Azure Spring Cloud Logs Overview Level [Logs Azure]

Question: data_stream.dataset : "azure.springcloudlogs"


### Azure Spring Cloud Logs

[**Overview**](#/dashboard/azure-41e84340-ec20-11e9-90ec-112a988266d5) | [System Logs](#/dashboard/azure-87095750-f05a-11e9-90ec-112a988266d5) | [Application Console Logs](#/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5)

Navigation Azure Spring Cloud Logs

Subscription and Type Filter

Question: data_stream.dataset :"azure.springcloudlogs"

Spring Cloud Logs Activity

Count

Top Resource Groups

Services

Top Resources

Log Level

[Logs Azure] Azure Spring Cloud logs Overview


Lists risk users produced by the Azure AD Identity Protection service.

Question: azure.identityprotection.category : "RiskyUsers"

Identity Protection Risky Users [Azure Logs]


Lists user risk event produced by the Azure AD Identity Protection service.

Question: azure.identityprotection.category : "UserRiskEvents"

Identity Protection User Risk Events [Azure Logs]


Provide an overview and statistics of the provisioning activities on your enterprise applications.

Question: azure.identityprotection.category : "UserRiskEvents"

Detection Sources

Question: azure.identityprotection.category : "UserRiskEvents"

Detected Risk Type

Question: azure.identityprotection.category : "UserRiskEvents"

Detection Timeline

Risky Users

Risky Sign-ins

[Logs Azure] Azure AD Identity Protection


Question: data_stream.dataset :"azure.activitylogs"

Caller IP [Logs Azure]

Caller IP [Logs Azure]


Firewall Network Rule Logs [Logs Azure]


Navigation Users [Logs Azure]

### Azure Monitoring

[Overview](#/dashboard/azure-41e84340-ec20-11e9-90ec-112a988266d5) | [**Users**](#/dashboard/azure-87095750-f05a-11e9-90ec-112a988266d5) | [Alerts](#/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5)

Navigation Users [Logs Azure]


User Filters [Logs Azure]

User Filters [Logs Azure]


User Activity Overview [Logs Azure]

Question: data_stream.dataset :"azure.activitylogs" and azure.activitylogs.event_category :"Administrative" and azure.activitylogs.identity.claims_initiated_by_user.fullname :*

User Activity Overview [Logs Azure]


Question: data_stream.dataset :"azure.activitylogs"

Resource Type Breakdown [Logs Azure]

Resource Type Breakdown [Logs Azure]


This dashboard shows expanded user activity in Azure cloud.

Navigation Users

User Filters

User Activity Overview

Users List

Top Caller IPs

Authorization Activity User

Top Resource Groups

Resource Creations

Resource Deletions

Top Resource Types

[Logs Azure] User Activity


Dashboard providing statistics about alerts ingested from the Azure Firewall NAT Rule Log events.

Question: AzureFirewallNatRuleLog

**Navigation**

[Overview](/app/dashboards#/view/azure-280493a0-f1a1-11ec-a5a8-bf965bcd5646)
[Network Rule Logs](/app/dashboards#/view/azure-91224490-f1a6-11ec-a5a8-bf965bcd5646)
**[Network NAT Rule Logs (This Page)](/app/dashboards#/view/azure-8731b980-f1aa-11ec-a5a8-bf965bcd5646)**
[Application Rule Logs](/app/dashboards#/view/azure-1e5c9b50-f24a-11ec-a5a8-bf965bcd5646)
[DNS Proxy Logs](/app/dashboards#/view/azure-cad82b40-f251-11ec-a5a8-bf965bcd5646)

[Integrations Page](/app/integrations/detail/azure/overview?integration=firewall_logs)

**Overview**

This dashboard provides an overall view of Azure Firewall Network NAT Rule Log events.

Firewall Filters

Unique Source IPs

Unique Destination IPs

Unique Source Countries

Unique Destination Countries

Unique Network Protocols

Top Event Generating Firewalls

Top Source Countries

Top values of destination.geo.country_name

Top Destination Countries

Network Protocols and Applications

Top Event Source IPs

Top Event Destination IPs

Top Network Protocols

[Logs Azure] Firewall Network NAT Rule Log


Dashboard providing statistics about alerts ingested from the AWS Network Firewall integration.

Question: AzureFirewallNetworkRuleLog

**Navigation**

[Overview](/app/dashboards#/view/azure-280493a0-f1a1-11ec-a5a8-bf965bcd5646)
**[Network Rule Logs (This Page)](/app/dashboards#/view/azure-91224490-f1a6-11ec-a5a8-bf965bcd5646)**
[Network NAT Rule Logs](/app/dashboards#/view/azure-8731b980-f1aa-11ec-a5a8-bf965bcd5646)
[Application Rule Logs](/app/dashboards#/view/azure-1e5c9b50-f24a-11ec-a5a8-bf965bcd5646)
[DNS Proxy Logs](/app/dashboards#/view/azure-cad82b40-f251-11ec-a5a8-bf965bcd5646)

[Integrations Page](/app/integrations/detail/azure/overview?integration=firewall_logs)

**Overview**

This dashboard provides an overall view of Azure Firewall Network Rule Log events.

Unique Source IPs

Unique Destination IPs

Unique Source Countries

Unique Destination Countries

Unique Network Protocols

Top Event Generating Firewalls

Top Source Countries

Top Destination Countries

Network Protocols and Applications

Top Event Source IPs

Top Event Destination IPs

Top Network Protocols

Firewall Filters

[Logs Azure] Firewall Network Rule Log


Dashboard providing statistics about logs ingested from the Azure Firewall DNS Proxy events.

Question: AzureFirewallDnsProxyLog

**Navigation**

[Overview](/app/dashboards#/view/azure-280493a0-f1a1-11ec-a5a8-bf965bcd5646)
[Network Rule Logs](/app/dashboards#/view/azure-91224490-f1a6-11ec-a5a8-bf965bcd5646)
[Network NAT Rule Logs](/app/dashboards#/view/azure-8731b980-f1aa-11ec-a5a8-bf965bcd5646)
[Application Rule Logs)](/app/dashboards#/view/azure-1e5c9b50-f24a-11ec-a5a8-bf965bcd5646)
**[DNS Proxy Logs (This Page)](/app/dashboards#/view/azure-cad82b40-f251-11ec-a5a8-bf965bcd5646)**

[Integrations Page](/app/integrations/detail/azure/overview?integration=firewall_logs)

**Overview**

This dashboard provides an overall view of Azure Firewall DNS Proxy Log events.

Firewall Filters

Total DNS Queries

Unique Source IPs

Unique Source Countries

Unique Domains

add

sum(source.bytes) + sum(destination.bytes)

Total Bytes

Unique Network Protocols

Top Event Source Addresses

Top Event Generating Firewalls

Top Domains

[Logs Azure] Firewall DNS Proxy Log


RADIUS - Destination Port

RADIUS - Destination Port


Security Onion - DNP3 - IIN

Security Onion - DNP3 - IIN


Security Onion - DNP3


Security Onion - RFB - Authentication Method


Question: tags:kerberos

Security Onion - Kerberos


Kerberos - Success Status (Donut Chart)

Kerberos - Success Status (Donut Chart)


RADIUS - Source IP Address

RADIUS - Source IP Address


Connections - Responder Bytes

Connections - Responder Bytes


Security Onion - Tunnels - Type

Security Onion - Tunnels - Type


Connections - Source - Responder Bytes ( Tile Map)


Connections - Source - Responder Bytes


Security Onion - SSL - Validation Status


Question: tags:radius

Security Onion - RADIUS


Intel - Destination IP Address

Intel - Destination IP Address


NIDS Alerts - Severity (Pie Chart)

NIDS Alerts - Severity (Pie Chart)


Kerberos - Renewable

Kerberos - Renewable


RFB - Source IP Address

RFB - Source IP Address


Connections - Destination Port

Connections - Destination Port


DNP3 - Function Reply

DNP3 - Function Reply


RDP - Keyboard Layout (Pie Chart)

RDP - Keyboard Layout (Pie Chart)


RFB - Authentication Method

RFB - Authentication Method


Autoruns - Log Count Over Time

Autoruns - Log Count Over Time

@timestamp per 30 seconds

Count


Question: event.module:osquery

Security Onion - Osquery


IRC - Destination IP Address

IRC - Destination IP Address


Bro - Notice - Message/Sub-Message

Bro - Notice - Message/Sub-Message


Top 50 - Destination IP Address

Top 50 - Destination IP Address


NTLM - Server NetBIOS Name

NTLM - Server NetBIOS Name


RFB - Authentication Method (Horizontal Bar Chart)

Count


Question: event_type:bro_ssl AND _exists_:server_name_frequency_score

SSL - Certificate Server Name Frequency Analysis


Connections - Protocol (Bar Chart)

Connections - Protocol (Bar Chart)

Protocol

Count


Firewall - Source IP Address

Firewall - Source IP Address


SMTP - TLS (Pie Chart)

SMTP - TLS (Pie Chart)


Security Onion - MySQL - Success

Security Onion - MySQL - Success


Question: tags:mysql

Security Onion - MySQL


Question: event_type:bro_x509 AND _exists_:issuer_organization_frequency_score

X.509 - Certificate Issuer Organization Frequency Analysis


SMTP - Subject

SMTP - Subject


MySQL - Success

MySQL - Success


RDP - Result (Horizontal Bar Chart)

RDP - Result (Horizontal Bar Chart)

Count


Autoruns - Hostname (Tag Cloud)

Autoruns - Hostname (Tag Cloud)


Security Onion - HTTP - Count

Security Onion - HTTP - Count


NIDS - Alerts

NIDS - Alerts


Security Onion - Zeek - Notice Message

Security Onion - Zeek - Notice Message


Intel - Matched

Intel - Matched


Security Onion - RFB - Share Flag

Security Onion - RFB - Share Flag


Security Onion - RFB - Desktop Name

Security Onion - RFB - Desktop Name


Question: tags:rfb

Security Onion - RFB


Security Onion - Connection Count

Security Onion - Connection Count


Question: tags:tunnel

Security Onion - Tunnels


Kerberos - Log Count Over Time

Kerberos - Log Count Over Time

@timestamp per 12 hours

Count


Question: event_type:bro_dns AND _exists_:parent_domain_frequency_score

DNS - Parent Domain Frequency Analysis

DNS - Parent Domain Frequency Analysis


Weird - Summary

Weird - Summary


Bro - Syslog - Destination Port

Bro - Syslog - Destination Port


Security Onion - DNP3 - FC Reply

Security Onion - DNP3 - FC Reply


Connections - Top Source IPs


Files - Files By Size (Bytes)

Files - Files By Size (Bytes)


DCE/RPC - Log Count Over Time

DCE/RPC - Log Count Over Time

@timestamp per 30 minutes

Count


RADIUS - Log Count Over TIme

RADIUS - Log Count Over TIme

@timestamp per 12 hours

Count


Connections - Destination - Sum of Total Bytes


ElastAlert - Destination Port

ElastAlert - Destination Port


DHCP - Domain Name

DHCP - Domain Name


Strelka - File - Entropy

Strelka - File - Entropy


RADIUS - Destination IP Address

RADIUS - Destination IP Address


Security Onion - SIP - Warning

Security Onion - SIP - Warning


FTP - Source IP Address

FTP - Source IP Address


Autoruns - Launch String

Autoruns - Launch String


Discover [Cloudflare]


Get a quick overview of the most important metrics from your websites and applications on the Cloudflare network.

Traffic Type [Cloudflare]

Top Requested URI [Cloudflare]

Top Traffic Countries [Cloudflare]

HTTP Protocols [Cloudflare]

Content Type [Cloudflare]

Request Methods [Cloudflare]

Top Referrer [Cloudflare]

Top Traffic Type [Cloudflare]

Top Traffic IPs [Cloudflare]

Top User Agents [Cloudflare]

Total Number of Requests [Cloudflare]

Total Bandwidth [Cloudflare]

hit, stale, updating, ignored, revalidated

Cached Bandwidth [Cloudflare]

Threats Stopped [Cloudflare]

Question: cloudflare.log*

![alt text](https://www.cloudflare.com/img/logo-cloudflare-dark.svg)

Cloudflare logo [Cloudflare]

Question: cloudflare.log*

**Web Traffic Overview**

Web Traffic Overview - text [Cloudflare]

**Web Traffic Types -
Get insight into the various types of traffic and content**

Web Traffic Types - Text [Cloudflare]

Filters [Cloudflare]

Top Traffic Countries Map [Cloudflare]

Cloudflare - Snapshot


Get insights on threats to your websites and applications, including number of threats stopped, threats over time, top threat countries, and more.

Total Number of Requests [Cloudflare]

Question: unknown

Question: unknown

WAF Events Triggered [Cloudflare]

Threats Stopped [Cloudflare]

Top Threat Client IPs [Cloudflare]

Top Threat Target URIs [Cloudflare]

Top Threat User Agents [Cloudflare]

Top Pathing Statuses [Cloudflare]

Top Threat Countries [Cloudflare]

Count

Threats Over Time [Cloudflare]

Top Threats Stopped [Cloudflare]

Question: cloudflare.log*

Cloudflare logo [Cloudflare]

Question: cloudflare.log*

**Threats - Review threat activity**

Threats - Review threat activity - text [Cloudflare]

Filters [Cloudflare]

Top Threat Countries Map [Cloudflare]

Cloudflare - Security (Overview)


Get insights into your most popular hostnames, most requested content types, breakdown of request methods, and connection type.

Count

Client Requests by Content Type [Cloudflare]

Count

Client Requests Methods Over Time [Cloudflare]

Count

Client Requests by Connection Over Time [Cloudflare]

Count

Client Requests by Hostname Over Time [Cloudflare]

Question: cloudflare.log*

Cloudflare logo [Cloudflare]

Filters [Cloudflare]

Question: cloudflare.log*

**Origin Requests By Hostname - Content Type - Request Methods - Connection Type**

Origin Requests By Hostname - Content Type - Request Methods - Connection Type - text [Cloudflare]

Cloudflare - Performance (Hostname, Content Type, Request Methods, Connection Type)


Identify and address performance issues and caching misconfigurations. Metrics include total vs. cached bandwidth, saved bandwidth, total requests, cache ratio, top uncached requests, and more.

Total Number of Requests [Cloudflare]

Cached Requests [Cloudflare]

Uncached Requests [Cloudflare]

Total Bandwidth [Cloudflare]

Cached Bandwidth [Cloudflare]

Uncached Bandwidth [Cloudflare]

Count

Cache status over time [Cloudflare]

Cache Status Ratio [Cloudflare]

Question: miss

Question: miss

Top URIs with Cache Status Miss [Cloudflare]

Question: data_stream.dataset : "cloudflare.log"

Question: metricset.name:cloudflare.cache.status

Question: data_stream.dataset : "cloudflare.log" AND cloudflare.cache.status:(hit OR stale OR updating OR ignored)

Question: data_stream.dataset : "cloudflare.log" AND cloudflare.cache.status:(-hit OR -stale OR -updating OR -ignored)

Total number of requests vs cached vs uncached over time [Cloudflare]

Question: data_stream.dataset : "cloudflare.log"

Question: data_stream.dataset : "cloudflare.log" AND cloudflare.origin.response.status_code:>0

Total Requests vs. Origin Requests in rps last 24 hours [Cloudflare]

Question: cloudflare.cache.status:(hit OR stale OR updating OR ignored OR revalidated)

Question: cloudflare.cache.status:(-hit OR -stale OR -updating OR -ignored OR -revalidated)

Cached vs Uncached Bandwidth Over Time [Cloudflare]

Question: cloudflare.origin.response.status_code:>0

Total Bandwidth vs Origin Bandwidth in Mbps last 24 hours - 7.x [Cloudflare]

Question: cloudflare.log*

Cloudflare logo [Cloudflare]

Question: cloudflare.log*

**Requests**

Requests - text [Cloudflare]

Question: cloudflare.log*

**Bandwidth**

Bandwidth - text [Cloudflare]

Question: cloudflare.log*

**Cache**

Cache - text [Cloudflare]

Filters [Cloudflare]

Question: cloudflare.log*

**Performance Overview**

Performance Overview - text [Cloudflare]

Cloudflare - Performance (Requests, Bandwidth, Cache)


Get insights on the availability of your websites and applications. Metrics include origin response error ratio, origin response status over time, percentage of 3xx/4xx/5xx errors over time, and more.

Count

Edge Response Status Over Time [Cloudflare]

Count

Origin Response Status Over Time [Cloudflare]

Top Client IPs and AS Number - Reliability [Cloudflare]

Top Countries - Reliability [Cloudflare]

Top Requested URI - Reliability [Cloudflare]

Top User Agents - Reliability [Cloudflare]

Top Hostnames - Reliability [Cloudflare]

Edge Response Error Ratio [Cloudflare]

Origin Response Error Ratio [Cloudflare]

Errors Ratio (Edge) [Cloudflare]

Filters [Cloudflare]

Question: cloudflare.log*

**Summary of Edge and Origin Response Status**

Get an overview of the edge and origin response status codes

Summary of Edge and Origin Response Status - text [Cloudflare]

Question: cloudflare.log*

Cloudflare logo [Cloudflare]

Question: cloudflare.log*

Detailed View Breakdown of Origin Response Status Codes by Various Metrics - text [Cloudflare]

Cloudflare - Reliability


Get insights into the performance of your static and dynamic content, including slowest URLs.

Percentiles of OriginResponseTime

Origin time to first byte dynamic requests [Cloudflare]

Percentiles of OriginResponseTime

Origin time to first byte static requests [Cloudflare]

Slowest URIs by cumulative time to first byte for dynamic requests [Cloudflare]

Slowest URIs by cumulative time to first byte for static requests [Cloudflare]

Question: cloudflare.log*

Cloudflare logo [Cloudflare]

Question: cloudflare.log*

**Static vs Dynamic Content**

Static vs Dynamic Content - text [Cloudflare]

Filters [Cloudflare]

Cloudflare - Performance (Static vs. Dynamic Content)


Get insights on rate limiting protection against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior targeted at your websites or applications.

Count

Rate Limit Over Time [Cloudflare]

Top Rate Limit Actions [Cloudflare]

Top Rate Limit Countries [Cloudflare]

Question: ban

Question: ban

Top Banned Client IPs [Cloudflare]

Question: cloudflare.log*

Cloudflare logo [Cloudflare]

Question: cloudflare.log*

**Rate Limiting - Get insights into rate limiting events and banned IPs and URIs**

Rate Limiting Get insights into rate limiting events and banned IPs and URIs - text [Cloudflare]

Filters [Cloudflare]

Cloudflare - Security (Rate Limiting)


Get insights on threat identification and mitigation by our Web Application Firewall, including events like SQL injections, XSS, and more. Use this data to fine tune the firewall to target obvious threats and prevent false positives.

Question: unknown

Question: unknown

WAF: Top User Agents [Cloudflare]

Question: unknown

Question: unknown

Top WAF Rules Triggered [Cloudflare]

Question: unknown

Question: unknown

WAF: Top Client IP [Cloudflare]

Question: unknown

Question: unknown

WAF: Top Hosts [Cloudflare]

Question: unknown

Question: unknown

WAF: Top Countries [Cloudflare]

Question: unknown

Question: unknown

WAF Events Triggered [Cloudflare]

Question: unknown

Question: unknown

Count

WAF Events Over Time [Cloudflare]

Total Number of Requests [Cloudflare]

Question: cloudflare.log*

Cloudflare logo [Cloudflare]

Question: cloudflare.log*

**WAF - Events triggered by the Web Application Firewall**

WAF Events triggered by the Web Application Firewall - text [Cloudflare]

Filters [Cloudflare]

Cloudflare - Security (WAF)


HTTP - Destination IP Address

HTTP - Destination IP Address


NTLM - Destination IP Address

NTLM - Destination IP Address


Endgame - All Logs (copy)

Endgame - All Logs


FTP - Command

FTP - Command


NIDS - Alerts Over Time

NIDS - Alerts Over Time

@timestamp per 30 minutes

Count


SMTP - Destination Port

SMTP - Destination Port


NIDS - Classification

NIDS - Classification


RFB - Destination IP Address

RFB - Destination IP Address


SMTP - User Agent

SMTP - User Agent


Connections - Service

Connections - Service


NTLM - Destination Port

NTLM - Destination Port


Sensors/Devices and Services

Sensors/Devices and Services


DCE/RPC - Destination Port

DCE/RPC - Destination Port


logs-osquery_manager.result*


Software - Log Count Over Time

Software - Log Count Over Time

@timestamp per 12 hours

Count


NIDS Alerts - Destination IP Address

NIDS Alerts - Destination IP Address


Security Onion - SSL - Server Name

Security Onion - SSL - Server Name


SSL - Source IP Address

SSL - Source IP Address


Security Onion - Network Datasets

Security Onion - Network Datasets


Weird - Destination Port

Weird - Destination Port


DNS - Queries

DNS - Queries


SSH - Authentication Success

SSH - Authentication Success

Authentication Success

Count


Security Onion - SIP - URI

Security Onion - SIP - URI


Question: tags:sip

Security Onion - SIP


SIP - Request Path

SIP - Request Path


DNP3 - Source IP Address

DNP3 - Source IP Address


Firewall - Destination IP Address

Firewall - Destination IP Address


Autoruns - Hostname

Autoruns - Hostname


SIP - Destination Port

SIP - Destination Port


SMTP  - Destination Country (Donut Chart)


Files - Source

Files - Source


Question: event_type:bro_x509 AND _exists_:certificate_common_name_frequency_score

X.509 - Certificate Common Name Frequency Analysis


Hash - SSDeep

Hash - SSDeep


Sysmon - Event ID (Horizontal Bar Chart)

Count


FTP - Argument

FTP - Argument


NTLM - Hostname

NTLM - Hostname


DNS - Destination Port (Horizontal Bar Chart)

Count


Kerberos - Cipher (Donut Chart)

Kerberos - Cipher (Donut Chart)


HTTP - Destination Country (Vertical Bar Chart)

Country

Count


IRC - Source IP Address

IRC - Source IP Address


SNMP - Session Duration

SNMP - Session Duration


SSH -Server

SSH -Server


Firewall - Log Count Over Time

Firewall - Log Count Over Time

@timestamp per 30 seconds

Count


Syslog - Source IP Address

Syslog - Source IP Address


Security Onion - Host - Domain

Security Onion - Host - Domain


RADIUS - Username

RADIUS - Username


SNMP - Source IP Address

SNMP - Source IP Address


Notice - Destination Port (Vertical Bar Chart)

Port

Count


ElastAlert


RFB - Destination Port

RFB - Destination Port


Tunnels - Log Count Over TIme

Tunnels - Log Count Over TIme

@timestamp per 12 hours

Count


DNS - Query/Answer

DNS - Query/Answer


DHCP - Log Count Over Time

DHCP - Log Count Over Time

@timestamp per 12 hours

Count


Bro - Syslog - Protocol

Bro - Syslog - Protocol


Connections - Destination - Top Connection Duration


SSL - Summary

SSL - Summary


OSSEC - Archive


Security Onion - SMB - File System

Security Onion - SMB - File System


NIDS Alert - Source Port

NIDS Alert  - Destination Port

NIDS - Alert Summary

NIDS - Alert Title

NIDS - Rule Signature

NIDS - SID Drilldown


Security Onion - HTTP - Version

Security Onion - HTTP - Version


OSSEC Alerts - Event Summary

OSSEC Alerts - Event Summary


NTLM - Server DNS Name

NTLM - Server DNS Name


FTP - Destination Port

FTP - Destination Port


RDP - Encryption Level (Vertical Bar Chart)

Encryption Level

Count


DNP3 - Destination IP Address

DNP3 - Destination IP Address


Question: tags:ssl

Security Onion - SSL


Question: event.kind: pipeline_error and error.message : *

[Elastic Agent] Integration Errors


Integration Name

Agent Name

**Navigation**

**Agent Health**

[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824)
[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824)
[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395)
**[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824)**

**Overview**

This dashboards visualizes the statistics and overall health of all the active integrations.

Table of Contents

[Elastic Agent] Integration Errors Table

[Elastic Agent] Events per Integration

[Elastic Agent] Integrations


Question: error

[Elastic Agent] Agent Errors


Agent Hostname

Integration Name

Agent Version

**Navigation**

**Agent Health**

[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824)
**[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824)**
[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395)
[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824)

**Overview**

This dashboards shows more detailed health information specifically related to running Elastic Agent instances.

Table of Contents

[Elastic Agent] Most Active Agents

Question: apm.*

[Elastic Agent] Agent Versions

defaults(count(kql='log.level : "error" '), 0)

Question: log.level : "error"

defaults

[Elastic Agent] Agents with Errors

[Elastic Agent] Integrations per Agent

[Elastic Agent] Agent Info


**Navigation**

**Agent Health**

**[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824)**
[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824)
[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395)
[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824)

**Overview**

This dashboard gives an overview of the current overall state and health of all Agents and their related enabled Integrations.

Table of Contents

Part of defaults(unique_count(data_stream.dataset), 0)

defaults(count(event.kind, kql='event.kind: pipeline_error'), 0)

Question: event.kind: pipeline_error

defaults(unique_count(agent.id), 0)

Current Active Agents

Question: log.level: error

defaults(count(kql='log.level: error'), 0)

Most Active Agents

Total Ingest Rates

Most Active Integrations

[Elastic Agent] Overview


Agent Hostname

Elastic Agent metrics dashboard

**Navigation**

**Agent Health**

[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824)
[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824)
**[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395)**
[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824)

**Overview**

This dashboard is used to show detailed metrics related to the specific agent used in the filter.

Table of Contents

[Elastic Agent] Memory Usage

Empty XY chart

[Elastic Agent] Open Handles

Question: data_stream.dataset : "elastic_agent.*"

[Elastic Agent] Total events rate /s

Question: data_stream.dataset : "elastic_agent.*"

[Elastic Agent] Output write throughput

Question: data_stream.dataset : "elastic_agent.*"

[Elastic Agent] Output write errors

Question: data_stream.dataset : "elastic_agent.*"

[Elastic Agent] Events acknowledged rate /s

      if (params.deltaUsageDerivNormalizedValue > 0 && params.periodsDerivNormalizedValue >0  && params.quota > 0) {
        // if throttling is configured
        double  factor = params.deltaUsageDerivNormalizedValue / (params.periodsDerivNormalizedValue * params.quota * 1000);

        return factor * 100;
      }

      return null;

[Elastic Agent] CGroup CPU Usage

Empty XY chart

[Elastic Agent] Cgroup Memory Usage

if (params.cpu_total > 0) {
  return params.cpu_total / params._interval
}

[Elastic Agent] CPU Usage

[Elastic Agent] Agent metrics


Kerberos - Server

Kerberos - Server


Connections - Source - Sum of Total Bytes


SSL - Destination Port

SSL - Destination Port


SMTP - Source IP Address

SMTP - Source IP Address


FTP - Destination Address

FTP - Destination Address


Question: tags:smb*

Security Onion - SMB


DCE/RPC - Round Trip Time

DCE/RPC - Round Trip Time


NTLM - Source IP Address

NTLM - Source IP Address


Question: tags:alert AND event.module:playbook

Security Onion - Alert Data

Security Onion - Playbook


SIP - Source IP Address

SIP - Source IP Address


DCE/RPC - Source IP Address

DCE/RPC - Source IP Address


Tunnels - Country

Tunnels - Country

Country

Count


IRC - Destination Country

IRC - Destination Country


ElastAlert - Alert Type

ElastAlert - Alert Type


Kerberos - Service

Kerberos - Service


Logstash - Processing Performance

Logstash - Processing Performance

Log Type


Firewall - Protocol

Firewall - Protocol

Count


FTP - Username

FTP - Username


RDP - Source IP Address

RDP - Source IP Address


Security Onion - Zeek - Notice Action

Security Onion - Zeek - Notice Action


Question: event.dataset:notice AND event.module:zeek

Security Onion - Zeek - Notices


Question: suricata

Security Onion - Playbook - Rules

Security Onion - Playbook - Rules


X.509 - Certificate Subject

X.509 - Certificate Subject


Security Onion - Syslog - Severity (Donut)


Firewall - Destination Port

Firewall - Destination Port


RDP - Log Count Over Time

RDP - Log Count Over Time

@timestamp per 12 hours

Count


Security Onion - Connections - Top Source IPs


DNS - Answers

DNS - Answers


Question: event.module:strelka

Security Onion - Strelka


Question: github.audit

GitHub Audit Users


Owner/Organization

Repository

State

Severity

Total Alerts Created [GitHub Code Scanning]

Question: github.state:dismissed

divide

count()/count(kql='github.state:dismissed')

Alerts Found/Fixed Ratio [GitHub Code Scanning]

Open vs Resolved/Dismissed [GitHub Code Scanning]

Question: open

Open Alerts Count [GitHub Code Scanning]

Mean Time to Resolution [GitHub Code Scanning]

Mean Time To Resolution [GitHub Code Scanning]

Resolved/Dismissed Alerts Count [GitHub Code Scanning]

Ratio between the alerts generated and the number of commits

Part of Ratio between the alerts and the number of commits generated

count()/unique_count(github.code_scanning.most_recent_instance.commit_sha)

Alert/Commit Ratio [GitHub Code Scanning]

Top values of github.repository.owner.login + 1 other

Alerts count by owner and by repository [GitHub Code Scanning]

Top repositories contributing to alerts by owner

Aerts % by owner and by repository [GitHub Code Scanning]

Alerts % by owner and by repository [GitHub Code Scanning]

Tool Contribution Count [GitHub Code Scanning]

Top 5 values of github.code_scanning.tool.name

Top 10 values of github.code_scanning.tool.name

Daily Tool Contribution [GitHub Code Scanning]

Alert Severity Count [GitHub Code Scanning]

Alert Severity % [GitHub Code Scanning]

Daily Alerts Count by Severity [GitHub Code Scanning]

Rule Severity [GitHub Code Scanning]

Top Rules [GitHub Code Scanning]

Top files [GitHub Code Scanning]

Top users dismissing alerts [GitHub Code Scanning]

Events Timeline [GitHub Code Scanning]

[GitHub] Code Scanning Alerts


Owner/Organization

Repository

State

Severity

Total Secrets Found [GitHub Secret Scanning]

Question: github.state:dismissed or github.state:resolved

count()/count(kql='github.state:dismissed or github.state:resolved')

Secrets Found/Fixed Ratio [GitHub Secret Scanning]

Open vs Fixed/Resolved Secrets[GitHub Secret Scanning]

Question: open

Open Secrets Count [GitHub Secret Scanning]

Mean Time to Resolution [GitHub Secret Scanning]

Fixed Secrets Count [GitHub Secret Scanning]

Found Secrets count by owner and by repository [GitHub Secret Scanning]

Found Secrets % by owner and by repository [GitHub Secret Scanning]

Question: open

Open Secrets Count by Type [GitHub Secret Scanning]

Question: open

Open Secrets % by Type [GitHub Secret Scanning]

Question: github.secret_scanning.time_to_resolution.sec: *

Fixed Secrets [GitHub Secret Scanning]

Found Secrets [GitHub Secret Scanning]

Top users resolving secrets [GitHub Secret Scanning]

Events Timeline [GitHub Secret Scanning]

[GitHub] Secret Scanning Alerts


State

Severity

Owner/Organization

Repository

Total Alerts Created [GitHub Dependabot]

Question: github.state:dismissed

Alerts Found/Fixed Ratio [GitHub Dependabot]

Question: github.dependabot

Open vs Resolved/Dismissed [GitHub Dependabot]

Open Alerts Count [GitHub Dependabot]

Resolved/Dismissed Alerts Count [GitHub Dependabot]

Question: github.dependabot

Mean Time to Resolution [GitHub Dependabot]

Mean Time To Resolution [GitHub Dependabot]

Alerts count by owner and by repository [GitHub Dependabot]

Aerts % by owner and by repository [GitHub Dependabot]

Question: github.dependabot

Alert Severity Count [GitHub Dependabot]

Question: github.dependabot

Alert Severity % [GitHub Dependabot]

Question: github.dependabot

Daily Alerts Count by Severity [GitHub Dependabot]

Question: github.dependabot

Top files [GitHub Dependabot]

Question: github.dependabot

Top users dismissing alerts [GitHub Dependabot]

Question: github.dependabot

Events Timeline [GitHub Dependabot]

[GitHub] Dependabot Alerts


Owner/ Organization

Repository

State

Severity

Alert Type

Total Alerts Count [GitHub Advanced Security]

Question: github.severity : "critical"

Question: github.severity : "high"

Question: github.severity : "medium"

Question: github.severity : "low"

Question: github.severity : "undefined"

Open Alerts Count by Severity [GitHub Advanced Security]

Question: github.severity : "critical"

Question: github.severity : "high"

Question: github.severity : "medium"

Question: github.severity : "low"

Question: github.severity : "undefined"

Open Alerts % by Severity [GitHub Advanced Security]

Open Alerts Count [GitHub Advanced Security]

Resolved/Dismissed Alerts Count [GitHub Advanced Security]

Question: open

Open Alerts count by owner and by repository [GitHub Advanced Security]

Question: open

Open Alerts % by owner and by repository [GitHub Advanced Security]

Question: data_stream.dataset : "github.code_scanning"

Question: data_stream.dataset : "github.secret_scanning"

Question: data_stream.dataset : "github.dependabot"

Question: open

Empty XY chart

Open Alerts by Type [GitHub Advanced Security]

Question: data_stream.dataset : "github.code_scanning"

Question: data_stream.dataset : "github.secret_scanning"

Question: data_stream.dataset : "github.dependabot"

Question: open

Open Alerts % by Type [GitHub Advanced Security]

[GitHub] Advanced Security Overview


Question: github.audit

Controls Audit [GitHub]

User Changes [GitHub]

Count

User Change Timeline [GitHub]

[GitHub] User Change Audit


Question: github.audit

GitHub Audit


Question: github.audit

Controls Audit [GitHub]

Total Events [GitHub]

Count

Events over time [GitHub]

Question: github.audit

Activity Map by Actor Location [GitHub]

Events per Organization [GitHub]

Count

Top 5 Event Types [GitHub]

Count

Top 5 Active Users [GitHub]

Count

Top 10 Active Repositories [GitHub]

[GitHub] Audit Log Activity


Owner/Organization

Repository

State

Question: github.issues

Total Alerts Created [GitHub Code Scanning]

Total Issues Created [GitHub Issues]

Question: github.state:closed

count()/count(kql='github.state:closed')

Alerts Found/Fixed Ratio [GitHub Code Scanning]

Issues Created/Closed Ratio [GitHub Issues]

Question: github.issues

Open vs Resolved/Dismissed [GitHub Code Scanning]

Open vs Closed [GitHub Issues]

Question: open

Open Alerts Count [GitHub Code Scanning]

Open Issues Count [GitHub Issues]

divide

round

round(average(github.issues.time_to_close.sec))/86400

Question: github.issues

Mean Time to Resolution [GitHub Code Scanning]

Mean Time To Close Issues [GitHub Issues]

Resolved/Dismissed Alerts Count [GitHub Code Scanning]

Closed Issues Count [GitHub Issues]

Question: github.issues

Tool Contribution Count [GitHub Code Scanning]

Top Issues by labels [GitHub Issues]

Top 10 values of github.issues.labels.name

Question: github.issues

Tool Contribution [GitHub Code Scanning]

Top Issues % by labels [GitHub Issues]

Question: github.issues

Issues Count by labels [GitHub Issues]

Question: github.issues

Top Users Creating Issues [GitHub Issues]

Question: github.issues

Top users with assigned issues [GitHub Issues]

Question: github.issues

Top users closing the issues [GitHub Issues]

Question: github.issues

Events Timeline [GitHub Code Scanning]

Events Timeline [GitHub Issues]

[GitHub] Issues


Group Identity Setting Changes [Logs Google Workspace]


Documents Shared Outside of the Organization [Logs Google Workspace]


Overview of Google Workspace Token.

Total Token Count [Logs Google Workspace]

Distribution of Token Events by Event Action [Logs Google Workspace]

Empty XY chart

Distribution of Token Events by Client Type [Logs Google Workspace]

Distribution of Token Events by App Name [Logs Google Workspace]

Distribution of Token Events by API Name [Logs Google Workspace]

Distribution of Token Events by Method Name [Logs Google Workspace]

[Logs Google Workspace] Token


Successful Logins by Compromised Users [Logs Google Workspace]


ACL Changes [Logs Google Workspace]


Overview of Google Workspace Rules.

Total Severity [Logs Google Workspace]

Distribution of Rules by Severity [Logs Google Workspace]

Question: google_workspace.rules.severity : "HIGH"

Question: google_workspace.rules.severity : "MEDIUM"

Question: google_workspace.rules.severity : "LOW"

Distribution of Rules by Device Type [Logs Google Workspace]

Distribution of Rules by Event Action [Logs Google Workspace]

Distribution of Rules by Rule Type [Logs Google Workspace]

Distribution of Rules by Data Source [Logs Google Workspace]

Distribution of Rules by Resource Type [Logs Google Workspace]

Top 10 Organization Domain [Logs Google Workspace]

Top 10 User IP [Logs Google Workspace]

Top 10 Trigger of the Rule Evaluation [Logs Google Workspace]

Triggered Rules by Severity Over Time [Logs Google Workspace]

[Logs Google Workspace] Rules


Group Spam Moderation Setting Changes [Logs Google Workspace]


Overview of Google Workspace Group Enterprise.

Total Group Enterprise Count [Logs Google Workspace]

Distribution of Group Enterprise Events by Member Type [Logs Google Workspace]

Distribution of Group Enterprise Events by Member Role [Logs Google Workspace]

Distribution of Group Enterprise Events by Event Action [Logs Google Workspace]

[Logs Google Workspace] Group Enterprise


Overview of Google Workspace Device.

Total Device Count [Logs Google Workspace]

Distribution of Device Events by Type [Logs Google Workspace]

Distribution of Device Events by Account State [Logs Google Workspace]

Top 10 Devices with Most Failed Password Attempts [Logs Google Workspace]

List of Device Compliance and Device Deactivation Reason [Logs Google Workspace]

Empty XY chart

Distribution of Device Events by Event Action [Logs Google Workspace]

Distribution of Device by Security Patch Level [Logs Google Workspace]

Empty XY chart

Distribution of Device Events by Potentially Harmful App Category [Logs Google Workspace]

Distribution of Device Events by Application State [Logs Google Workspace]

Empty XY chart

Distribution of Device Events by Action Type [Logs Google Workspace]

Distribution of Device Events by Application Report Severity [Logs Google Workspace]

Distribution of Device Events by Device Policy App Privilege [Logs Google Workspace]

Distribution of Device Events by Policy Status [Logs Google Workspace]

Distribution of Device Events by Policy Sync Type [Logs Google Workspace]

Distribution of Device Events by Action Execution Status [Logs Google Workspace]

Distribution of Device Events by Device Ownership [Logs Google Workspace]

Distribution of Device Events by OS Property [Logs Google Workspace]

Distribution of Device Events by Device Property [Logs Google Workspace]

Distribution of Device Events by Device Setting [Logs Google Workspace]

[Logs Google Workspace] Device


Group Info Settings Changes [Logs Google Workspace]


Login Failure by Types [Logs Google Workspace]


Settings Changes [Logs Google Workspace]


Overview of Google Workspace Admin.

Admin Activity by Location [Logs Google Workspace]

Distribution of Admin Events by Event Action [Logs Google Workspace]

Top 10 Data Source [Logs Google Workspace]

Distribution of Admin Events by Domain [Logs Google Workspace]

Distribution of Admin Events by Device Type [Logs Google Workspace]

[Logs Google Workspace] Admin


Group Topic Setting Changes [Logs Google Workspace]


Question: data_stream.dataset : "google_workspace.alert"

User Email and Alert Type [Logs Google Workspace]


Context Aware Access [Logs Google Workspace]


Overview of Google Workspace User Account.

User Account Activity by Location [Logs Google Workspace]

Distribution of User Account Events by Event Action [Logs Google Workspace]

Top 10 Organization Domain [Logs Google Workspace]

Top 10 IP of User Account [Logs Google Workspace]

[Logs Google Workspace] User Account


Group New Members Restrictions Setting Changes [Logs Google Workspace]


Group Permission Changes [Logs Google Workspace]


Overview of Google Workspace Groups.

Group Activity by Location [Logs Google Workspace]

Distribution of Groups Events by Event Action [Logs Google Workspace]

Top 10 ACL Permissions [Logs Google Workspace]

[Logs Google Workspace] Groups


Question: data_stream.dataset : "google_workspace.alert"

Alert [Logs Google Workspace]


Overview of Google Workspace Alert.

Question: data_stream.dataset : "google_workspace.alert"

Question: data_stream.dataset : "google_workspace.alert"

Top 10 Customer ID and Alert Type [Logs Google Workspace]

Question: data_stream.dataset : "google_workspace.alert"

Distribution of Alert Event by Alert Status [Logs Google Workspace]

Question: data_stream.dataset : "google_workspace.alert"

Total Alert [Logs Google Workspace]

Question: data_stream.dataset : "google_workspace.alert"

Distribution of Alert Event by Alert Source [Logs Google Workspace]

Question: data_stream.dataset : "google_workspace.alert"

Distribution of Alert Event by Alert Severity [Logs Google Workspace]

Question: data_stream.dataset : "google_workspace.alert"

Top 10 Alert Type [Logs Google Workspace]

Question: data_stream.dataset : "google_workspace.alert"

Top 10 Source IP [Logs Google Workspace]

Question: data_stream.dataset : "google_workspace.alert"

Top 10 Alert and Security Tool Link [Logs Google Workspace]

Question: data_stream.dataset : "google_workspace.alert"

Top 10 Rule Name and Alert Type [Logs Google Workspace]

Question: data_stream.dataset : "google_workspace.alert"

Top 10 Device Type, Device ID and Device Model [Logs Google Workspace]

[Logs Google Workspace] Alert


Overview of Google Workspace Context Aware Access.

Total Context Aware Access Count [Logs Google Workspace]

Distribution of Context Aware Access Events by Event Action [Logs Google Workspace]

[Logs Google Workspace] Context Aware Access


Overview of Google Workspace Access Transparency and GCP.

Access Transparency Logs

Total Access Transparency Count [Logs Google Workspace]

Distribution of Access Transparency Events by Product Name [Logs Google Workspace]

GCP Logs

Distribution of GCP Events by Event Action [Logs Google Workspace]

Question: event.action : "DELETE_POSIX_ACCOUNT"

Question: event.action : "DELETE_SSH_PUBLIC_KEY"

Total Delete Posix Account and Delete SSH Public Key Count [Logs Google Workspace]

Question: event.action : "GET_SSH_PUBLIC_KEY"

Question: event.action : "GET_LOGIN_PROFILE"

Total Retrieve SSH Public Key and Retrieve Login Profile Count [Logs Google Workspace]

[Logs Google Workspace] Access Transparency and GCP


Overview of Google Workspace SAML.

SAML Activity by Location [Logs Google Workspace]

Total Failed sign-in Attempts [Logs Google Workspace]

Distribution of SAML Events by Requester of Authentication [Logs Google Workspace]

Distribution of SAML Events by Event Action [Logs Google Workspace]

Distribution of SAML Events by Failure Type [Logs Google Workspace]

[Logs Google Workspace] SAML


Overview of Google Workspace Login.

Login Activity by Location [Logs Google Workspace]

Total Successful Login [Logs Google Workspace]

Total Login Failures [Logs Google Workspace]

Distribution of Login Events by Login State [Logs Google Workspace]

Login Activity Over Time [Logs Google Workspace]

Top 10 Login by IPs [Logs Google Workspace]

[Logs Google Workspace] Login


Overview of Google Workspace Drive.

Drive Activity by Location [Logs Google Workspace]

Question: download

Distribution of Document Downloads by Title [Logs Google Workspace]

Distribution of Drive Events by Event Action [Logs Google Workspace]

Drive Activity by Country Over Time [Logs Google Workspace]

Question: upload

Top 10 Uploads by Title [Logs Google Workspace]

Distribution of Drive Events by Document Type [Logs Google Workspace]

Question: view

Top 10 Viewed Documents [Logs Google Workspace]

[Logs Google Workspace] Drive


OSSEC Rootkits [Osquery Manager]


OS versions [Osquery Manager]


OS versions [Osquery Manager]

OS versions [Osquery Manager]


Question: action_id:pack_it-compliance_kernel_integrations

Kernel integrations [Osquery Manager]


Question: Live

Question: Live

Number of Kernel integrations [Osquery Manager]


Navigation [Osquery Manager]

Navigation [Osquery Manager]

[Compliance](#/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05) | [OSSEC Rootkit](#/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040)


Question: action_id:pack_it-compliance_deb_packages

DEB packages installed [Osquery Manager]


Mounts [Osquery Manager]


Mounts by type [Osquery Manager]

Mounts by type [Osquery Manager]


Dashboard for visualizing the data collected by the Osquery compliance pack.

[Osquery Manager] Compliance pack


Info OSSEC rootkit [Osquery Manager]

This dashboard shows data collected by the ossec-rootkit pack from osquery.

Info OSSEC rootkit [Osquery Manager]


Number of hosts infected [Osquery Manager]


Number of rootkits found [Osquery Manager]


This dashboard shows data collected by the OSSEC rootkit pack from osquery

[Osquery Manager] OSSEC rootkit pack


Slow logs [Logs Redis]


Keyspace

Redis keys metrics

Empty XY chart

Keys by type

Question: list

Empty XY chart

Lists length

Question: string

Empty XY chart

Average size of string keys

Empty XY chart

Average keys TTL

[Metrics Redis] Keys


Question: redis.log

Logs [Logs Redis]


Overview dashboard for the FIlebeat Redis integration

Empty XY chart

Top slowest commands [Logs Redis]

Log levels and roles breakdown [Logs Redis]

Empty XY chart

Logs over time [Logs Redis]

[Logs Redis] Overview


Overview of Redis server metrics

Question: (data_stream.dataset:redis.info OR data_stream.dataset:redis.key OR data_stream.dataset:redis.keyspace)

Clients [Metrics Redis]

Question: (data_stream.dataset:redis.info OR data_stream.dataset:redis.key OR data_stream.dataset:redis.keyspace)

Empty XY chart

Connected clients [Metrics Redis]

Question: (data_stream.dataset:redis.info OR data_stream.dataset:redis.key OR data_stream.dataset:redis.keyspace)

Empty XY chart

Keyspaces [Metrics Redis]

Question: (data_stream.dataset:redis.info OR data_stream.dataset:redis.key OR data_stream.dataset:redis.keyspace)

Hosts [Metrics Redis]

Question: (data_stream.dataset:redis.info OR data_stream.dataset:redis.key OR data_stream.dataset:redis.keyspace)

Server Versions [Metrics Redis]

Question: (data_stream.dataset:redis.info OR data_stream.dataset:redis.key OR data_stream.dataset:redis.keyspace)

Server mode [Metrics Redis]

Question: (data_stream.dataset:redis.info OR data_stream.dataset:redis.key OR data_stream.dataset:redis.keyspace)

Multiplexing API [Metrics Redis]

[Metrics Redis] Overview


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Logouts [Windows System Security]


Question: system.auth.useradd:*

useradd logs [Logs System]


Question: system.auth.groupadd:*

groupadd logs [Logs System]


New users and groups dashboard for the System integration in Logs

[Syslog](#/dashboard/system-Logs-syslog-dashboard) | [Sudo commands](#/dashboard/system-277876d0-fa2c-11e6-bbd3-29c986c96e5a) | [SSH logins](#/dashboard/system-5517a150-f9ce-11e6-8115-a7c18106d86a) | [New users and groups](#/dashboard/system-0d3f2380-fa78-11e6-ae9b-81e5311e8cab)

Dashboards [Logs System]

Question: data_stream.dataset : "system.auth"

New users [Logs System]

New users over time [Logs System]

Question: data_stream.dataset : "system.auth"

New users by shell [Logs System]

New users by home directory [Logs System]

New groups [Logs System]

New groups over time [Logs System]

[Logs System] New users and groups


Question: system.auth.sudo:*

Sudo commands [Logs System]


Sudo commands dashboard from the Logs System integration

Dashboards [Logs System]

Question: data_stream.dataset : "system.auth"

Top sudo commands [Logs System]

Sudo commands by user [Logs System]

Question: system.auth.sudo.error:*

Sudo errors [Logs System]

[Logs System] Sudo commands


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User management Details - Search [Windows System Security]


Question: data_stream.dataset:system.auth AND system.auth.ssh.event:*

SSH login attempts [Logs System]


SSH dashboard for the System integration in Logs

Dashboards [Logs System]

SSH failed login attempts source locations [Logs System]

Question: system.auth.ssh.event:Failed OR system.auth.ssh.event:Invalid

SSH login attempts [Logs System]

Question: system.auth.ssh.event:Accepted

Successful SSH logins [Logs System]

Question: system.auth.ssh.event:Failed OR system.auth.ssh.event:Invalid

SSH users of failed login attempts [Logs System]

[Logs System] SSH login attempts


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Remote Interactive Connections and Disconnections [Windows System Security]


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Logon Details [Windows System Security]


User management activity.

Question: Microsoft-Windows-Security-Auditing

# **User Management Events**

#### This dashboard shows information about User Management Events collected by winlogbeat

User  Management Events - Description [Windows System Security]

Users Created - Table [Windows System Security]

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Users Enabled - Table [Windows System Security]

Users Disabled - Table [Windows System Security]

Users Deleted - Table [Windows System Security]

Users Password Changes - Table [Windows System Security]

Unlocked Users - Table [Windows System Security]

Users Changes  Table [Windows System Security]

Users Locked Out - Table [Windows System Security]

Users Renamed - Table [Windows System Security]

[Windows Overview](#/dashboard/system-Windows-Dashboard) | [User Logon Information](#/dashboard/system-bae11b00-9bfc-11ea-87e4-49f31ec44891) |  [Logon Failed and Account Lockout](#/dashboard/system-d401ef40-a7d5-11e9-a422-d144027429da) | **User Management Events** | [Group Management Events](#/dashboard/system-bb858830-f412-11e9-8405-516218e3d268)

Dashboard links  [Windows System Security]

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Management Actions [Windows System Security]

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Event Actions - Table [Windows System Security]

Target Users [Windows System Security]

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Management Events - Affected Users vs Actions - Heatmap [Windows System Security]

logs-*

logs-*

Question: event.code: "4720"

TSVB visualization

logs-*

Question: event.code: "4722"

TSVB visualization

logs-*

Question: event.code: "4726"

TSVB visualization

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Event Distribution in time [Windows System Security]

logs-*

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4725")

TSVB visualization

logs-*

Question: event.code: "4767"

TSVB visualization

logs-*

Question: event.code: "4723"  OR event.code: "4724"

TSVB visualization

logs-*

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4740")

TSVB visualization

logs-*

Question: event.code: "4781"

TSVB visualization

logs-*

Question: event.code: "4738"

TSVB visualization

[System Windows Security] User Management Events


Question: Microsoft-Windows-Security-Auditing

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

3. Login Failed Details


Overview of host metrics

## Host overview

To select another host, either go back to [System Overview](#/dashboard/system-Metrics-system-overview) or select a host from the dropdown at the top below the search bar

System Navigation [Metrics System]

Question: system.network

Question: -system.network.name:l*

Outbound Traffic [Metrics System]

Question: system.cpu

Question: data_stream.dataset : "system.cpu"

CPU Usage Gauge [Metrics System]

Question: system.memory

Question: data_stream.dataset : "system.memory"

Memory Usage Gauge [Metrics System]

Question: system.load

Load Gauge [Metrics System]

Question: system.network

Question: -system.network.name:l*

Inbound Traffic [Metrics System]

Question: system.process

Question: system.memory

Question: data_stream.dataset : "system.memory"

Memory usage vs total [Metrics System]

Question: system.fsstat

Question: data_stream.dataset : "system.fsstat"

Disk Used [Metrics System]

### CPU

Question: system.process

Question: process.cpu.pct: *

Top Processes by CPU Usage

Question: system.cpu

Empty XY chart

CPU Usage

Question: system.load

System load

### Memory

Question: system.process

Question: system.process.memory.rss.pct: *

Top Processes by Memory Usage

subtract

average(system.memory.used.bytes) - average(system.memory.actual.used.bytes)

Question: system.memory

Memory usage

Question: system.memory

Question: data_stream.dataset : "system.memory"

Swap usage [Metrics System]

### Disk

Question: system.filesystem

Question: system.filesystem.used.pct: *

Top mountpoints by disk usage

Question: system.diskio

Question: data_stream.dataset : "system.diskio"

Disk IO

Question: system.fsstat

Question: data_stream.dataset : "system.fsstat"

Disk Used [Metrics System] (copy)

### Network

Question: system.network

Question: -system.network.name:l*

Inbound Traffic [Metrics System] (copy)

Question: system.network

Question: data_stream.dataset : "system.network"

Packetloss [Metrics System]

Question: system.network

Question: -system.network.name:l*

Outbound Traffic [Metrics System] (copy)

Question: system.network

Question: data_stream.dataset : "system.network"

Packetloss [Metrics System] (copy)

Question: -system.network.name:l*

params.rate != null && params.rate > 0 ? params.rate * -1 : null

Network Traffic (Packets)

Question: system.network

Question: -system.network.name:l*

Network Traffic (Bytes)

[Metrics System] Host overview


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Details - Search View [Windows System Security]


Syslog logs [Logs System]


Syslog dashboard from the Logs System integration

Dashboards [Logs System]

Syslog events by hostname [Logs System]

Syslog hostnames and processes [Logs System]

[Logs System] Syslog dashboard


Overview of system metrics

# System overview

To view host details, select a host from the list below by clicking the respective label.

System Navigation [Metrics System]

Question: system.memory

Question: system.cpu

Question: system.cpu

Top Hosts by CPU

Question: system.fsstat

Question: system.memory

Top Hosts by Memory

Question: system.cpu

Top Hosts by CPU Usage over time

Question: system.memory

Top Hosts by Memory Usage over time

[Metrics System] Overview


Overview of all Windows Event Logs.

## **Windows Overview**

User Logon Dashboard [Windows System Security]

Number of Events [Windows Overview]

Number of Events [Windows Overview]

**Windows Overview** | [User Logon Information](#/dashboard/system-bae11b00-9bfc-11ea-87e4-49f31ec44891) |  [Logon Failed and Account Lockout](#/dashboard/system-d401ef40-a7d5-11e9-a422-d144027429da) | [User Management Events](#/dashboard/system-71f720f0-ff18-11e9-8405-516218e3d268) | [Group Management Events](#/dashboard/system-bb858830-f412-11e9-8405-516218e3d268)

Number of Events Over Time By Channel [Windows Overview]

Sources (Provider Names) [Windows Overview]

Top Event IDs [Windows Overview]

Event Levels [Windows Overview]

[System] Windows Overview


Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

User Logons [Windows System Security]


User logon activity dashboard.

Question: Microsoft-Windows-Security-Auditing

Logged on Administrators [Windows System Security]

Administrator Users [Windows System Security]

## **Logon Information Dashboard**

Logon Details

[Windows Overview](#/dashboard/system-Windows-Dashboard) | **User Logon Information** | [Logon Failed and Account Lockout](#/dashboard/system-d401ef40-a7d5-11e9-a422-d144027429da) | [User Management Events](#/dashboard/system-71f720f0-ff18-11e9-8405-516218e3d268) | [Group Management Events](#/dashboard/system-bb858830-f412-11e9-8405-516218e3d268)

logs-*

logs-*

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4672")

TSVB visualization

logs-*

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4624")

TSVB visualization

logs-*

Question: event.code: "4672"

Question: event.code: "4624"

Logon Events Timeline

Logon Events Timeline

Logon Types  [Windows System Security]

Logon Types  [Windows System Security]

Logon Sources [Windows System Security]

RDP Reconnections and Desconnections

Logon with Explicit Credentials [Windows System Security]

Logout Details

[System Windows Security] User Logons


Group management activity.

Question: Microsoft-Windows-Security-Auditing

# **Group Management Events**

#### This dashboard shows information about Group Management Events collected by the Elastic Agent Windows integrations (System, Windows, Custom Windows Event Logs).

Group Management Events - Description [Windows System Security]

Groups Created - Table [Windows System Security]

Group Changes - Table [Windows System Security]

Groups Deleted - Table [Windows System Security]

Users Added - Table [Windows System Security]

Users Removed from Group - Table [Windows System Security]

Group Enumeration - Table [Windows System Security]

Logon Details  [Windows System Security]

Group Management Operations Details [Windows System Security]

[Windows Overview](#/dashboard/system-Windows-Dashboard) | [User Logon Information](#/dashboard/system-bae11b00-9bfc-11ea-87e4-49f31ec44891) | [Logon Failed and Account Lockout](#/dashboard/system-d401ef40-a7d5-11e9-a422-d144027429da) | [User Management Events](#/dashboard/system-71f720f0-ff18-11e9-8405-516218e3d268) | **Group Management Events**

Dashboard links  [Windows System Security]

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Events - Event Actions [Windows System Security]

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Events - Event Actions - Table [Windows System Security]

Group Management Events - Target Groups  [Windows System Security]

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Events - Groups vs Actions - Heatmap [Windows System Security]

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Group Management Action Distribution over Time [Windows System Security]

logs-*

Question: event.code:4731 OR event.code:4727 OR event.code:"4754" OR event.code:"4749" OR event.code:"4759"  OR event.code:"4744"  OR event.code:"4783"  OR event.code:"4790"

TSVB visualization

logs-*

Question: event.code:4735 OR event.code:4737 OR event.code:"4755" OR event.code:"4764"  OR event.code:"4750" OR event.code:"4760" OR event.code:"4745" OR event.code:"4784" OR event.code:"4791"

TSVB visualization

logs-*

Question: event.code:4734 OR event.code:4730 OR event.code:4758 OR event.code:4753  OR event.code:4763  OR event.code:4748  OR event.code:4789  OR event.code:4792

TSVB visualization

logs-*

Question: event.code:4731 OR event.code:4727 OR event.code:"4754" OR event.code:"4749" OR event.code:"4759"  OR event.code:"4744"  OR event.code:"4783"  OR event.code:"4790"

TSVB visualization

logs-*

Question: event.code:4733 OR  event.code:4729 OR event.code:4788 OR event.code:4786 OR event.code:4752 OR event.code:4762 OR event.code:4747

TSVB visualization

logs-*

TSVB visualization

[System Windows Security] Group Management Events


Failed and blocked accounts.

Question: Microsoft-Windows-Security-Auditing

### **Failed Logons and Account Lockouts**

Failed Logon and Account Lockout [Windows System Security]

Question: event.code: 4624

Question: event.code: 4625

Question: Microsoft-Windows-Security-Auditing

Logon Successful vs Failed [Windows System Security]

Question: data_stream.dataset:windows.security OR data_stream.dataset:system.security

Blocked Accounts Tag [Windows System Security]

Blocked Acoounts

Question: event.code: 4624

Question: event.code: 4625

Question: Microsoft-Windows-Security-Auditing

Logon Successful - Logon Failed Timeline [Windows System Security]

Logon Failed Acconts [Windows System Security]

Question: Microsoft-Windows-Security-Auditing

Failed Logon HeatMap [Windows System Security]

Logon Failed and Account Lockouts

Question: Microsoft-Windows-Security-Auditing

Logon Failed Table [Windows System Security]

[Windows Overview](#/dashboard/system-Windows-Dashboard) | [User Logon Information](#/dashboard/system-bae11b00-9bfc-11ea-87e4-49f31ec44891) | **Logon Failed and Account Lockout** | [User Management Events](#/dashboard/system-71f720f0-ff18-11e9-8405-516218e3d268) | [Group Management Events](#/dashboard/system-bb858830-f412-11e9-8405-516218e3d268)

Question: Microsoft-Windows-Security-Auditing

Logon Failed Source IPs

logs-*

Question: ((data_stream.dataset:windows.security OR data_stream.dataset:system.security) AND event.code: "4625")

TSVB visualization

logs-*

Question: event.code: "4740"

TSVB visualization

[System Windows Security] Failed and Blocked Accounts


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Details [Windows powershell]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Engine versions [Windows powershell]

Engine versions [Windows powershell]


Question: service

Question: service

Services [Metrics Windows]


Hosts [Metrics Windows]

Hosts [Metrics Windows]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset.windows.powershell_operational)

Unique engine versions [Windows powershell]


Unique Services [Metrics Windows]

Unique Services [Metrics Windows]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset.windows.powershell_operational)

Users [Windows powershell]

Users [Windows powershell]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset.windows.powershell_operational)

Total engine started [Windows powershell]

Question: event.code: 400


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset.windows.powershell_operational)

Top active hosts [Windows powershell]

Top active hosts [Windows powershell]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Total remote commands [Windows powershell]

Question: process.title:"ServerRemoteHost"


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Engine and Command started[Windows powershell]

Question: event.code: "400"

Question: event.code: "4105"

Count


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Total commands [Windows powershell]

Question: powershell.command.name: *

Total commands [Windows powershell]


Startup States [Metrics Windows]

Startup States [Metrics Windows]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Unique hosts [Windows powershell]

Unique hosts [Windows powershell]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Connected users [Windows powershell]

Connected users [Windows powershell]


Question: CommandInvocation

Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Top Invoked Commands [Windows powershell]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Started providers [Windows powershell]

Started providers [Windows powershell]


Non-zero Service Exit Codes [Metrics Windows]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Unique users [Windows powershell]

Unique users [Windows powershell]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Engine versions ran by host [Windows powershell]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Host processes [Windows powershell]

Host processes [Windows powershell]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Event type [Windows powershell]

Event type [Windows powershell]


Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

Event Levels [Windows powershell]

Event Levels [Windows powershell]


Overview dashboard for powershell integration.

Question: (data_stream.dataset:windows.powershell OR data_stream.dataset:windows.powershell_operational)

[Windows powershell] Overview


Service States [Metrics Windows]

Service States [Metrics Windows]


Overview of the Windows Service States

[Metrics Windows] Services