overview-dashboard.json

{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "language": "kuery",
          "query": ""
        },
        "filter": []
      }
    },
    "title": "Requests Rate",
    "uiStateJSON": "{}",
    "version": 1,
    "visState": {
      "title": "Requests Rate",
      "type": "timelion",
      "params": {
        "expression": ".es(split=request_status.keyword:20, index=waf-logs-*).label(\"Request Status: $1\", \"^.*:(.*) >.*\")",
        "interval": "auto"
      },
      "aggs": []
    }
  },
  "id": "92a3e950-3438-11ea-983a-f74b5d6c2f97",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEyOCwyXQ=="
}
{
  "attributes": {
    "fields": [
      {
        "name": "@timestamp",
        "type": "date",
        "esTypes": [
          "date"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true
      },
      {
        "name": "@version",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "@version.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "@version",
        "subType": "multi"
      },
      {
        "name": "ASM:unit_hostname",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "ASM:unit_hostname.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "ASM:unit_hostname",
        "subType": "multi"
      },
      {
        "name": "_id",
        "type": "string",
        "esTypes": [
          "_id"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": false
      },
      {
        "name": "_index",
        "type": "string",
        "esTypes": [
          "_index"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": false
      },
      {
        "name": "_score",
        "type": "number",
        "count": 0,
        "scripted": false,
        "searchable": false,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "_source",
        "type": "_source",
        "esTypes": [
          "_source"
        ],
        "count": 0,
        "scripted": false,
        "searchable": false,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "_type",
        "type": "string",
        "esTypes": [
          "_type"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": false
      },
      {
        "name": "attack_type",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "attack_type.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "attack_type",
        "subType": "multi"
      },
      {
        "name": "blocking_exception_reason",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "blocking_exception_reason.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "blocking_exception_reason",
        "subType": "multi"
      },
      {
        "name": "captcha_result",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "captcha_result.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "captcha_result",
        "subType": "multi"
      },
      {
        "name": "date_time",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "date_time.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "date_time",
        "subType": "multi"
      },
      {
        "name": "dest_ip",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "dest_ip.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "dest_ip",
        "subType": "multi"
      },
      {
        "name": "dest_port",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "dest_port.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "dest_port",
        "subType": "multi"
      },
      {
        "name": "device_id",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "device_id.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "device_id",
        "subType": "multi"
      },
      {
        "name": "facility",
        "type": "number",
        "esTypes": [
          "long"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true
      },
      {
        "name": "facility_label",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "facility_label.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "facility_label",
        "subType": "multi"
      },
      {
        "name": "fragment",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "fragment.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "fragment",
        "subType": "multi"
      },
      {
        "name": "geo_location",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geo_location.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geo_location",
        "subType": "multi"
      },
      {
        "name": "geoip.city_name",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.city_name.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.city_name",
        "subType": "multi"
      },
      {
        "name": "geoip.continent_code",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.continent_code.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.continent_code",
        "subType": "multi"
      },
      {
        "name": "geoip.country_code2",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.country_code2.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.country_code2",
        "subType": "multi"
      },
      {
        "name": "geoip.country_code3",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.country_code3.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.country_code3",
        "subType": "multi"
      },
      {
        "name": "geoip.country_name",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.country_name.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.country_name",
        "subType": "multi"
      },
      {
        "name": "geoip.dma_code",
        "type": "number",
        "esTypes": [
          "long"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true
      },
      {
        "name": "geoip.ip",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.ip.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.ip",
        "subType": "multi"
      },
      {
        "name": "geoip.latitude",
        "type": "number",
        "esTypes": [
          "float"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true
      },
      {
        "name": "geoip.location.lat",
        "type": "number",
        "esTypes": [
          "float"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true
      },
      {
        "name": "geoip.location.lon",
        "type": "number",
        "esTypes": [
          "float"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true
      },
      {
        "name": "geoip.longitude",
        "type": "number",
        "esTypes": [
          "float"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true
      },
      {
        "name": "geoip.postal_code",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.postal_code.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.postal_code",
        "subType": "multi"
      },
      {
        "name": "geoip.region_code",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.region_code.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.region_code",
        "subType": "multi"
      },
      {
        "name": "geoip.region_name",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.region_name.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.region_name",
        "subType": "multi"
      },
      {
        "name": "geoip.timezone",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "geoip.timezone.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "geoip.timezone",
        "subType": "multi"
      },
      {
        "name": "host",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "host.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "host",
        "subType": "multi"
      },
      {
        "name": "http_class_name",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "http_class_name.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "http_class_name",
        "subType": "multi"
      },
      {
        "name": "ip_address_intelligence",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "ip_address_intelligence.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "ip_address_intelligence",
        "subType": "multi"
      },
      {
        "name": "ip_client",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "ip_client.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "ip_client",
        "subType": "multi"
      },
      {
        "name": "logsource",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "logsource.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "logsource",
        "subType": "multi"
      },
      {
        "name": "management_ip_address",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "management_ip_address.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "management_ip_address",
        "subType": "multi"
      },
      {
        "name": "management_ip_address_2",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "management_ip_address_2.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "management_ip_address_2",
        "subType": "multi"
      },
      {
        "name": "message",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "message.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "message",
        "subType": "multi"
      },
      {
        "name": "method",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "method.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "method",
        "subType": "multi"
      },
      {
        "name": "microservice",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "microservice.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "microservice",
        "subType": "multi"
      },
      {
        "name": "policy_apply_date",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "policy_apply_date.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "policy_apply_date",
        "subType": "multi"
      },
      {
        "name": "policy_name",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "policy_name.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "policy_name",
        "subType": "multi"
      },
      {
        "name": "priority",
        "type": "number",
        "esTypes": [
          "long"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true
      },
      {
        "name": "protocol",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "protocol.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "protocol",
        "subType": "multi"
      },
      {
        "name": "query_string",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "query_string.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "query_string",
        "subType": "multi"
      },
      {
        "name": "request",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "request.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "request",
        "subType": "multi"
      },
      {
        "name": "request_status",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "request_status.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "request_status",
        "subType": "multi"
      },
      {
        "name": "response",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "response.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "response",
        "subType": "multi"
      },
      {
        "name": "response_code",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "response_code.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "response_code",
        "subType": "multi"
      },
      {
        "name": "route_domain",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "route_domain.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "route_domain",
        "subType": "multi"
      },
      {
        "name": "session_id",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "session_id.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "session_id",
        "subType": "multi"
      },
      {
        "name": "severity",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "severity.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "severity",
        "subType": "multi"
      },
      {
        "name": "severity_label",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "severity_label.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "severity_label",
        "subType": "multi"
      },
      {
        "name": "sig_cves",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "sig_cves.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "sig_cves",
        "subType": "multi"
      },
      {
        "name": "sig_ids",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "sig_ids.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "sig_ids",
        "subType": "multi"
      },
      {
        "name": "sig_names",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "sig_names.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "sig_names",
        "subType": "multi"
      },
      {
        "name": "src_port",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "src_port.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "src_port",
        "subType": "multi"
      },
      {
        "name": "staged_sig_cves",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "staged_sig_cves.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "staged_sig_cves",
        "subType": "multi"
      },
      {
        "name": "staged_sig_ids",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "staged_sig_ids.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "staged_sig_ids",
        "subType": "multi"
      },
      {
        "name": "staged_sig_names",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "staged_sig_names.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "staged_sig_names",
        "subType": "multi"
      },
      {
        "name": "staged_threat_campaign_names",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "staged_threat_campaign_names.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "staged_threat_campaign_names",
        "subType": "multi"
      },
      {
        "name": "sub_violations",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "sub_violations.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "sub_violations",
        "subType": "multi"
      },
      {
        "name": "support_id",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "support_id.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "support_id",
        "subType": "multi"
      },
      {
        "name": "tags",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "tags.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "tags",
        "subType": "multi"
      },
      {
        "name": "tap_event_id",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "tap_event_id.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "tap_event_id",
        "subType": "multi"
      },
      {
        "name": "tap_vid",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "tap_vid.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "tap_vid",
        "subType": "multi"
      },
      {
        "name": "threat_campaign_names",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "threat_campaign_names.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "threat_campaign_names",
        "subType": "multi"
      },
      {
        "name": "timestamp",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "timestamp.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "timestamp",
        "subType": "multi"
      },
      {
        "name": "uri",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "uri.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "uri",
        "subType": "multi"
      },
      {
        "name": "username",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "username.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "username",
        "subType": "multi"
      },
      {
        "name": "violation_rating",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "violation_rating.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "violation_rating",
        "subType": "multi"
      },
      {
        "name": "violations",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "violations.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "violations",
        "subType": "multi"
      },
      {
        "name": "virus_name",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "virus_name.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "virus_name",
        "subType": "multi"
      },
      {
        "name": "vs_name",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "vs_name.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "vs_name",
        "subType": "multi"
      },
      {
        "name": "web_application_name",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "web_application_name.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "web_application_name",
        "subType": "multi"
      },
      {
        "name": "websocket_direction",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "websocket_direction.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "websocket_direction",
        "subType": "multi"
      },
      {
        "name": "websocket_message_type",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "websocket_message_type.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "websocket_message_type",
        "subType": "multi"
      },
      {
        "name": "x_forwarded_for_header_value",
        "type": "string",
        "esTypes": [
          "text"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": false,
        "readFromDocValues": false
      },
      {
        "name": "x_forwarded_for_header_value.keyword",
        "type": "string",
        "esTypes": [
          "keyword"
        ],
        "count": 0,
        "scripted": false,
        "searchable": true,
        "aggregatable": true,
        "readFromDocValues": true,
        "parent": "x_forwarded_for_header_value",
        "subType": "multi"
      }
    ],
    "timeFieldName": "@timestamp",
    "title": "waf-logs-*"
  },
  "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
  "migrationVersion": {
    "index-pattern": "6.5.0"
  },
  "references": [],
  "type": "index-pattern",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEyOSwyXQ=="
}
{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "language": "kuery",
          "query": ""
        },
        "filter": [],
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
      }
    },
    "title": "Requests Distribution",
    "uiStateJSON": "{\"vis\":{\"colors\":{\"Blocked\":\"#BF1B00\",\"Alarmed\":\"#EAB839\",\"Alerted\":\"#E5AC0E\"}}}",
    "version": 1,
    "visState": {
      "title": "Requests Distribution",
      "type": "pie",
      "params": {
        "type": "pie",
        "addTooltip": true,
        "addLegend": true,
        "legendPosition": "right",
        "isDonut": true,
        "labels": {
          "show": false,
          "values": true,
          "last_level": true,
          "truncate": 100
        },
        "dimensions": {
          "metric": {
            "accessor": 1,
            "format": {
              "id": "number"
            },
            "params": {},
            "aggType": "count"
          },
          "buckets": [
            {
              "accessor": 0,
              "format": {},
              "params": {},
              "aggType": "filters"
            }
          ]
        }
      },
      "aggs": [
        {
          "id": "1",
          "enabled": true,
          "type": "count",
          "schema": "metric",
          "params": {}
        },
        {
          "id": "2",
          "enabled": true,
          "type": "filters",
          "schema": "segment",
          "params": {
            "filters": [
              {
                "input": {
                  "query": "violations.keyword : N/A and request_status : passed",
                  "language": "kuery"
                },
                "label": "Clean"
              },
              {
                "input": {
                  "query": "request_status :  blocked",
                  "language": "kuery"
                },
                "label": "Blocked"
              },
              {
                "input": {
                  "query": "request_status :  alerted",
                  "language": "kuery"
                },
                "label": "Alerted"
              }
            ]
          }
        }
      ]
    }
  },
  "id": "7e5c83d0-2056-11ea-bcff-c3c564493235",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [
    {
      "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
      "type": "index-pattern"
    }
  ],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:51.361Z",
  "version": "WzE0MiwyXQ=="
}
{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "language": "kuery",
          "query": ""
        },
        "filter": []
      }
    },
    "title": "Response Codes Rate",
    "uiStateJSON": "{}",
    "version": 1,
    "visState": {
      "title": "Response Codes Rate",
      "type": "timelion",
      "params": {
        "expression": ".es(split=response_code.keyword:20, index=waf-logs-*).label(\"Response Code: $1\", \"^.*:(.*) >.*\")",
        "interval": "auto"
      },
      "aggs": []
    }
  },
  "id": "d990f700-3702-11ea-a241-09ab559b62bd",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEzMSwyXQ=="
}
{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "query": "",
          "language": "kuery"
        },
        "filter": [],
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
      }
    },
    "title": "Response Codes Distribution",
    "uiStateJSON": "{}",
    "version": 1,
    "visState": {
      "title": "Response Codes Distribution",
      "type": "pie",
      "params": {
        "type": "pie",
        "addTooltip": true,
        "addLegend": true,
        "legendPosition": "right",
        "isDonut": true,
        "labels": {
          "show": false,
          "values": true,
          "last_level": true,
          "truncate": 100
        },
        "dimensions": {
          "metric": {
            "accessor": 1,
            "format": {
              "id": "number"
            },
            "params": {},
            "aggType": "count"
          },
          "buckets": [
            {
              "accessor": 0,
              "format": {
                "id": "terms",
                "params": {
                  "id": "string",
                  "otherBucketLabel": "Other",
                  "missingBucketLabel": "Missing"
                }
              },
              "params": {},
              "aggType": "terms"
            }
          ]
        }
      },
      "aggs": [
        {
          "id": "1",
          "enabled": true,
          "type": "count",
          "schema": "metric",
          "params": {}
        },
        {
          "id": "2",
          "enabled": true,
          "type": "terms",
          "schema": "segment",
          "params": {
            "field": "response_code.keyword",
            "orderBy": "1",
            "order": "desc",
            "size": 5,
            "otherBucket": false,
            "otherBucketLabel": "Other",
            "missingBucket": false,
            "missingBucketLabel": "Missing"
          }
        }
      ]
    }
  },
  "id": "5e376660-3703-11ea-a241-09ab559b62bd",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [
    {
      "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
      "type": "index-pattern"
    }
  ],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEzMiwyXQ=="
}
{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "language": "kuery",
          "query": ""
        },
        "filter": [],
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
      }
    },
    "title": "Top Talkers",
    "uiStateJSON": "{}",
    "version": 1,
    "visState": {
      "title": "Top Talkers",
      "type": "histogram",
      "params": {
        "addLegend": true,
        "addTimeMarker": false,
        "addTooltip": true,
        "categoryAxes": [
          {
            "id": "CategoryAxis-1",
            "labels": {
              "filter": true,
              "show": true,
              "truncate": 15
            },
            "position": "bottom",
            "scale": {
              "type": "linear"
            },
            "show": true,
            "style": {},
            "title": {},
            "type": "category"
          }
        ],
        "dimensions": {
          "x": {
            "accessor": 0,
            "format": {
              "id": "terms",
              "params": {
                "id": "string",
                "otherBucketLabel": "Other",
                "missingBucketLabel": "Missing"
              }
            },
            "params": {},
            "aggType": "terms"
          },
          "y": [
            {
              "accessor": 1,
              "format": {
                "id": "number"
              },
              "params": {},
              "aggType": "count"
            }
          ]
        },
        "grid": {
          "categoryLines": false
        },
        "labels": {
          "show": false
        },
        "legendPosition": "right",
        "seriesParams": [
          {
            "data": {
              "id": "1",
              "label": "Count"
            },
            "drawLinesBetweenPoints": true,
            "mode": "stacked",
            "show": "true",
            "showCircles": true,
            "type": "histogram",
            "valueAxis": "ValueAxis-1"
          }
        ],
        "thresholdLine": {
          "color": "#34130C",
          "show": false,
          "style": "full",
          "value": 10,
          "width": 1
        },
        "times": [],
        "type": "histogram",
        "valueAxes": [
          {
            "id": "ValueAxis-1",
            "labels": {
              "filter": false,
              "rotate": 0,
              "show": true,
              "truncate": 100
            },
            "name": "LeftAxis-1",
            "position": "left",
            "scale": {
              "mode": "normal",
              "type": "linear"
            },
            "show": true,
            "style": {},
            "title": {
              "text": "Count"
            },
            "type": "value"
          }
        ]
      },
      "aggs": [
        {
          "id": "1",
          "enabled": true,
          "type": "count",
          "schema": "metric",
          "params": {}
        },
        {
          "id": "2",
          "enabled": true,
          "type": "terms",
          "schema": "segment",
          "params": {
            "field": "ip_client.keyword",
            "orderBy": "1",
            "order": "desc",
            "size": 20,
            "otherBucket": false,
            "otherBucketLabel": "Other",
            "missingBucket": false,
            "missingBucketLabel": "Missing",
            "customLabel": "Client IPs"
          }
        }
      ]
    }
  },
  "id": "5eee5660-366b-11ea-a241-09ab559b62bd",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [
    {
      "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
      "type": "index-pattern"
    }
  ],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEzMywyXQ=="
}
{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "language": "kuery",
          "query": ""
        },
        "filter": [],
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
      }
    },
    "title": "Top URLs",
    "uiStateJSON": "{}",
    "version": 1,
    "visState": {
      "aggs": [
        {
          "enabled": true,
          "id": "1",
          "params": {},
          "schema": "metric",
          "type": "count"
        },
        {
          "enabled": true,
          "id": "2",
          "params": {
            "customLabel": "URLs",
            "field": "uri.keyword",
            "missingBucket": false,
            "missingBucketLabel": "Missing",
            "order": "desc",
            "orderBy": "1",
            "otherBucket": false,
            "otherBucketLabel": "Other",
            "size": 20
          },
          "schema": "segment",
          "type": "terms"
        }
      ],
      "params": {
        "addLegend": true,
        "addTimeMarker": false,
        "addTooltip": true,
        "categoryAxes": [
          {
            "id": "CategoryAxis-1",
            "labels": {
              "filter": true,
              "show": true,
              "truncate": 10
            },
            "position": "bottom",
            "scale": {
              "type": "linear"
            },
            "show": true,
            "style": {},
            "title": {},
            "type": "category"
          }
        ],
        "dimensions": {
          "x": {
            "accessor": 0,
            "aggType": "terms",
            "format": {
              "id": "terms",
              "params": {
                "id": "string",
                "missingBucketLabel": "Missing",
                "otherBucketLabel": "Other"
              }
            },
            "params": {}
          },
          "y": [
            {
              "accessor": 1,
              "aggType": "count",
              "format": {
                "id": "number"
              },
              "params": {}
            }
          ]
        },
        "grid": {
          "categoryLines": false
        },
        "labels": {
          "show": false
        },
        "legendPosition": "right",
        "seriesParams": [
          {
            "data": {
              "id": "1",
              "label": "Count"
            },
            "drawLinesBetweenPoints": true,
            "mode": "stacked",
            "show": "true",
            "showCircles": true,
            "type": "histogram",
            "valueAxis": "ValueAxis-1"
          }
        ],
        "thresholdLine": {
          "color": "#34130C",
          "show": false,
          "style": "full",
          "value": 10,
          "width": 1
        },
        "times": [],
        "type": "histogram",
        "valueAxes": [
          {
            "id": "ValueAxis-1",
            "labels": {
              "filter": false,
              "rotate": 0,
              "show": true,
              "truncate": 100
            },
            "name": "LeftAxis-1",
            "position": "left",
            "scale": {
              "mode": "normal",
              "type": "linear"
            },
            "show": true,
            "style": {},
            "title": {
              "text": "Count"
            },
            "type": "value"
          }
        ]
      },
      "title": "Top URLs",
      "type": "histogram"
    }
  },
  "id": "2b7fd200-3642-11ea-983a-f74b5d6c2f97",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [
    {
      "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
      "type": "index-pattern"
    }
  ],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEzNCwyXQ=="
}
{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "query": "",
          "language": "kuery"
        },
        "filter": [],
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
      }
    },
    "title": "Top Violator IPs",
    "uiStateJSON": "{}",
    "version": 1,
    "visState": {
      "title": "Top Violator IPs",
      "type": "histogram",
      "params": {
        "type": "histogram",
        "grid": {
          "categoryLines": false
        },
        "categoryAxes": [
          {
            "id": "CategoryAxis-1",
            "type": "category",
            "position": "bottom",
            "show": true,
            "style": {},
            "scale": {
              "type": "linear"
            },
            "labels": {
              "show": true,
              "filter": true,
              "truncate": 100
            },
            "title": {}
          }
        ],
        "valueAxes": [
          {
            "id": "ValueAxis-1",
            "name": "LeftAxis-1",
            "type": "value",
            "position": "left",
            "show": true,
            "style": {},
            "scale": {
              "type": "linear",
              "mode": "normal"
            },
            "labels": {
              "show": true,
              "rotate": 0,
              "filter": false,
              "truncate": 100
            },
            "title": {
              "text": "Count"
            }
          }
        ],
        "seriesParams": [
          {
            "show": "true",
            "type": "histogram",
            "mode": "stacked",
            "data": {
              "label": "Count",
              "id": "1"
            },
            "valueAxis": "ValueAxis-1",
            "drawLinesBetweenPoints": true,
            "showCircles": true
          }
        ],
        "addTooltip": true,
        "addLegend": true,
        "legendPosition": "right",
        "times": [],
        "addTimeMarker": false,
        "labels": {
          "show": false
        },
        "thresholdLine": {
          "show": false,
          "value": 10,
          "width": 1,
          "style": "full",
          "color": "#34130C"
        },
        "dimensions": {
          "x": {
            "accessor": 0,
            "format": {
              "id": "terms",
              "params": {
                "id": "string",
                "otherBucketLabel": "Other",
                "missingBucketLabel": "Missing"
              }
            },
            "params": {},
            "aggType": "terms"
          },
          "y": [
            {
              "accessor": 2,
              "format": {
                "id": "number"
              },
              "params": {},
              "aggType": "count"
            }
          ],
          "series": [
            {
              "accessor": 1,
              "format": {
                "id": "terms",
                "params": {
                  "id": "string",
                  "otherBucketLabel": "Other",
                  "missingBucketLabel": "Missing"
                }
              },
              "params": {},
              "aggType": "terms"
            }
          ]
        }
      },
      "aggs": [
        {
          "id": "1",
          "enabled": true,
          "type": "count",
          "schema": "metric",
          "params": {}
        },
        {
          "id": "2",
          "enabled": true,
          "type": "terms",
          "schema": "segment",
          "params": {
            "field": "ip_client.keyword",
            "orderBy": "1",
            "order": "desc",
            "size": 20,
            "otherBucket": false,
            "otherBucketLabel": "Other",
            "missingBucket": false,
            "missingBucketLabel": "Missing",
            "customLabel": "Violator IPs"
          }
        },
        {
          "id": "3",
          "enabled": true,
          "type": "terms",
          "schema": "group",
          "params": {
            "field": "violations.keyword",
            "orderBy": "1",
            "order": "desc",
            "size": 5,
            "otherBucket": false,
            "otherBucketLabel": "Other",
            "missingBucket": false,
            "missingBucketLabel": "Missing",
            "exclude": "N/A"
          }
        }
      ]
    }
  },
  "id": "e97cb520-2053-11ea-bcff-c3c564493235",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [
    {
      "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
      "type": "index-pattern"
    }
  ],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEzNSwyXQ=="
}
{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "language": "kuery",
          "query": ""
        },
        "filter": [],
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
      }
    },
    "title": "Signatures Distribution",
    "uiStateJSON": "{}",
    "version": 1,
    "visState": {
      "title": "Signatures Distribution",
      "type": "pie",
      "params": {
        "type": "pie",
        "addTooltip": true,
        "addLegend": true,
        "legendPosition": "right",
        "isDonut": true,
        "labels": {
          "show": false,
          "values": true,
          "last_level": true,
          "truncate": 100
        },
        "dimensions": {
          "metric": {
            "accessor": 1,
            "format": {
              "id": "number"
            },
            "params": {},
            "aggType": "count"
          },
          "buckets": [
            {
              "accessor": 0,
              "format": {
                "id": "terms",
                "params": {
                  "id": "string",
                  "otherBucketLabel": "Other",
                  "missingBucketLabel": "Missing"
                }
              },
              "params": {},
              "aggType": "terms"
            }
          ]
        }
      },
      "aggs": [
        {
          "id": "1",
          "enabled": true,
          "type": "count",
          "schema": "metric",
          "params": {}
        },
        {
          "id": "2",
          "enabled": true,
          "type": "terms",
          "schema": "segment",
          "params": {
            "field": "sig_ids.keyword",
            "orderBy": "1",
            "order": "desc",
            "size": 20,
            "otherBucket": false,
            "otherBucketLabel": "Other",
            "missingBucket": false,
            "missingBucketLabel": "Missing",
            "exclude": "N/A",
            "customLabel": "Signature ID"
          }
        }
      ]
    }
  },
  "id": "8ace9ec0-2054-11ea-bcff-c3c564493235",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [
    {
      "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
      "type": "index-pattern"
    }
  ],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEzNiwyXQ=="
}
{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "query": "",
          "language": "kuery"
        },
        "filter": [],
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
      }
    },
    "title": "Violations Distribution",
    "uiStateJSON": "{}",
    "version": 1,
    "visState": {
      "title": "Violations Distribution",
      "type": "pie",
      "params": {
        "addLegend": true,
        "addTooltip": true,
        "dimensions": {
          "metric": {
            "accessor": 1,
            "format": {
              "id": "number"
            },
            "params": {},
            "aggType": "count"
          },
          "buckets": [
            {
              "accessor": 0,
              "format": {
                "id": "terms",
                "params": {
                  "id": "string",
                  "otherBucketLabel": "Other",
                  "missingBucketLabel": "Missing"
                }
              },
              "params": {},
              "aggType": "terms"
            }
          ]
        },
        "isDonut": true,
        "labels": {
          "last_level": true,
          "show": false,
          "truncate": 100,
          "values": true
        },
        "legendPosition": "right",
        "type": "pie"
      },
      "aggs": [
        {
          "id": "1",
          "enabled": true,
          "type": "count",
          "schema": "metric",
          "params": {}
        },
        {
          "id": "2",
          "enabled": true,
          "type": "terms",
          "schema": "segment",
          "params": {
            "field": "violations.keyword",
            "orderBy": "1",
            "order": "desc",
            "size": 20,
            "otherBucket": false,
            "otherBucketLabel": "Other",
            "missingBucket": false,
            "missingBucketLabel": "Missing",
            "exclude": "N/A",
            "customLabel": "Violation"
          }
        }
      ]
    }
  },
  "id": "9b6276f0-2052-11ea-bcff-c3c564493235",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [
    {
      "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
      "type": "index-pattern"
    }
  ],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEzNywyXQ=="
}
{
  "attributes": {
    "description": "",
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "language": "kuery",
          "query": ""
        },
        "filter": [],
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
      }
    },
    "title": "GEO",
    "uiStateJSON": "{\"mapZoom\":1,\"mapCenter\":[64.5498936275396,0]}",
    "version": 1,
    "visState": {
      "title": "GEO",
      "type": "region_map",
      "params": {
        "addTooltip": true,
        "bucket": {
          "accessor": 0,
          "format": {
            "id": "terms",
            "params": {
              "id": "string",
              "otherBucketLabel": "Other",
              "missingBucketLabel": "Missing"
            }
          },
          "params": {},
          "aggType": "terms"
        },
        "colorSchema": "Green to Red",
        "emsHotLink": "https://maps.elastic.co/v7.4?locale=en#file/world_countries",
        "isDisplayWarning": true,
        "legendPosition": "bottomright",
        "mapCenter": [
          0,
          0
        ],
        "mapZoom": 2,
        "metric": {
          "accessor": 1,
          "format": {
            "id": "number"
          },
          "params": {},
          "aggType": "count"
        },
        "outlineWeight": 1,
        "selectedJoinField": {
          "type": "id",
          "name": "iso2",
          "description": "ISO 3166-1 alpha-2 code"
        },
        "showAllShapes": true,
        "wms": {
          "enabled": false,
          "options": {
            "format": "image/png",
            "transparent": true
          },
          "selectedTmsLayer": {
            "origin": "elastic_maps_service",
            "id": "road_map",
            "minZoom": 0,
            "maxZoom": 20,
            "attribution": "<p><a rel=\"noreferrer noopener\" href=\"https://www.openstreetmap.org/copyright\">OpenStreetMap contributors</a> | <a rel=\"noreferrer noopener\" href=\"https://openmaptiles.org\">OpenMapTiles</a> | <a rel=\"noreferrer noopener\" href=\"https://www.maptiler.com\">MapTiler</a> | <a rel=\"noreferrer noopener\" href=\"https://www.elastic.co/elastic-maps-service\">Elastic Maps Service</a></p>"
          }
        },
        "selectedLayer": {
          "name": "World Countries",
          "origin": "elastic_maps_service",
          "id": "world_countries",
          "created_at": "2017-04-26T17:12:15.978370",
          "attribution": "<a href=\"http://www.naturalearthdata.com/about/terms-of-use\">Made with NaturalEarth</a> | <a href=\"https://www.elastic.co/elastic-maps-service\">Elastic Maps Service</a>",
          "fields": [
            {
              "type": "id",
              "name": "iso2",
              "description": "ISO 3166-1 alpha-2 code"
            },
            {
              "type": "id",
              "name": "iso3",
              "description": "ISO 3166-1 alpha-3 code"
            },
            {
              "type": "property",
              "name": "name",
              "description": "name"
            }
          ],
          "format": {
            "type": "geojson"
          },
          "layerId": "elastic_maps_service.World Countries",
          "isEMS": true
        }
      },
      "aggs": [
        {
          "id": "1",
          "enabled": true,
          "type": "count",
          "schema": "metric",
          "params": {
            "customLabel": "Request Count"
          }
        },
        {
          "id": "2",
          "enabled": true,
          "type": "terms",
          "schema": "segment",
          "params": {
            "field": "geoip.country_code3.keyword",
            "orderBy": "1",
            "order": "desc",
            "size": 5,
            "otherBucket": false,
            "otherBucketLabel": "Other",
            "missingBucket": false,
            "missingBucketLabel": "Missing"
          }
        }
      ]
    }
  },
  "id": "d19c31a0-3666-11ea-a241-09ab559b62bd",
  "migrationVersion": {
    "visualization": "7.4.2"
  },
  "references": [
    {
      "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
      "type": "index-pattern"
    }
  ],
  "type": "visualization",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEzOCwyXQ=="
}
{
  "attributes": {
    "columns": [
      "method",
      "uri",
      "violations",
      "response_code",
      "request_status",
      "ip_client"
    ],
    "description": "",
    "hits": 0,
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "highlightAll": true,
        "version": true,
        "query": {
          "language": "kuery",
          "query": "support_id : * "
        },
        "filter": [],
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
      }
    },
    "sort": [
      [
        "@timestamp",
        "desc"
      ]
    ],
    "title": "All Requests",
    "version": 1
  },
  "id": "e3e0a060-343d-11ea-983a-f74b5d6c2f97",
  "migrationVersion": {
    "search": "7.4.0"
  },
  "references": [
    {
      "id": "b6896160-1ade-11ea-bb19-634fb23c25ea",
      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
      "type": "index-pattern"
    }
  ],
  "type": "search",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzEzOSwyXQ=="
}
{
  "attributes": {
    "description": "",
    "hits": 0,
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "query": {
          "language": "kuery",
          "query": ""
        },
        "filter": []
      }
    },
    "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}",
    "panelsJSON": [
      {
        "embeddableConfig": {},
        "gridData": {
          "h": 7,
          "i": "d7699f7c-f08d-49a6-bba4-391818076fc2",
          "w": 36,
          "x": 0,
          "y": 0
        },
        "panelIndex": "d7699f7c-f08d-49a6-bba4-391818076fc2",
        "version": "7.4.0",
        "panelRefName": "panel_0"
      },
      {
        "embeddableConfig": {
          "colors": {
            "Alarmed": "#EAB839",
            "Blocked": "#BF1B00"
          },
          "legendOpen": false,
          "vis": {
            "colors": {
              "Alarmed": "#EAB839",
              "Blocked": "#BF1B00"
            },
            "legendOpen": true
          }
        },
        "gridData": {
          "h": 7,
          "i": "be9d107d-a926-4151-b184-cc8ce56a84f4",
          "w": 12,
          "x": 36,
          "y": 0
        },
        "panelIndex": "be9d107d-a926-4151-b184-cc8ce56a84f4",
        "version": "7.4.0",
        "panelRefName": "panel_1"
      },
      {
        "embeddableConfig": {},
        "gridData": {
          "h": 7,
          "i": "52a4031f-1321-4cf8-a649-bb3b87ee24d2",
          "w": 36,
          "x": 0,
          "y": 7
        },
        "panelIndex": "52a4031f-1321-4cf8-a649-bb3b87ee24d2",
        "version": "7.4.0",
        "panelRefName": "panel_2"
      },
      {
        "embeddableConfig": {},
        "gridData": {
          "h": 7,
          "i": "b542bf0d-be9e-415d-bb88-5749cff274a3",
          "w": 12,
          "x": 36,
          "y": 7
        },
        "panelIndex": "b542bf0d-be9e-415d-bb88-5749cff274a3",
        "version": "7.4.0",
        "panelRefName": "panel_3"
      },
      {
        "embeddableConfig": {},
        "gridData": {
          "h": 11,
          "i": "cceda060-776b-40cb-b045-5649ace38816",
          "w": 24,
          "x": 0,
          "y": 14
        },
        "panelIndex": "cceda060-776b-40cb-b045-5649ace38816",
        "version": "7.4.0",
        "panelRefName": "panel_4"
      },
      {
        "embeddableConfig": {
          "vis": {
            "legendOpen": false
          }
        },
        "gridData": {
          "h": 11,
          "i": "37bc87ed-cb35-48fb-84fe-1142f57de563",
          "w": 24,
          "x": 24,
          "y": 14
        },
        "panelIndex": "37bc87ed-cb35-48fb-84fe-1142f57de563",
        "version": "7.4.0",
        "panelRefName": "panel_5"
      },
      {
        "embeddableConfig": {
          "vis": {
            "legendOpen": false
          }
        },
        "gridData": {
          "h": 10,
          "i": "494496f1-d1fd-4ea6-abaa-69c8728c5dec",
          "w": 17,
          "x": 0,
          "y": 25
        },
        "panelIndex": "494496f1-d1fd-4ea6-abaa-69c8728c5dec",
        "version": "7.4.0",
        "panelRefName": "panel_6"
      },
      {
        "embeddableConfig": {
          "legendOpen": false,
          "vis": {
            "legendOpen": true
          }
        },
        "gridData": {
          "h": 10,
          "i": "8ae28754-12f5-4508-85bc-c99c40f45139",
          "w": 15,
          "x": 17,
          "y": 25
        },
        "panelIndex": "8ae28754-12f5-4508-85bc-c99c40f45139",
        "version": "7.4.0",
        "panelRefName": "panel_7"
      },
      {
        "embeddableConfig": {
          "legendOpen": false,
          "vis": {
            "legendOpen": true
          }
        },
        "gridData": {
          "h": 10,
          "i": "c8041f88-a91e-4904-9991-6a891a4bbb2e",
          "w": 16,
          "x": 32,
          "y": 25
        },
        "panelIndex": "c8041f88-a91e-4904-9991-6a891a4bbb2e",
        "version": "7.4.0",
        "panelRefName": "panel_8"
      },
      {
        "embeddableConfig": {
          "mapCenter": null,
          "mapZoom": 2
        },
        "gridData": {
          "h": 14,
          "i": "93ed98ec-fb4c-4171-a847-85f6a6c38e7d",
          "w": 48,
          "x": 0,
          "y": 35
        },
        "panelIndex": "93ed98ec-fb4c-4171-a847-85f6a6c38e7d",
        "version": "7.4.0",
        "panelRefName": "panel_9"
      },
      {
        "embeddableConfig": {},
        "gridData": {
          "h": 15,
          "i": "45501e8d-621a-4908-90b8-c2db02b3e82b",
          "w": 48,
          "x": 0,
          "y": 49
        },
        "panelIndex": "45501e8d-621a-4908-90b8-c2db02b3e82b",
        "version": "7.4.0",
        "panelRefName": "panel_10"
      }
    ],
    "timeRestore": false,
    "title": "Overview",
    "version": 1
  },
  "id": "140fbf30-363e-11ea-983a-f74b5d6c2f97",
  "migrationVersion": {
    "dashboard": "7.3.0"
  },
  "references": [
    {
      "id": "92a3e950-3438-11ea-983a-f74b5d6c2f97",
      "name": "panel_0",
      "type": "visualization"
    },
    {
      "id": "7e5c83d0-2056-11ea-bcff-c3c564493235",
      "name": "panel_1",
      "type": "visualization"
    },
    {
      "id": "d990f700-3702-11ea-a241-09ab559b62bd",
      "name": "panel_2",
      "type": "visualization"
    },
    {
      "id": "5e376660-3703-11ea-a241-09ab559b62bd",
      "name": "panel_3",
      "type": "visualization"
    },
    {
      "id": "5eee5660-366b-11ea-a241-09ab559b62bd",
      "name": "panel_4",
      "type": "visualization"
    },
    {
      "id": "2b7fd200-3642-11ea-983a-f74b5d6c2f97",
      "name": "panel_5",
      "type": "visualization"
    },
    {
      "id": "e97cb520-2053-11ea-bcff-c3c564493235",
      "name": "panel_6",
      "type": "visualization"
    },
    {
      "id": "8ace9ec0-2054-11ea-bcff-c3c564493235",
      "name": "panel_7",
      "type": "visualization"
    },
    {
      "id": "9b6276f0-2052-11ea-bcff-c3c564493235",
      "name": "panel_8",
      "type": "visualization"
    },
    {
      "id": "d19c31a0-3666-11ea-a241-09ab559b62bd",
      "name": "panel_9",
      "type": "visualization"
    },
    {
      "id": "e3e0a060-343d-11ea-983a-f74b5d6c2f97",
      "name": "panel_10",
      "type": "search"
    }
  ],
  "type": "dashboard",
  "updated_at": "2020-06-16T22:07:16.336Z",
  "version": "WzE0MCwyXQ=="
}