4\"}, {\"panelIndex\": \"6\", \"title\": \"Disabled Users [Winlogbeat Security]\", \"gridData\": {\"y\": 66, \"w\": 9, \"i\": \"6\", \"x\": 0, \"h\": 16}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_5\"}, {\"panelIndex\": \"7\", \"title\": \"Deleted Users [Winlogbeat Security]\", \"gridData\": {\"y\": 44, \"w\": 9, \"i\": \"7\", \"x\": 18, \"h\": 16}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_6\"}, {\"panelIndex\": \"8\", \"title\": \"Actions performed over Users [Winlogbeat Security]\", \"gridData\": {\"y\": 19, \"w\": 48, \"i\": \"8\", \"x\": 0, \"h\": 20}, \"embeddableConfig\": {\"vis\": {\"legendOpen\": false, \"defaultColors\": {\"8 - 12\": \"rgb(116,196,118)\", \"4 - 8\": \"rgb(199,233,192)\", \"12 - 16\": \"rgb(35,139,69)\", \"0 - 4\": \"rgb(247,252,245)\"}}}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_7\"}, {\"panelIndex\": \"9\", \"title\": \"Passwords Changes [Winlogbeat Security]\", \"gridData\": {\"y\": 66, \"w\": 9, \"i\": \"9\", \"x\": 18, \"h\": 16}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_8\"}, {\"panelIndex\": \"10\", \"title\": \"\", \"gridData\": {\"y\": 39, \"w\": 9, \"i\": \"10\", \"x\": 0, \"h\": 5}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_9\"}, {\"panelIndex\": \"11\", \"title\": \"\", \"gridData\": {\"y\": 39, \"w\": 9, \"i\": \"11\", \"x\": 9, \"h\": 5}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_10\"}, {\"panelIndex\": \"12\", \"title\": \"\", \"gridData\": {\"y\": 39, \"w\": 9, \"i\": \"12\", \"x\": 18, \"h\": 5}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_11\"}, {\"panelIndex\": \"13\", \"title\": \"\", \"gridData\": {\"y\": 60, \"w\": 9, \"i\": \"13\", \"x\": 0, \"h\": 6}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_12\"}, {\"panelIndex\": \"14\", \"title\": \"\", \"gridData\": {\"y\": 60, \"w\": 9, \"i\": \"14\", \"x\": 18, \"h\": 6}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_13\"}, {\"panelIndex\": \"15\", \"title\": \"Unlocked Users [Winlogbeat Security]\", \"gridData\": {\"y\": 66, \"w\": 9, \"i\": \"15\", \"x\": 9, \"h\": 16}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_14\"}, {\"panelIndex\": \"16\", \"title\": \"Users Changes [Winlogbeat Security]\", \"gridData\": {\"y\": 88, \"w\": 9, \"i\": \"16\", \"x\": 18, \"h\": 16}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_15\"}, {\"panelIndex\": \"17\", \"title\": \"\", \"gridData\": {\"y\": 82, \"w\": 9, \"i\": \"17\", \"x\": 0, \"h\": 6}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_16\"}, {\"panelIndex\": \"18\", \"title\": \"\", \"gridData\": {\"y\": 60, \"w\": 9, \"i\": \"18\", \"x\": 9, \"h\": 6}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_17\"}, {\"panelIndex\": \"19\", \"title\": \"\", \"gridData\": {\"y\": 82, \"w\": 9, \"i\": \"19\", \"x\": 18, \"h\": 6}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_18\"}, {\"panelIndex\": \"20\", \"title\": \"Locked-out Users [Winlogbeat Security]\", \"gridData\": {\"y\": 88, \"w\": 9, \"i\": \"20\", \"x\": 0, \"h\": 16}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_19\"}, {\"panelIndex\": \"21\", \"title\": \"User Management Actions Distributions over Time [Winlogbeat Security]\", \"gridData\": {\"y\": 39, \"w\": 20, \"i\": \"21\", \"x\": 27, \"h\": 27}, \"embeddableConfig\": {}, \"version\": \"7.3.0\", \"panelRefName\": \"panel_20\"}, {\"panelIndex\": \"22\", \"version\": \"7.3.1\", \"gridData\": {\"y\": 66, \"w\": 21, \"i\": \"22\", \"x\": 27, \"h\": 38}, \"embeddableConfig\": {}, \"panelRefName\": \"panel_21\"}, {\"panelIndex\": \"23\", \"version\": \"7.3.1\", \"gridData\": {\"y\": 104, \"w\": 48, \"i\": \"23\", \"x\": 0, \"h\": 19}, \"embeddableConfig\": {}, \"panelRefName\": \"panel_22\"}, {\"panelIndex\": \"24\", \"title\": \"\", \"gridData\": {\"y\": 82, \"w\": 9, \"i\": \"24\", \"x\": 9, \"h\": 6}, \"embeddableConfig\": {}, \"version\": \"7.3.1\", \"panelRefName\": \"panel_23\"}, {\"panelIndex\": \"25\", \"version\": \"7.3.1\", \"gridData\": {\"y\": 88, \"w\": 9, \"i\": \"25\", \"x\": 9, \"h\": 16}, \"embeddableConfig\": {}, \"panelRefName\": \"panel_24\"}]",
                "timeRestore": false,
                "title": "[Winlogbeat Security] User Management Events - Simple Metric",
                "version": 1
            },
            "id": "8223bed0-b9e9-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "dashboard": "7.3.0"
            },
            "references": [
                {
                    "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_0",
                    "type": "visualization"
                },
                {
                    "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_1",
                    "type": "visualization"
                },
                {
                    "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_2",
                    "type": "visualization"
                },
                {
                    "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_3",
                    "type": "visualization"
                },
                {
                    "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_4",
                    "type": "visualization"
                },
                {
                    "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_5",
                    "type": "visualization"
                },
                {
                    "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_6",
                    "type": "visualization"
                },
                {
                    "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_7",
                    "type": "visualization"
                },
                {
                    "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_8",
                    "type": "visualization"
                },
                {
                    "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_9",
                    "type": "visualization"
                },
                {
                    "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_10",
                    "type": "visualization"
                },
                {
                    "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_11",
                    "type": "visualization"
                },
                {
                    "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_12",
                    "type": "visualization"
                },
                {
                    "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_13",
                    "type": "visualization"
                },
                {
                    "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_14",
                    "type": "visualization"
                },
                {
                    "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_15",
                    "type": "visualization"
                },
                {
                    "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_16",
                    "type": "visualization"
                },
                {
                    "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_17",
                    "type": "visualization"
                },
                {
                    "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_18",
                    "type": "visualization"
                },
                {
                    "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf",
                    "name": "panel_19",
                    "type": "visualization"
                },
                {
                    "id": "8f723a10-bd97-11e9-b9c5-fddc96658612",
                    "name": "panel_20",
                    "type": "visualization"
                },
                {
                    "id": "7e178c80-fee1-11e9-8405-516218e3d268",
                    "name": "panel_21",
                    "type": "search"
                },
                {
                    "id": "324686c0-fefb-11e9-8405-516218e3d268",
                    "name": "panel_22",
                    "type": "search"
                },
                {
                    "id": "5e19ff80-231c-11ea-8405-516218e3d268",
                    "name": "panel_23",
                    "type": "visualization"
                },
                {
                    "id": "fa876300-231a-11ea-8405-516218e3d268",
                    "name": "panel_24",
                    "type": "visualization"
                }
            ],
            "type": "dashboard",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzcwLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"
                },
                "title": "User  Management Events - Description [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"User  Management Events - Description [Winlogbeat Security]\", \"params\": {\"fontSize\": 10, \"openLinksInNewTab\": false, \"markdown\": \"# **User Management Events**\\n\\n#### This dashboard shows information about User Management Events collected by winlogbeat\\n#\\n#\\n#\\nEvent | Description\\n-- | --\\n4720 | A user account was created\\n4722 | A user account was enabled\\n4723 | An attempt was made to change an account's password\\n4724 | An attempt was made to reset an account's password\\n4725 | An user account was disabled\\n4726 | An user account was deleted\\n4738 | An user account was changed\\n4740 | An user account was locked out\\n4767 | An account was unlocked\\n4781 | The name of an account was changed\"}, \"type\": \"markdown\", \"aggs\": []}"
            },
            "id": "2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzcxLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4720\"}}, {\"match_phrase\": {\"event.code\": \"4722\"}}, {\"match_phrase\": {\"event.code\": \"4723\"}}, {\"match_phrase\": {\"event.code\": \"4724\"}}, {\"match_phrase\": {\"event.code\": \"4725\"}}, {\"match_phrase\": {\"event.code\": \"4726\"}}, {\"match_phrase\": {\"event.code\": \"4738\"}}, {\"match_phrase\": {\"event.code\": \"4740\"}}, {\"match_phrase\": {\"event.code\": \"4765\"}}, {\"match_phrase\": {\"event.code\": \"4766\"}}, {\"match_phrase\": {\"event.code\": \"4767\"}}, {\"match_phrase\": {\"event.code\": \"4780\"}}, {\"match_phrase\": {\"event.code\": \"4781\"}}, {\"match_phrase\": {\"event.code\": \"4794\"}}, {\"match_phrase\": {\"event.code\": \"5376\"}}, {\"match_phrase\": {\"event.code\": \"5377\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4720\", \"4722\", \"4723\", \"4724\", \"4725\", \"4726\", \"4738\", \"4740\", \"4765\", \"4766\", \"4767\", \"4780\", \"4781\", \"4794\", \"5376\", \"5377\"], \"value\": \"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "User Management Events - Event Actions - Donut [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"User Management Events - Event Actions - Donut [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"type\": \"pie\", \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}], \"metric\": {\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 1, \"aggType\": \"count\"}}, \"isDonut\": true, \"labels\": {\"last_level\": true, \"values\": true, \"truncate\": 100, \"show\": true}, \"addLegend\": true, \"legendPosition\": \"right\"}, \"type\": \"pie\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"otherBucket\": false}}]}"
            },
            "id": "833e0110-b9ec-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzcyLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4720\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4720\"}, \"value\": \"4720\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Created - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Created - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.TargetUserName\", \"missingBucket\": false, \"customLabel\": \"Created User\", \"otherBucketLabel\": \"Other\", \"size\": 100, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": true, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonID\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzczLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4720\"}}, {\"match_phrase\": {\"event.code\": \"4722\"}}, {\"match_phrase\": {\"event.code\": \"4723\"}}, {\"match_phrase\": {\"event.code\": \"4724\"}}, {\"match_phrase\": {\"event.code\": \"4725\"}}, {\"match_phrase\": {\"event.code\": \"4726\"}}, {\"match_phrase\": {\"event.code\": \"4738\"}}, {\"match_phrase\": {\"event.code\": \"4740\"}}, {\"match_phrase\": {\"event.code\": \"4765\"}}, {\"match_phrase\": {\"event.code\": \"4766\"}}, {\"match_phrase\": {\"event.code\": \"4767\"}}, {\"match_phrase\": {\"event.code\": \"4780\"}}, {\"match_phrase\": {\"event.code\": \"4781\"}}, {\"match_phrase\": {\"event.code\": \"4794\"}}, {\"match_phrase\": {\"event.code\": \"5376\"}}, {\"match_phrase\": {\"event.code\": \"5377\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4720\", \"4722\", \"4723\", \"4724\", \"4725\", \"4726\", \"4738\", \"4740\", \"4765\", \"4766\", \"4767\", \"4780\", \"4781\", \"4794\", \"5376\", \"5377\"], \"value\": \"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "User Management Events - Event Actions - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"User Management Events - Event Actions - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 2, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"customLabel\": \"Event Short Description\", \"otherBucketLabel\": \"Other\", \"size\": 10, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"event.code\", \"missingBucket\": false, \"customLabel\": \"Event Code\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "b2cecf10-bcd3-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzc0LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4722\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4722\"}, \"value\": \"4722\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Enabled - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Enabled - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.TargetUserName\", \"missingBucket\": false, \"customLabel\": \"Enabled User\", \"otherBucketLabel\": \"Other\", \"size\": 100, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": true, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonId\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzc1LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4725\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4725\"}, \"value\": \"4725\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Disabled - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Disabled - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.TargetUserName\", \"missingBucket\": false, \"customLabel\": \"Disabled User\", \"otherBucketLabel\": \"Other\", \"size\": 100, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": true, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonId\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "8f20c950-bcd4-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzc2LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4726\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4726\"}, \"value\": \"4726\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Deleted - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Deleted - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.TargetUserName\", \"missingBucket\": false, \"customLabel\": \"Deleted User\", \"otherBucketLabel\": \"Other\", \"size\": 100, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": true, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performed LogonId\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzc3LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4720\"}}, {\"match_phrase\": {\"event.code\": \"4722\"}}, {\"match_phrase\": {\"event.code\": \"4723\"}}, {\"match_phrase\": {\"event.code\": \"4724\"}}, {\"match_phrase\": {\"event.code\": \"4725\"}}, {\"match_phrase\": {\"event.code\": \"4726\"}}, {\"match_phrase\": {\"event.code\": \"4738\"}}, {\"match_phrase\": {\"event.code\": \"4740\"}}, {\"match_phrase\": {\"event.code\": \"4765\"}}, {\"match_phrase\": {\"event.code\": \"4766\"}}, {\"match_phrase\": {\"event.code\": \"4767\"}}, {\"match_phrase\": {\"event.code\": \"4780\"}}, {\"match_phrase\": {\"event.code\": \"4781\"}}, {\"match_phrase\": {\"event.code\": \"4794\"}}, {\"match_phrase\": {\"event.code\": \"5376\"}}, {\"match_phrase\": {\"event.code\": \"5377\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4720\", \"4722\", \"4723\", \"4724\", \"4725\", \"4726\", \"4738\", \"4740\", \"4765\", \"4766\", \"4767\", \"4780\", \"4781\", \"4794\", \"5376\", \"5377\"], \"value\": \"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "User Management Events - Affected Users vs Actions - Heatmap [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"defaultColors\": {\"14 - 28\": \"rgb(198,219,239)\", \"0 - 14\": \"rgb(247,251,255)\", \"28 - 42\": \"rgb(107,174,214)\", \"42 - 55\": \"rgb(33,113,181)\"}}}",
                "version": 1,
                "visState": "{\"title\": \"User Management Events - Affected Users vs Actions - Heatmap [Winlogbeat Security]\", \"params\": {\"valueAxes\": [{\"scale\": {\"type\": \"linear\", \"defaultYExtents\": false}, \"id\": \"ValueAxis-1\", \"labels\": {\"color\": \"black\", \"show\": true, \"overwriteColor\": false, \"rotate\": 0}, \"type\": \"value\", \"show\": false}], \"type\": \"heatmap\", \"legendPosition\": \"right\", \"addLegend\": true, \"addTooltip\": true, \"colorSchema\": \"Blues\", \"percentageMode\": false, \"dimensions\": {\"x\": {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, \"y\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 2, \"aggType\": \"count\"}], \"series\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}]}, \"invertColors\": false, \"enableHover\": false, \"colorsNumber\": 4, \"colorsRange\": [], \"setColorRange\": false, \"times\": []}, \"type\": \"heatmap\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"winlog.event_data.TargetUserName\", \"missingBucket\": false, \"customLabel\": \"Target User\", \"otherBucketLabel\": \"Other\", \"size\": 15, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"group\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"customLabel\": \"Operation\", \"otherBucketLabel\": \"Other\", \"size\": 10, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "dce77e60-bcd7-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzc4LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4723\"}}, {\"match_phrase\": {\"event.code\": \"4724\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4723\", \"4724\"], \"value\": \"4723, 4724\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Password Changes - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Password Changes - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.TargetUserName\", \"missingBucket\": false, \"customLabel\": \"Password Change to\", \"otherBucketLabel\": \"Other\", \"size\": 100, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": true, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonId\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzc5LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4720\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4720\"}, \"value\": \"4720\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Created - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Created - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": false, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"None\", \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Users Created\"}}]}"
            },
            "id": "102efd20-bcdd-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzgwLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4722\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4722\"}, \"value\": \"4722\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Enabled - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Enabled - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": false, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"None\", \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"cardinality\", \"schema\": \"metric\", \"params\": {\"field\": \"user.name\", \"customLabel\": \"Users Enabled\"}}]}"
            },
            "id": "855957d0-bcdd-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzgxLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4726\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4726\"}, \"value\": \"4726\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Deleted - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Deleted - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": false, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"None\", \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Deleted Users\"}}]}"
            },
            "id": "c359b020-bcdd-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzgyLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4725\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4725\"}, \"value\": \"4725\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Disabled - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Disabled - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": false, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"None\", \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"cardinality\", \"schema\": \"metric\", \"params\": {\"field\": \"user.name\", \"customLabel\": \"Disabled Users\"}}]}"
            },
            "id": "0cb2d940-bcde-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzgzLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4723\"}}, {\"match_phrase\": {\"event.code\": \"4724\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4723\", \"4724\"], \"value\": \"4723, 4724\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Password Reset / Changes [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Password Reset / Changes [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": false, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"None\", \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Password Changes\"}}]}"
            },
            "id": "568a8130-bcde-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzg0LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4767\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4767\"}, \"value\": \"4767\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Unlocked Users - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Unlocked Users - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.TargetUserName\", \"missingBucket\": false, \"customLabel\": \"Unlocked User\", \"otherBucketLabel\": \"Other\", \"size\": 100, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": true, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer Logonid\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "da2110c0-bcea-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzg1LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4738\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4738\"}, \"value\": \"4738\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Changes  Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Changes  Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.TargetUserName\", \"missingBucket\": false, \"customLabel\": \"Changed  User\", \"otherBucketLabel\": \"Other\", \"size\": 100, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": true, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonId\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "abf96c10-bcea-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzg2LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4740\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4740\"], \"value\": \"4740\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Unlocks - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Unlocks - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": false, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"None\", \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Users Locked Out\"}}]}"
            },
            "id": "84502430-bce8-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzg3LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4767\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4767\"], \"value\": \"4767\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Unlocked Users - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Unlocked Users - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": false, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"None\", \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Users Unlocks\"}}]}"
            },
            "id": "ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzg4LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4738\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4738\"], \"value\": \"4738\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Changes - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Changes - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": false, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"None\", \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Changes in Users\"}}]}"
            },
            "id": "5d92b100-bce8-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzg5LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4740\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4740\"}, \"value\": \"4740\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Locked Out - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Locked Out - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.TargetUserName\", \"missingBucket\": false, \"customLabel\": \"Locked  User\", \"otherBucketLabel\": \"Other\", \"size\": 100, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": true, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonId\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzkwLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4720\"}}, {\"match_phrase\": {\"event.code\": \"4722\"}}, {\"match_phrase\": {\"event.code\": \"4723\"}}, {\"match_phrase\": {\"event.code\": \"4724\"}}, {\"match_phrase\": {\"event.code\": \"4725\"}}, {\"match_phrase\": {\"event.code\": \"4726\"}}, {\"match_phrase\": {\"event.code\": \"4738\"}}, {\"match_phrase\": {\"event.code\": \"4740\"}}, {\"match_phrase\": {\"event.code\": \"4767\"}}, {\"match_phrase\": {\"event.code\": \"4781\"}}, {\"match_phrase\": {\"event.code\": \"4798\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4720\", \"4722\", \"4723\", \"4724\", \"4725\", \"4726\", \"4738\", \"4740\", \"4767\", \"4781\", \"4798\"], \"value\": \"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781, 4798\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Event Distribution in time [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Event Distribution in time [Winlogbeat Security]\", \"params\": {\"valueAxes\": [{\"scale\": {\"mode\": \"normal\", \"type\": \"linear\"}, \"style\": {}, \"position\": \"left\", \"type\": \"value\", \"title\": {\"text\": \"Count\"}, \"id\": \"ValueAxis-1\", \"labels\": {\"truncate\": 100, \"show\": true, \"filter\": false, \"rotate\": 0}, \"show\": true, \"name\": \"LeftAxis-1\"}], \"type\": \"histogram\", \"legendPosition\": \"bottom\", \"addLegend\": true, \"addTimeMarker\": false, \"addTooltip\": true, \"seriesParams\": [{\"type\": \"histogram\", \"drawLinesBetweenPoints\": true, \"mode\": \"stacked\", \"data\": {\"id\": \"1\", \"label\": \"Count\"}, \"valueAxis\": \"ValueAxis-1\", \"show\": \"true\", \"showCircles\": true}], \"dimensions\": {\"x\": {\"params\": {\"bounds\": {\"min\": \"2019-09-20T13:10:39.628Z\", \"max\": \"2019-11-04T14:10:39.628Z\"}, \"interval\": \"PT12H\", \"format\": \"YYYY-MM-DD HH:mm\", \"date\": true}, \"format\": {\"id\": \"date\", \"params\": {\"pattern\": \"YYYY-MM-DD HH:mm\"}}, \"accessor\": 0, \"aggType\": \"date_histogram\"}, \"y\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 2, \"aggType\": \"count\"}], \"series\": [{\"params\": {}, \"format\": {}, \"accessor\": 1, \"aggType\": \"filters\"}]}, \"categoryAxes\": [{\"scale\": {\"type\": \"linear\"}, \"style\": {}, \"position\": \"bottom\", \"type\": \"category\", \"title\": {}, \"id\": \"CategoryAxis-1\", \"labels\": {\"truncate\": 100, \"show\": true, \"filter\": true}, \"show\": true}], \"grid\": {\"categoryLines\": false}, \"labels\": {\"show\": true}, \"times\": []}, \"type\": \"histogram\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"date_histogram\", \"schema\": \"segment\", \"params\": {\"extended_bounds\": {}, \"field\": \"@timestamp\", \"interval\": \"auto\", \"timeRange\": {\"to\": \"now\", \"from\": \"now-45d\"}, \"useNormalizedEsInterval\": true, \"min_doc_count\": 1, \"drop_partials\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"group\", \"params\": {\"field\": \"event.action\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"otherBucket\": false}}]}"
            },
            "id": "8f723a10-bd97-11e9-b9c5-fddc96658612",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzkxLDFd"
        },
        {
            "attributes": {
                "columns": [
                    "user.name",
                    "source.domain",
                    "source.ip",
                    "winlog.logon.id",
                    "winlog.logon.type"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"highlightAll\": true, \"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"version\": true, \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4624\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4624\"], \"value\": \"4624\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "sort": [
                    [
                        "@timestamp",
                        "desc"
                    ]
                ],
                "title": "Logon Details [Winlogbeat Security]",
                "version": 1
            },
            "id": "7e178c80-fee1-11e9-8405-516218e3d268",
            "migrationVersion": {
                "search": "7.4.0"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "search",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzkyLDFd"
        },
        {
            "attributes": {
                "columns": [
                    "event.action",
                    "winlog.event_data.TargetUserName",
                    "user.domain",
                    "winlog.event_data.SubjectUserName",
                    "winlog.event_data.SubjectDomainName",
                    "winlog.logon.id",
                    "related.user"
                ],
                "description": "",
                "hits": 0,
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"highlightAll\": true, \"query\": {\"query\": \"\", \"language\": \"lucene\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"version\": true, \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4720\"}}, {\"match_phrase\": {\"event.code\": \"4722\"}}, {\"match_phrase\": {\"event.code\": \"4723\"}}, {\"match_phrase\": {\"event.code\": \"4724\"}}, {\"match_phrase\": {\"event.code\": \"4725\"}}, {\"match_phrase\": {\"event.code\": \"4726\"}}, {\"match_phrase\": {\"event.code\": \"4738\"}}, {\"match_phrase\": {\"event.code\": \"4740\"}}, {\"match_phrase\": {\"event.code\": \"4767\"}}, {\"match_phrase\": {\"event.code\": \"4781\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4720\", \"4722\", \"4723\", \"4724\", \"4725\", \"4726\", \"4738\", \"4740\", \"4767\", \"4781\"], \"value\": \"4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4767, 4781\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "sort": [
                    [
                        "@timestamp",
                        "desc"
                    ]
                ],
                "title": "User management Details - Search [Winlogbeat Security]",
                "version": 1
            },
            "id": "324686c0-fefb-11e9-8405-516218e3d268",
            "migrationVersion": {
                "search": "7.4.0"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "search",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "WzkzLDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"bool\": {\"should\": [{\"match_phrase\": {\"event.code\": \"4781\"}}], \"minimum_should_match\": 1}}, \"meta\": {\"params\": [\"4781\"], \"value\": \"4781\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrases\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Renamed - Simple Metric [Winlogbeat Security]",
                "uiStateJSON": "{}",
                "version": 1,
                "visState": "{\"title\": \"Users Renamed - Simple Metric [Winlogbeat Security]\", \"params\": {\"addTooltip\": true, \"dimensions\": {\"metrics\": [{\"type\": \"vis_dimension\", \"accessor\": 0, \"format\": {\"id\": \"number\", \"params\": {}}}]}, \"metric\": {\"style\": {\"fontSize\": 60, \"subText\": \"\", \"bgColor\": false, \"bgFill\": \"#000\", \"labelColor\": false}, \"metricColorMode\": \"None\", \"invertColors\": false, \"colorSchema\": \"Green to Red\", \"labels\": {\"show\": true}, \"colorsRange\": [{\"type\": \"range\", \"to\": 10000, \"from\": 0}], \"useRanges\": false, \"percentageMode\": false}, \"type\": \"metric\", \"addLegend\": false}, \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Renamed Users\"}}]}"
            },
            "id": "5e19ff80-231c-11ea-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzk0LDFd"
        },
        {
            "attributes": {
                "description": "",
                "kibanaSavedObjectMeta": {
                    "searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\", \"filter\": [{\"query\": {\"match\": {\"event.code\": {\"query\": \"4781\", \"type\": \"phrase\"}}}, \"meta\": {\"params\": {\"query\": \"4781\"}, \"value\": \"4781\", \"disabled\": false, \"alias\": null, \"key\": \"event.code\", \"negate\": false, \"type\": \"phrase\", \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"}, \"$state\": {\"store\": \"appState\"}}]}"
                },
                "title": "Users Renamed - Table [Winlogbeat Security]",
                "uiStateJSON": "{\"vis\": {\"params\": {\"sort\": {\"columnIndex\": null, \"direction\": null}}}}",
                "version": 1,
                "visState": "{\"title\": \"Users Renamed - Table [Winlogbeat Security]\", \"params\": {\"showTotal\": false, \"showMetricsAtAllLevels\": false, \"dimensions\": {\"buckets\": [{\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 0, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 1, \"aggType\": \"terms\"}, {\"params\": {}, \"format\": {\"id\": \"terms\", \"params\": {\"id\": \"string\", \"missingBucketLabel\": \"Missing\", \"otherBucketLabel\": \"Other\"}}, \"accessor\": 2, \"aggType\": \"terms\"}], \"metrics\": [{\"params\": {}, \"format\": {\"id\": \"number\"}, \"accessor\": 3, \"aggType\": \"count\"}]}, \"sort\": {\"columnIndex\": null, \"direction\": null}, \"perPage\": 10, \"showPartialRows\": false, \"totalFunc\": \"sum\"}, \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.OldTargetUserName\", \"missingBucket\": false, \"customLabel\": \"Old User Name\", \"otherBucketLabel\": \"Other\", \"size\": 100, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.event_data.SubjectUserName\", \"missingBucket\": true, \"customLabel\": \"Performed by\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"winlog.logon.id\", \"missingBucket\": false, \"customLabel\": \"Performer LogonId\", \"otherBucketLabel\": \"Other\", \"size\": 5, \"orderBy\": \"1\", \"order\": \"desc\", \"missingBucketLabel\": \"Missing\", \"otherBucket\": false}}]}"
            },
            "id": "fa876300-231a-11ea-8405-516218e3d268",
            "migrationVersion": {
                "visualization": "7.4.2"
            },
            "references": [
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
                    "type": "index-pattern"
                },
                {
                    "id": "winlogbeat-*",
                    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
                    "type": "index-pattern"
                }
            ],
            "type": "visualization",
            "updated_at": "2020-02-04T20:39:02.784Z",
            "version": "Wzk1LDFd"
        }
    ],
    "version": "7.5.2"
}