Skip to content

Commit e96772f

Browse files
mmguerommguero
committed
for cisagov#780, first stab at integrating vadr dashboards
1 parent e836297 commit e96772f

13 files changed

+4458
-42
lines changed

‎dashboards/dashboards/vadr/0f52b420-9e08-11ef-8358-f36ccc4ae837.json‎

Lines changed: 689 additions & 0 deletions
Large diffs are not rendered by default.

‎dashboards/dashboards/vadr/0fb588c0-2d0f-11f0-af4f-052f357bea07.json‎

Lines changed: 233 additions & 0 deletions
Large diffs are not rendered by default.

‎dashboards/dashboards/vadr/11cd7300-fc34-11ee-a696-1ddfa039ab2d.json‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
{
2+
"objects": [
3+
{
4+
"attributes": {
5+
"description": "",
6+
"hits": 0,
7+
"kibanaSavedObjectMeta": {
8+
"searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"
9+
},
10+
"optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}",
11+
"panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"h\":32,\"i\":\"6ef04251-4987-4a5c-9202-a0997fd1ef95\",\"w\":40,\"x\":8,\"y\":0},\"panelIndex\":\"6ef04251-4987-4a5c-9202-a0997fd1ef95\",\"version\":\"2.19.1\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{},\"gridData\":{\"h\":15,\"i\":\"be01d1a6-070e-48e8-b23f-2c996befd61b\",\"w\":8,\"x\":0,\"y\":0},\"panelIndex\":\"be01d1a6-070e-48e8-b23f-2c996befd61b\",\"version\":\"2.19.1\",\"panelRefName\":\"panel_1\"}]",
12+
"timeRestore": false,
13+
"title": "VADR - NAVV",
14+
"version": 1
15+
},
16+
"id": "11cd7300-fc34-11ee-a696-1ddfa039ab2d",
17+
"migrationVersion": {
18+
"dashboard": "7.9.3"
19+
},
20+
"namespaces": [
21+
"default"
22+
],
23+
"references": [
24+
{
25+
"id": "eeb31a60-fc37-11ee-a696-1ddfa039ab2d",
26+
"name": "panel_0",
27+
"type": "visualization"
28+
},
29+
{
30+
"id": "4fdd16a0-3334-11ef-94c9-09db3014d49a",
31+
"name": "panel_1",
32+
"type": "visualization"
33+
}
34+
],
35+
"type": "dashboard",
36+
"updated_at": "2025-09-22T22:01:44.786Z",
37+
"version": "WzExNDEsMV0="
38+
},
39+
{
40+
"attributes": {
41+
"description": "",
42+
"kibanaSavedObjectMeta": {
43+
"searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"
44+
},
45+
"savedSearchRefName": "search_0",
46+
"title": "NAVV_1.0",
47+
"uiStateJSON": "{\"vis\":{\"sortColumn\":{\"colIndex\":10,\"direction\":\"desc\"}}}",
48+
"version": 1,
49+
"visState": "{\"title\":\"NAVV_1.0\",\"type\":\"table\",\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"params\":{},\"schema\":\"metric\"},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"source.ip\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Source IP\"},\"schema\":\"bucket\"},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"source.oui\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Source MAC\"},\"schema\":\"bucket\"},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"source.segment.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Source Network\"},\"schema\":\"bucket\"},{\"id\":\"5\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"destination.segment.name\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Destination Network\"},\"schema\":\"bucket\"},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"destination.ip\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Destination IP\"},\"schema\":\"bucket\"},{\"id\":\"7\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"destination.oui\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"-\",\"customLabel\":\"Destination MAC\"},\"schema\":\"bucket\"},{\"id\":\"8\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"destination.port\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Port\"},\"schema\":\"bucket\"},{\"id\":\"9\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"network.protocol\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"Unmapped\",\"customLabel\":\"Service\"},\"schema\":\"bucket\"},{\"id\":\"10\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"protocol\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":true,\"missingBucketLabel\":\"No Protocol\",\"customLabel\":\"Protocol\"},\"schema\":\"bucket\"},{\"id\":\"11\",\"enabled\":true,\"type\":\"terms\",\"params\":{\"field\":\"zeek.conn.conn_state_description\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":100,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"customLabel\":\"Conn State\"},\"schema\":\"bucket\"}],\"params\":{\"perPage\":100,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"showTotal\":false,\"totalFunc\":\"sum\",\"percentageCol\":\"\",\"row\":true}}"
50+
},
51+
"id": "eeb31a60-fc37-11ee-a696-1ddfa039ab2d",
52+
"migrationVersion": {
53+
"visualization": "7.10.0"
54+
},
55+
"namespaces": [
56+
"default"
57+
],
58+
"references": [
59+
{
60+
"id": "52570870-e9d4-444f-a3df-e44c6757ed9f",
61+
"name": "search_0",
62+
"type": "search"
63+
}
64+
],
65+
"type": "visualization",
66+
"updated_at": "2025-09-22T22:01:44.786Z",
67+
"version": "WzExMzksMV0="
68+
},
69+
{
70+
"attributes": {
71+
"description": "",
72+
"kibanaSavedObjectMeta": {
73+
"searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\"}},\"language\":\"lucene\"},\"filter\":[]}"
74+
},
75+
"title": "VADR Network Logs",
76+
"uiStateJSON": "{}",
77+
"version": 1,
78+
"visState": "{\"title\":\"VADR Network Logs\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"markdown\":\"### VADR Toolkit \\n[Inventory](#/dashboard/d16105d0-2b75-11f0-92dc-5f54cacd4f4e) \\n[Misconfigurations](#dashboard/f75511b0-2b79-11f0-92dc-5f54cacd4f4e) \\n[Outdated/Insecure Services](#/dashboard/62ac0aa0-2b9c-11f0-bb82-8ffd215e5a91) \\n[External Communications](#/dashboard/5cd4b680-2b8e-11f0-92dc-5f54cacd4f4e) \\n[Domain Queries](#/dashboard/82e4ebe0-2d11-11f0-af4f-052f357bea07) \\n[Remote Access](#/dashboard/985cb6a0-2ba0-11f0-bb82-8ffd215e5a91) \\n[Intrusion Detection Alerts](#/dashboard/8444dee0-3023-11f0-af4f-052f357bea07) \\n[Segment Examiner](#/dashboard/0f52b420-9e08-11ef-8358-f36ccc4ae837) \\n[Sankey Tool](#/dashboard/0fb588c0-2d0f-11f0-af4f-052f357bea07) \\n[Force Directed Tool - Beta](#/dashboard/ac8b32c0-be66-11ef-9ff5-ff2a2927176e) \\n[NAVV](#/dashboard/11cd7300-fc34-11ee-a696-1ddfa039ab2d) \\n[Legacy Analysis](#/dashboard/590fcc10-fe8f-11ee-99f0-3db6323f1fae) \\n\\n### General 120 Byte\\n[Malcolm Homepage (Overview)](#/dashboard/0ad3d7c2-3441-485e-9dfe-dbb22e84e576) \\n[Security Overview](#/dashboard/95479950-41f2-11ea-88fa-7151df485405) \\n[ICS/IoT Security Overview](#/dashboard/4a4bde20-4760-11ea-949c-bbb5a9feecbf) \\n[Severity](#/dashboard/d2dd0180-06b1-11ec-8c6b-353266ade330) \\n[Connections](#/dashboard/abdd7550-2c7c-40dc-947e-f6d186a158c4) \\n[Actions and Results](#/dashboard/a33e0a50-afcd-11ea-993f-b7d8522a8bed) \\n[Asset Interaction Analysis](#/dashboard/677ee170-809e-11ed-8d5b-07069f823b6f) \\n[Best Guess](#/dashboard/12e3a130-d83b-11eb-a0b0-f328ce09b0b7) \\n[↪ NetBox](/netbox/) \\n[↪ Arkime](/arkime/) \\n● [DNS](#/dashboard/2cf94cd0-ecab-40a5-95a7-8419f3a39cd9) ● [NTP](#/dashboard/af5df620-eeb6-11e9-bdef-65a192b7f586) ● [SNMP](#/dashboard/4e5f106e-c60a-4226-8f64-d534abb912ab) \",\"type\":\"markdown\",\"fontSize\":10,\"openLinksInNewTab\":false}}"
79+
},
80+
"id": "4fdd16a0-3334-11ef-94c9-09db3014d49a",
81+
"migrationVersion": {
82+
"visualization": "7.10.0"
83+
},
84+
"namespaces": [
85+
"default"
86+
],
87+
"references": [],
88+
"type": "visualization",
89+
"updated_at": "2025-09-22T22:01:44.786Z",
90+
"version": "WzExNDAsMV0="
91+
},
92+
{
93+
"attributes": {
94+
"columns": [
95+
"network.transport",
96+
"network.protocol",
97+
"source.ip",
98+
"source.port",
99+
"destination.ip",
100+
"destination.port",
101+
"network.bytes",
102+
"event.id"
103+
],
104+
"description": "",
105+
"hits": 0,
106+
"kibanaSavedObjectMeta": {
107+
"searchSourceJSON": "{\"highlightAll\":false,\"version\":true,\"filter\":[],\"query\":{\"query\":{\"query_string\":{\"query\":\"(event.provider:zeek AND event.dataset:conn) OR (event.provider:suricata AND event.dataset:flow)\",\"analyze_wildcard\":true}},\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
108+
},
109+
"sort": [
110+
[
111+
"MALCOLM_NETWORK_INDEX_TIME_FIELD_REPLACER",
112+
"desc"
113+
]
114+
],
115+
"title": "Connections - Logs",
116+
"version": 1
117+
},
118+
"id": "52570870-e9d4-444f-a3df-e44c6757ed9f",
119+
"migrationVersion": {
120+
"search": "7.9.3"
121+
},
122+
"namespaces": [
123+
"default"
124+
],
125+
"references": [
126+
{
127+
"id": "MALCOLM_NETWORK_INDEX_PATTERN_REPLACER",
128+
"name": "kibanaSavedObjectMeta.searchSourceJSON.index",
129+
"type": "index-pattern"
130+
}
131+
],
132+
"type": "search",
133+
"updated_at": "2025-09-22T21:57:44.795Z",
134+
"version": "Wzk3NiwxXQ=="
135+
}
136+
],
137+
"version": "3.2.0"
138+
}

0 commit comments

Comments
 (0)