Page Comparison

1. 1. Image Added

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. 4 buckets are needed to configure this visualization.

4. Bucket configuration for Bucket 1

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "host.ip" or search for it.

   4. Order by, Order and Size should all remain with their default values. Properly configured, the first bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket configuration for Bucket 2

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "vulnerability.description" or search for it.

   4. Order by, Order and Size should all remain with their default values. Properly configured, the second bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket configuration for Bucket 3

   1. Under Buckets, click the Add button, and select Split table.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "host.hostname" or search for it.

   4. Order by, Order and Size should all remain with their default values. Properly configured, the third bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket configuration for Bucket 4

   1. Under Buckets, click the Add button, and select Split rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "vulnerability.score.base" or search for it.

   4. Set Order by to "Custom Metric"

   5. Set Aggregation to Count

   6. Order and Size should all remain with their default values. Properly configured, the fourth bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. One bucket is needed to configure this visualization. Under Buckets, click the Add button, making sure to select Split Slices.

4. In the Aggregation drop down, select Date Histogram.

5. In the Field box, enter "vulnerability.first_found" or search for it.

6. Set the value in the Minimum interval box to Weekly

7. A custom label of Week First Found can be added

8. Properly configured, the bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the bucket is configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

   2. Set the filter up as seen below. You will have to manually type in "ecs-1.5.0-vulnerability in the Value field and click Save

1. 1. Image Added

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. Two buckets are needed to configure this visualization.

4. Under Buckets, click the Add button and select X-Axis

5. In the Aggregation drop down, select Terms.

6. In the Field box, enter "host.hostname" or search for it.

7. Order by, Order and Size should all remain with their default values. Properly configured, the first bucket configuration will look like the screenshot below:
   

1. Image Added

2. For the second bucket, click the Add button

3. Select Split Series and In the Aggregation drop down, select Terms.

4. In the Field box, enter "vulnerability.severity" or search for it.

5. Order by = Alphabetical, Order and Size should all remain with their default values. A custom label of Severity can be added.

6. Properly configured, the second bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

4. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

5. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

   2. Set the second filter up as seen below
      

1. 1. Image Added

   2. Set the last filter up as seen below. You will have to manually type in "ecs-1.5.0-vulnerability in the Value field and click Save
      

1. 1. Image Added

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. Two buckets are needed to configure this visualization.

4. Under Buckets, click the Add button and select X-Axis

5. In the Aggregation drop down, select Terms.

6. In the Field box, enter "host.hostname" or search for it.

7. Order by = Metric: Vulnerability Count by Severity

8. Order = Descending

9. Size can vary but for this example it is set to 200

10. A custom lable of Hosts can be added

11. Properly configured, the first bucket configuration will look like the screenshot below:
    

1. Image Added

2. For the second bucket, click the Add button

3. Select Split Series and In the Aggregation drop down, select Terms.

4. In the Field box, enter "vulnerability.severity" or search for it.

5. Order by = Alphabetical, Order and Size should all remain with their default values. A custom label of Severity can be added.

6. Properly configured, the second bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

   2. Set the second filter up as seen below
      
      

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. Two buckets are needed to configure this visualization.

4. Under Buckets, click the Add button and select X-Axis

5. In the Aggregation drop down, select Terms.

6. In the Field box, enter "host.hostname" or search for it.

7. Order by, Order and Size should all remain with their default values. Properly configured, the first bucket configuration will look like the screenshot below:
   

1. Image Added

2. For the second bucket, click the Add button

3. Select Split Series and In the Aggregation drop down, select Terms.

4. In the Field box, enter "vulnerability.severity" or search for it.

5. Order by should be set to Alphabetical, Order and Size can remain with their default values. A custom label of Severity can be added. Properly configured, the second bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. 3 buckets are needed to configure this visualization.

4. Bucket configuration for Bucket 1

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Date Histogram.

   3. In the Field box, enter "vulnerability.first_found" or search for it.

   4. In the Minimum Interval box, select Daily

   5. A custom label of First Report Containing Vulnerability can be set

   6. Properly configured, the first bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket configuration for Bucket 2

   1. Under Buckets, click the Add button, and select Split rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "vulnerability.description" or search for it.

   4. Order by, Order should remain with their default values.

   5. Size can vary, but for this example it is set to 50

   6. A custom label of Vulnerability Description can be set

   7. Properly configured, the second bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket configuration for Bucket 3

   1. Under Buckets, click the Add button, and select Split rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "vulnerability.id" or search for it.

   4. Order by = Alphabetical, Order and Size should all remain with their default values.

   5. Properly configured, the third bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. One bucket is needed to configure this visualization. Under Buckets, click the Add button, making sure to select Split Slices.

4. In the Aggregation drop down, select Terms.

5. In the Field box, enter "host.os.full" or search for it.

6. Order by, Order and Size should all remain with their default values.

7. A custom label of Operating System can be set

8. Properly configured, the bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the bucket is configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. One bucket is needed to configure this visualization

4. Under Buckets, click the Add button and select X-Axis

5. In the Aggregation drop down, select Date Histogram.

6. In the Field box, enter "@timestamp" or search for it.

7. In the Minimum Interval box, select Daily

8. A custom label of Vulnerability Report Date can be set

9. Properly configured, the bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the bucket is configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

   2. Set the second filter up as seen below. You will have to manually type in 3, 4 and 5. These are the severity levels
      

1. 1. Image Added

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. One bucket is needed to configure this visualization

4. Under Buckets, click the Add button and select X-Axis

5. In the Aggregation drop down, select Date Histogram.

6. In the Field box, enter "@timestamp" or search for it.

7. In the Minimum Interval box, select Daily

8. A custom label of Vulnerability Report Date can be set

9. Properly configured, the bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the bucket is configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

2. Under metrics this should already be set to Y-axis Count. No change is needed.

3. One bucket is needed to configure this visualization

4. Under Buckets, click the Add button and select X-Axis

5. In the Aggregation drop down, select Date Histogram.

6. In the Field box, enter "@timestamp" or search for it.

7. In the Minimum Interval box, select Daily

8. A custom label of Date can be set

9. Properly configured, the bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the bucket is configured, click the Apply Changes button.

3. Set the date range for the visualization.

4. 1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

5. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

2. Under metrics this should already be set to Metric Count. No change is needed.

3. One bucket is needed to configure this visualization

4. Under Buckets, click the Add button and select Split rows

5. In the Aggregation drop down, select Terms.

6. In the Field box, enter "parsed.trendmicro.name" or search for it.

7. Order by = Metric: Count, Order = Descending, Size = 10

8. A custom label of IDS Event Type Name can be set

9. Properly configured, the bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the bucket is configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

2. Under metrics this should already be set to Y-Axis Count. No change is needed.

3. One bucket is needed to configure this visualization

4. Under Buckets, click the Add button and select X-Axis

5. In the Aggregation drop down, select Terms.

6. In the Field box, enter "hostname" or search for it.

7. Order by, Order, & Size leave at default

8. A custom label of Hostname can be set

9. Properly configured, the bucket configuration will look like the screenshot below:
   

1. Image Added

2. When the bucket is configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

   2. Set the second filter up as seen below
      

1. 1. Image Added

   2. Set the third filter up as seen below
      

1. 1. Image Added

2. Under metrics this should already be set to Metric Count. No change is needed.

3. One bucket is needed to configure this visualization.

4. Bucket configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "src_geo.country_name" or search for it.

   4. Order = Descending and Size =10 (can vary depending on how long you want the list)

   5. A custom label of Location can be added

   6. Properly configured, the bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

2. Under metrics this should already be set to Metric Count. No change is needed.

3. Three buckets are needed to configure this visualization.

4. Bucket 1 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "@timestamp" or search for it.

   4. Order = Descending and Size =5 (can vary depending on how long you want the list)

   5. Properly configured, the first bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket 2 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "hostname" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the second bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket 3 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "message" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the third bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

4. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

5. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

2. Under metrics this should already be set to Metric Count. No change is needed.

3. Three buckets are needed to configure this visualization.

4. Bucket 1 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "@timestamp" or search for it.

   4. Order = Descending and Size =5 (can vary depending on how long you want the list)

   5. Properly configured, the first bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket 2 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "hostname" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the second bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket 3 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "message" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the third bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. 1. Image Added

   2. Set the second filter up as seen below
      

1. 1. Image Added

2. Under metrics this should already be set to Metric Count. No change is needed.

3. Three buckets are needed to configure this visualization.

4. Bucket 1 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "@timestamp" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the first bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket 2 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "hostname" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the second bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket 3 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "message" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the third bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. filters will be applied to this visualization:

   1. Click on Add filter

   2. Set the first filter up as seen below
      Image Modified
      

   3. Set the second filter up as seen below
      

1. 1. Image Added

2. Under metrics this should already be set to Metric Count. No change is needed.

3. Three buckets are needed to configure this visualization.

4. Bucket 1 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "@timestamp" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the first bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket 2 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "hostname" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the second bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. Bucket 3 configuration

   1. Under Buckets, click the Add button, and select Split Rows.

   2. In the Aggregation drop down, select Terms.

   3. In the Field box, enter "message" or search for it.

   4. Order = Descending and Size =1000 (can vary depending on how long you want the list)

   5. Properly configured, the third bucket configuration will look like the screenshot below:
      

1. 1. Image Added

2. When the buckets are configured, click the Apply Changes button.

3. Set the date range for the visualization.

   1. If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.

4. Save the visualization by clicking Save in the top left of the screen.

Users can view previous visualizations by clicking Visualizations and selecting the desired visualization from the list.

1. Image Added

2. Select "Terms" for the Aggregation, and type in "vulnerability.pci_flag" for the field and hit the blue arrow at the top of the box
   

1. Image Added

2. Next, select "+Add filter" , and type "vulnerability.description" for Field, "Exists" as the Operator and hit "Save"
   

1. Image Added

2. Add another filter by selecting ''+Add filter", and type ''vulnerability.pci_flag" for Field, and "is" for Operator. Type the number "1" in Value and hit "Save"
   

1. Image Added

2. Make sure to adjust the time if you are not getting any data to populate.

3. Don't forget to save your Visualization at the top left.

1. Image Added

   
   

   1. (If you receive an error, change the time field to the last 30 days to expand your search)

2. Navigate to Buckets, add bucket and select "Split slices"
   

1. Image Added

2. Aggregation= Terms, type ''event.severity'' for Field
   

1. Image Added

   1. To confirm those changes, click the blue box with a triangle:
      

1. 1. Image Added

2. Don't forget to save your Visualization at the top left