{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"_parentId":{"value":"3519580184"}},"macroMetadata":{"macroId":{"value":"2d45d90c-1918-47bf-b8f6-09f1fd65450f"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"3d782347-86f6-49d7-b1fb-8a135af06054"}},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Vulnerability Distribution by Severity","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Vulnerability Distribution by Severity","type":"text","marks":[{"type":"strong"}]},{"text":" report will show you the vulnerability by a severity number","type":"text"}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the?","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":"?screen. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on?","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the?","type":"text"},{"text":"Create new visualization?","type":"text","marks":[{"type":"strong"}]},{"text":"button. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the?","type":"text"},{"text":"Pie Chart?","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\". ","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization: ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save ","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One bucket is needed to configure this visualization. Under Buckets, click the?","type":"text"},{"text":"Add?","type":"text","marks":[{"type":"strong"}]},{"text":"button, making sure to select?","type":"text"},{"text":"Split Slices","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select?","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the?","type":"text"},{"text":"Field?","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"vulnerability.severity\" or search for it. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order and Size should all remain with their default values. Properly configured, the bucket configuration will look like the screenshot below: ","type":"text"},{"type":"hardBreak"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"width":"200","id":"b0b5ced2-63e3-4e16-97e2-070fe7f1064c","collection":"contentId-3519580184","height":""}}},{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the bucket is configured, click the?","type":"text"},{"text":"Apply Changes?","type":"text","marks":[{"type":"strong"}]},{"text":"button. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking?","type":"text"},{"text":"Save?","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen. ","type":"text"},{"type":"hardBreak"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking?","type":"text"},{"text":"Visualizations?","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list. ","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":77061,"__fileMimeType":"image/png","width":927,"id":"78a32b60-a53d-4b95-9628-6daeaadb6042","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-4-36.png","height":621}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Vulnerability by Host","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Vulnerability by Host ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you the top vulnerabilities by hostname","type":"text"}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Data Table ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":57897,"__fileMimeType":"image/png","width":444,"id":"91908204-2a99-405a-86dd-d93ca9606373","collection":"contentId-3519580184","type":"file","__fileName":"vuln host 7b.png","height":230}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"4 buckets are needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket configuration for Bucket 1","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"host.ip\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order and Size should all remain with their default values. Properly configured, the first bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":16427,"__fileMimeType":"image/png","width":156,"id":"91102e81-3a4a-426c-bbb9-e0adc45d0f7e","collection":"contentId-3519580184","type":"file","__fileName":"vuln host 10d.png","height":264}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket configuration for Bucket 2","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"vulnerability.description\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order and Size should all remain with their default values. Properly configured, the second bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":24305,"__fileMimeType":"image/png","width":191,"id":"6371ded4-0254-4210-a7d4-8287044d8028","collection":"contentId-3519580184","type":"file","__fileName":"vuln host 11d.png","height":321}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket configuration for Bucket 3","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split table","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"host.hostname\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order and Size should all remain with their default values. Properly configured, the third bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":24810,"__fileMimeType":"image/png","width":192,"id":"834a07ca-9c80-446f-995c-7e069c4251f4","collection":"contentId-3519580184","type":"file","__fileName":"vuln host 12d.png","height":359}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket configuration for Bucket 4","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"vulnerability.score.base\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set Order by to \"Custom Metric\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set Aggregation to Count","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order and Size should all remain with their default values. Properly configured, the fourth bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":30286,"__fileMimeType":"image/png","width":197,"id":"be64d12a-3ee5-4270-b577-9594900a07a0","collection":"contentId-3519580184","type":"file","__fileName":"vuln host 13f.png","height":416}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":195056,"__fileMimeType":"image/png","width":1280,"id":"44fd0bfb-9f4e-44ad-bf55-c0c49078eb57","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-4-6.png","height":735}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Vulnerability Distribution by First Found","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Vulnerability Distribution by First Found ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you the vulnerabilities by the date they were first discovered.","type":"text"}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Pie Chart ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the customer account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":31626,"__fileMimeType":"image/png","width":371,"id":"9a34d147-6dac-4bd4-be86-bb5bcfd37105","collection":"contentId-3519580184","type":"file","__fileName":"7.png","height":192}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One bucket is needed to configure this visualization. Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, making sure to select ","type":"text"},{"text":"Split Slices","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Date Histogram","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"vulnerability.first_found\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the value in the ","type":"text"},{"text":"Minimum interval ","type":"text","marks":[{"type":"strong"}]},{"text":"box to ","type":"text"},{"text":"Weekly","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of ","type":"text"},{"text":"Week First Found","type":"text","marks":[{"type":"strong"}]},{"text":" can be added","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":28252,"__fileMimeType":"image/png","width":217,"id":"3470592a-1d1c-47cc-8d6f-0c38d689f780","collection":"contentId-3519580184","type":"file","__fileName":"8.png","height":364}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the bucket is configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":193643,"__fileMimeType":"image/png","width":1060,"id":"ddc6d1ed-3797-4ae8-8390-9df83c1dd3e7","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-5-11.png","height":688}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Top 5 Hosts by Count of High Severity Vulnerabilities","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Top 5 Hosts by Count of High Severity Vulnerabilities ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you the top 5 hosts by count of high severity vulnerabilities","type":"text"}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Vertical Bar ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Two filters will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":11531,"__fileMimeType":"image/png","width":297,"id":"5a58c5a4-7bf6-4a31-bd0f-dadda4af7f13","collection":"contentId-3519580184","type":"file","__fileName":"9.png","height":158}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":48077,"__fileMimeType":"image/png","width":439,"id":"93bbb318-fc67-4d60-8e9b-f46451c5f1cb","collection":"contentId-3519580184","type":"file","__fileName":"10.png","height":234}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Two buckets are needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button and select ","type":"text"},{"text":"X-Axis","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"host.hostname\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order and Size should all remain with their default values. Properly configured, the first bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":26418,"__fileMimeType":"image/png","width":201,"id":"c85dd45d-54f7-4717-82f6-a70b383eb588","collection":"contentId-3519580184","type":"file","__fileName":"11.png","height":373}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the second bucket, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"Split ","type":"text","marks":[{"type":"strong"}]},{"text":"Series and In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"vulnerability.severity\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by = Alphabetical, Order and Size should all remain with their default values. A custom label of ","type":"text"},{"text":"Severity ","type":"text","marks":[{"type":"strong"}]},{"text":"can be added.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the second bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":23405,"__fileMimeType":"image/png","width":191,"id":"769ab64d-5e9f-47bc-8ab0-95d2d512ec92","collection":"contentId-3519580184","type":"file","__fileName":"12.png","height":320}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":415,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":71277,"__fileMimeType":"image/png","width":1280,"id":"0873e691-9d42-4040-a36b-74e0c23f9b8b","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-5-57.png","height":433}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Top 5 Hosts by Count of Vulnerabilities","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Top 5 Hosts by Count of Vulnerabilities ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you the top 5 hosts by count of total vulnerabilities","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Vertical Bar ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Three filters will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the first filter up as seen below.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":64471,"__fileMimeType":"image/png","width":472,"id":"1b219e3d-cab0-402c-826c-ac1b48523169","collection":"contentId-3519580184","type":"file","__fileName":"13.png","height":234}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the second filter up as seen below","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":39047,"__fileMimeType":"image/png","width":480,"id":"f758c754-7b9a-4d78-9db6-46ff9b9b066b","collection":"contentId-3519580184","type":"file","__fileName":"14.png","height":161}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the last filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":59997,"__fileMimeType":"image/png","width":446,"id":"898d4c20-ce96-404a-87a0-42a4c8dec9e4","collection":"contentId-3519580184","type":"file","__fileName":"15.png","height":233}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Two buckets are needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button and select ","type":"text"},{"text":"X-Axis","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"host.hostname\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by = Metric: Vulnerability Count by Severity","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Size can vary but for this example it is set to 200","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom lable of Hosts can be added","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the first bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":23654,"__fileMimeType":"image/png","width":193,"id":"8f0ccfa8-b4a5-40ee-beb8-7a3e7aeaf31c","collection":"contentId-3519580184","type":"file","__fileName":"16.png","height":323}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the second bucket, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"Split Series","type":"text","marks":[{"type":"strong"}]},{"text":" and In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"vulnerability.severity\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by = Alphabetical, Order and Size should all remain with their default values. A custom label of ","type":"text"},{"text":"Severity ","type":"text","marks":[{"type":"strong"}]},{"text":"can be added.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the second bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":23405,"__fileMimeType":"image/png","width":191,"id":"4488adda-5976-4527-9190-6becf0b7bf01","collection":"contentId-3519580184","type":"file","__fileName":"17.png","height":320}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":82342,"__fileMimeType":"image/png","width":1280,"id":"088e5906-23da-433b-807e-0d3030b2cf33","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-6-33.png","height":387}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Top 5 Hosts by Count of Net New Vulnerabilities","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Top 5 Hosts by Count of Net New Vulnerabilities ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you the top 5 hosts by count of net new vulnerabilities","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Vertical Bar ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"},{"type":"hardBreak"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Two filters will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the first filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":37736,"__fileMimeType":"image/png","width":394,"id":"685cb58d-7bf5-421b-8e38-0549d8fe7f60","collection":"contentId-3519580184","type":"file","__fileName":"NET NEW 6B.png","height":210}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the second filter up as seen below","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Two buckets are needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button and select ","type":"text"},{"text":"X-Axis","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"host.hostname\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order and Size should all remain with their default values. Properly configured, the first bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":24636,"__fileMimeType":"image/png","width":200,"id":"65201b27-8576-48f4-8377-190a4ac40d84","collection":"contentId-3519580184","type":"file","__fileName":"net new 12.png","height":347}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the second bucket, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"Split Series","type":"text","marks":[{"type":"strong"}]},{"text":" and In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"vulnerability.severity\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by","type":"text","marks":[{"type":"strong"}]},{"text":" should be set to ","type":"text"},{"text":"Alphabetical","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"Order","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Size","type":"text","marks":[{"type":"strong"}]},{"text":" can remain with their default values. A custom label of ","type":"text"},{"text":"Severity ","type":"text","marks":[{"type":"strong"}]},{"text":"can be added. Properly configured, the second bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":23405,"__fileMimeType":"image/png","width":191,"id":"7c9ea741-7bdc-444f-85f4-8a542e485f57","collection":"contentId-3519580184","type":"file","__fileName":"net new 16.png","height":320}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":81030,"__fileMimeType":"image/png","width":1280,"id":"a7a93af8-46dc-4570-80c4-40e106f3bcdf","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-7-18.png","height":372}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Vulnerabilities Sorted from First to Last Discovered","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Vulnerabilities Sorted From First to Last Discovered ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a data table of all vulnerabilities sorted from first to last by discovered date","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Data Table ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":57897,"__fileMimeType":"image/png","width":444,"id":"f2bfa548-36e3-4acb-bb1c-bfa18ba3687d","collection":"contentId-3519580184","type":"file","__fileName":"sorted last 7b.png","height":230}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"3 buckets are needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket configuration for Bucket 1","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Date Histogram","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"vulnerability.first_found\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Minimum Interval","type":"text","marks":[{"type":"strong"}]},{"text":" box, select ","type":"text"},{"text":"Daily","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of ","type":"text"},{"text":"First Report Containing Vulnerability","type":"text","marks":[{"type":"strong"}]},{"text":" can be set","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the first bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":12774,"__fileMimeType":"image/png","width":188,"id":"fdf5183f-4315-42e5-8f8c-9712c1f69675","collection":"contentId-3519580184","type":"file","__fileName":"sorted last 10f.png","height":168}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket configuration for Bucket 2","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"vulnerability.description\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order should remain with their default values.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Size can vary, but for this example it is set to 50","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of ","type":"text"},{"text":"Vulnerability Description","type":"text","marks":[{"type":"strong"}]},{"text":" can be set","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the second bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":24983,"__fileMimeType":"image/png","width":195,"id":"7390e6df-39ce-4901-9183-50f48435d3e0","collection":"contentId-3519580184","type":"file","__fileName":"sorted last 11g.png","height":317}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket configuration for Bucket 3","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"","type":"text"},{"text":"vulnerability.id","type":"text","marks":[{"type":"link","attrs":{"href":"http://vulnerability.id"}}]},{"text":"\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by = Alphabetical, Order and Size should all remain with their default values.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the third bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":23010,"__fileMimeType":"image/png","width":191,"id":"9081bcd1-0fda-459d-b545-4f2628862f21","collection":"contentId-3519580184","type":"file","__fileName":"sorted last 12e.png","height":320}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":141552,"__fileMimeType":"image/png","width":1280,"id":"548366ac-e088-4839-baf7-608160401362","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-7-46.png","height":411}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Vulnerability Distribution by OS","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Vulnerability Distribution by OS ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you the vulnerabilities by Operating System type","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Pie Chart ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":53129,"__fileMimeType":"image/png","width":438,"id":"3cfadf3b-fc54-4c33-b33f-0bdc5880313e","collection":"contentId-3519580184","type":"file","__fileName":"vuln os 7b.png","height":232}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One bucket is needed to configure this visualization. Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, making sure to select ","type":"text"},{"text":"Split Slices","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"host.os.full\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order and Size should all remain with their default values.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of Operating System can be set","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":24596,"__fileMimeType":"image/png","width":191,"id":"82872913-9189-4e92-a68f-97d27d7f3526","collection":"contentId-3519580184","type":"file","__fileName":"vuln OS 14.png","height":325}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the bucket is configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":108172,"__fileMimeType":"image/png","width":1280,"id":"ab73c936-133c-4aa6-99b1-08ea7f42149f","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-8-15.png","height":349}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Count of Vulnerabilities by Report Date","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Count of Vulnerabilities By Report Date ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a line graph of vulnerability count by report date","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Line ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":53129,"__fileMimeType":"image/png","width":438,"id":"3435fe44-639d-4390-8de9-9da3686a5c5f","collection":"contentId-3519580184","type":"file","__fileName":"count by dat 7b.png","height":232}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One bucket is needed to configure this visualization","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button and select ","type":"text"},{"text":"X-Axis","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Date Histogram","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"@timestamp\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Minimum Interval","type":"text","marks":[{"type":"strong"}]},{"text":" box, select ","type":"text"},{"text":"Daily ","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of ","type":"text"},{"text":"Vulnerability Report Date","type":"text","marks":[{"type":"strong"}]},{"text":" can be set","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":23455,"__fileMimeType":"image/png","width":196,"id":"d7e18185-6189-4169-a850-32510dd722ee","collection":"contentId-3519580184","type":"file","__fileName":"count by date 15.png","height":272}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the bucket is configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":77634,"__fileMimeType":"image/png","width":1280,"id":"26dc499e-5c70-491b-90fb-7043767c882c","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-8-46.png","height":387}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Count of High Severity Vulnerabilities by Report Date","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Count of High Severity Vulnerabilities By Report Date ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a line graph of the count of high severity vulnerabilities by date","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Line ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Two filters will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the first filter up as seen below. You will have to manually type in \"ecs-1.5.0-vulnerability in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":53129,"__fileMimeType":"image/png","width":438,"id":"14454ccd-d030-438b-bb9e-ec8eb6b270bd","collection":"contentId-3519580184","type":"file","__fileName":"count high date 7b.png","height":232}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the second filter up as seen below. You will have to manually type in 3, 4 and 5. These are the severity levels","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":11935,"__fileMimeType":"image/png","width":290,"id":"1be264be-2b8f-4450-afed-fb4367f2d17f","collection":"contentId-3519580184","type":"file","__fileName":"count high date 7c.png","height":152}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One bucket is needed to configure this visualization","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button and select ","type":"text"},{"text":"X-Axis","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Date Histogram","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"@timestamp\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Minimum Interval","type":"text","marks":[{"type":"strong"}]},{"text":" box, select ","type":"text"},{"text":"Daily ","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of ","type":"text"},{"text":"Vulnerability Report Date","type":"text","marks":[{"type":"strong"}]},{"text":" can be set","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":23455,"__fileMimeType":"image/png","width":196,"id":"a6515f86-37e8-41c4-8cf8-0d87d5c9c3d3","collection":"contentId-3519580184","type":"file","__fileName":"count high date 15.png","height":272}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the bucket is configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":81344,"__fileMimeType":"image/png","width":1280,"id":"3e695a62-3a67-4d66-9ad5-d0e06b78c773","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-9-23.png","height":382}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Count of IDS Events","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Count of IDS Events ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a line graph count of IDS events","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Line ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"trend-hids\" in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":9711,"__fileMimeType":"image/png","width":287,"id":"b5f93551-2261-44a0-a3b0-1ebd4ac0bae5","collection":"contentId-3519580184","type":"file","__fileName":"count IDS 7b.png","height":153}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One bucket is needed to configure this visualization","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button and select ","type":"text"},{"text":"X-Axis","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Date Histogram","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"@timestamp\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Minimum Interval","type":"text","marks":[{"type":"strong"}]},{"text":" box, select ","type":"text"},{"text":"Daily ","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of ","type":"text"},{"text":"Date","type":"text","marks":[{"type":"strong"}]},{"text":" can be set","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":22069,"__fileMimeType":"image/png","width":192,"id":"0bfb8108-6675-4f0f-835c-3974e7759f41","collection":"contentId-3519580184","type":"file","__fileName":"count IDS 15.png","height":267}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the bucket is configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":95388,"__fileMimeType":"image/png","width":1280,"id":"d474939e-0734-4437-8b66-89d5522bf53a","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-15_11-9-45.png","height":349}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Top 10 IDS Event Types","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Top 10 IDS Event Types ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a data table of the Top 10 types of IDS event","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Line ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"trend-hids\" in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":9711,"__fileMimeType":"image/png","width":287,"id":"6d12de91-46a0-4b29-8891-c6e695b0da6f","collection":"contentId-3519580184","type":"file","__fileName":"top IDS 7b.png","height":153}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Metric Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One bucket is needed to configure this visualization","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button and select ","type":"text"},{"text":"Split rows","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"","type":"text"},{"text":"parsed.trendmicro.name","type":"text","marks":[{"type":"link","attrs":{"href":"http://parsed.trendmicro.name"}}]},{"text":"\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by = Metric: Count, Order = Descending, Size = 10","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of ","type":"text"},{"text":"IDS Event Type Name","type":"text","marks":[{"type":"strong"}]},{"text":" can be set","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":217,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":24139,"__fileMimeType":"image/png","width":193,"id":"26d6e5f7-ffa7-46dd-ab93-54b5c4302a4a","collection":"contentId-3519580184","type":"file","__fileName":"top IDS 15.png","height":317}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the bucket is configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":176393,"__fileMimeType":"image/png","width":1057,"id":"77093b09-8b95-49d6-815e-c22188305101","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-17_16-19-38.png","height":548}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Top 5 Systems by IDS Event Count","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Top 5 Systems By IDS Event Count ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a vertical bar graph of the Top 5 systems by the total count of IDS events","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Vertical Bar ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the filter up as seen below. You will have to manually type in \"trend-hids\" in the Value field and click Save","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":43.0},"content":[{"type":"media","attrs":{"__fileSize":9711,"__fileMimeType":"image/png","width":287,"id":"17f94233-0afa-40e5-9de1-aff5b2471307","collection":"contentId-3519580184","type":"file","__fileName":"5 ids event 7b.png","height":153}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Y-Axis Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One bucket is needed to configure this visualization","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button and select ","type":"text"},{"text":"X-Axis","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"hostname\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order, & Size leave at default","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of ","type":"text"},{"text":"Hostname","type":"text","marks":[{"type":"strong"}]},{"text":" can be set","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":28.0},"content":[{"type":"media","attrs":{"__fileSize":22621,"__fileMimeType":"image/png","width":191,"id":"0ebb9a1a-4ff0-4e5c-a133-a737ac3a360e","collection":"contentId-3519580184","type":"file","__fileName":"5 ids event 15.png","height":319}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the bucket is configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start"},"content":[{"type":"media","attrs":{"__fileSize":82393,"__fileMimeType":"image/png","width":1280,"id":"c3965a78-dd73-4f28-a727-66a85dba56ce","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-17_16-20-44.png","height":644}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Security - IPRM Location","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Security — IPRM Location ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a data table with geographic country locations and security event counts coming from each country","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Data Table ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Three filters will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the first filter up as seen below","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":6757,"__fileMimeType":"image/png","width":263,"id":"6c2940ea-0804-4e7b-9046-4567a6870227","collection":"contentId-3519580184","type":"file","__fileName":"iprm7b.png","height":92}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the second filter up as seen below","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":8811,"__fileMimeType":"image/png","width":260,"id":"5c767c95-3b9d-4266-b934-72034c5947b5","collection":"contentId-3519580184","type":"file","__fileName":"iprm7c.png","height":139}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the third filter up as seen below","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":7807,"__fileMimeType":"image/png","width":264,"id":"51493839-f6db-44c5-908b-efe430b5ad50","collection":"contentId-3519580184","type":"file","__fileName":"iprm7d.png","height":96}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Metric Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One bucket is needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"src_geo.country_name\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =10 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A custom label of ","type":"text"},{"text":"Location","type":"text","marks":[{"type":"strong"}]},{"text":" can be added","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":22834,"__fileMimeType":"image/png","width":189,"id":"46bffce2-ffa5-4a70-9f88-8fa6688c3377","collection":"contentId-3519580184","type":"file","__fileName":"iprm10f.png","height":323}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":57321,"__fileMimeType":"image/png","width":1268,"id":"9c8cdd37-6fb1-45c4-a67e-0df0f9a1f41e","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-17_16-21-29.png","height":493}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Windows Successful Logins","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Windows Successful Logins ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a data table listing hostname, timestamp and the message log for successful logins on Windows systems","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Data Table ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the first filter up as seen below. The value in Field is wineventlog.event_id","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":9131,"__fileMimeType":"image/png","width":261,"id":"80d139f0-cc0a-495c-8a05-05d76e182a29","collection":"contentId-3519580184","type":"file","__fileName":"1.png","height":140}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Metric Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Three buckets are needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 1 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"@timestamp\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =5 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the first bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":21430,"__fileMimeType":"image/png","width":192,"id":"ab951ee9-5630-48e5-989a-b4098eeed13e","collection":"contentId-3519580184","type":"file","__fileName":"2.png","height":323}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 2 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"hostname\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the second bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":22134,"__fileMimeType":"image/png","width":193,"id":"384ea2b6-4e5c-45f4-b1c1-19bf7fc4c8ea","collection":"contentId-3519580184","type":"file","__fileName":"3.png","height":323}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 3 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"message\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the third bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":21888,"__fileMimeType":"image/png","width":191,"id":"1bb5eeac-0f59-40e2-be5b-554bf1197ba8","collection":"contentId-3519580184","type":"file","__fileName":"4.png","height":321}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":522883,"__fileMimeType":"image/png","width":988,"id":"6a4f3792-d61a-40fe-aa38-60c65f606eef","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-17_16-23-13.png","height":626}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Windows Failed Logins","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Windows Failed Logins ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a data table listing hostname, timestamp and the message log for failed logins on Windows systems","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Data Table ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"One filter will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the first filter up as seen below. The value in Field is wineventlog.event_id","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":9131,"__fileMimeType":"image/png","width":261,"id":"80d139f0-cc0a-495c-8a05-05d76e182a29","collection":"contentId-3519580184","type":"file","__fileName":"1.png","height":140}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Metric Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Three buckets are needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 1 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"@timestamp\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =5 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the first bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":21430,"__fileMimeType":"image/png","width":192,"id":"ab951ee9-5630-48e5-989a-b4098eeed13e","collection":"contentId-3519580184","type":"file","__fileName":"2.png","height":323}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 2 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"hostname\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the second bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":22134,"__fileMimeType":"image/png","width":193,"id":"384ea2b6-4e5c-45f4-b1c1-19bf7fc4c8ea","collection":"contentId-3519580184","type":"file","__fileName":"3.png","height":323}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 3 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"message\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the third bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":21888,"__fileMimeType":"image/png","width":191,"id":"1bb5eeac-0f59-40e2-be5b-554bf1197ba8","collection":"contentId-3519580184","type":"file","__fileName":"4.png","height":321}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":414,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":409989,"__fileMimeType":"image/png","width":1026,"id":"7ed4d936-4abf-4666-928e-aa23661c9441","collection":"contentId-3519580184","type":"file","__fileName":"image2020-12-17_16-22-7.png","height":545}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Linux Successful Logins","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Linux Successful Logins ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a data table listing hostname, timestamp and the message log for successful logins on Linux systems","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Data Table ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Two filters will be applied to this visualization:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add Filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the first filter up as seen below","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":11777,"__fileMimeType":"image/png","width":277,"id":"63fe6cd3-bc91-4729-8d9f-ab7213d365e9","collection":"contentId-3519580184","type":"file","__fileName":"succlinux1.png","height":146}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the second filter up as seen below","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":14796,"__fileMimeType":"image/png","width":277,"id":"dd69bb2c-720d-4f47-90aa-72d8ef33f227","collection":"contentId-3519580184","type":"file","__fileName":"succlinux2.png","height":192}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Metric Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Three buckets are needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 1 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"@timestamp\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the first bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":22064,"__fileMimeType":"image/png","width":191,"id":"d54009fe-5e49-412f-83c6-040f5ba42402","collection":"contentId-3519580184","type":"file","__fileName":"succlinux3.png","height":324}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 2 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"hostname\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the second bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":22134,"__fileMimeType":"image/png","width":193,"id":"70a700c9-1a73-41ab-8486-22711fb40436","collection":"contentId-3519580184","type":"file","__fileName":"succlinux4.png","height":323}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 3 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"message\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the third bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":21888,"__fileMimeType":"image/png","width":191,"id":"9375504d-875f-4567-b4c7-27ae10b6a2cb","collection":"contentId-3519580184","type":"file","__fileName":"5.png","height":321}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"wide","width":828,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":83855,"__fileMimeType":"image/png","width":970,"id":"71c94726-e9ba-4c89-8089-0acb0424d6e6","collection":"contentId-3519580184","type":"file","__fileName":"succlinux5.png","height":246}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Linux Failed Logins","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Linux Failed Logins ","type":"text","marks":[{"type":"strong"}]},{"text":"report will show you a data table listing hostname, timestamp and the message log for failed logins on Linux systems","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Data Table ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner accountId may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Two filters will be applied to this visualization: ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on Add filter","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the first filter up as seen below","type":"text"},{"type":"hardBreak"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"width":"300","id":"75fbad61-4a65-4d50-bea9-c1b2208a1e15","collection":"contentId-3519580184","height":""}}},{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the second filter up as seen below","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":11747,"__fileMimeType":"image/png","width":263,"id":"a0bbdc5b-284e-4104-80f4-1192c06f8495","collection":"contentId-3519580184","type":"file","__fileName":"failedlinux2.png","height":141}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under metrics this should already be set to Metric Count. No change is needed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Three buckets are needed to configure this visualization.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 1 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"@timestamp\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the first bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":22064,"__fileMimeType":"image/png","width":191,"id":"f17a682b-0623-4bab-b229-986f05c8c56c","collection":"contentId-3519580184","type":"file","__fileName":"failedlinux3.png","height":324}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 2 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"hostname\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the second bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":22134,"__fileMimeType":"image/png","width":193,"id":"6e81defe-94e4-4a20-9902-209c9ce19fe1","collection":"contentId-3519580184","type":"file","__fileName":"failedlinux4.png","height":323}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Bucket 3 configuration","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, and select ","type":"text"},{"text":"Split Rows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"message\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order = Descending and Size =1000 (can vary depending on how long you want the list)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Properly configured, the third bucket configuration will look like the screenshot below:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":210,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":21888,"__fileMimeType":"image/png","width":191,"id":"9375504d-875f-4567-b4c7-27ae10b6a2cb","collection":"contentId-3519580184","type":"file","__fileName":"5.png","height":321}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When the buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added to narrow down the results if desired.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text"},{"text":"Visualizations ","type":"text","marks":[{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for Example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"wide","width":828,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":146116,"__fileMimeType":"image/png","width":958,"id":"766f38fb-7a46-4aaf-983e-c0b6322047e6","collection":"contentId-3519580184","type":"file","__fileName":"Linux_Failed_Logins.png","height":500}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"PCI Flagged Vulnerabilities","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"\"Create new visualization\"","type":"text","marks":[{"type":"strong"}]},{"text":" and scroll down and select ","type":"text"},{"text":"\"Data Table\"","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources, select __customer.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner account Id may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under ","type":"text"},{"text":"\"Buckets\"","type":"text","marks":[{"type":"strong"}]},{"text":", select ","type":"text"},{"text":"\"Add\"","type":"text","marks":[{"type":"strong"}]},{"text":" and then ","type":"text"},{"text":"\"Split Rows\"","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":341,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":10862,"__fileMimeType":"image/png","width":236,"id":"2e6bde9f-3587-4517-a480-c86123ade752","collection":"contentId-3519580184","type":"file","__fileName":"pci viz1.png","height":171}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"\"Terms\"","type":"text","marks":[{"type":"strong"}]},{"text":" for the Aggregation, and type in ","type":"text"},{"text":"\"vulnerability.pci_flag\"","type":"text","marks":[{"type":"strong"}]},{"text":" for the field and hit the blue arrow at the top of the box","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":341,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":7434,"__fileMimeType":"image/png","width":260,"id":"ca7702c5-83b1-452d-8a57-a783d7950591","collection":"contentId-3519580184","type":"file","__fileName":"pcivis2.png","height":99}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Next, select ","type":"text"},{"text":"\"+Add filter\"","type":"text","marks":[{"type":"strong"}]},{"text":" , and type ","type":"text"},{"text":"\"vulnerability.description\"","type":"text","marks":[{"type":"strong"}]},{"text":" for Field, ","type":"text"},{"text":"\"Exists\"","type":"text","marks":[{"type":"strong"}]},{"text":" as the Operator and hit ","type":"text"},{"text":"\"Save\"","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":341,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":13781,"__fileMimeType":"image/png","width":274,"id":"8c542d4d-19f9-4542-95c9-caf21e5e0f46","collection":"contentId-3519580184","type":"file","__fileName":"pcivis3.png","height":199}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add another filter by selecting ","type":"text"},{"text":"''+Add filter\"","type":"text","marks":[{"type":"strong"}]},{"text":", and type ","type":"text"},{"text":"''vulnerability.pci_flag\"","type":"text","marks":[{"type":"strong"}]},{"text":" for Field, and ","type":"text"},{"text":"\"is\"","type":"text","marks":[{"type":"strong"}]},{"text":" for Operator. Type the number ","type":"text"},{"text":"\"1\"","type":"text","marks":[{"type":"strong"}]},{"text":" in Value and hit \"Save\"","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":341,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":17279,"__fileMimeType":"image/png","width":340,"id":"6072a93e-22fc-44a8-a2bb-2b5a90c4d4a1","collection":"contentId-3519580184","type":"file","__fileName":"pcivis4.png","height":268}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure to adjust the time if you are not getting any data to populate.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Don't forget to save your Visualization at the top left.","type":"text"}]}]}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Expand for example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":726,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":50306,"__fileMimeType":"image/png","width":1280,"id":"81580cf8-3c5d-4dc2-83e2-9f82c4b7b4b2","collection":"contentId-3519580184","type":"file","__fileName":"pcivis5.png","height":441}}]}]},{"type":"paragraph"}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"CSPM: Failed by Severity","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"CSPM: Failed by Severity","type":"text","marks":[{"type":"strong"}]},{"text":" visualization is a pie chart that displays failed reports by severity.","type":"text"}]},{"type":"paragraph"},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Click for steps..."},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"\"Create new visualization\"","type":"text","marks":[{"type":"strong"}]},{"text":" and scroll down and select ","type":"text"},{"text":"\"Pie\"","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In sources select __customer.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Partner account Id may be 1 or another number. Select the source matching the account number in the top right corner of the AMP page or listed on the Account page followed by \"_customer\".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"\"Add filter\"","type":"text","marks":[{"type":"strong"}]},{"text":" to filter to the failed report data:","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Type ''event.outcome\" in ","type":"text"},{"text":"Operator","type":"text","marks":[{"type":"strong"}]},{"text":" is ''is'', and ","type":"text"},{"text":"Value","type":"text","marks":[{"type":"strong"}]},{"text":" is \"FAIL\". Then hit ''Save\"","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":341,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":17112,"__fileMimeType":"image/png","width":408,"id":"ee7061e8-76a7-4ab4-86ff-6ac9f2d43fc5","collection":"contentId-3519580184","type":"file","__fileName":"cspmvis1.png","height":320}}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(If you receive an error, change the time field to the last 30 days to expand your search)","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Navigate to ","type":"text"},{"text":"Buckets,","type":"text","marks":[{"type":"strong"}]},{"text":" add bucket and select \"","type":"text"},{"text":"Split slices\"","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":341,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":16062,"__fileMimeType":"image/png","width":329,"id":"55c89bd8-8f29-45e2-8217-99370f47dfcd","collection":"contentId-3519580184","type":"file","__fileName":"cspmvis2.png","height":192}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Aggregation","type":"text","marks":[{"type":"strong"}]},{"text":"= Terms, type '","type":"text"},{"text":"'event.severity''","type":"text","marks":[{"type":"strong"}]},{"text":" for Field","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":341,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":13140,"__fileMimeType":"image/png","width":318,"id":"ebf92b86-38a3-4662-810d-f8451fa6ff9d","collection":"contentId-3519580184","type":"file","__fileName":"cspmvis3.png","height":331}}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To confirm those changes, click the blue box with a triangle:","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":330,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":5809,"__fileMimeType":"image/png","width":331,"id":"0ef9987e-085d-48da-9123-46d44b28006c","collection":"contentId-3519580184","type":"file","__fileName":"cspmvis4.png","height":150}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Don't forget to save your Visualization at the top left","type":"text"}]}]}]}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph"},{"type":"expand","attrs":{"title":"Expand for example..."},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":726,"widthType":"pixel"},"content":[{"type":"media","attrs":{"__fileSize":19913,"__fileMimeType":"image/png","width":1128,"id":"d2535279-74e0-4d23-9032-db05a5e5c9b4","collection":"contentId-3519580184","type":"file","__fileName":"cspmvis5.png","height":560}}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]}],"version":1}

Browser not supported