title: Title

title: Title

type: markdown

markdown:
![Image](https://stingar.security.duke.edu/files/2019/12/STINGARwoTHREAT.jpg)
### Threat Analysis (last 30 days)

type: visualization


@timestamp

type: date

type: string

type: number

type: boolean

title: stingar-*

type: index-pattern


title: Daily attack_counts by protocol

title: Daily attack_counts by protocol

type: histogram

color: #eee

type: category

position: bottom

type: linear

type: value

position: left

mode: normal

text: Count

show: true

mode: stacked

label: Count

legendPosition: right

style: full

pattern: YYYY-MM-DD

intervalESUnit: d

format: YYYY-MM-DD

label: @timestamp per day

aggType: count

otherBucketLabel: Other

missingBucketLabel: Missing

basePath: /kibana

label: protocol.keyword: Descending

aggType: terms

type: palette

type: count

schema: metric

type: terms

schema: group

order: desc

schema: segment

to: now

interval: d


title: Sensor Count

type: cardinality

schema: orderAgg

orderBy: custom

colorSchema: Green to Red

type: range

type: metric

title: Sensor Count


title: Total Attack Count

title: Total Attack Count

customLabel: Total Attack Count


title: Successful attack attempts

label: hp_data.credentials.success: Descending

text: Count

title: Successful attack attempts


title: protocol

type: search


description: Detected Threat with shell commands by Protocol

title: Threat Protocols Detected

customLabel: Threat Protocols Detected

label: Threat Protocols Detected

legendPosition: bottom

type: pie

legendDisplay: show

title: Threat Protocols Detected

type: visualization


store: appState

key: protocol

query: mssqld

type: phrase

title: SQL attack commands

title: SQL attack commands

type: table

totalFunc: sum

label: hp_data.commands.keyword: Descending

schema: bucket


type: exists

value: exists

title: loggedIn


title: ssh attack commands

direction: asc

title: ssh attack commands

label: Attacker shell commands

customLabel: Attacker shell commands


title: User Credentials

title: User Credentials

label: Attacker Login Credentials

customLabel: Attacker Login Credential


title: Attacker IPs

title: Attacker IPs

label: Most Popular Attacker's Source IP

customLabel: Most Popular Attacker's IP address

type: index-pattern


type: phrases

value: wget, curl, tftp, ftpget

params: wget curl tftp ftpget

title: Script Kiddies


title: default_dashboard

type: dashboard


title: stingar-*


title: sensor_dashboard