kibana-searches.json

[
  {
    "_id": "Cache-transactions",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "Cache transactions",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[],\"query\":{\"query_string\":{\"query\":\"type: redis\",\"analyze_wildcard\":true}}}"
      },
      "columns": [
        "type",
        "method",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "DB-transactions",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "DB transactions",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[],\"query\":{\"query_string\":{\"query\":\"type: mysql or type: pgsql or type: mongodb\",\"analyze_wildcard\":true}}}"
      },
      "columns": [
        "type",
        "method",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "Default-Search",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "Default Search",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[{\"meta\":{\"disabled\":false,\"index\":\"[packetbeat-]YYYY.MM.DD\",\"key\":\"type\",\"negate\":false,\"value\":\"mongodb\"},\"query\":{\"match\":{\"type\":{\"query\":\"mongodb\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status",
        "query"
      ]
    }
  },
  {
    "_id": "Errors",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "Errors",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[{\"meta\":{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"negate\":true,\"key\":\"status\",\"value\":\"OK\",\"disabled\":false},\"query\":{\"match\":{\"status\":{\"query\":\"OK\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}}}"
      },
      "columns": [
        "type",
        "method",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "Filesystem-stats",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "Filesystem stats",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[topbeat-]YYYY.MM.DD\",\"query\":{\"query_string\":{\"query\":\"type: filesystem\",\"analyze_wildcard\":true}},\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"filter\":[]}"
      },
      "columns": [
        "_source"
      ]
    }
  },
  {
    "_id": "HTTP-errors",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "HTTP errors",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[{\"meta\":{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"negate\":false,\"key\":\"type\",\"value\":\"http\",\"disabled\":false},\"query\":{\"match\":{\"type\":{\"query\":\"http\",\"type\":\"phrase\"}}}},{\"meta\":{\"negate\":true,\"index\":\"[packetbeat-]YYYY.MM.DD\",\"key\":\"http.code\",\"value\":200,\"disabled\":false},\"query\":{\"match\":{\"http.code\":{\"query\":200,\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}"
      },
      "columns": [
        "type",
        "method",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "MongoDB-errors",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "MongoDB errors",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[{\"meta\":{\"disabled\":false,\"index\":\"[packetbeat-]YYYY.MM.DD\",\"key\":\"type\",\"negate\":false,\"value\":\"mongodb\"},\"query\":{\"match\":{\"type\":{\"query\":\"mongodb\",\"type\":\"phrase\"}}}},{\"meta\":{\"negate\":true,\"index\":\"[packetbeat-]YYYY.MM.DD\",\"key\":\"status\",\"value\":\"OK\",\"disabled\":false},\"query\":{\"match\":{\"status\":{\"query\":\"OK\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status",
        "query"
      ]
    }
  },
  {
    "_id": "MongoDB-transactions",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "MongoDB transactions",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[{\"meta\":{\"disabled\":false,\"index\":\"[packetbeat-]YYYY.MM.DD\",\"key\":\"type\",\"negate\":false,\"value\":\"mongodb\"},\"query\":{\"match\":{\"type\":{\"query\":\"mongodb\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status",
        "query"
      ]
    }
  },
  {
    "_id": "MongoDB-transactions-with-write-concern-0",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "MongoDB transactions with write concern 0",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[{\"meta\":{\"disabled\":false,\"index\":\"[packetbeat-]YYYY.MM.DD\",\"key\":\"type\",\"negate\":false,\"value\":\"mongodb\"},\"query\":{\"match\":{\"type\":{\"query\":\"mongodb\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"request: \\\"writeConcern w 0\\\"\"}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status",
        "query"
      ]
    }
  },
  {
    "_id": "MySQL-errors",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "MySQL errors",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[{\"meta\":{\"disabled\":false,\"index\":\"[packetbeat-]YYYY.MM.DD\",\"key\":\"type\",\"negate\":false,\"value\":\"mysql\"},\"query\":{\"match\":{\"type\":{\"query\":\"mysql\",\"type\":\"phrase\"}}}},{\"meta\":{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"negate\":true,\"key\":\"status\",\"value\":\"OK\",\"disabled\":false},\"query\":{\"match\":{\"status\":{\"query\":\"OK\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "MySQL-Transactions",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "MySQL Transactions",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[{\"meta\":{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"negate\":false,\"key\":\"type\",\"value\":\"mysql\",\"disabled\":false},\"query\":{\"match\":{\"type\":{\"query\":\"mysql\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "PgSQL-errors",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "PgSQL errors",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[{\"meta\":{\"disabled\":false,\"index\":\"[packetbeat-]YYYY.MM.DD\",\"key\":\"type\",\"negate\":false,\"value\":\"pgsql\"},\"query\":{\"match\":{\"type\":{\"query\":\"pgsql\",\"type\":\"phrase\"}}}},{\"meta\":{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"negate\":true,\"key\":\"status\",\"value\":\"OK\",\"disabled\":false},\"query\":{\"match\":{\"status\":{\"query\":\"OK\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "PgSQL-transactions",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "PgSQL transactions",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[{\"meta\":{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"negate\":false,\"key\":\"type\",\"value\":\"pgsql\",\"disabled\":false},\"query\":{\"match\":{\"type\":{\"query\":\"pgsql\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "Processes",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "Processes",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[topbeat-]YYYY.MM.DD\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[{\"meta\":{\"negate\":false,\"index\":\"[topbeat-]YYYY.MM.DD\",\"key\":\"type\",\"value\":\"proc\",\"disabled\":false},\"query\":{\"match\":{\"type\":{\"query\":\"proc\",\"type\":\"phrase\"}}}}]}"
      },
      "columns": [
        "proc.name",
        "proc.cpu.user_p",
        "proc.mem.rss_p",
        "proc.mem.rss",
        "proc.state",
        "proc.cpu.start_time"
      ]
    }
  },
  {
    "_id": "Proc-stats",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "Proc stats",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[topbeat-]YYYY.MM.DD\",\"query\":{\"query_string\":{\"query\":\"type: process\",\"analyze_wildcard\":true}},\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"filter\":[]}"
      },
      "columns": [
        "_source"
      ]
    }
  },
  {
    "_id": "RPC-transactions",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "RPC transactions",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[],\"query\":{\"query_string\":{\"query\":\"type: thrift\",\"analyze_wildcard\":true}}}"
      },
      "columns": [
        "type",
        "method",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "System-stats",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "System stats",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[topbeat-]YYYY.MM.DD\",\"query\":{\"query_string\":{\"query\":\"type: system\",\"analyze_wildcard\":true}},\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"filter\":[]}"
      },
      "columns": [
        "_source"
      ]
    }
  },
  {
    "_id": "System-wide",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "System wide",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[topbeat-]YYYY.MM.DD\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[{\"meta\":{\"negate\":false,\"index\":\"[topbeat-]YYYY.MM.DD\",\"key\":\"type\",\"value\":\"system\",\"disabled\":false},\"query\":{\"match\":{\"type\":{\"query\":\"system\",\"type\":\"phrase\"}}}}]}"
      },
      "columns": [
        "beat.name",
        "cpu.user_p",
        "cpu.steal",
        "load.load1",
        "load.load5",
        "mem.used",
        "mem.used_p"
      ]
    }
  },
  {
    "_id": "Thrift-errors",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "Thrift errors",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[{\"meta\":{\"disabled\":false,\"index\":\"[packetbeat-]YYYY.MM.DD\",\"key\":\"type\",\"negate\":false,\"value\":\"thrift\"},\"query\":{\"match\":{\"type\":{\"query\":\"thrift\",\"type\":\"phrase\"}}}},{\"meta\":{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"negate\":true,\"key\":\"status\",\"value\":\"OK\",\"disabled\":false},\"query\":{\"match\":{\"status\":{\"query\":\"OK\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"type: thrift\"}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "Thrift-transactions",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "Thrift transactions",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[{\"meta\":{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"negate\":false,\"key\":\"type\",\"value\":\"thrift\",\"disabled\":false},\"query\":{\"match\":{\"type\":{\"query\":\"thrift\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"type: thrift\"}}}"
      },
      "columns": [
        "method",
        "type",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "Web-transactions",
    "_type": "search",
    "_source": {
      "sort": [
        "@timestamp",
        "desc"
      ],
      "hits": 0,
      "description": "",
      "title": "Web transactions",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}}},\"filter\":[{\"meta\":{\"index\":\"[packetbeat-]YYYY.MM.DD\",\"negate\":false,\"key\":\"type\",\"value\":\"http\",\"disabled\":false},\"query\":{\"match\":{\"type\":{\"query\":\"http\",\"type\":\"phrase\"}}}}],\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}"
      },
      "columns": [
        "type",
        "method",
        "path",
        "responsetime",
        "status"
      ]
    }
  },
  {
    "_id": "NXLog:-Windows-Software:-Installation-and-Updates",
    "_type": "search",
    "_source": {
      "title": "NXLog: Windows Software: Installation and Updates",
      "description": "",
      "hits": 0,
      "columns": [
        "_source"
      ],
      "sort": [
        "@timestamp",
        "desc"
      ],
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"logstash-*\",\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"query\":{\"query_string\":{\"query\":\"tags:tcp_json_windows AND \\\"Installation Successful\\\"\",\"analyze_wildcard\":true}}}"
      }
    }
  },
  {
    "_id": "OSSEC:-Changed-File-(Linux)",
    "_type": "search",
    "_source": {
      "title": "OSSEC: Changed File (Linux)",
      "description": "",
      "hits": 0,
      "columns": [
        "ossec_modified_file",
        "ossec_host_fqdn",
        "Details"
      ],
      "sort": [
        "@timestamp",
        "desc"
      ],
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"logstash-*\",\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"query\":{\"query_string\":{\"query\":\"\\\"Integrity checksum changed\\\"\",\"analyze_wildcard\":true}}}"
      }
    }
  },
  {
    "_id": "OSSEC:-All-Alerts",
    "_type": "search",
    "_source": {
      "title": "OSSEC: All Alerts",
      "description": "",
      "hits": 0,
      "columns": [
        "Alert_Level",
        "ossec_host_fqdn",
        "ossec_host_ip",
        "Src_IP",
        "Description",
        "Rule"
      ],
      "sort": [
        "@timestamp",
        "desc"
      ],
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"logstash-*\",\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"query\":{\"query_string\":{\"query\":\"* -(iam-shb-*)\",\"analyze_wildcard\":true}}}"
      }
    }
  },
  {
    "_id": "OSSEC-General-Search",
    "_type": "search",
    "_source": {
      "title": "OSSEC - General Search",
      "description": "",
      "hits": 0,
      "columns": [
        "Alert_Level",
        "ossec_host_fqdn",
        "ossec_host_ip",
        "Details"
      ],
      "sort": [
        "@timestamp",
        "desc"
      ],
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"logstash-*\",\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}}}"
      }
    }
  },
  {
    "_id": "Linux:-User-and-Group-Events",
    "_type": "search",
    "_source": {
      "title": "Linux: User and Group Events",
      "description": "",
      "hits": 0,
      "columns": [
        "pam_username",
        "tags",
        "pam_message",
        "message"
      ],
      "sort": [
        "@timestamp",
        "desc"
      ],
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"[filebeat-]YYYY.MM.DD\",\"query\":{\"query_string\":{\"query\":\"tags:\\\"linux_new_group\\\" tags:\\\"linux_new_user\\\" tags:\\\"linux_password_changed\\\" tags:\\\"linux_delete_user\\\" tags:\\\"linux_removed_group\\\"\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}"
      }
    }
  },
  {
    "_id": "UCLA-Netflow",
    "_type": "search",
    "_source": {
      "title": "UCLA Netflow",
      "description": "",
      "hits": 0,
      "columns": [
        "netflow.in_bytes",
        "netflow.ipv4_src_addr",
        "netflow.ipv4_dst_addr",
        "tags",
        "netflow.l4_src_port",
        "netflow.l4_dst_port",
        "src_geoip.country_name",
        "dst_geoip.country_name"
      ],
      "sort": [
        "netflow.in_bytes",
        "desc"
      ],
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"logstash-*\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"tags:src_ucla_* tags:dst_ucla_*\"}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}"
      }
    }
  }
]