-
Notifications
You must be signed in to change notification settings - Fork 8.1k
/
manifest.json
111 lines (111 loc) · 2.95 KB
/
manifest.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
{
"id": "nginx_ecs",
"title": "Nginx access logs",
"description": "Find unusual activity in HTTP access logs from filebeat (ECS).",
"type": "Web Access Logs",
"logoFile": "logo.json",
"defaultIndexPattern": "filebeat-*",
"query": {
"bool": {
"filter": [
{ "term": { "event.dataset": "nginx.access" } },
{ "exists": { "field": "source.address" } },
{ "exists": { "field": "url.original" } },
{ "exists": { "field": "http.response.status_code" } }
]
}
},
"jobs": [
{
"id": "visitor_rate_ecs",
"file": "visitor_rate_ecs.json"
},
{
"id": "status_code_rate_ecs",
"file": "status_code_rate_ecs.json"
},
{
"id": "source_ip_url_count_ecs",
"file": "source_ip_url_count_ecs.json"
},
{
"id": "source_ip_request_rate_ecs",
"file": "source_ip_request_rate_ecs.json"
},
{
"id": "low_request_rate_ecs",
"file": "low_request_rate_ecs.json"
}
],
"datafeeds": [
{
"id": "datafeed-visitor_rate_ecs",
"file": "datafeed_visitor_rate_ecs.json",
"job_id": "visitor_rate_ecs"
},
{
"id": "datafeed-status_code_rate_ecs",
"file": "datafeed_status_code_rate_ecs.json",
"job_id": "status_code_rate_ecs"
},
{
"id": "datafeed-source_ip_url_count_ecs",
"file": "datafeed_source_ip_url_count_ecs.json",
"job_id": "source_ip_url_count_ecs"
},
{
"id": "datafeed-source_ip_request_rate_ecs",
"file": "datafeed_source_ip_request_rate_ecs.json",
"job_id": "source_ip_request_rate_ecs"
},
{
"id": "datafeed-low_request_rate_ecs",
"file": "datafeed_low_request_rate_ecs.json",
"job_id": "low_request_rate_ecs"
}
],
"kibana": {
"dashboard": [
{
"id": "ml_http_access_explorer_ecs",
"file": "ml_http_access_explorer_ecs.json"
}
],
"search": [
{
"id": "ml_http_access_filebeat_ecs",
"file": "ml_http_access_filebeat_ecs.json"
}
],
"visualization": [
{
"id": "ml_http_access_map_ecs",
"file": "ml_http_access_map_ecs.json"
},
{
"id": "ml_http_access_source_ip_timechart_ecs",
"file": "ml_http_access_source_ip_timechart_ecs.json"
},
{
"id": "ml_http_access_status_code_timechart_ecs",
"file": "ml_http_access_status_code_timechart_ecs.json"
},
{
"id": "ml_http_access_top_source_ips_table_ecs",
"file": "ml_http_access_top_source_ips_table_ecs.json"
},
{
"id": "ml_http_access_top_urls_table_ecs",
"file": "ml_http_access_top_urls_table_ecs.json"
},
{
"id": "ml_http_access_unique_count_url_timechart_ecs",
"file": "ml_http_access_unique_count_url_timechart_ecs.json"
},
{
"id": "ml_http_access_events_timechart_ecs",
"file": "ml_http_access_events_timechart_ecs.json"
}
]
}
}