logrhythm · john-gress · Sep 20, 2019 · Sep 17, 2019 · Sep 20, 2019
diff --git a/packaging/kibana.spec b/packaging/kibana.spec
@@ -6,7 +6,7 @@ License:       https://github.com/elastic/kibana/blob/master/licenses/APACHE-LIC
 Group:         Development/Tools
 URL:           https://github.com/elastic/kibana
 Source:        https://github.com/elastic/kibana
-Requires:      python-elasticsearch >= 1.9.0
+Requires:      python >= 2.7.5, python-requests, python-chardet
 Requires(post): systemd
 
 %description
@@ -38,10 +38,10 @@ cp systemd/kibana.service %{buildroot}/lib/systemd/system
 
 mkdir -p %{buildroot}/usr/local/%{name}-%{kibana_version}-linux-x64
 cp -a build/oss/%{name}-%{kibana_version}-linux-x86_64/* %{buildroot}/usr/local/%{name}-%{kibana_version}-linux-x64/
+cp -a resources/ %{buildroot}/usr/local/%{name}-%{kibana_version}-linux-x64/
 
 mkdir -p %{buildroot}/usr/local/%{name}-%{kibana_version}-linux-x64/scripts
 cp scripts/exportAssets.py %{buildroot}/usr/local/%{name}-%{kibana_version}-linux-x64/scripts
-cp scripts/setDefaultIndex.py %{buildroot}/usr/local/%{name}-%{kibana_version}-linux-x64/scripts
 cp scripts/loadAssets.py %{buildroot}/usr/local/%{name}-%{kibana_version}-linux-x64/scripts
 cp scripts/util.py %{buildroot}/usr/local/%{name}-%{kibana_version}-linux-x64/scripts
 

diff --git a/resources/dashboard:Capture-Dashboard.json b/resources/dashboard:Capture-Dashboard.json
@@ -0,0 +1,51 @@
+{
+   "migrationVersion": {
+      "dashboard": "7.0.0"
+   }, 
+   "references": [
+      {
+         "type": "index-pattern", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b"
+      }, 
+      {
+         "type": "index-pattern", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b"
+      }, 
+      {
+         "type": "index-pattern", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b"
+      }, 
+      {
+         "type": "search", 
+         "name": "panel_0", 
+         "id": "Capture-Table"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_1", 
+         "id": "Top-Applications-By-Bandwidth-(histogram)"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_2", 
+         "id": "Top-Applications-By-Bandwidth-(pie)"
+      }
+   ], 
+   "type": "dashboard", 
+   "dashboard": {
+      "hits": 0, 
+      "timeRestore": false, 
+      "description": "", 
+      "title": "Capture Dashboard", 
+      "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":18,\"w\":48,\"h\":21,\"i\":\"1\"},\"panelIndex\":\"1\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":36,\"h\":18,\"i\":\"2\"},\"panelIndex\":\"2\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":36,\"y\":0,\"w\":12,\"h\":18,\"i\":\"3\"},\"panelIndex\":\"3\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_2\"}]", 
+      "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", 
+      "version": 1, 
+      "kibanaSavedObjectMeta": {
+         "searchSourceJSON": "{\"filter\":[{\"meta\":{\"alias\":\"Pcap Captured\",\"negate\":false,\"type\":\"phrase\",\"key\":\"Captured\",\"value\":\"true\",\"params\":{\"query\":true},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"Captured\":{\"query\":true,\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}},{\"range\":{\"TimeStartRaw\":{\"gte\":\"1568688732\"}},\"meta\":{\"type\":\"range\",\"disabled\":false,\"negate\":false,\"alias\":\"Pcap Available on Disk\",\"key\":\"TimeStartRaw\",\"value\":\"1,566,770,100 to +\u221e\",\"params\":{\"gte\":\"1568688732\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"alias\":\"Pcap Written to Disk\",\"negate\":false,\"type\":\"phrase\",\"key\":\"Written\",\"value\":\"true\",\"params\":{\"query\":true},\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index\"},\"query\":{\"match\":{\"Written\":{\"query\":true,\"type\":\"phrase\"}}},\"$state\":{\"store\":\"appState\"}}],\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"time_zone\":\"America/Denver\"}}}}"
+      }
+   }, 
+   "updated_at": "2019-09-16T21:43:45.043Z"
+}
diff --git a/resources/dashboard:File-Reconstruction-Dashboard.json b/resources/dashboard:File-Reconstruction-Dashboard.json
@@ -0,0 +1,71 @@
+{
+   "migrationVersion": {
+      "dashboard": "7.0.0"
+   }, 
+   "references": [
+      {
+         "type": "index-pattern", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b"
+      }, 
+      {
+         "type": "index-pattern", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b"
+      }, 
+      {
+         "type": "index-pattern", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_0", 
+         "id": "Top-10-Attachment-Types-(bar-graph)"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_1", 
+         "id": "Top-10-Attachment-Names"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_2", 
+         "id": "Top-10-Senders-By-Count"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_3", 
+         "id": "Top-10-Receivers-By-Count"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_4", 
+         "id": "Top-10-Attachment-Types-By-Count"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_5", 
+         "id": "Sessions-Over-Time"
+      }, 
+      {
+         "type": "search", 
+         "name": "panel_6", 
+         "id": "Attachment-Table"
+      }
+   ], 
+   "type": "dashboard", 
+   "dashboard": {
+      "hits": 0, 
+      "timeRestore": false, 
+      "description": "", 
+      "title": "File Reconstruction Dashboard", 
+      "panelsJSON": "[{\"gridData\":{\"x\":0,\"y\":0,\"w\":26,\"h\":15,\"i\":\"1\"},\"panelIndex\":\"1\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_0\"},{\"gridData\":{\"x\":26,\"y\":0,\"w\":11,\"h\":15,\"i\":\"2\"},\"panelIndex\":\"2\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_1\"},{\"gridData\":{\"x\":37,\"y\":0,\"w\":11,\"h\":15,\"i\":\"3\"},\"panelIndex\":\"3\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":37,\"y\":15,\"w\":11,\"h\":15,\"i\":\"4\"},\"panelIndex\":\"4\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_3\"},{\"gridData\":{\"x\":26,\"y\":15,\"w\":11,\"h\":15,\"i\":\"5\"},\"panelIndex\":\"5\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_4\"},{\"gridData\":{\"x\":0,\"y\":15,\"w\":26,\"h\":15,\"i\":\"6\"},\"panelIndex\":\"6\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_5\"},{\"embeddableConfig\":{\"columns\":[\"Attach\",\"Captured\",\"SenderEmail\",\"ReceiverEmail\",\"Filename\",\"AttachSize\",\"AttachType\"],\"sort\":[\"TimeUpdated\",\"desc\"]},\"gridData\":{\"x\":0,\"y\":30,\"w\":48,\"h\":24,\"i\":\"7\"},\"panelIndex\":\"7\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_6\"}]", 
+      "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", 
+      "version": 3, 
+      "kibanaSavedObjectMeta": {
+         "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":\"Pcap Captured\",\"disabled\":false,\"key\":\"Captured\",\"negate\":false,\"params\":{\"query\":true},\"type\":\"phrase\",\"value\":\"true\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"Captured\":{\"query\":true,\"type\":\"phrase\"}}}},{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":\"Has Attachment\",\"disabled\":false,\"key\":\"Attach\",\"negate\":false,\"params\":{\"query\":true},\"type\":\"phrase\",\"value\":\"true\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index\"},\"query\":{\"match\":{\"Attach\":{\"query\":true,\"type\":\"phrase\"}}}},{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":\"Pcap Available on Disk\",\"disabled\":false,\"key\":\"TimeStartRaw\",\"negate\":false,\"params\":{\"gte\":\"1568614275\"},\"type\":\"range\",\"value\":\"1,567,536,977 to +\u221e\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index\"},\"range\":{\"TimeStartRaw\":{\"gte\":\"1568614275\"}}}],\"query\":{\"language\":\"lucene\",\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"time_zone\":\"America/Denver\"}}}}"
+      }
+   }, 
+   "updated_at": "2019-09-16T21:42:31.908Z"
+}
diff --git a/resources/dashboard:b595b4a0-d0c6-11e9-a8eb-5fa4111061ad.json b/resources/dashboard:b595b4a0-d0c6-11e9-a8eb-5fa4111061ad.json
@@ -0,0 +1,41 @@
+{
+   "migrationVersion": {
+      "dashboard": "7.0.0"
+   }, 
+   "references": [
+      {
+         "type": "search", 
+         "name": "panel_0", 
+         "id": "Analyze-Table"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_1", 
+         "id": "Top-Applications-By-Bandwidth-(histogram)"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_2", 
+         "id": "Top-Applications-By-Packet-Count"
+      }, 
+      {
+         "type": "visualization", 
+         "name": "panel_3", 
+         "id": "Top-Applications-By-Bandwidth-(pie)"
+      }
+   ], 
+   "type": "dashboard", 
+   "dashboard": {
+      "hits": 0, 
+      "timeRestore": false, 
+      "description": "", 
+      "title": "Analyze Dashboard", 
+      "panelsJSON": "[{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":22,\"w\":48,\"h\":23,\"i\":\"4\"},\"panelIndex\":\"4\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_0\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":0,\"y\":0,\"w\":36,\"h\":22,\"i\":\"5\"},\"panelIndex\":\"5\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_1\"},{\"embeddableConfig\":{},\"gridData\":{\"x\":36,\"y\":11,\"w\":12,\"h\":11,\"i\":\"6\"},\"panelIndex\":\"6\",\"version\":\"7.2.0\",\"panelRefName\":\"panel_2\"},{\"gridData\":{\"x\":36,\"y\":0,\"w\":12,\"h\":11,\"i\":\"7\"},\"version\":\"7.2.0\",\"panelIndex\":\"7\",\"embeddableConfig\":{},\"panelRefName\":\"panel_3\"}]", 
+      "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}", 
+      "version": 1, 
+      "kibanaSavedObjectMeta": {
+         "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[]}"
+      }
+   }, 
+   "updated_at": "2019-09-16T21:36:20.181Z"
+}
diff --git a/resources/index-pattern:361f5c00-b47c-11e9-86a0-cd3d7bf2f81b.json b/resources/index-pattern:361f5c00-b47c-11e9-86a0-cd3d7bf2f81b.json
diff --git a/resources/search:Analyze-Table.json b/resources/search:Analyze-Table.json
@@ -0,0 +1,35 @@
+{
+   "migrationVersion": {
+      "search": "7.0.0"
+   }, 
+   "references": [
+      {
+         "type": "index-pattern", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.index", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b"
+      }
+   ], 
+   "search": {
+      "sort": [
+         "TimeUpdated", 
+         "desc"
+      ], 
+      "hits": 0, 
+      "description": "", 
+      "title": "Analyze Table", 
+      "version": 1, 
+      "kibanaSavedObjectMeta": {
+         "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"time_zone\":\"America/Denver\"}},\"language\":\"lucene\"},\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[],\"highlightAll\":true,\"version\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
+      }, 
+      "columns": [
+         "SrcIP", 
+         "DestIP", 
+         "Application", 
+         "Duration", 
+         "FlowCompleted", 
+         "Session"
+      ]
+   }, 
+   "type": "search", 
+   "updated_at": "2019-09-06T16:50:36.068Z"
+}
diff --git a/resources/search:Attachment-Table.json b/resources/search:Attachment-Table.json
@@ -0,0 +1,40 @@
+{
+   "migrationVersion": {
+      "search": "7.0.0"
+   }, 
+   "references": [
+      {
+         "type": "index-pattern", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.index"
+      }, 
+      {
+         "type": "index-pattern", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index"
+      }
+   ], 
+   "search": {
+      "sort": [
+         "TimeUpdated", 
+         "desc"
+      ], 
+      "hits": 0, 
+      "description": "", 
+      "title": "Attachment Table", 
+      "version": 2, 
+      "kibanaSavedObjectMeta": {
+         "searchSourceJSON": "{\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[{\"meta\":{\"negate\":false,\"key\":\"Attach\",\"value\":\"true\",\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match\":{\"Attach\":{\"query\":true,\"type\":\"phrase\"}}}}],\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"language\":\"lucene\"},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
+      }, 
+      "columns": [
+         "Attach", 
+         "SenderEmail", 
+         "ReceiverEmail", 
+         "Filename", 
+         "AttachSize", 
+         "AttachType"
+      ]
+   }, 
+   "type": "search", 
+   "updated_at": "2019-09-10T15:48:50.528Z"
+}
diff --git a/resources/search:Capture-Table.json b/resources/search:Capture-Table.json
@@ -0,0 +1,36 @@
+{
+   "migrationVersion": {
+      "search": "7.0.0"
+   }, 
+   "references": [
+      {
+         "type": "index-pattern", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.index"
+      }
+   ], 
+   "search": {
+      "sort": [
+         "TimeUpdated", 
+         "desc"
+      ], 
+      "hits": 0, 
+      "description": "", 
+      "title": "Capture Table", 
+      "version": 1, 
+      "kibanaSavedObjectMeta": {
+         "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\",\"time_zone\":\"America/Denver\"}},\"language\":\"lucene\"},\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647},\"filter\":[],\"highlightAll\":true,\"version\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
+      }, 
+      "columns": [
+         "SrcIP", 
+         "DestIP", 
+         "Application", 
+         "Duration", 
+         "FlowCompleted", 
+         "Session", 
+         "Captured"
+      ]
+   }, 
+   "type": "search", 
+   "updated_at": "2019-09-10T15:48:45.439Z"
+}
diff --git a/resources/visualization:Sessions-Over-Time.json b/resources/visualization:Sessions-Over-Time.json
@@ -0,0 +1,24 @@
+{
+   "migrationVersion": {
+      "visualization": "7.2.0"
+   }, 
+   "visualization": {
+      "visState": "{\"type\":\"line\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":false,\"showCircles\":true,\"smoothLines\":false,\"interpolate\":\"linear\",\"scale\":\"linear\",\"drawLinesBetweenPoints\":true,\"radiusRatio\":9,\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"TimeUpdated\",\"interval\":\"auto\",\"min_doc_count\":1,\"extended_bounds\":{}}}],\"listeners\":{}}", 
+      "description": "", 
+      "title": "Sessions Over Time", 
+      "uiStateJSON": "{}", 
+      "version": 2, 
+      "kibanaSavedObjectMeta": {
+         "searchSourceJSON": "{\"query\":{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
+      }
+   }, 
+   "type": "visualization", 
+   "updated_at": "2019-09-10T15:48:45.439Z", 
+   "references": [
+      {
+         "type": "index-pattern", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.index"
+      }
+   ]
+}
diff --git a/resources/visualization:Top-10-Attachment-Names.json b/resources/visualization:Top-10-Attachment-Names.json
@@ -0,0 +1,24 @@
+{
+   "migrationVersion": {
+      "visualization": "7.2.0"
+   }, 
+   "visualization": {
+      "visState": "{\"title\":\"Top 10 Attachment Names\",\"type\":\"pie\",\"params\":{\"addLegend\":true,\"addTooltip\":true,\"isDonut\":false,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"shareYAxis\":true,\"type\":\"pie\",\"dimensions\":{\"metric\":{\"accessor\":1,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"},\"buckets\":[{\"accessor\":0,\"format\":{\"id\":\"terms\",\"params\":{\"id\":\"string\",\"otherBucketLabel\":\"Other\",\"missingBucketLabel\":\"Missing\"}},\"params\":{},\"aggType\":\"terms\"}]}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"Filename.keyword\",\"order\":\"desc\",\"size\":10,\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}", 
+      "description": "", 
+      "title": "Top 10 Attachment Names", 
+      "uiStateJSON": "{}", 
+      "version": 1, 
+      "kibanaSavedObjectMeta": {
+         "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"*\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
+      }
+   }, 
+   "type": "visualization", 
+   "updated_at": "2019-09-10T15:48:45.439Z", 
+   "references": [
+      {
+         "type": "index-pattern", 
+         "id": "361f5c00-b47c-11e9-86a0-cd3d7bf2f81b", 
+         "name": "kibanaSavedObjectMeta.searchSourceJSON.index"
+      }
+   ]
+}