diff --git a/packages/aws/_dev/build/docs/README.md b/packages/aws/_dev/build/docs/README.md index 63fe4d5d745..ba138f8c8ef 100644 --- a/packages/aws/_dev/build/docs/README.md +++ b/packages/aws/_dev/build/docs/README.md @@ -30,20 +30,20 @@ The AWS integration uses different AWS API to bootstrap and collect metrics and Each of these APIs may generate extra charges on your AWS Account. Refer to [AWS Pricing](https://aws.amazon.com/pricing) for more information. -| AWS API Name | AWS API Count | Frequency | Datastream | -|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|----------------------| -| IAM ListAccountAliases | 1 | Once on startup | all | -| STS GetCallerIdentity | 1 | Once on startup | all | -| EC2 DescribeRegions | 1 | Once on startup | all | -| CloudWatch ListMetrics | Total number of results / ListMetrics max page size (500, based on [AWS API ListMetrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html) | Per region per collection period | metrics related only | -| CloudWatch GetMetricData | Total number of results / GetMetricData max page size (500, based on [AWS API GetMetricData](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html) | Per region per namespace per collection period | metrics related only | -| CloudWatch DescribeLogGroups | Total number of results / DescribeLogGroups max page size (50, based on [AWS API DescribeLogGroups](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html) | Per region per collection period | logs related only | -| CloudWatch FilterLogEvents | Total number of results / FilterLogEvents max page size (1MB or 10'0000 events, based on [AWS API FilterLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html) | Per log group per region per collection period | logs related only | -| CostExplorer GetCostAndUsage | Total number of results / GetCostAndUsage max page size (8192, based on [AWS API GetCostAndUsage](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.html) | Per CostExplorer Group Definition per region per collection period | AWS Billing | -| S3 ListObjectsV2 | Total number of results / ListObjectsV2 max page size (up to 1,000, based on [AWS API FilterLogEvents](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html) | Per bucket per region per collection period | logs related only | -| S3 GetObject | 1 | Per object per collection period | logs related only | -| SecurityHub GetFindings | Total number of results / GetFindings max page size ( 100, based on [AWS API GetFindings](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html) | Per region per collection period | AWS Security Hub | | -| SecurityHub GetInsights | Total number of results / GetInsights max page size ( 100, based on [AWS API GetInsights](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsights.html) | Per region per collection period | AWS Security Hub | | +| AWS API Name | AWS API Count | Frequency | Datastream | +|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|-----------------------| +| IAM ListAccountAliases | 1 | Once on startup | all | +| STS GetCallerIdentity | 1 | Once on startup | all | +| EC2 DescribeRegions | 1 | Once on startup | all | +| CloudWatch ListMetrics | Total number of results / ListMetrics max page size (500, based on [AWS API ListMetrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html) | Per region per collection period | metrics related only | +| CloudWatch GetMetricData | Total number of results / GetMetricData max page size (500, based on [AWS API GetMetricData](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html) | Per region per namespace per collection period | metrics related only | +| CloudWatch DescribeLogGroups | Total number of results / DescribeLogGroups max page size (50, based on [AWS API DescribeLogGroups](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html) | Per region per collection period | logs related only | +| CloudWatch FilterLogEvents | Total number of results / FilterLogEvents max page size (1MB or 10'0000 events, based on [AWS API FilterLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html) | Per log group per region per collection period | logs related only | +| CostExplorer GetCostAndUsage | Total number of results / GetCostAndUsage max page size (8192, based on [AWS API GetCostAndUsage](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.html) | Per CostExplorer Group Definition per region per collection period | AWS Billing | +| S3 ListObjectsV2 | Total number of results / ListObjectsV2 max page size (up to 1,000, based on [AWS API FilterLogEvents](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html) | Per bucket per region per collection period | logs related only | +| S3 GetObject | 1 | Per object per collection period | logs related only | +| SecurityHub GetFindings | Total number of results / GetFindings max page size ( 100, based on [AWS API GetFindings](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html) | Per region per collection period | AWS Security Hub CSPM | | +| SecurityHub GetInsights | Total number of results / GetInsights max page size ( 100, based on [AWS API GetInsights](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsights.html) | Per region per collection period | AWS Security Hub CSPM | | | SQS ReceiveMessage | 1 | Every 20s minimum (more frequent if messages are waiting) | logs related only (S3 notifications) | | SQS DeleteMessage | 1 | Once per received message | logs related only (S3 notifications) | | SQS ChangeMessageVisibility | 1 | When message processing exceeds 150s | logs related only (S3 notifications) | diff --git a/packages/aws/_dev/build/docs/securityhub.md b/packages/aws/_dev/build/docs/securityhub.md index 9e2f15fb14e..5972bd8d57f 100644 --- a/packages/aws/_dev/build/docs/securityhub.md +++ b/packages/aws/_dev/build/docs/securityhub.md @@ -1,6 +1,6 @@ -# Security Hub +# Security Hub CSPM -The [AWS Security Hub](https://docs.aws.amazon.com/securityhub/) integration collects and parses data from AWS Security Hub REST APIs. +The [AWS Security Hub CSPM](https://docs.aws.amazon.com/securityhub/) integration collects and parses data from AWS Security Hub REST APIs. **IMPORTANT: Extra AWS charges on API requests will be generated by this integration. Check [API Requests](https://www.elastic.co/docs/current/integrations/aws#api-requests) for more details.** diff --git a/packages/aws/changelog.yml b/packages/aws/changelog.yml index 1e8dabb8aa3..ed7dbfd0e74 100644 --- a/packages/aws/changelog.yml +++ b/packages/aws/changelog.yml @@ -1,4 +1,11 @@ # newer versions go on top +- version: "4.6.0" + changes: + - description: | + Rebrand AWS Security Hub as AWS Security Hub CSPM to align with the vendor's current branding. + This change does not impact existing functionalities. + type: enhancement + link: https://github.com/elastic/integrations/pull/16195 - version: "4.5.0" changes: - description: Prevent updating fleet health status to degraded when the HTTPJSON template value evaluation is empty. diff --git a/packages/aws/data_stream/securityhub_findings/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/securityhub_findings/elasticsearch/ingest_pipeline/default.yml index eaae6ea3bdf..0ee38df7a15 100644 --- a/packages/aws/data_stream/securityhub_findings/elasticsearch/ingest_pipeline/default.yml +++ b/packages/aws/data_stream/securityhub_findings/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,5 @@ --- -description: Pipeline for processing AWS Security Hub Findings logs. +description: Pipeline for processing AWS Security Hub CSPM Findings logs. processors: - remove: field: diff --git a/packages/aws/data_stream/securityhub_findings/manifest.yml b/packages/aws/data_stream/securityhub_findings/manifest.yml index e5839f4868e..0fd2700f3ef 100644 --- a/packages/aws/data_stream/securityhub_findings/manifest.yml +++ b/packages/aws/data_stream/securityhub_findings/manifest.yml @@ -1,15 +1,15 @@ -title: Collect AWS Security Hub Findings logs from AWS +title: Collect AWS Security Hub CSPM Findings logs from AWS type: logs streams: - input: httpjson - title: Collect AWS Security Hub Findings from AWS - description: Collect AWS Security Hub Findings from AWS. + title: Collect AWS Security Hub CSPM Findings from AWS + description: Collect AWS Security Hub CSPM Findings from AWS. template_path: httpjson.yml.hbs vars: - name: interval type: text title: Interval - description: Interval to fetch AWS Security Hub Findings from AWS. (Interval should be greater than 1 hour.) + description: Interval to fetch AWS Security Hub CSPM Findings from AWS. (Interval should be greater than 1 hour.) multi: false required: true show_user: true @@ -24,7 +24,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the AWS Security Hub Findings from AWS. (Initial Interval should be greater than 1 hour.) + description: How far back to pull the AWS Security Hub CSPM Findings from AWS. (Initial Interval should be greater than 1 hour.) default: 24h multi: false required: true diff --git a/packages/aws/data_stream/securityhub_findings_full_posture/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/securityhub_findings_full_posture/elasticsearch/ingest_pipeline/default.yml index e39e939619e..ea152008fce 100644 --- a/packages/aws/data_stream/securityhub_findings_full_posture/elasticsearch/ingest_pipeline/default.yml +++ b/packages/aws/data_stream/securityhub_findings_full_posture/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,5 @@ --- -description: Pipeline for processing AWS Security Hub Findings Full Posture logs. +description: Pipeline for processing AWS Security Hub CSPM Findings Full Posture logs. processors: - remove: field: diff --git a/packages/aws/data_stream/securityhub_findings_full_posture/manifest.yml b/packages/aws/data_stream/securityhub_findings_full_posture/manifest.yml index 7be8b690b32..c0f1a2cdd3f 100644 --- a/packages/aws/data_stream/securityhub_findings_full_posture/manifest.yml +++ b/packages/aws/data_stream/securityhub_findings_full_posture/manifest.yml @@ -1,9 +1,9 @@ -title: Collect AWS Security Hub Findings Full Posture logs from AWS +title: Collect AWS Security Hub CSPM Findings Full Posture logs from AWS type: logs streams: - input: httpjson - title: Collect AWS Security Hub Findings Full Posture from AWS - description: Collect AWS Security Hub Findings Full Posture from AWS. + title: Collect AWS Security Hub CSPM Findings Full Posture from AWS + description: Collect AWS Security Hub CSPM Findings Full Posture from AWS. template_path: httpjson.yml.hbs vars: - name: enable_request_tracer diff --git a/packages/aws/data_stream/securityhub_insights/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/securityhub_insights/elasticsearch/ingest_pipeline/default.yml index a8c129cdf37..e7ebfbed472 100644 --- a/packages/aws/data_stream/securityhub_insights/elasticsearch/ingest_pipeline/default.yml +++ b/packages/aws/data_stream/securityhub_insights/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,5 @@ --- -description: Pipeline for processing AWS Security Hub Insights logs. +description: Pipeline for processing AWS Security Hub CSPM Insights logs. processors: - remove: field: diff --git a/packages/aws/data_stream/securityhub_insights/manifest.yml b/packages/aws/data_stream/securityhub_insights/manifest.yml index 061692146cf..d8a4ef9f893 100644 --- a/packages/aws/data_stream/securityhub_insights/manifest.yml +++ b/packages/aws/data_stream/securityhub_insights/manifest.yml @@ -1,15 +1,15 @@ -title: Collect AWS Security Hub Insights logs from AWS +title: Collect AWS Security Hub CSPM Insights logs from AWS type: logs streams: - input: httpjson - title: Collect AWS Security Hub Insights from AWS - description: Collect AWS Security Hub Insights from AWS. + title: Collect AWS Security Hub CSPM Insights from AWS + description: Collect AWS Security Hub CSPM Insights from AWS. template_path: httpjson.yml.hbs vars: - name: interval type: text title: Interval - description: Interval to fetch AWS Security Hub Insights from AWS. + description: Interval to fetch AWS Security Hub CSPM Insights from AWS. multi: false required: true show_user: true diff --git a/packages/aws/docs/README.md b/packages/aws/docs/README.md index 71a3fd9b168..1d89ba80217 100644 --- a/packages/aws/docs/README.md +++ b/packages/aws/docs/README.md @@ -30,20 +30,20 @@ The AWS integration uses different AWS API to bootstrap and collect metrics and Each of these APIs may generate extra charges on your AWS Account. Refer to [AWS Pricing](https://aws.amazon.com/pricing) for more information. -| AWS API Name | AWS API Count | Frequency | Datastream | -|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|----------------------| -| IAM ListAccountAliases | 1 | Once on startup | all | -| STS GetCallerIdentity | 1 | Once on startup | all | -| EC2 DescribeRegions | 1 | Once on startup | all | -| CloudWatch ListMetrics | Total number of results / ListMetrics max page size (500, based on [AWS API ListMetrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html) | Per region per collection period | metrics related only | -| CloudWatch GetMetricData | Total number of results / GetMetricData max page size (500, based on [AWS API GetMetricData](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html) | Per region per namespace per collection period | metrics related only | -| CloudWatch DescribeLogGroups | Total number of results / DescribeLogGroups max page size (50, based on [AWS API DescribeLogGroups](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html) | Per region per collection period | logs related only | -| CloudWatch FilterLogEvents | Total number of results / FilterLogEvents max page size (1MB or 10'0000 events, based on [AWS API FilterLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html) | Per log group per region per collection period | logs related only | -| CostExplorer GetCostAndUsage | Total number of results / GetCostAndUsage max page size (8192, based on [AWS API GetCostAndUsage](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.html) | Per CostExplorer Group Definition per region per collection period | AWS Billing | -| S3 ListObjectsV2 | Total number of results / ListObjectsV2 max page size (up to 1,000, based on [AWS API FilterLogEvents](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html) | Per bucket per region per collection period | logs related only | -| S3 GetObject | 1 | Per object per collection period | logs related only | -| SecurityHub GetFindings | Total number of results / GetFindings max page size ( 100, based on [AWS API GetFindings](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html) | Per region per collection period | AWS Security Hub | | -| SecurityHub GetInsights | Total number of results / GetInsights max page size ( 100, based on [AWS API GetInsights](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsights.html) | Per region per collection period | AWS Security Hub | | +| AWS API Name | AWS API Count | Frequency | Datastream | +|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|-----------------------| +| IAM ListAccountAliases | 1 | Once on startup | all | +| STS GetCallerIdentity | 1 | Once on startup | all | +| EC2 DescribeRegions | 1 | Once on startup | all | +| CloudWatch ListMetrics | Total number of results / ListMetrics max page size (500, based on [AWS API ListMetrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html) | Per region per collection period | metrics related only | +| CloudWatch GetMetricData | Total number of results / GetMetricData max page size (500, based on [AWS API GetMetricData](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html) | Per region per namespace per collection period | metrics related only | +| CloudWatch DescribeLogGroups | Total number of results / DescribeLogGroups max page size (50, based on [AWS API DescribeLogGroups](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html) | Per region per collection period | logs related only | +| CloudWatch FilterLogEvents | Total number of results / FilterLogEvents max page size (1MB or 10'0000 events, based on [AWS API FilterLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html) | Per log group per region per collection period | logs related only | +| CostExplorer GetCostAndUsage | Total number of results / GetCostAndUsage max page size (8192, based on [AWS API GetCostAndUsage](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.html) | Per CostExplorer Group Definition per region per collection period | AWS Billing | +| S3 ListObjectsV2 | Total number of results / ListObjectsV2 max page size (up to 1,000, based on [AWS API FilterLogEvents](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html) | Per bucket per region per collection period | logs related only | +| S3 GetObject | 1 | Per object per collection period | logs related only | +| SecurityHub GetFindings | Total number of results / GetFindings max page size ( 100, based on [AWS API GetFindings](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html) | Per region per collection period | AWS Security Hub CSPM | | +| SecurityHub GetInsights | Total number of results / GetInsights max page size ( 100, based on [AWS API GetInsights](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsights.html) | Per region per collection period | AWS Security Hub CSPM | | | SQS ReceiveMessage | 1 | Every 20s minimum (more frequent if messages are waiting) | logs related only (S3 notifications) | | SQS DeleteMessage | 1 | Once per received message | logs related only (S3 notifications) | | SQS ChangeMessageVisibility | 1 | When message processing exceeds 150s | logs related only (S3 notifications) | diff --git a/packages/aws/docs/securityhub.md b/packages/aws/docs/securityhub.md index 2d91d5c36db..9963e977f46 100644 --- a/packages/aws/docs/securityhub.md +++ b/packages/aws/docs/securityhub.md @@ -1,6 +1,6 @@ -# Security Hub +# Security Hub CSPM -The [AWS Security Hub](https://docs.aws.amazon.com/securityhub/) integration collects and parses data from AWS Security Hub REST APIs. +The [AWS Security Hub CSPM](https://docs.aws.amazon.com/securityhub/) integration collects and parses data from AWS Security Hub REST APIs. **IMPORTANT: Extra AWS charges on API requests will be generated by this integration. Check [API Requests](https://www.elastic.co/docs/current/integrations/aws#api-requests) for more details.** diff --git a/packages/aws/elasticsearch/transform/latest_cdr_misconfigurations/transform.yml b/packages/aws/elasticsearch/transform/latest_cdr_misconfigurations/transform.yml index 6ebadb14d73..df24e54fc42 100644 --- a/packages/aws/elasticsearch/transform/latest_cdr_misconfigurations/transform.yml +++ b/packages/aws/elasticsearch/transform/latest_cdr_misconfigurations/transform.yml @@ -17,7 +17,7 @@ latest: - resource.id - data_stream.namespace sort: "@timestamp" -description: Latest SecurityHub Findings from AWS +description: Latest Security Hub CSPM Findings from AWS. frequency: 5m sync: time: diff --git a/packages/aws/img/logo_securityhub.svg b/packages/aws/img/logo_securityhub.svg index 0181a99cd10..b869adb6e7c 100644 --- a/packages/aws/img/logo_securityhub.svg +++ b/packages/aws/img/logo_securityhub.svg @@ -1,8 +1,18 @@ - - - - - - - + + + + Icon-Architecture/64/Arch_AWS-Security-Hub_64 + Created with Sketch. + + + + + + + + + + + + \ No newline at end of file diff --git a/packages/aws/img/securityhub-screenshot.png b/packages/aws/img/securityhub-screenshot.png deleted file mode 100644 index e711ede7dcc..00000000000 Binary files a/packages/aws/img/securityhub-screenshot.png and /dev/null differ diff --git a/packages/aws/img/securityhub_cspm_findings_insights_dashboard.png b/packages/aws/img/securityhub_cspm_findings_insights_dashboard.png new file mode 100644 index 00000000000..06be91df34b Binary files /dev/null and b/packages/aws/img/securityhub_cspm_findings_insights_dashboard.png differ diff --git a/packages/aws/img/securityhub_cspm_summary_dashboard.png b/packages/aws/img/securityhub_cspm_summary_dashboard.png new file mode 100644 index 00000000000..9a8f255a623 Binary files /dev/null and b/packages/aws/img/securityhub_cspm_summary_dashboard.png differ diff --git a/packages/aws/img/securityhub_summary_dashboard.png b/packages/aws/img/securityhub_summary_dashboard.png deleted file mode 100644 index 44789e6fa0b..00000000000 Binary files a/packages/aws/img/securityhub_summary_dashboard.png and /dev/null differ diff --git a/packages/aws/kibana/dashboard/aws-3d3dbe00-f79f-11ec-aa7f-c173c0f9e267.json b/packages/aws/kibana/dashboard/aws-3d3dbe00-f79f-11ec-aa7f-c173c0f9e267.json index 92348a6c34f..2f74bc3a5a5 100644 --- a/packages/aws/kibana/dashboard/aws-3d3dbe00-f79f-11ec-aa7f-c173c0f9e267.json +++ b/packages/aws/kibana/dashboard/aws-3d3dbe00-f79f-11ec-aa7f-c173c0f9e267.json @@ -64,7 +64,8 @@ "title": "", "type": "markdown", "uiState": {} - } + }, + "type": "visualization" }, "gridData": { "h": 4, @@ -76,14 +77,204 @@ "panelIndex": "c893ddac-d20f-4dd8-9223-ce8eebec350f", "title": "Dashboards [Logs AWS]", "type": "visualization", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { "attributes": { "description": "", - "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map\"},\"id\":\"01ebeac6-0c24-44c1-a59f-774292776002\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"joins\":[{\"leftField\":\"iso2\",\"right\":{\"type\":\"ES_TERM_SOURCE\",\"id\":\"39ac4104-7e4f-47fa-a965-035f9ea2d076\",\"indexPatternTitle\":\"logs-*\",\"term\":\"aws.securityhub_findings.action.aws_api_call.remote_ip.country.code\",\"metrics\":[{\"type\":\"count\"}],\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"indexPatternRefName\":\"layer_1_join_0_index_pattern\"}}],\"sourceDescriptor\":{\"type\":\"EMS_FILE\",\"id\":\"world_countries\",\"tooltipProperties\":[\"iso2\"]},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"__kbnjoin__count__39ac4104-7e4f-47fa-a965-035f9ea2d076\",\"origin\":\"join\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#3d3d3d\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"__kbnjoin__count__39ac4104-7e4f-47fa-a965-035f9ea2d076\",\"origin\":\"join\"}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"eaf2779b-e6e6-40d9-89d4-b3f04f536a25\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"GEOJSON_VECTOR\"}]", - "mapStateJSON": "{\"zoom\":1.06,\"center\":{\"lon\":0,\"lat\":19.94277},\"timeFilters\":{\"from\":\"now-7d/d\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"data_stream.dataset : \\\"aws.securityhub_findings\\\" \",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "layerListJSON": [ + { + "alpha": 1, + "id": "01ebeac6-0c24-44c1-a59f-774292776002", + "includeInFitToBounds": true, + "label": null, + "maxZoom": 24, + "minZoom": 0, + "sourceDescriptor": { + "isAutoSelect": true, + "lightModeDefault": "road_map", + "type": "EMS_TMS" + }, + "style": { + "type": "TILE" + }, + "type": "EMS_VECTOR_TILE", + "visible": true + }, + { + "alpha": 0.75, + "id": "eaf2779b-e6e6-40d9-89d4-b3f04f536a25", + "includeInFitToBounds": true, + "joins": [ + { + "leftField": "iso2", + "right": { + "applyForceRefresh": true, + "applyGlobalQuery": true, + "applyGlobalTime": true, + "id": "39ac4104-7e4f-47fa-a965-035f9ea2d076", + "indexPatternRefName": "layer_1_join_0_index_pattern", + "indexPatternTitle": "logs-*", + "metrics": [ + { + "type": "count" + } + ], + "term": "aws.securityhub_findings.action.aws_api_call.remote_ip.country.code", + "type": "ES_TERM_SOURCE" + } + } + ], + "label": null, + "maxZoom": 24, + "minZoom": 0, + "sourceDescriptor": { + "id": "world_countries", + "tooltipProperties": [ + "iso2" + ], + "type": "EMS_FILE" + }, + "style": { + "isTimeAware": true, + "properties": { + "fillColor": { + "options": { + "color": "Yellow to Red", + "colorCategory": "palette_0", + "field": { + "name": "__kbnjoin__count__39ac4104-7e4f-47fa-a965-035f9ea2d076", + "origin": "join" + }, + "fieldMetaOptions": { + "isEnabled": true, + "sigma": 3 + }, + "type": "ORDINAL" + }, + "type": "DYNAMIC" + }, + "icon": { + "options": { + "value": "marker" + }, + "type": "STATIC" + }, + "iconOrientation": { + "options": { + "orientation": 0 + }, + "type": "STATIC" + }, + "iconSize": { + "options": { + "size": 6 + }, + "type": "STATIC" + }, + "labelBorderColor": { + "options": { + "color": "#FFFFFF" + }, + "type": "STATIC" + }, + "labelBorderSize": { + "options": { + "size": "SMALL" + } + }, + "labelColor": { + "options": { + "color": "#000000" + }, + "type": "STATIC" + }, + "labelSize": { + "options": { + "size": 14 + }, + "type": "STATIC" + }, + "labelText": { + "options": { + "field": { + "name": "__kbnjoin__count__39ac4104-7e4f-47fa-a965-035f9ea2d076", + "origin": "join" + } + }, + "type": "DYNAMIC" + }, + "lineColor": { + "options": { + "color": "#3d3d3d" + }, + "type": "STATIC" + }, + "lineWidth": { + "options": { + "size": 1 + }, + "type": "STATIC" + }, + "symbolizeAs": { + "options": { + "value": "circle" + } + } + }, + "type": "VECTOR" + }, + "type": "GEOJSON_VECTOR", + "visible": true + } + ], + "mapStateJSON": { + "center": { + "lat": 19.94277, + "lon": 0 + }, + "filters": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" " + }, + "refreshConfig": { + "interval": 0, + "isPaused": true + }, + "settings": { + "autoFitToDataBounds": false, + "backgroundColor": "#ffffff", + "browserLocation": { + "zoom": 2 + }, + "disableInteractive": false, + "disableTooltipControl": false, + "fixedLocation": { + "lat": 0, + "lon": 0, + "zoom": 2 + }, + "hideLayerControl": false, + "hideToolbarOverlay": false, + "hideViewControl": false, + "initialLocation": "LAST_SAVED_LOCATION", + "maxZoom": 24, + "minZoom": 0, + "showScaleControl": false, + "showSpatialFilters": true, + "showTimesliderToggleButton": true, + "spatialFiltersAlpa": 0.3, + "spatialFiltersFillColor": "#DA8B45", + "spatialFiltersLineColor": "#DA8B45" + }, + "timeFilters": { + "from": "now-7d/d", + "to": "now" + }, + "zoom": 1.06 + }, "references": [ { "id": "logs-*", @@ -92,7 +283,10 @@ } ], "title": "AWS API Call by Countries [Logs AWS]", - "uiStateJSON": "{\"isLayerTOCOpen\":false,\"openTOCDetails\":[]}" + "uiStateJSON": { + "isLayerTOCOpen": false, + "openTOCDetails": [] + } }, "enhancements": {}, "hiddenLayers": [], @@ -108,7 +302,8 @@ "lon": 0, "zoom": 1.06 }, - "openTOCDetails": [] + "openTOCDetails": [], + "type": "map" }, "gridData": { "h": 20, @@ -119,14 +314,204 @@ }, "panelIndex": "a170a10e-e4e0-4ea6-8562-336df9f46e2f", "type": "map", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { "attributes": { "description": "", - "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map\"},\"id\":\"08cfbaf0-8c92-472f-9728-8bce4e663334\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"joins\":[{\"leftField\":\"iso2\",\"right\":{\"type\":\"ES_TERM_SOURCE\",\"id\":\"8c509e4c-57b1-4bde-9617-b0159ece3c86\",\"indexPatternTitle\":\"logs-*\",\"term\":\"aws.securityhub_findings.action.network_connection.remote_ip.country.code\",\"metrics\":[{\"type\":\"count\"}],\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"indexPatternRefName\":\"layer_1_join_0_index_pattern\"}}],\"sourceDescriptor\":{\"type\":\"EMS_FILE\",\"id\":\"world_countries\",\"tooltipProperties\":[\"iso2\"]},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"__kbnjoin__count__8c509e4c-57b1-4bde-9617-b0159ece3c86\",\"origin\":\"join\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#3d3d3d\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"__kbnjoin__count__8c509e4c-57b1-4bde-9617-b0159ece3c86\",\"origin\":\"join\"}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"f158a7b9-474b-4846-8b59-bbfea4728396\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"GEOJSON_VECTOR\"}]", - "mapStateJSON": "{\"zoom\":1.33,\"center\":{\"lon\":13.80026,\"lat\":14.52408},\"timeFilters\":{\"from\":\"now-7d/d\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"data_stream.dataset : \\\"aws.securityhub_findings\\\" \",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "layerListJSON": [ + { + "alpha": 1, + "id": "08cfbaf0-8c92-472f-9728-8bce4e663334", + "includeInFitToBounds": true, + "label": null, + "maxZoom": 24, + "minZoom": 0, + "sourceDescriptor": { + "isAutoSelect": true, + "lightModeDefault": "road_map", + "type": "EMS_TMS" + }, + "style": { + "type": "TILE" + }, + "type": "EMS_VECTOR_TILE", + "visible": true + }, + { + "alpha": 0.75, + "id": "f158a7b9-474b-4846-8b59-bbfea4728396", + "includeInFitToBounds": true, + "joins": [ + { + "leftField": "iso2", + "right": { + "applyForceRefresh": true, + "applyGlobalQuery": true, + "applyGlobalTime": true, + "id": "8c509e4c-57b1-4bde-9617-b0159ece3c86", + "indexPatternRefName": "layer_1_join_0_index_pattern", + "indexPatternTitle": "logs-*", + "metrics": [ + { + "type": "count" + } + ], + "term": "aws.securityhub_findings.action.network_connection.remote_ip.country.code", + "type": "ES_TERM_SOURCE" + } + } + ], + "label": null, + "maxZoom": 24, + "minZoom": 0, + "sourceDescriptor": { + "id": "world_countries", + "tooltipProperties": [ + "iso2" + ], + "type": "EMS_FILE" + }, + "style": { + "isTimeAware": true, + "properties": { + "fillColor": { + "options": { + "color": "Yellow to Red", + "colorCategory": "palette_0", + "field": { + "name": "__kbnjoin__count__8c509e4c-57b1-4bde-9617-b0159ece3c86", + "origin": "join" + }, + "fieldMetaOptions": { + "isEnabled": true, + "sigma": 3 + }, + "type": "ORDINAL" + }, + "type": "DYNAMIC" + }, + "icon": { + "options": { + "value": "marker" + }, + "type": "STATIC" + }, + "iconOrientation": { + "options": { + "orientation": 0 + }, + "type": "STATIC" + }, + "iconSize": { + "options": { + "size": 6 + }, + "type": "STATIC" + }, + "labelBorderColor": { + "options": { + "color": "#FFFFFF" + }, + "type": "STATIC" + }, + "labelBorderSize": { + "options": { + "size": "SMALL" + } + }, + "labelColor": { + "options": { + "color": "#000000" + }, + "type": "STATIC" + }, + "labelSize": { + "options": { + "size": 14 + }, + "type": "STATIC" + }, + "labelText": { + "options": { + "field": { + "name": "__kbnjoin__count__8c509e4c-57b1-4bde-9617-b0159ece3c86", + "origin": "join" + } + }, + "type": "DYNAMIC" + }, + "lineColor": { + "options": { + "color": "#3d3d3d" + }, + "type": "STATIC" + }, + "lineWidth": { + "options": { + "size": 1 + }, + "type": "STATIC" + }, + "symbolizeAs": { + "options": { + "value": "circle" + } + } + }, + "type": "VECTOR" + }, + "type": "GEOJSON_VECTOR", + "visible": true + } + ], + "mapStateJSON": { + "center": { + "lat": 14.52408, + "lon": 13.80026 + }, + "filters": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" " + }, + "refreshConfig": { + "interval": 0, + "isPaused": true + }, + "settings": { + "autoFitToDataBounds": false, + "backgroundColor": "#ffffff", + "browserLocation": { + "zoom": 2 + }, + "disableInteractive": false, + "disableTooltipControl": false, + "fixedLocation": { + "lat": 0, + "lon": 0, + "zoom": 2 + }, + "hideLayerControl": false, + "hideToolbarOverlay": false, + "hideViewControl": false, + "initialLocation": "LAST_SAVED_LOCATION", + "maxZoom": 24, + "minZoom": 0, + "showScaleControl": false, + "showSpatialFilters": true, + "showTimesliderToggleButton": true, + "spatialFiltersAlpa": 0.3, + "spatialFiltersFillColor": "#DA8B45", + "spatialFiltersLineColor": "#DA8B45" + }, + "timeFilters": { + "from": "now-7d/d", + "to": "now" + }, + "zoom": 1.33 + }, "references": [ { "id": "logs-*", @@ -135,7 +520,10 @@ } ], "title": "Network Connection by Countries [Logs AWS]", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + "uiStateJSON": { + "isLayerTOCOpen": true, + "openTOCDetails": [] + } }, "enhancements": {}, "hiddenLayers": [], @@ -151,7 +539,8 @@ "lon": 0, "zoom": 1.06 }, - "openTOCDetails": [] + "openTOCDetails": [], + "type": "map" }, "gridData": { "h": 21, @@ -162,7 +551,7 @@ }, "panelIndex": "d5eeb926-44de-424a-adff-b842fed487f1", "type": "map", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -181,7 +570,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1d4e4b9a-eafe-4c08-8a88-4ee56a5f196d": { "columnOrder": [ @@ -232,16 +621,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "9d4fb7b1-f33f-4818-bed0-7e432f3f757b" - ], "layerId": "1d4e4b9a-eafe-4c08-8a88-4ee56a5f196d", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "2c42f7b4-d1de-4da0-b480-7b84e51df812", + "metrics": [ + "2c42f7b4-d1de-4da0-b480-7b84e51df812" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "9d4fb7b1-f33f-4818-bed0-7e432f3f757b" + ] } ], "shape": "pie" @@ -250,7 +641,8 @@ "title": "Distribution of Events by Action Type [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -261,7 +653,7 @@ }, "panelIndex": "ea83392c-bf61-452b-a925-da53a605f15e", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -280,7 +672,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a95d4f74-a7e0-4bc7-a9aa-b368816e2ce6": { "columnOrder": [ @@ -331,16 +723,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "ac5884ec-c3fa-4b6e-a4af-e49794e71472" - ], "layerId": "a95d4f74-a7e0-4bc7-a9aa-b368816e2ce6", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "5b765bda-f376-4403-8809-8896c3e6bd21", + "metrics": [ + "5b765bda-f376-4403-8809-8896c3e6bd21" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "ac5884ec-c3fa-4b6e-a4af-e49794e71472" + ] } ], "shape": "pie" @@ -349,7 +743,8 @@ "title": "Distribution of Events by Network Connection Direction [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -360,7 +755,7 @@ }, "panelIndex": "058d0f04-1686-4516-80f2-1a83851ea96e", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -379,7 +774,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "edff9217-fdd3-400b-badf-89f37350f168": { "columnOrder": [ @@ -479,7 +874,8 @@ "title": "Distribution of Events by AWS API Call Action Service Name [Logs AWS]", "visualizationType": "lnsXY" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -490,7 +886,7 @@ }, "panelIndex": "bd8c282c-17ad-4104-8fec-bb9581748919", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -509,7 +905,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7bf878d9-be2e-4436-b1b0-14411b106a14": { "columnOrder": [ @@ -560,16 +956,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "b67d6fee-3664-4292-95db-10d5f740c5d0" - ], "layerId": "7bf878d9-be2e-4436-b1b0-14411b106a14", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "ad38b778-54c1-4ec8-b50f-0467530d75ef", + "metrics": [ + "ad38b778-54c1-4ec8-b50f-0467530d75ef" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "b67d6fee-3664-4292-95db-10d5f740c5d0" + ] } ], "shape": "pie" @@ -578,7 +976,8 @@ "title": "Distribution of Events by DNS Request Blocked [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -589,7 +988,7 @@ }, "panelIndex": "54045abd-664a-46da-8e75-c1b52460eda3", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -608,7 +1007,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "afe9f1d1-b684-48fb-9be7-d916f7c8ad82": { "columnOrder": [ @@ -659,16 +1058,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "c9f9b29b-9d9d-4472-8fa9-6a18da0f13d5" - ], "layerId": "afe9f1d1-b684-48fb-9be7-d916f7c8ad82", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "8806c732-d4db-45e0-a14b-c73f8efbc513", + "metrics": [ + "8806c732-d4db-45e0-a14b-c73f8efbc513" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "c9f9b29b-9d9d-4472-8fa9-6a18da0f13d5" + ] } ], "shape": "pie" @@ -677,7 +1078,8 @@ "title": "Distribution of Events by Port Probe Blocked [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -688,7 +1090,7 @@ }, "panelIndex": "1a7df8c6-6da8-451d-a2cf-36cadce30b36", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -707,7 +1109,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "bc5ed209-d33a-4368-8e12-f481b4ed358d": { "columnOrder": [ @@ -758,16 +1160,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "6bd9b2ee-81b5-4cb7-9022-298d885f1d98" - ], "layerId": "bc5ed209-d33a-4368-8e12-f481b4ed358d", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "2c535e6a-760b-44d4-8060-0b742c9dd26e", + "metrics": [ + "2c535e6a-760b-44d4-8060-0b742c9dd26e" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "6bd9b2ee-81b5-4cb7-9022-298d885f1d98" + ] } ], "shape": "pie" @@ -776,7 +1180,8 @@ "title": "Distribution of Events by Network Connection Action Blocked [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -787,7 +1192,7 @@ }, "panelIndex": "ec4c18fe-7102-4ce9-92ad-810a834e3e63", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -806,7 +1211,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cd1ff007-7eb1-4c71-a626-ea5ad9fcb0ba": { "columnOrder": [ @@ -857,16 +1262,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "73da44f6-de88-4c64-b0e6-bccf0117127a" - ], "layerId": "cd1ff007-7eb1-4c71-a626-ea5ad9fcb0ba", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "b1b4bb34-c135-4e33-8d0e-3db33c4eaaf4", + "metrics": [ + "b1b4bb34-c135-4e33-8d0e-3db33c4eaaf4" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "73da44f6-de88-4c64-b0e6-bccf0117127a" + ] } ], "shape": "pie" @@ -875,7 +1282,8 @@ "title": "Distribution of Events by AWS API Call Caller Type [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -886,7 +1294,7 @@ }, "panelIndex": "a0109b78-7c58-4956-8d61-12fa00bd53f7", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -905,7 +1313,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f61b43c4-a565-45fc-b2fc-48b276c32f13": { "columnOrder": [ @@ -970,7 +1378,8 @@ "title": "Top 10 DNS Request Domain [Logs AWS]", "visualizationType": "lnsDatatable" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -981,7 +1390,7 @@ }, "panelIndex": "46b72e3d-9471-4b3c-8509-bdd8fb4c989c", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -1000,7 +1409,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "78886a7e-623a-4494-9ea1-c5fe1bc95184": { "columnOrder": [ @@ -1051,16 +1460,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "5307171c-ada8-477c-b851-6a81b6df6843" - ], "layerId": "78886a7e-623a-4494-9ea1-c5fe1bc95184", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "02b5ef7f-40e2-47ca-a312-90d247faf0f4", + "metrics": [ + "02b5ef7f-40e2-47ca-a312-90d247faf0f4" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "5307171c-ada8-477c-b851-6a81b6df6843" + ] } ], "shape": "pie" @@ -1069,7 +1480,8 @@ "title": "Distribution of Events by DNS Request Protocol [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -1080,18 +1492,16 @@ }, "panelIndex": "dc7a8f88-82e6-4fdd-a567-1feae710b3aa", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" } ], "timeRestore": false, - "title": "[Logs AWS] Security Hub Findings Action", + "title": "[Logs AWS] Security Hub CSPM Findings Action", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.8.0", + "created_at": "2025-12-02T10:22:57.864Z", "id": "aws-3d3dbe00-f79f-11ec-aa7f-c173c0f9e267", - "migrationVersion": { - "dashboard": "8.4.0" - }, "references": [ { "id": "logs-*", @@ -1197,7 +1607,13 @@ "id": "logs-*", "name": "dc7a8f88-82e6-4fdd-a567-1feae710b3aa:indexpattern-datasource-layer-78886a7e-623a-4494-9ea1-c5fe1bc95184", "type": "index-pattern" + }, + { + "id": "aws-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" } ], - "type": "dashboard" + "type": "dashboard", + "typeMigrationVersion": "10.3.0" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-8fcf4c20-f7a3-11ec-aa7f-c173c0f9e267.json b/packages/aws/kibana/dashboard/aws-8fcf4c20-f7a3-11ec-aa7f-c173c0f9e267.json index 305a665d160..9d0e62007fd 100644 --- a/packages/aws/kibana/dashboard/aws-8fcf4c20-f7a3-11ec-aa7f-c173c0f9e267.json +++ b/packages/aws/kibana/dashboard/aws-8fcf4c20-f7a3-11ec-aa7f-c173c0f9e267.json @@ -64,7 +64,8 @@ "title": "", "type": "markdown", "uiState": {} - } + }, + "type": "visualization" }, "gridData": { "h": 4, @@ -76,7 +77,7 @@ "panelIndex": "33863c95-e6d3-4329-9542-6e9217835667", "title": "Dashboards [Logs AWS]", "type": "visualization", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -95,7 +96,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "97ae45f9-914d-400a-a0ff-a552929da066": { "columnOrder": [ @@ -146,16 +147,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "197371a3-1954-4de8-8cfc-23d0a50d6397" - ], "layerId": "97ae45f9-914d-400a-a0ff-a552929da066", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "0d3af6a4-596e-4883-aeee-f44a2b42837b", + "metrics": [ + "0d3af6a4-596e-4883-aeee-f44a2b42837b" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "197371a3-1954-4de8-8cfc-23d0a50d6397" + ] } ], "shape": "pie" @@ -164,7 +167,8 @@ "title": "Distribution of Events by Malware Type [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -175,7 +179,7 @@ }, "panelIndex": "69aa2695-1a0d-4880-a442-78b49526c18f", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -194,7 +198,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ec821de0-e8d0-46f4-8e63-1388b7c57265": { "columnOrder": [ @@ -245,16 +249,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "07ec2df6-4405-4d5b-9eba-0e06202a1d06" - ], "layerId": "ec821de0-e8d0-46f4-8e63-1388b7c57265", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "4f0675c0-0d2b-4e6c-b51f-385a8d21cae7", + "metrics": [ + "4f0675c0-0d2b-4e6c-b51f-385a8d21cae7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "07ec2df6-4405-4d5b-9eba-0e06202a1d06" + ] } ], "shape": "pie" @@ -263,7 +269,8 @@ "title": "Distribution of Events by Malware Name [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -274,7 +281,7 @@ }, "panelIndex": "6837f195-98b9-4779-b57f-9c5e07ff792a", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -293,7 +300,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ec5625d1-6a47-4ead-a7c4-6e369d0fb4e7": { "columnOrder": [ @@ -393,7 +400,8 @@ "title": "Distribution of Events by Malware State [Logs AWS]", "visualizationType": "lnsXY" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -404,7 +412,7 @@ }, "panelIndex": "52ad6981-7a3f-4e9c-af24-518e29ffe56d", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -423,7 +431,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8eb34878-735f-482c-b58b-0bcfd9f11ed1": { "columnOrder": [ @@ -474,16 +482,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "0bd238d4-8fa8-46cf-8a18-c69c7c8ee1ea" - ], "layerId": "8eb34878-735f-482c-b58b-0bcfd9f11ed1", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "9591a475-adab-45fc-892a-911080cd07a7", + "metrics": [ + "9591a475-adab-45fc-892a-911080cd07a7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "0bd238d4-8fa8-46cf-8a18-c69c7c8ee1ea" + ] } ], "shape": "pie" @@ -492,7 +502,8 @@ "title": "Distribution of Events by Network Path Component Type [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -503,7 +514,7 @@ }, "panelIndex": "5cd7295e-838e-4f5c-80de-a9dd230c526c", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -522,7 +533,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4a40b1d8-5f8b-442d-a352-5bf66b4f364f": { "columnOrder": [ @@ -587,7 +598,8 @@ "title": "Top 10 Ingress Protocol [Logs AWS]", "visualizationType": "lnsDatatable" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -598,7 +610,7 @@ }, "panelIndex": "56982ba0-3da7-46bc-8ce6-61c1bb1e0820", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -617,7 +629,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6ef8ab89-3684-480c-af93-3fad3b718174": { "columnOrder": [ @@ -682,7 +694,8 @@ "title": "Top 10 Egress Protocol [Logs AWS]", "visualizationType": "lnsDatatable" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -693,7 +706,7 @@ }, "panelIndex": "2b7f73cd-2ada-421b-84a5-35d2982c3e1d", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -712,7 +725,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3a11fcb2-1821-437a-91ef-48d8338f7ba2": { "columnOrder": [ @@ -763,16 +776,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "ef7d92b1-db24-49eb-adaa-a05684e881a1" - ], "layerId": "3a11fcb2-1821-437a-91ef-48d8338f7ba2", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "67719af2-f662-4ffd-91d2-f875af400840", + "metrics": [ + "67719af2-f662-4ffd-91d2-f875af400840" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "ef7d92b1-db24-49eb-adaa-a05684e881a1" + ] } ], "shape": "pie" @@ -781,7 +796,8 @@ "title": "Distribution of Events by Threat Intelligence Indicator Type [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -792,7 +808,7 @@ }, "panelIndex": "2c62f9a1-c269-4a3b-b62d-526c2e174a6c", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -811,7 +827,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "5f1e82af-15cf-4d2c-aff7-447ac521d7f8": { "columnOrder": [ @@ -862,16 +878,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "bc1e8902-547d-4243-a66d-36067c1507e3" - ], "layerId": "5f1e82af-15cf-4d2c-aff7-447ac521d7f8", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "248d6591-7c85-4edd-aaa6-cd0242a86384", + "metrics": [ + "248d6591-7c85-4edd-aaa6-cd0242a86384" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "bc1e8902-547d-4243-a66d-36067c1507e3" + ] } ], "shape": "pie" @@ -880,7 +898,8 @@ "title": "Distribution of Events by Threat Intelligence Indicator Source [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -891,7 +910,7 @@ }, "panelIndex": "00a582c1-01a0-4e9f-817e-b79a7937c42c", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -910,7 +929,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "fae68851-ba41-4905-ac89-ca3c4a38e39f": { "columnOrder": [ @@ -961,16 +980,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "6a71130a-c336-4454-8f15-83fde3a5e0a8" - ], "layerId": "fae68851-ba41-4905-ac89-ca3c4a38e39f", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "115799f5-6e44-4786-ad84-90989e5274a7", + "metrics": [ + "115799f5-6e44-4786-ad84-90989e5274a7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "6a71130a-c336-4454-8f15-83fde3a5e0a8" + ] } ], "shape": "pie" @@ -979,7 +1000,8 @@ "title": "Distribution of Events by Threat Intelligence Indicator Category [Logs AWS]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -990,18 +1012,16 @@ }, "panelIndex": "97fc0cf4-15d3-4e5c-a1a5-943fc892b0c4", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" } ], "timeRestore": false, - "title": "[Logs AWS] Security Hub Findings Malware, Threat Intelligence Indicator and Network Path", + "title": "[Logs AWS] Security Hub CSPM Findings Malware, Threat Intelligence Indicator and Network Path", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.8.0", + "created_at": "2025-12-02T10:23:02.872Z", "id": "aws-8fcf4c20-f7a3-11ec-aa7f-c173c0f9e267", - "migrationVersion": { - "dashboard": "8.4.0" - }, "references": [ { "id": "logs-*", @@ -1092,7 +1112,13 @@ "id": "logs-*", "name": "97fc0cf4-15d3-4e5c-a1a5-943fc892b0c4:indexpattern-datasource-layer-fae68851-ba41-4905-ac89-ca3c4a38e39f", "type": "index-pattern" + }, + { + "id": "aws-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" } ], - "type": "dashboard" + "type": "dashboard", + "typeMigrationVersion": "10.3.0" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30.json b/packages/aws/kibana/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30.json index 86811cef4d2..c37958d14f2 100644 --- a/packages/aws/kibana/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30.json +++ b/packages/aws/kibana/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30.json @@ -12,10 +12,16 @@ "panelsJSON": { "c819da49-49e8-4460-8329-8521d7f8ac8a": { "explicitInput": { - "enhancements": {}, + "dataViewId": "logs-*", + "exclude": false, + "existsSelected": false, "fieldName": "cloud.account.id", - "id": "c819da49-49e8-4460-8329-8521d7f8ac8a", + "searchTechnique": "prefix", "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, "title": "Account" }, "grow": true, @@ -25,10 +31,16 @@ }, "d620f0d7-381f-456f-8660-a6e6838e34fc": { "explicitInput": { - "enhancements": {}, + "dataViewId": "logs-*", + "exclude": false, + "existsSelected": false, "fieldName": "data_stream.dataset", - "id": "d620f0d7-381f-456f-8660-a6e6838e34fc", + "searchTechnique": "prefix", "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, "title": "Integrations" }, "grow": true, @@ -38,10 +50,16 @@ }, "f7d8c037-280e-4387-84e2-fa76ee6124da": { "explicitInput": { - "enhancements": {}, + "dataViewId": "logs-*", + "exclude": false, + "existsSelected": false, "fieldName": "aws.securityhub_findings.region", - "id": "f7d8c037-280e-4387-84e2-fa76ee6124da", + "searchTechnique": "prefix", "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, "title": "Region" }, "grow": true, @@ -115,7 +133,8 @@ "title": "", "type": "markdown", "uiState": {} - } + }, + "title": "Dashboards [Logs AWS]" }, "gridData": { "h": 4, @@ -125,12 +144,15 @@ "y": 0 }, "panelIndex": "d5280fe0-536d-45b0-87c4-1fb9c41065fd", - "title": "Dashboards [Logs AWS]", "type": "visualization" }, { "embeddableConfig": { - "enhancements": {}, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, "savedVis": { "data": { "aggs": [], @@ -143,10 +165,9 @@ } }, "description": "", - "id": "", "params": { "fontSize": 12, - "markdown": "# AWS Security Hub Finding summary", + "markdown": "# AWS Security Hub CSPM Finding summary", "openLinksInNewTab": false }, "title": "", @@ -254,7 +275,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Distribution of Events by Account [Logs AWS]" }, "gridData": { "h": 15, @@ -264,7 +286,6 @@ "y": 7 }, "panelIndex": "146c2ac6-d83d-4fcb-808a-d24c2762f45c", - "title": "Distribution of Events by Account [Logs AWS]", "type": "lens" }, { @@ -359,7 +380,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Distribution of Events by Region [Logs AWS]" }, "gridData": { "h": 15, @@ -369,7 +391,6 @@ "y": 7 }, "panelIndex": "2aeb6bda-8e7f-40bf-a8b3-ea8fdee8dea7", - "title": "Distribution of Events by Region [Logs AWS]", "type": "lens" }, { @@ -428,7 +449,8 @@ "visualizationType": "lnsMetric" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Events with Successful Findings [Logs AWS]" }, "gridData": { "h": 7, @@ -438,7 +460,6 @@ "y": 22 }, "panelIndex": "996217a3-e617-4b6a-b40a-89a521d588dc", - "title": "Events with Successful Findings [Logs AWS]", "type": "lens" }, { @@ -536,7 +557,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Distribution of Events by AWS Service [Logs AWS]" }, "gridData": { "h": 15, @@ -546,7 +568,6 @@ "y": 22 }, "panelIndex": "4de4ac27-d439-4131-81f2-f6f9fcd10387", - "title": "Distribution of Events by AWS Service [Logs AWS]", "type": "lens" }, { @@ -673,7 +694,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Top Rules Contributing to Findings [Logs AWS]" }, "gridData": { "h": 15, @@ -683,7 +705,6 @@ "y": 22 }, "panelIndex": "69a42735-8625-4f93-af73-09fc337b6bb1", - "title": "Top Rules Contributing to Findings [Logs AWS]", "type": "lens" }, { @@ -742,7 +763,8 @@ "visualizationType": "lnsMetric" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Events with Failure Findings [Logs AWS]" }, "gridData": { "h": 8, @@ -752,7 +774,6 @@ "y": 29 }, "panelIndex": "7419d896-5a39-461c-a72d-09734cc6d67e", - "title": "Events with Failure Findings [Logs AWS]", "type": "lens" }, { @@ -832,7 +853,8 @@ "visualizationType": "lnsMetric" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Count by Severity [Logs AWS]" }, "gridData": { "h": 8, @@ -842,7 +864,6 @@ "y": 37 }, "panelIndex": "7a319626-d1c2-4728-9611-3bbea3c850d4", - "title": "Count by Severity [Logs AWS]", "type": "lens" }, { @@ -1059,7 +1080,8 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Distribution of Finding's Severity Over Time [Logs AWS]" }, "gridData": { "h": 9, @@ -1069,7 +1091,6 @@ "y": 45 }, "panelIndex": "7c5505a3-f4e0-43af-8e25-260e9e7e8473", - "title": "Distribution of Finding's Severity Over Time [Logs AWS]", "type": "lens" }, { @@ -1172,8 +1193,21 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": {}, - "hidePanelTitles": false + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "hidePanelTitles": false, + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "title": "Security Hub CSPM - Affected Instance ID [Logs AWS]" }, "gridData": { "h": 8, @@ -1183,7 +1217,6 @@ "y": 54 }, "panelIndex": "d296bb5b-a63d-4931-84aa-d3a2d0fa754d", - "title": "Security Hub - Affected Instance ID [Logs AWS]", "type": "lens" }, { @@ -1317,8 +1350,21 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": {}, - "hidePanelTitles": false + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "hidePanelTitles": false, + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "title": "Security Hub CSPM - Finding Types [Logs AWS]" }, "gridData": { "h": 16, @@ -1328,7 +1374,6 @@ "y": 54 }, "panelIndex": "933df910-8ae4-4a4b-9af7-87b30a92d952", - "title": "Security Hub - Finding Types [Logs AWS]", "type": "lens" }, { @@ -1431,8 +1476,21 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": {}, - "hidePanelTitles": false + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "hidePanelTitles": false, + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "title": "Security Hub CSPM - Network Direction [Logs AWS]" }, "gridData": { "h": 8, @@ -1442,7 +1500,6 @@ "y": 62 }, "panelIndex": "a4cba719-5f51-4090-910f-12e39dc01239", - "title": "Security Hub - Network Direction [Logs AWS]", "type": "lens" }, { @@ -1738,8 +1795,21 @@ "type": "lens", "visualizationType": "lnsDatatable" }, - "enhancements": {}, - "hidePanelTitles": false + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "hidePanelTitles": false, + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "title": "Security Hub CSPM - Findings [Logs AWS]" }, "gridData": { "h": 18, @@ -1749,7 +1819,6 @@ "y": 70 }, "panelIndex": "5c3b2b5f-b097-4b2e-adae-a4d9149e808f", - "title": "Security Hub - Findings [Logs AWS]", "type": "lens" }, { @@ -1774,7 +1843,8 @@ }, "type": "markdown", "uiState": {} - } + }, + "title": "" }, "gridData": { "h": 3, @@ -1784,7 +1854,6 @@ "y": 88 }, "panelIndex": "7a8bdb96-e4c4-4e63-bc80-14fbd4b97c2f", - "title": "", "type": "visualization" }, { @@ -2052,7 +2121,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "" }, "gridData": { "h": 17, @@ -2062,7 +2132,6 @@ "y": 91 }, "panelIndex": "9c9ea523-c04c-4783-9737-494bb8a1d068", - "title": "", "type": "lens" }, { @@ -2087,7 +2156,8 @@ }, "type": "markdown", "uiState": {} - } + }, + "title": "" }, "gridData": { "h": 3, @@ -2097,12 +2167,18 @@ "y": 108 }, "panelIndex": "a22c199d-3314-4dc0-9c99-79d7dad12c6c", - "title": "", "type": "visualization" }, { "embeddableConfig": { - "enhancements": {} + "description": "", + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedObjectId": "aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5", + "title": "Security Hub CSPM - Raw Events [Logs AWS]" }, "gridData": { "h": 16, @@ -2117,7 +2193,14 @@ }, { "embeddableConfig": { - "enhancements": {} + "description": "", + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedObjectId": "aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5", + "title": "Essential Details - Security Hub CSPM [Logs AWS]" }, "gridData": { "h": 16, @@ -2132,19 +2215,28 @@ } ], "timeRestore": false, - "title": "[Logs AWS] Security Hub Summary Dashboard", - "version": 2 + "title": "[Logs AWS] Security Hub CSPM Summary Dashboard", + "version": 3 }, "coreMigrationVersion": "8.8.0", - "created_at": "2024-09-23T11:31:27.865Z", + "created_at": "2025-12-02T10:23:03.601Z", "id": "aws-c9f103d0-5f63-11ed-bd69-473ce047ef30", - "managed": false, "references": [ { "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" }, + { + "id": "aws-security-solution-default", + "name": "tag-ref-aws-security-solution-default", + "type": "tag" + }, + { + "id": "aws-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" + }, { "id": "logs-*", "name": "146c2ac6-d83d-4fcb-808a-d24c2762f45c:indexpattern-datasource-layer-4b9a3fe3-f262-48c5-97cd-3f32f2264fdb", @@ -2232,21 +2324,21 @@ }, { "id": "logs-*", - "name": "controlGroup_f7d8c037-280e-4387-84e2-fa76ee6124da:optionsListDataView", + "name": "controlGroup_c819da49-49e8-4460-8329-8521d7f8ac8a:optionsListDataView", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_c819da49-49e8-4460-8329-8521d7f8ac8a:optionsListDataView", + "name": "controlGroup_f7d8c037-280e-4387-84e2-fa76ee6124da:optionsListDataView", "type": "index-pattern" }, { - "id": "aws-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0", - "updated_by": "u_2762430631_cloud" + "typeMigrationVersion": "10.3.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-cc571400-dc61-11ec-a6e3-1bc5ab0aa1b4.json b/packages/aws/kibana/dashboard/aws-cc571400-dc61-11ec-a6e3-1bc5ab0aa1b4.json index b36161b2124..9e0c5cf3566 100644 --- a/packages/aws/kibana/dashboard/aws-cc571400-dc61-11ec-a6e3-1bc5ab0aa1b4.json +++ b/packages/aws/kibana/dashboard/aws-cc571400-dc61-11ec-a6e3-1bc5ab0aa1b4.json @@ -77,7 +77,8 @@ "title": "", "type": "markdown", "uiState": {} - } + }, + "type": "visualization" }, "gridData": { "h": 4, @@ -89,7 +90,7 @@ "panelIndex": "4668ee49-067c-4cfc-a1d4-a3ab08c226b3", "title": "Dashboards [Logs AWS]", "type": "visualization", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -108,7 +109,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0e162cf0-664f-4e61-811a-53b6647439eb": { "columnOrder": [ @@ -175,7 +176,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -187,7 +189,7 @@ "panelIndex": "172b1706-6063-4239-92f8-3b8467011451", "title": "Top 10 Network Protocols [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -206,7 +208,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4a594fbf-8dbd-4a05-b3e0-3fbbad5b9935": { "columnOrder": [ @@ -257,16 +259,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "13ac5e44-4247-4cd7-ba24-485bab02c205" - ], "layerId": "4a594fbf-8dbd-4a05-b3e0-3fbbad5b9935", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "5438dbe3-f3f6-4def-8a4a-3584628557c7", + "metrics": [ + "5438dbe3-f3f6-4def-8a4a-3584628557c7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "13ac5e44-4247-4cd7-ba24-485bab02c205" + ] } ], "shape": "pie" @@ -277,7 +281,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -289,7 +294,7 @@ "panelIndex": "97721563-8afc-4ff2-b30d-a309a6673b09", "title": "Distribution of Events by Network Direction [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -308,7 +313,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a2993a77-e691-4f3b-8924-14a76108ce95": { "columnOrder": [ @@ -408,7 +413,8 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -420,7 +426,7 @@ "panelIndex": "40ab8dcf-a27a-4c38-b007-9d089e826939", "title": "Distribution of Events by Patch Summary Operation [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -439,7 +445,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "474374c1-eb7e-4000-908b-730e850b8860": { "columnOrder": [ @@ -490,16 +496,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "256717a7-0674-4a1b-92d9-54aa940245b3" - ], "layerId": "474374c1-eb7e-4000-908b-730e850b8860", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "2cf6c73d-46f7-4acd-82d9-249f323a5499", + "metrics": [ + "2cf6c73d-46f7-4acd-82d9-249f323a5499" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "256717a7-0674-4a1b-92d9-54aa940245b3" + ] } ], "shape": "pie" @@ -510,7 +518,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -522,7 +531,7 @@ "panelIndex": "ab35d746-7e18-49e8-b7e0-f7d9d2ade580", "title": "Distribution of Events by Severity Label [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -541,7 +550,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f338c401-cb0d-4b88-b79a-331e97840ec7": { "columnOrder": [ @@ -592,16 +601,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "f90394f0-f268-40db-b0df-1fc66f92f3dd" - ], "layerId": "f338c401-cb0d-4b88-b79a-331e97840ec7", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "70f96d67-909a-4954-b3b1-2baa7ed05c5a", + "metrics": [ + "70f96d67-909a-4954-b3b1-2baa7ed05c5a" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "f90394f0-f268-40db-b0df-1fc66f92f3dd" + ] } ], "shape": "pie" @@ -612,7 +623,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -624,7 +636,7 @@ "panelIndex": "6d092e76-fd08-4a90-a79d-f4a6d7c0539a", "title": "Distribution of Events by Workflow Status [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -643,7 +655,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "24f9158d-6500-4033-9d0a-e5e66e628cd4": { "columnOrder": [ @@ -710,7 +722,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -722,7 +735,7 @@ "panelIndex": "d73afd74-7fb1-467f-a1a3-2758d228d350", "title": "Top 10 Process Name [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -741,7 +754,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "121c4faf-2de3-4bca-9a64-a1f1c5a0a8f0": { "columnOrder": [ @@ -792,16 +805,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "3d8e7c68-095e-4e40-bfe8-2199305ddfc6" - ], "layerId": "121c4faf-2de3-4bca-9a64-a1f1c5a0a8f0", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "5ebd8b37-0d00-4eef-9733-2c122890207c", + "metrics": [ + "5ebd8b37-0d00-4eef-9733-2c122890207c" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "3d8e7c68-095e-4e40-bfe8-2199305ddfc6" + ] } ], "shape": "pie" @@ -812,7 +827,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -824,7 +840,7 @@ "panelIndex": "7a63107d-cb62-4206-bd3b-23f9d492d158", "title": "Distribution of Events by Patch Summary Reboot Option [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -843,7 +859,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "70c66cc2-30b9-462d-9581-705567e5cdcc": { "columnOrder": [ @@ -910,7 +926,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -922,7 +939,7 @@ "panelIndex": "615635af-0004-4e26-984b-e35cf9b65678", "title": "Top 10 Software Packages having Vulnerability [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -941,7 +958,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6501c2cb-9124-4f68-959f-0edcdf9192df": { "columnOrder": [ @@ -992,16 +1009,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "b6af7a3e-4422-4a19-a0f8-745088629509" - ], "layerId": "6501c2cb-9124-4f68-959f-0edcdf9192df", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "59a527c4-30d6-40c2-90ee-978520ad0a6d", + "metrics": [ + "59a527c4-30d6-40c2-90ee-978520ad0a6d" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "b6af7a3e-4422-4a19-a0f8-745088629509" + ] } ], "shape": "pie" @@ -1011,7 +1030,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -1023,7 +1043,7 @@ "panelIndex": "e2e1e909-11f4-4143-90f2-01f8f655889e", "title": "Distribution of Events by Vendor Severity [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -1042,7 +1062,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d0ec8900-0fdd-42d2-a9ca-341473136d56": { "columnOrder": [ @@ -1144,7 +1164,8 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -1156,7 +1177,7 @@ "panelIndex": "0fb0e89f-d06b-410f-833a-7cdd065bb0f1", "title": "Distribution of Events by Vulnerable Packages Architecture [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -1175,7 +1196,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a35f9122-38bb-412a-bfe8-63ac32cff907": { "columnOrder": [ @@ -1226,16 +1247,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "98fd6f34-859b-4715-b89a-ac7c5df5d069" - ], "layerId": "a35f9122-38bb-412a-bfe8-63ac32cff907", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "a929085b-2ce4-42a8-8fce-220f12728af8", + "metrics": [ + "a929085b-2ce4-42a8-8fce-220f12728af8" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "98fd6f34-859b-4715-b89a-ac7c5df5d069" + ] } ], "shape": "pie" @@ -1246,7 +1269,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -1258,7 +1282,7 @@ "panelIndex": "e2d82ea2-864c-43f0-835a-eb20d0c81595", "title": "Distribution of Events by Compliance Status [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" }, { "embeddableConfig": { @@ -1277,7 +1301,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a43577d9-3b6a-4b88-945e-20a290ac059a": { "columnOrder": [ @@ -1344,7 +1368,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -1356,18 +1381,16 @@ "panelIndex": "12d448b6-1ea8-42a9-89d0-c9b025b86438", "title": "Top 10 Security Hub Insight Name [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.9.0" } ], "timeRestore": false, - "title": "[Logs AWS] Security Hub Findings and Insights Overview", + "title": "[Logs AWS] Security Hub CSPM Findings and Insights Overview", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.8.0", + "created_at": "2025-12-02T10:23:00.550Z", "id": "aws-cc571400-dc61-11ec-a6e3-1bc5ab0aa1b4", - "migrationVersion": { - "dashboard": "8.4.0" - }, "references": [ { "id": "logs-*", @@ -1488,7 +1511,13 @@ "id": "logs-*", "name": "12d448b6-1ea8-42a9-89d0-c9b025b86438:indexpattern-datasource-layer-a43577d9-3b6a-4b88-945e-20a290ac059a", "type": "index-pattern" + }, + { + "id": "aws-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" } ], - "type": "dashboard" + "type": "dashboard", + "typeMigrationVersion": "10.3.0" } \ No newline at end of file diff --git a/packages/aws/kibana/search/aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5.json b/packages/aws/kibana/search/aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5.json index 357290a6554..d343944b03f 100644 --- a/packages/aws/kibana/search/aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5.json +++ b/packages/aws/kibana/search/aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5.json @@ -20,18 +20,22 @@ "desc" ] ], - "title": "Security Hub - Raw Events [Logs AWS]" + "title": "Security Hub CSPM - Raw Events [Logs AWS]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2024-09-23T11:21:41.694Z", + "created_at": "2025-12-02T10:16:07.632Z", "id": "aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5", - "managed": true, "references": [ { "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" }, + { + "id": "aws-security-solution-default", + "name": "tag-ref-aws-security-solution-default", + "type": "tag" + }, { "id": "aws-security-solution-default", "name": "tag-ref-security-solution-default", @@ -39,5 +43,5 @@ } ], "type": "search", - "typeMigrationVersion": "10.3.0" + "typeMigrationVersion": "10.5.0" } \ No newline at end of file diff --git a/packages/aws/kibana/search/aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5.json b/packages/aws/kibana/search/aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5.json index 3d44e55eea8..014c1e7f29a 100644 --- a/packages/aws/kibana/search/aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5.json +++ b/packages/aws/kibana/search/aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5.json @@ -29,18 +29,22 @@ "desc" ] ], - "title": "Essential Details - Security Hub [Logs AWS]" + "title": "Essential Details - Security Hub CSPM [Logs AWS]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2024-09-23T11:21:41.694Z", + "created_at": "2025-12-02T10:16:07.632Z", "id": "aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5", - "managed": true, "references": [ { "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" }, + { + "id": "aws-security-solution-default", + "name": "tag-ref-aws-security-solution-default", + "type": "tag" + }, { "id": "aws-security-solution-default", "name": "tag-ref-security-solution-default", @@ -48,5 +52,5 @@ } ], "type": "search", - "typeMigrationVersion": "10.3.0" + "typeMigrationVersion": "10.5.0" } \ No newline at end of file diff --git a/packages/aws/kibana/tag/aws-security-solution-default.json b/packages/aws/kibana/tag/aws-security-solution-default.json index 82bd27f7af0..42f11c4c5bc 100644 --- a/packages/aws/kibana/tag/aws-security-solution-default.json +++ b/packages/aws/kibana/tag/aws-security-solution-default.json @@ -5,7 +5,7 @@ "name": "Security Solution" }, "coreMigrationVersion": "8.8.0", - "created_at": "2025-06-24T13:39:33.510Z", + "created_at": "2025-12-02T10:16:07.632Z", "id": "aws-security-solution-default", "references": [], "type": "tag", diff --git a/packages/aws/manifest.yml b/packages/aws/manifest.yml index fdcc6515292..7aa5c50007c 100644 --- a/packages/aws/manifest.yml +++ b/packages/aws/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.3.2 name: aws title: AWS -version: "4.5.0" +version: "4.6.0" description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent. type: integration categories: @@ -767,8 +767,8 @@ policy_templates: size: 1366x1351 type: image/png - name: securityhub - title: AWS Security Hub - description: Collect AWS Security Hub Logs with Elastic Agent. + title: AWS Security Hub CSPM + description: Collect AWS Security Hub CSPM Logs with Elastic Agent. deployment_modes: default: enabled: true @@ -787,15 +787,15 @@ policy_templates: - misconfiguration_workflow inputs: - type: httpjson - title: Collect AWS Security Hub logs via API - description: Collecting AWS Security Hub logs via API. + title: Collect AWS Security Hub CSPM logs via API + description: Collecting AWS Security Hub CSPM logs via API. screenshots: - - src: /img/securityhub-screenshot.png - title: Security Hub dashboard screenshot + - src: /img/securityhub_cspm_findings_insights_dashboard.png + title: Security Hub CSPM Findings and Insights dashboard screenshot size: 600x600 type: image/png - - src: /img/securityhub_summary_dashboard.png - title: Security Hub dashboard screenshot + - src: /img/securityhub_cspm_summary_dashboard.png + title: Security Hub CSPM summary dashboard screenshot size: 600x600 type: image/png icons: