/
manifest.json
75 lines (75 loc) · 2.19 KB
/
manifest.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
{
"id": "auditbeat_process_docker_ecs",
"title": "Auditbeat docker processes",
"description": "Detect unusual processes in docker containers from auditd data (ECS).",
"type": "Auditbeat data",
"logoFile": "logo.json",
"defaultIndexPattern": "auditbeat-*",
"query": {
"bool": {
"filter": [
{ "term": { "event.module": "auditd" } },
{ "term": { "container.runtime": "docker" } }
],
"must": {
"exists": { "field": "auditd.data.syscall" }
},
"must_not": { "terms": { "_tier": [ "data_frozen", "data_cold" ] } }
}
},
"jobs": [
{
"id": "docker_high_count_process_events_ecs",
"file": "docker_high_count_process_events_ecs.json"
},
{
"id": "docker_rare_process_activity_ecs",
"file": "docker_rare_process_activity_ecs.json"
}
],
"datafeeds": [
{
"id": "datafeed-docker_high_count_process_events_ecs",
"file": "datafeed_docker_high_count_process_events_ecs.json",
"job_id": "docker_high_count_process_events_ecs"
},
{
"id": "datafeed-docker_rare_process_activity_ecs",
"file": "datafeed_docker_rare_process_activity_ecs.json",
"job_id": "docker_rare_process_activity_ecs"
}
],
"kibana": {
"dashboard": [
{
"id": "ml_auditbeat_docker_process_event_rate_ecs",
"file": "ml_auditbeat_docker_process_event_rate_ecs.json"
},
{
"id": "ml_auditbeat_docker_process_explorer_ecs",
"file": "ml_auditbeat_docker_process_explorer_ecs.json"
}
],
"search": [
{
"id": "ml_auditbeat_docker_process_events_ecs",
"file": "ml_auditbeat_docker_process_events_ecs.json"
}
],
"visualization": [
{
"id": "ml_auditbeat_docker_process_event_rate_by_process_ecs",
"file": "ml_auditbeat_docker_process_event_rate_by_process_ecs.json"
},
{
"id": "ml_auditbeat_docker_process_event_rate_vis_ecs",
"file": "ml_auditbeat_docker_process_event_rate_vis_ecs.json"
},
{
"id": "ml_auditbeat_docker_process_occurrence_ecs",
"file": "ml_auditbeat_docker_process_occurrence_ecs.json"
}
]
},
"tags": ["security"]
}