Grafana dashboard: NGINX NAP - Attack Signatures
Description: This Dashboard provides more visibility into the logs generated by NGINX App Protect. This is part of a series of NGINX App Protect Dashboards

Please refer to the [GitHub Repo](https://github.com/skenderidis/nap-dashboard) for details on how to setup the entire solution that includes the following Dashboards:
- NAP Main Dashboard
- BOT Dashboard
- Attack Signatures Dashboard
- Support ID
- more

{
  "__inputs": [
    {
      "name": "DS_WAF-DECODED",
      "label": "WAF-Decoded",
      "description": "",
      "type": "datasource",
      "pluginId": "elasticsearch",
      "pluginName": "Elasticsearch"
    }
  ],
  "__elements": [],
  "__requires": [
    {
      "type": "panel",
      "id": "barchart",
      "name": "Bar chart",
      "version": ""
    },
    {
      "type": "datasource",
      "id": "elasticsearch",
      "name": "Elasticsearch",
      "version": "1.0.0"
    },
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "8.3.6"
    },
    {
      "type": "panel",
      "id": "piechart",
      "name": "Pie chart",
      "version": ""
    },
    {
      "type": "panel",
      "id": "stat",
      "name": "Stat",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    },
    {
      "type": "panel",
      "id": "timeseries",
      "name": "Time series",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "target": {
          "limit": 100,
          "matchAny": false,
          "tags": [],
          "type": "dashboard"
        },
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 0,
  "id": null,
  "iteration": 1651034266503,
  "links": [],
  "liveNow": false,
  "panels": [
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 50,
      "panels": [
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "palette-classic"
              },
              "custom": {
                "hideFrom": {
                  "legend": false,
                  "tooltip": false,
                  "viz": false
                }
              },
              "mappings": [],
              "unit": "short"
            },
            "overrides": []
          },
          "gridPos": {
            "h": 6,
            "w": 3,
            "x": 0,
            "y": 1
          },
          "id": 51,
          "options": {
            "displayLabels": [
              "name",
              "percent"
            ],
            "legend": {
              "displayMode": "hidden",
              "placement": "bottom",
              "values": [
                "percent"
              ]
            },
            "pieType": "pie",
            "reduceOptions": {
              "calcs": [
                "lastNotNull"
              ],
              "fields": "",
              "values": true
            },
            "tooltip": {
              "mode": "multi"
            }
          },
          "pluginVersion": "8.3.3",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "request_status.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "15"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Blocked",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "violations.keyword": 0
                },
                "renameByName": {
                  "Count": "",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "Unique Signatures",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count uri.keyword": "URLs",
                  "details.violation.sig_data.sig_id.keyword": "Signature ID",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            },
            {
              "id": "convertFieldType",
              "options": {
                "conversions": [],
                "fields": {}
              }
            }
          ],
          "type": "piechart"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "palette-classic"
              },
              "custom": {
                "hideFrom": {
                  "legend": false,
                  "tooltip": false,
                  "viz": false
                }
              },
              "mappings": [],
              "unit": "short"
            },
            "overrides": []
          },
          "gridPos": {
            "h": 6,
            "w": 3,
            "x": 3,
            "y": 1
          },
          "id": 52,
          "options": {
            "displayLabels": [
              "name",
              "percent"
            ],
            "legend": {
              "displayMode": "hidden",
              "placement": "bottom",
              "values": [
                "percent"
              ]
            },
            "pieType": "pie",
            "reduceOptions": {
              "calcs": [
                "lastNotNull"
              ],
              "fields": "",
              "values": true
            },
            "tooltip": {
              "mode": "multi"
            }
          },
          "pluginVersion": "8.3.3",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "signature-details.risk.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "15"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Signature Risk",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "violations.keyword": 0
                },
                "renameByName": {
                  "Count": "",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "Unique Signatures",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count uri.keyword": "URLs",
                  "details.violation.sig_data.sig_id.keyword": "Signature ID",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            },
            {
              "id": "convertFieldType",
              "options": {
                "conversions": [],
                "fields": {}
              }
            }
          ],
          "type": "piechart"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "palette-classic"
              },
              "custom": {
                "hideFrom": {
                  "legend": false,
                  "tooltip": false,
                  "viz": false
                }
              },
              "mappings": [],
              "unit": "short"
            },
            "overrides": []
          },
          "gridPos": {
            "h": 6,
            "w": 3,
            "x": 6,
            "y": 1
          },
          "id": 53,
          "options": {
            "displayLabels": [
              "name",
              "percent"
            ],
            "legend": {
              "displayMode": "hidden",
              "placement": "bottom",
              "values": [
                "percent"
              ]
            },
            "pieType": "pie",
            "reduceOptions": {
              "calcs": [
                "lastNotNull"
              ],
              "fields": "",
              "values": true
            },
            "tooltip": {
              "mode": "multi"
            }
          },
          "pluginVersion": "8.3.3",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "client_class.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "15"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Bots",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "violations.keyword": 0
                },
                "renameByName": {
                  "Count": "",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "Unique Signatures",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count uri.keyword": "URLs",
                  "details.violation.sig_data.sig_id.keyword": "Signature ID",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            },
            {
              "id": "convertFieldType",
              "options": {
                "conversions": [],
                "fields": {}
              }
            }
          ],
          "type": "piechart"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "palette-classic"
              },
              "custom": {
                "hideFrom": {
                  "legend": false,
                  "tooltip": false,
                  "viz": false
                }
              },
              "mappings": [],
              "unit": "short"
            },
            "overrides": []
          },
          "gridPos": {
            "h": 6,
            "w": 3,
            "x": 9,
            "y": 1
          },
          "id": 54,
          "options": {
            "displayLabels": [
              "name",
              "percent"
            ],
            "legend": {
              "displayMode": "hidden",
              "placement": "bottom",
              "values": [
                "percent"
              ]
            },
            "pieType": "pie",
            "reduceOptions": {
              "calcs": [
                "lastNotNull"
              ],
              "fields": "",
              "values": true
            },
            "tooltip": {
              "mode": "multi"
            }
          },
          "pluginVersion": "8.3.3",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "bot_signature_name.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "15"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Bot Name",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "violations.keyword": 0
                },
                "renameByName": {
                  "Count": "",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "Unique Signatures",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count uri.keyword": "URLs",
                  "details.violation.sig_data.sig_id.keyword": "Signature ID",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            },
            {
              "id": "convertFieldType",
              "options": {
                "conversions": [],
                "fields": {}
              }
            }
          ],
          "type": "piechart"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "palette-classic"
              },
              "custom": {
                "hideFrom": {
                  "legend": false,
                  "tooltip": false,
                  "viz": false
                }
              },
              "mappings": [],
              "unit": "short"
            },
            "overrides": []
          },
          "gridPos": {
            "h": 6,
            "w": 3,
            "x": 12,
            "y": 1
          },
          "id": 56,
          "options": {
            "displayLabels": [
              "name",
              "percent"
            ],
            "legend": {
              "displayMode": "hidden",
              "placement": "bottom",
              "values": [
                "percent"
              ]
            },
            "pieType": "pie",
            "reduceOptions": {
              "calcs": [
                "lastNotNull"
              ],
              "fields": "",
              "values": true
            },
            "tooltip": {
              "mode": "multi"
            }
          },
          "pluginVersion": "8.3.3",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "blocking_exception_reason.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "15"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Blocking Exception",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "violations.keyword": 0
                },
                "renameByName": {
                  "Count": "",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "Unique Signatures",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count uri.keyword": "URLs",
                  "details.violation.sig_data.sig_id.keyword": "Signature ID",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            },
            {
              "id": "convertFieldType",
              "options": {
                "conversions": [],
                "fields": {}
              }
            }
          ],
          "type": "piechart"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "palette-classic"
              },
              "custom": {
                "hideFrom": {
                  "legend": false,
                  "tooltip": false,
                  "viz": false
                }
              },
              "mappings": [],
              "unit": "short"
            },
            "overrides": []
          },
          "gridPos": {
            "h": 6,
            "w": 3,
            "x": 15,
            "y": 1
          },
          "id": 57,
          "options": {
            "displayLabels": [
              "name",
              "percent"
            ],
            "legend": {
              "displayMode": "hidden",
              "placement": "bottom",
              "values": [
                "percent"
              ]
            },
            "pieType": "pie",
            "reduceOptions": {
              "calcs": [
                "lastNotNull"
              ],
              "fields": "",
              "values": true
            },
            "tooltip": {
              "mode": "multi"
            }
          },
          "pluginVersion": "8.3.3",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "method.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "15"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Methods",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "violations.keyword": 0
                },
                "renameByName": {
                  "Count": "",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "Unique Signatures",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count uri.keyword": "URLs",
                  "details.violation.sig_data.sig_id.keyword": "Signature ID",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            },
            {
              "id": "convertFieldType",
              "options": {
                "conversions": [],
                "fields": {}
              }
            }
          ],
          "type": "piechart"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": false
              },
              "mappings": [],
              "thresholds": {
                "mode": "percentage",
                "steps": [
                  {
                    "color": "red"
                  },
                  {
                    "color": "green",
                    "value": 90
                  }
                ]
              },
              "unit": "short"
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Hits"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 90
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 6,
            "w": 6,
            "x": 18,
            "y": 1
          },
          "id": 62,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 1,
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.3",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "sig_cves.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "10"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "NOT sig_cves.keyword:\"N/A\" && signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "CVEs",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "uri.keyword": 0
                },
                "renameByName": {
                  "Count": "Hits",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "IPs",
                  "Unique Count ip_client": "IPs",
                  "Unique Count violations.keyword": "Violations",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "policy_name.keyword": "Policy Name",
                  "sig_cves.keyword": "CVEs",
                  "uri.keyword": "URLs"
                }
              }
            }
          ],
          "type": "table"
        }
      ],
      "title": "Details",
      "type": "row"
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 1
      },
      "id": 32,
      "panels": [],
      "title": "Main",
      "type": "row"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 0,
        "y": 2
      },
      "id": 23,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "8.3.6",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto"
              },
              "type": "date_histogram"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "id": "1",
              "type": "count"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "Signature Hits",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 3,
        "y": 2
      },
      "id": 21,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "/^Unique Count$/",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "8.3.6",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "details.sig_data.sig_id.keyword",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "field": "details.sig_data.sig_id.keyword",
              "id": "1",
              "type": "cardinality"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "Unique Signatures",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "axisLabel": "",
            "axisPlacement": "auto",
            "axisSoftMin": 0,
            "fillOpacity": 80,
            "gradientMode": "none",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineWidth": 1
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "yellow",
                "value": null
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 10,
        "w": 7,
        "x": 6,
        "y": 2
      },
      "id": 13,
      "options": {
        "barWidth": 0.97,
        "groupWidth": 0.7,
        "legend": {
          "calcs": [],
          "displayMode": "hidden",
          "placement": "bottom"
        },
        "orientation": "horizontal",
        "showValue": "auto",
        "stacking": "none",
        "tooltip": {
          "mode": "single"
        },
        "xTickLabelRotation": 0
      },
      "pluginVersion": "8.3.3",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "details.context.keyword",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "1",
                "size": "15"
              },
              "type": "terms"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "id": "1",
              "type": "count"
            },
            {
              "field": "details.sig_data.sig_id.keyword",
              "id": "3",
              "type": "cardinality"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "Signature Context",
      "transformations": [
        {
          "id": "organize",
          "options": {
            "excludeByName": {},
            "indexByName": {
              "Count 1": 1,
              "Count 2": 2,
              "violations.keyword": 0
            },
            "renameByName": {
              "Count": "Signature Hits",
              "Count 1": "Hits",
              "Count 2": "Blocked",
              "Unique Count": "Unique Signatures",
              "Unique Count ip_client": "IPs",
              "Unique Count policy_name.keyword": "Policies",
              "Unique Count uri.keyword": "URLs",
              "details.violation.sig_data.sig_id.keyword": "Signature ID",
              "details.violation.viol_name.keyword": "Violations",
              "ip_client": "IP address",
              "sig_names.keyword": "Signatures",
              "violations.keyword": "Violations"
            }
          }
        },
        {
          "id": "convertFieldType",
          "options": {
            "conversions": [],
            "fields": {}
          }
        }
      ],
      "type": "barchart"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": [],
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 10,
        "w": 5,
        "x": 13,
        "y": 2
      },
      "id": 29,
      "options": {
        "displayLabels": [
          "name",
          "percent"
        ],
        "legend": {
          "displayMode": "list",
          "placement": "bottom",
          "values": [
            "value"
          ]
        },
        "pieType": "pie",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": true
        },
        "tooltip": {
          "mode": "multi"
        }
      },
      "pluginVersion": "8.3.3",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "signature-details.accuracy.keyword",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "1",
                "size": "15"
              },
              "type": "terms"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "id": "1",
              "type": "count"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "Signature Accuracy",
      "transformations": [
        {
          "id": "organize",
          "options": {
            "excludeByName": {},
            "indexByName": {
              "Count 1": 1,
              "Count 2": 2,
              "violations.keyword": 0
            },
            "renameByName": {
              "Count": "",
              "Count 1": "Hits",
              "Count 2": "Blocked",
              "Unique Count": "Unique Signatures",
              "Unique Count ip_client": "IPs",
              "Unique Count policy_name.keyword": "Policies",
              "Unique Count uri.keyword": "URLs",
              "details.violation.sig_data.sig_id.keyword": "Signature ID",
              "details.violation.viol_name.keyword": "Violations",
              "ip_client": "IP address",
              "sig_names.keyword": "Signatures",
              "violations.keyword": "Violations"
            }
          }
        },
        {
          "id": "convertFieldType",
          "options": {
            "conversions": [],
            "fields": {}
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "displayMode": "auto",
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "percentage",
            "steps": [
              {
                "color": "red",
                "value": null
              },
              {
                "color": "green",
                "value": 90
              }
            ]
          },
          "unit": "short"
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "Hits"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 90
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 18,
        "y": 2
      },
      "id": 22,
      "options": {
        "footer": {
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "frameIndex": 1,
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "8.3.6",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "policy_name.keyword",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "1",
                "size": "10"
              },
              "type": "terms"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "id": "1",
              "type": "count"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "Policies",
      "transformations": [
        {
          "id": "organize",
          "options": {
            "excludeByName": {},
            "indexByName": {
              "Count 1": 1,
              "Count 2": 2,
              "uri.keyword": 0
            },
            "renameByName": {
              "Count": "Hits",
              "Count 1": "Hits",
              "Count 2": "Blocked",
              "Unique Count": "IPs",
              "Unique Count ip_client": "IPs",
              "Unique Count violations.keyword": "Violations",
              "details.violation.viol_name.keyword": "Violations",
              "ip_client": "IP address",
              "policy_name.keyword": "Policy Name",
              "uri.keyword": "URLs"
            }
          }
        }
      ],
      "type": "table"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 0,
        "y": 7
      },
      "id": 19,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "/^Unique Count$/",
          "values": true
        },
        "textMode": "auto"
      },
      "pluginVersion": "8.3.6",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "@version",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "_term",
                "size": "10"
              },
              "type": "terms"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "field": "support_id.keyword",
              "id": "1",
              "type": "cardinality"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "URL Transactions",
      "transformations": [],
      "type": "stat"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 3,
        "y": 7
      },
      "id": 20,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "/^Unique Count$/",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "8.3.6",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "@version",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "field": "source_host",
              "id": "1",
              "type": "cardinality"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "Attackers",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "displayMode": "auto",
            "filterable": true
          },
          "mappings": [],
          "thresholds": {
            "mode": "percentage",
            "steps": [
              {
                "color": "red",
                "value": null
              },
              {
                "color": "green",
                "value": 90
              }
            ]
          },
          "unit": "short"
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "Hits"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 87
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Signatures"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 104
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "URLs"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 71
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Policies"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 82
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Client IP"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 202
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 9,
        "w": 8,
        "x": 0,
        "y": 12
      },
      "id": 47,
      "options": {
        "footer": {
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "frameIndex": 1,
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "8.3.6",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "source_host",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "1",
                "size": "100"
              },
              "type": "terms"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "id": "1",
              "type": "count"
            },
            {
              "field": "uri.keyword",
              "id": "3",
              "type": "cardinality"
            },
            {
              "field": "sig_id.keyword",
              "id": "4",
              "type": "cardinality"
            },
            {
              "field": "policy_name.keyword",
              "id": "5",
              "type": "cardinality"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "IPs",
      "transformations": [
        {
          "id": "organize",
          "options": {
            "excludeByName": {},
            "indexByName": {
              "Count 1": 1,
              "Count 2": 2,
              "violations.keyword": 0
            },
            "renameByName": {
              "Count": "Hits",
              "Count 1": "Hits",
              "Count 2": "Blocked",
              "Unique Count": "IPs",
              "Unique Count ip_client": "IPs",
              "Unique Count policy_name.keyword": "Policies",
              "Unique Count sig_id.keyword": "Signatures",
              "Unique Count source_host": "IPs",
              "Unique Count uri.keyword": "URLs",
              "details.parameter_data.name.keyword": "Parameter Name",
              "details.parameter_data.value.keyword": "Most Common Value",
              "details.violation.viol_name.keyword": "Violations",
              "ip_client": "IP address",
              "sig_names.keyword": "Signatures",
              "signature-details.name.keyword": "Signature Name",
              "signature-details.sig_id": "Signature ID",
              "source_host": "Client IP",
              "uri.keyword": "URL",
              "violations.keyword": "Violations"
            }
          }
        }
      ],
      "type": "table"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "axisLabel": "",
            "axisPlacement": "auto",
            "barAlignment": 0,
            "drawStyle": "bars",
            "fillOpacity": 0,
            "gradientMode": "none",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineInterpolation": "linear",
            "lineWidth": 2,
            "pointSize": 5,
            "scaleDistribution": {
              "type": "linear"
            },
            "showPoints": "auto",
            "spanNulls": false,
            "stacking": {
              "group": "A",
              "mode": "none"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 9,
        "w": 16,
        "x": 8,
        "y": 12
      },
      "id": 8,
      "maxDataPoints": 500,
      "options": {
        "legend": {
          "calcs": [
            "sum"
          ],
          "displayMode": "table",
          "placement": "right",
          "sortBy": "Total",
          "sortDesc": true
        },
        "tooltip": {
          "mode": "multi"
        }
      },
      "pluginVersion": "8.3.3",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "signature-details.name.keyword",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "3",
                "size": "20"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "4",
              "settings": {
                "interval": "auto",
                "min_doc_count": "0",
                "timeZone": "utc",
                "trimEdges": "0"
              },
              "type": "date_histogram"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "id": "3",
              "type": "count"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "Top 20 Signature Hits over Time",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "displayMode": "auto",
            "filterable": true
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          },
          "unit": "short"
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "Hits"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 92
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "IPs"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 69
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "URLs"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 71
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Policies"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 82
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Signature ID"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 110
              },
              {
                "id": "unit"
              },
              {
                "id": "custom.displayMode",
                "value": "color-background-solid"
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Accuracy"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 92
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Risk"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 72
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 12,
        "w": 13,
        "x": 0,
        "y": 21
      },
      "id": 28,
      "options": {
        "footer": {
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "frameIndex": 1,
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "8.3.6",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "signature-details.name.keyword",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "1",
                "size": "100"
              },
              "type": "terms"
            },
            {
              "field": "signature-details.sig_id",
              "id": "6",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "1",
                "size": "1"
              },
              "type": "terms"
            },
            {
              "field": "signature-details.accuracy.keyword",
              "id": "7",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "_term",
                "size": "10"
              },
              "type": "terms"
            },
            {
              "field": "signature-details.risk.keyword",
              "id": "8",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "_term",
                "size": "10"
              },
              "type": "terms"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "id": "1",
              "type": "count"
            },
            {
              "field": "source_host",
              "id": "3",
              "type": "cardinality"
            },
            {
              "field": "uri.keyword",
              "id": "4",
              "type": "cardinality"
            },
            {
              "field": "policy_name.keyword",
              "id": "5",
              "type": "cardinality"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "Signature Names",
      "transformations": [
        {
          "id": "organize",
          "options": {
            "excludeByName": {},
            "indexByName": {
              "Count": 4,
              "Unique Count policy_name.keyword": 7,
              "Unique Count source_host": 5,
              "Unique Count uri.keyword": 6,
              "signature-details.accuracy.keyword": 2,
              "signature-details.name.keyword": 0,
              "signature-details.risk.keyword": 3,
              "signature-details.sig_id": 1
            },
            "renameByName": {
              "Count": "Hits",
              "Count 1": "Hits",
              "Count 2": "Blocked",
              "Unique Count": "IPs",
              "Unique Count ip_client": "IPs",
              "Unique Count policy_name.keyword": "Policies",
              "Unique Count source_host": "IPs",
              "Unique Count uri.keyword": "URLs",
              "details.parameter_data.name.keyword": "Parameter Name",
              "details.parameter_data.value.keyword": "Most Common Value",
              "details.violation.viol_name.keyword": "Violations",
              "ip_client": "IP address",
              "sig_names.keyword": "Signatures",
              "signature-details.accuracy.keyword": "Accuracy",
              "signature-details.name.keyword": "Signature Name",
              "signature-details.risk.keyword": "Risk",
              "signature-details.sig_id": "Signature ID",
              "violations.keyword": "Violations"
            }
          }
        }
      ],
      "type": "table"
    },
    {
      "datasource": {
        "type": "elasticsearch",
        "uid": "${DS_WAF-DECODED}"
      },
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "displayMode": "auto",
            "filterable": true
          },
          "mappings": [],
          "thresholds": {
            "mode": "percentage",
            "steps": [
              {
                "color": "red",
                "value": null
              },
              {
                "color": "green",
                "value": 90
              }
            ]
          },
          "unit": "short"
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "Violations"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 285
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Hits"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 87
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Blocked"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 114
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Signatures"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 104
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "IPs"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 70
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "URLs"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 71
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Policies"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 82
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "details.violation.parameter_data.name.keyword"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 362
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "details.violation.parameter_data.value.keyword"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 251
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "signature-details.sig_id"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 189
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 12,
        "w": 11,
        "x": 13,
        "y": 21
      },
      "id": 30,
      "options": {
        "footer": {
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "frameIndex": 1,
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "8.3.6",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "field": "uri.keyword",
              "id": "2",
              "settings": {
                "min_doc_count": "1",
                "order": "desc",
                "orderBy": "1",
                "size": "100"
              },
              "type": "terms"
            }
          ],
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "metrics": [
            {
              "id": "1",
              "type": "count"
            },
            {
              "field": "source_host",
              "id": "3",
              "type": "cardinality"
            },
            {
              "field": "sig_id.keyword",
              "id": "4",
              "type": "cardinality"
            },
            {
              "field": "policy_name.keyword",
              "id": "5",
              "type": "cardinality"
            }
          ],
          "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "title": "URLs",
      "transformations": [
        {
          "id": "organize",
          "options": {
            "excludeByName": {},
            "indexByName": {
              "Count 1": 1,
              "Count 2": 2,
              "violations.keyword": 0
            },
            "renameByName": {
              "Count": "Hits",
              "Count 1": "Hits",
              "Count 2": "Blocked",
              "Unique Count": "IPs",
              "Unique Count ip_client": "IPs",
              "Unique Count policy_name.keyword": "Policies",
              "Unique Count sig_id.keyword": "Signatures",
              "Unique Count source_host": "IPs",
              "Unique Count uri.keyword": "URLs",
              "details.parameter_data.name.keyword": "Parameter Name",
              "details.parameter_data.value.keyword": "Most Common Value",
              "details.violation.viol_name.keyword": "Violations",
              "ip_client": "IP address",
              "sig_names.keyword": "Signatures",
              "signature-details.name.keyword": "Signature Name",
              "signature-details.sig_id": "Signature ID",
              "uri.keyword": "URL",
              "violations.keyword": "Violations"
            }
          }
        }
      ],
      "type": "table"
    },
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 33
      },
      "id": 15,
      "panels": [
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "percentage",
                "steps": [
                  {
                    "color": "red"
                  },
                  {
                    "color": "green",
                    "value": 90
                  }
                ]
              },
              "unit": "short"
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Hits"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 87
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Signatures"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 556
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "IPs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 69
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "URLs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 71
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Policies"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 82
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Most Common Value"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "color-background-solid"
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 8,
            "w": 13,
            "x": 0,
            "y": 3
          },
          "id": 6,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 1,
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "details.parameter_data.name.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "100"
                  },
                  "type": "terms"
                },
                {
                  "field": "details.parameter_data.value.keyword",
                  "id": "6",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                },
                {
                  "field": "source_host",
                  "id": "3",
                  "type": "cardinality"
                },
                {
                  "field": "uri.keyword",
                  "id": "4",
                  "type": "cardinality"
                },
                {
                  "field": "policy_name.keyword",
                  "id": "5",
                  "type": "cardinality"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Parameter Names",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "violations.keyword": 0
                },
                "renameByName": {
                  "Count": "Hits",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "IPs",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count source_host": "IPs",
                  "Unique Count uri.keyword": "URLs",
                  "details.parameter_data.name.keyword": "Parameter Name",
                  "details.parameter_data.value.keyword": "Most Common Value",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            }
          ],
          "type": "table"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "percentage",
                "steps": [
                  {
                    "color": "orange"
                  }
                ]
              },
              "unit": "short"
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Hits"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 87
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "IPs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 69
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "URLs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 71
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Policies"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 82
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Parameters"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 110
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 8,
            "w": 11,
            "x": 13,
            "y": 3
          },
          "id": 27,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 1,
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "details.parameter_data.value.keyword",
                  "id": "6",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "100"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                },
                {
                  "field": "source_host",
                  "id": "3",
                  "type": "cardinality"
                },
                {
                  "field": "uri.keyword",
                  "id": "4",
                  "type": "cardinality"
                },
                {
                  "field": "policy_name.keyword",
                  "id": "5",
                  "type": "cardinality"
                },
                {
                  "field": "details.parameter_data.name.keyword",
                  "id": "7",
                  "type": "cardinality"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Parameter Values",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count": 1,
                  "Unique Count details.parameter_data.name.keyword": 2,
                  "Unique Count ip_client": 3,
                  "Unique Count policy_name.keyword": 5,
                  "Unique Count uri.keyword": 4,
                  "details.parameter_data.value.keyword": 0
                },
                "renameByName": {
                  "Count": "Hits",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "IPs",
                  "Unique Count details.parameter_data.name.keyword": "Parameters",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count source_host": "IPs",
                  "Unique Count uri.keyword": "URLs",
                  "details.parameter_data.name.keyword": "Parameter Name",
                  "details.parameter_data.value.keyword": "Parameter Value",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            }
          ],
          "type": "table"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "absolute",
                "steps": [
                  {
                    "color": "green"
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ]
              }
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Length"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 77
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Offset"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 73
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "JSON"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 84
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Signature ID"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  },
                  {
                    "id": "links",
                    "value": [
                      {
                        "targetBlank": true,
                        "title": "Relax this Signature",
                        "url": "http://192.168.3.50/nap/index.php?SignatureID=${__value.raw}&Policy=${__data.fields[\"Policy Name\"]}&SupportID=${__data.fields[\"Support ID\"]}&type=Signature&Context=Parameter&Entity=${__data.fields[\"Parameter Name\"]}"
                      }
                    ]
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Client IP"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Support ID"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "json-view"
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Request Status"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 121
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Code"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 85
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Method"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 90
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Rating"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 83
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Date"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 154
                  },
                  {
                    "id": "unit",
                    "value": "dateTimeAsIsoNoDateIfToday"
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Risk"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 68
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Accuracy"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 95
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 9,
            "w": 24,
            "x": 0,
            "y": 11
          },
          "id": 26,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "settings": {
                    "limit": "500"
                  },
                  "type": "logs"
                }
              ],
              "query": "_exists_:details.parameter_data.value && signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Parameter Context Logs",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {
                  "@timestamp": true,
                  "@version": true,
                  "_id": true,
                  "_index": true,
                  "_type": true,
                  "blocking_exception_reason": true,
                  "bot_signature_name": true,
                  "count": true,
                  "dest_port": true,
                  "details.context": true,
                  "details.cookie.cookie_name": true,
                  "details.cookie.cookie_pattern": true,
                  "details.cookie.cookie_value": true,
                  "details.cookie.staging": true,
                  "details.http_sanity_checks_status": true,
                  "details.http_sub_violation": true,
                  "details.http_sub_violation_status": true,
                  "details.parameter_data.auto_detected_type": true,
                  "details.parameter_data.staging": true,
                  "details.staging": true,
                  "details.viol_index": true,
                  "details.viol_name": true,
                  "highlight": true,
                  "host": true,
                  "ip_client": true,
                  "is_truncated": true,
                  "logsource": true,
                  "method": false,
                  "outcome": true,
                  "outcome_reason": true,
                  "policy_name": false,
                  "protocol": true,
                  "request_status": false,
                  "severity": true,
                  "severity_label": true,
                  "sig_cves": true,
                  "sig_id": true,
                  "sig_names": true,
                  "signature-details.sig_id": true,
                  "sort": true,
                  "source_host": false,
                  "src_port": true,
                  "sub_violations": true,
                  "support_id": false,
                  "threat_campaign_names": true,
                  "timestamp": true,
                  "type": true,
                  "unit_hostname": true,
                  "violation_rating": false,
                  "vs_name": true,
                  "x_forwarded_for_header_value": true
                },
                "indexByName": {
                  "@timestamp": 22,
                  "@version": 23,
                  "_id": 24,
                  "_index": 25,
                  "_source": 13,
                  "_type": 26,
                  "blocking_exception_reason": 27,
                  "bot_signature_name": 28,
                  "client_class": 12,
                  "count": 29,
                  "date_time": 0,
                  "dest_port": 30,
                  "details.context": 31,
                  "details.parameter_data.auto_detected_type": 32,
                  "details.parameter_data.enforcement_level": 19,
                  "details.parameter_data.name": 1,
                  "details.parameter_data.param_name_pattern": 20,
                  "details.parameter_data.staging": 33,
                  "details.parameter_data.value": 2,
                  "details.sig_data.blocking_mask": 21,
                  "details.sig_data.kw_data.buffer": 6,
                  "details.sig_data.kw_data.length": 8,
                  "details.sig_data.kw_data.offset": 7,
                  "details.sig_data.sig_id": 11,
                  "details.staging": 34,
                  "details.viol_index": 35,
                  "details.viol_name": 36,
                  "highlight": 37,
                  "host": 38,
                  "ip_client": 39,
                  "is_truncated": 40,
                  "logsource": 41,
                  "method": 17,
                  "outcome": 42,
                  "outcome_reason": 43,
                  "policy_name": 44,
                  "protocol": 45,
                  "request_status": 15,
                  "response_code": 16,
                  "severity": 46,
                  "severity_label": 47,
                  "sig_cves": 48,
                  "sig_id": 58,
                  "signature-details.accuracy": 4,
                  "signature-details.name": 3,
                  "signature-details.risk": 5,
                  "signature-details.sig_id": 59,
                  "sort": 49,
                  "source_host": 9,
                  "src_port": 50,
                  "sub_violations": 51,
                  "support_id": 14,
                  "threat_campaign_names": 52,
                  "timestamp": 53,
                  "type": 54,
                  "unit_hostname": 55,
                  "uri": 10,
                  "violation_rating": 18,
                  "vs_name": 56,
                  "x_forwarded_for_header_value": 57
                },
                "renameByName": {
                  "_source": "JSON",
                  "_type": "",
                  "client_class": "Client Class",
                  "count": "",
                  "date_time": "Date",
                  "details.parameter_data.auto_detected_type": "",
                  "details.parameter_data.enforcement_level": "Enforcement Level",
                  "details.parameter_data.name": "Parameter Name",
                  "details.parameter_data.param_name_pattern": "Wildcard Parameter",
                  "details.parameter_data.staging": "",
                  "details.parameter_data.value": "Parameter Value",
                  "details.sig_data.blocking_mask": "Blocking Mask",
                  "details.sig_data.kw_data.buffer": "Detected Buffer",
                  "details.sig_data.kw_data.length": "Length",
                  "details.sig_data.kw_data.offset": "Offset",
                  "details.sig_data.sig_id": "Signature ID",
                  "details.staging": "",
                  "method": "Method",
                  "policy_name": "Policy Name",
                  "request_status": "Request Status",
                  "response_code": "Code",
                  "signature-details.accuracy": "Accuracy",
                  "signature-details.name": "Sig Name",
                  "signature-details.risk": "Risk",
                  "source_host": "Client IP",
                  "support_id": "Support ID",
                  "uri": "URL",
                  "violation_rating": "Rating"
                }
              }
            }
          ],
          "type": "table"
        }
      ],
      "title": "Parameter Context",
      "type": "row"
    },
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 34
      },
      "id": 38,
      "panels": [
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "percentage",
                "steps": [
                  {
                    "color": "red"
                  }
                ]
              },
              "unit": "short"
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Hits"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 87
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "IPs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 69
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "URLs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 71
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Policies"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 82
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Most Common Value"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "color-background-solid"
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 8,
            "w": 13,
            "x": 0,
            "y": 4
          },
          "id": 41,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 1,
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "details.header.header_name.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "100"
                  },
                  "type": "terms"
                },
                {
                  "field": "details.header.header_value.keyword",
                  "id": "6",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                },
                {
                  "field": "source_host",
                  "id": "3",
                  "type": "cardinality"
                },
                {
                  "field": "uri.keyword",
                  "id": "4",
                  "type": "cardinality"
                },
                {
                  "field": "policy_name.keyword",
                  "id": "5",
                  "type": "cardinality"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Header Names",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "violations.keyword": 0
                },
                "renameByName": {
                  "Count": "Hits",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "IPs",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count source_host": "IPs",
                  "Unique Count uri.keyword": "URLs",
                  "details.header.header_name.keyword": "Header Name",
                  "details.header.header_value.keyword": "Most Common Value",
                  "details.parameter_data.name.keyword": "Parameter Name",
                  "details.parameter_data.value.keyword": "Most Common Value",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            }
          ],
          "type": "table"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "percentage",
                "steps": [
                  {
                    "color": "red"
                  },
                  {
                    "color": "green",
                    "value": 90
                  }
                ]
              }
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Hits"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 87
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "IPs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 69
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "URLs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 71
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Policies"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 82
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Headers"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 84
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 8,
            "w": 11,
            "x": 13,
            "y": 4
          },
          "id": 42,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 1,
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "details.header.header_value.keyword",
                  "id": "6",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "100"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                },
                {
                  "field": "source_host",
                  "id": "3",
                  "type": "cardinality"
                },
                {
                  "field": "uri.keyword",
                  "id": "4",
                  "type": "cardinality"
                },
                {
                  "field": "policy_name.keyword",
                  "id": "5",
                  "type": "cardinality"
                },
                {
                  "field": "details.header.header_name.keyword",
                  "id": "7",
                  "type": "cardinality"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Header Values",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count": 1,
                  "Unique Count details.header.header_name.keyword": 2,
                  "Unique Count policy_name.keyword": 4,
                  "Unique Count source_host": 5,
                  "Unique Count uri.keyword": 3,
                  "details.header.header_value.keyword": 0
                },
                "renameByName": {
                  "Count": "Hits",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "IPs",
                  "Unique Count details.header.header_name.keyword": "Headers",
                  "Unique Count details.parameter_data.name.keyword": "Parameters",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count source_host": "IPs",
                  "Unique Count uri.keyword": "URLs",
                  "details.header.header_value.keyword": "Header Value",
                  "details.parameter_data.name.keyword": "Parameter Name",
                  "details.parameter_data.value.keyword": "Parameter Value",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            }
          ],
          "type": "table"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "absolute",
                "steps": [
                  {
                    "color": "green"
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ]
              }
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Length"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 77
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Offset"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 73
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "JSON"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 84
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Signature ID"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Client IP"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Risk"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 70
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Accuracy"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 94
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Date"
                },
                "properties": [
                  {
                    "id": "unit",
                    "value": "dateTimeAsIsoNoDateIfToday"
                  },
                  {
                    "id": "custom.width",
                    "value": 136
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Support ID"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "json-view"
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 9,
            "w": 24,
            "x": 0,
            "y": 12
          },
          "id": 46,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "settings": {
                    "limit": "500"
                  },
                  "type": "logs"
                }
              ],
              "query": "_exists_:details.header && signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Header Context Logs",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {
                  "@timestamp": true,
                  "@version": true,
                  "_id": true,
                  "_index": true,
                  "_type": true,
                  "blocking_exception_reason": true,
                  "bot_signature_name": true,
                  "count": true,
                  "dest_port": true,
                  "details.context": true,
                  "details.cookie.cookie_name": false,
                  "details.cookie.cookie_pattern": true,
                  "details.cookie.cookie_value": false,
                  "details.cookie.staging": true,
                  "details.http_sanity_checks_status": true,
                  "details.http_sub_violation": true,
                  "details.http_sub_violation_status": true,
                  "details.parameter_data.auto_detected_type": true,
                  "details.staging": true,
                  "details.viol_index": true,
                  "details.viol_name": true,
                  "highlight": true,
                  "host": true,
                  "ip_client": true,
                  "is_truncated": true,
                  "logsource": true,
                  "method": false,
                  "outcome": true,
                  "outcome_reason": true,
                  "policy_name": true,
                  "protocol": true,
                  "request_status": false,
                  "severity": true,
                  "severity_label": true,
                  "sig_cves": true,
                  "sig_id": true,
                  "sig_names": true,
                  "signature-details.sig_id": true,
                  "sort": true,
                  "source_host": false,
                  "src_port": true,
                  "sub_violations": true,
                  "support_id": false,
                  "threat_campaign_names": true,
                  "timestamp": true,
                  "type": true,
                  "unit_hostname": true,
                  "violation_rating": true,
                  "vs_name": true,
                  "x_forwarded_for_header_value": true
                },
                "indexByName": {
                  "@timestamp": 18,
                  "@version": 19,
                  "_id": 20,
                  "_index": 21,
                  "_source": 13,
                  "_type": 22,
                  "blocking_exception_reason": 23,
                  "bot_signature_name": 24,
                  "client_class": 11,
                  "count": 25,
                  "date_time": 0,
                  "dest_port": 26,
                  "details.context": 27,
                  "details.header.header_name": 1,
                  "details.header.header_pattern": 56,
                  "details.header.header_value": 2,
                  "details.header.staging": 57,
                  "details.sig_data.blocking_mask": 28,
                  "details.sig_data.kw_data.buffer": 6,
                  "details.sig_data.kw_data.length": 8,
                  "details.sig_data.kw_data.offset": 7,
                  "details.sig_data.sig_id": 12,
                  "details.staging": 29,
                  "details.viol_index": 30,
                  "details.viol_name": 31,
                  "highlight": 32,
                  "host": 33,
                  "ip_client": 34,
                  "is_truncated": 35,
                  "logsource": 36,
                  "method": 16,
                  "outcome": 37,
                  "outcome_reason": 38,
                  "policy_name": 39,
                  "protocol": 40,
                  "request_status": 15,
                  "response_code": 17,
                  "severity": 41,
                  "severity_label": 42,
                  "sig_cves": 43,
                  "sig_id": 54,
                  "signature-details.accuracy": 4,
                  "signature-details.name": 3,
                  "signature-details.risk": 5,
                  "signature-details.sig_id": 55,
                  "sort": 44,
                  "source_host": 9,
                  "src_port": 45,
                  "sub_violations": 46,
                  "support_id": 14,
                  "threat_campaign_names": 47,
                  "timestamp": 48,
                  "type": 49,
                  "unit_hostname": 50,
                  "uri": 10,
                  "violation_rating": 51,
                  "vs_name": 52,
                  "x_forwarded_for_header_value": 53
                },
                "renameByName": {
                  "_source": "JSON",
                  "_type": "",
                  "client_class": "Client Class",
                  "count": "",
                  "date_time": "Date",
                  "details.cookie.cookie_name": "Cookie Name",
                  "details.cookie.cookie_value": "Cookie Value",
                  "details.cookie.staging": "",
                  "details.header.header_name": "Header Name",
                  "details.header.header_pattern": "",
                  "details.header.header_value": "Header Value",
                  "details.parameter_data.name": "Parameter Name",
                  "details.parameter_data.value": "Parameter Value",
                  "details.sig_data.blocking_mask": "Blocking Mask",
                  "details.sig_data.kw_data.buffer": "Detected Buffer",
                  "details.sig_data.kw_data.length": "Length",
                  "details.sig_data.kw_data.offset": "Offset",
                  "details.sig_data.sig_id": "Signature ID",
                  "method": "Method",
                  "outcome": "",
                  "request_status": "Status",
                  "response_code": "Code",
                  "signature-details.accuracy": "Accuracy",
                  "signature-details.name": "Sig Name",
                  "signature-details.risk": "Risk",
                  "source_host": "Client IP",
                  "support_id": "Support ID",
                  "uri": "URL"
                }
              }
            }
          ],
          "type": "table"
        }
      ],
      "title": "Header Context",
      "type": "row"
    },
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 35
      },
      "id": 36,
      "panels": [
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "percentage",
                "steps": [
                  {
                    "color": "red"
                  }
                ]
              },
              "unit": "short"
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Hits"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 87
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "IPs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 69
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "URLs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 71
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Policies"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 82
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Most Common Value"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "color-background-solid"
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 8,
            "w": 13,
            "x": 0,
            "y": 5
          },
          "id": 44,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 1,
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "details.cookie.cookie_name.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "100"
                  },
                  "type": "terms"
                },
                {
                  "field": "details.cookie.cookie_value.keyword",
                  "id": "6",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                },
                {
                  "field": "source_host",
                  "id": "3",
                  "type": "cardinality"
                },
                {
                  "field": "uri.keyword",
                  "id": "4",
                  "type": "cardinality"
                },
                {
                  "field": "policy_name.keyword",
                  "id": "5",
                  "type": "cardinality"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Cookie Names",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count 1": 1,
                  "Count 2": 2,
                  "violations.keyword": 0
                },
                "renameByName": {
                  "Count": "Hits",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "IPs",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count source_host": "IPs",
                  "Unique Count uri.keyword": "URLs",
                  "details.cookie.cookie_name.keyword": "Cookie Name",
                  "details.cookie.cookie_value.keyword": "Most Common Value",
                  "details.header.header_name.keyword": "Header Name",
                  "details.header.header_value.keyword": "Most Common Value",
                  "details.parameter_data.name.keyword": "Parameter Name",
                  "details.parameter_data.value.keyword": "Most Common Value",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            }
          ],
          "type": "table"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "percentage",
                "steps": [
                  {
                    "color": "red"
                  },
                  {
                    "color": "green",
                    "value": 90
                  }
                ]
              }
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Violations"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 285
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Hits"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 87
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Blocked"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 114
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Signatures"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 556
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "IPs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 69
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "URLs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 71
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Policies"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 82
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "details.violation.parameter_data.name.keyword"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 362
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "details.violation.parameter_data.value.keyword"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 251
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Parameters"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 110
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 8,
            "w": 11,
            "x": 13,
            "y": 5
          },
          "id": 45,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 1,
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "details.cookie.cookie_value.keyword",
                  "id": "6",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "100"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                },
                {
                  "field": "source_host",
                  "id": "3",
                  "type": "cardinality"
                },
                {
                  "field": "uri.keyword",
                  "id": "4",
                  "type": "cardinality"
                },
                {
                  "field": "policy_name.keyword",
                  "id": "5",
                  "type": "cardinality"
                },
                {
                  "field": "details.parameter_data.name.keyword",
                  "id": "7",
                  "type": "cardinality"
                }
              ],
              "query": "signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "All Cookie Values",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count": 1,
                  "Unique Count details.parameter_data.name.keyword": 2,
                  "Unique Count policy_name.keyword": 4,
                  "Unique Count source_host": 5,
                  "Unique Count uri.keyword": 3,
                  "details.cookie.cookie_value.keyword": 0
                },
                "renameByName": {
                  "Count": "Hits",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "IPs",
                  "Unique Count details.parameter_data.name.keyword": "Parameters",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count source_host": "IPs",
                  "Unique Count uri.keyword": "URLs",
                  "details.cookie.cookie_value.keyword": "Cookie Value",
                  "details.parameter_data.name.keyword": "Parameter Name",
                  "details.parameter_data.value.keyword": "Parameter Value",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            }
          ],
          "type": "table"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "absolute",
                "steps": [
                  {
                    "color": "green"
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ]
              }
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Length"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 77
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Offset"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 73
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "JSON"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 84
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Signature ID"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Client IP"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Risk"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 70
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Accuracy"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 94
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Date"
                },
                "properties": [
                  {
                    "id": "unit",
                    "value": "dateTimeAsIsoNoDateIfToday"
                  },
                  {
                    "id": "custom.width",
                    "value": 136
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Support ID"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "json-view"
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 9,
            "w": 24,
            "x": 0,
            "y": 13
          },
          "id": 48,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "settings": {
                    "limit": "500"
                  },
                  "type": "logs"
                }
              ],
              "query": "_exists_:details.cookie && signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Cookie Context Logs",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {
                  "@timestamp": true,
                  "@version": true,
                  "_id": true,
                  "_index": true,
                  "_type": true,
                  "blocking_exception_reason": true,
                  "bot_signature_name": true,
                  "count": true,
                  "dest_port": true,
                  "details.context": true,
                  "details.cookie.cookie_name": false,
                  "details.cookie.cookie_pattern": true,
                  "details.cookie.cookie_value": false,
                  "details.cookie.staging": true,
                  "details.http_sanity_checks_status": true,
                  "details.http_sub_violation": true,
                  "details.http_sub_violation_status": true,
                  "details.parameter_data.auto_detected_type": true,
                  "details.staging": true,
                  "details.viol_index": true,
                  "details.viol_name": true,
                  "highlight": true,
                  "host": true,
                  "ip_client": true,
                  "is_truncated": true,
                  "logsource": true,
                  "method": false,
                  "outcome": true,
                  "outcome_reason": true,
                  "policy_name": true,
                  "protocol": true,
                  "request_status": false,
                  "severity": true,
                  "severity_label": true,
                  "sig_cves": true,
                  "sig_id": true,
                  "sig_names": true,
                  "signature-details.sig_id": true,
                  "sort": true,
                  "source_host": false,
                  "src_port": true,
                  "sub_violations": true,
                  "support_id": false,
                  "threat_campaign_names": true,
                  "timestamp": true,
                  "type": true,
                  "unit_hostname": true,
                  "violation_rating": true,
                  "vs_name": true,
                  "x_forwarded_for_header_value": true
                },
                "indexByName": {
                  "@timestamp": 18,
                  "@version": 19,
                  "_id": 20,
                  "_index": 21,
                  "_source": 13,
                  "_type": 22,
                  "blocking_exception_reason": 23,
                  "bot_signature_name": 24,
                  "client_class": 11,
                  "count": 25,
                  "date_time": 0,
                  "dest_port": 26,
                  "details.context": 27,
                  "details.cookie.cookie_name": 1,
                  "details.cookie.cookie_pattern": 56,
                  "details.cookie.cookie_value": 2,
                  "details.cookie.staging": 57,
                  "details.sig_data.blocking_mask": 28,
                  "details.sig_data.kw_data.buffer": 6,
                  "details.sig_data.kw_data.length": 8,
                  "details.sig_data.kw_data.offset": 7,
                  "details.sig_data.sig_id": 12,
                  "details.staging": 29,
                  "details.viol_index": 30,
                  "details.viol_name": 31,
                  "highlight": 32,
                  "host": 33,
                  "ip_client": 34,
                  "is_truncated": 35,
                  "logsource": 36,
                  "method": 16,
                  "outcome": 37,
                  "outcome_reason": 38,
                  "policy_name": 39,
                  "protocol": 40,
                  "request_status": 15,
                  "response_code": 17,
                  "severity": 41,
                  "severity_label": 42,
                  "sig_cves": 43,
                  "sig_id": 54,
                  "signature-details.accuracy": 4,
                  "signature-details.name": 3,
                  "signature-details.risk": 5,
                  "signature-details.sig_id": 55,
                  "sort": 44,
                  "source_host": 9,
                  "src_port": 45,
                  "sub_violations": 46,
                  "support_id": 14,
                  "threat_campaign_names": 47,
                  "timestamp": 48,
                  "type": 49,
                  "unit_hostname": 50,
                  "uri": 10,
                  "violation_rating": 51,
                  "vs_name": 52,
                  "x_forwarded_for_header_value": 53
                },
                "renameByName": {
                  "_source": "JSON",
                  "_type": "",
                  "client_class": "Client Class",
                  "count": "",
                  "date_time": "Date",
                  "details.cookie.cookie_name": "Cookie Name",
                  "details.cookie.cookie_value": "Cookie Value",
                  "details.cookie.staging": "",
                  "details.header.header_name": "Header Name",
                  "details.header.header_pattern": "",
                  "details.header.header_value": "Header Value",
                  "details.parameter_data.name": "Parameter Name",
                  "details.parameter_data.value": "Parameter Value",
                  "details.sig_data.kw_data.buffer": "Detected Buffer",
                  "details.sig_data.kw_data.length": "Length",
                  "details.sig_data.kw_data.offset": "Offset",
                  "details.sig_data.sig_id": "Signature ID",
                  "method": "Method",
                  "outcome": "",
                  "request_status": "Status",
                  "response_code": "Code",
                  "signature-details.accuracy": "Accuracy",
                  "signature-details.name": "Sig Name",
                  "signature-details.risk": "Risk",
                  "source_host": "Client IP",
                  "support_id": "Support ID",
                  "uri": "URL"
                }
              }
            }
          ],
          "type": "table"
        }
      ],
      "title": "Cookie",
      "type": "row"
    },
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 36
      },
      "id": 2,
      "panels": [
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "percentage",
                "steps": [
                  {
                    "color": "red"
                  },
                  {
                    "color": "green",
                    "value": 90
                  }
                ]
              },
              "unit": "short"
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Violations"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 285
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Hits"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 87
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Blocked"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 114
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Signatures"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 556
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "IPs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 69
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "URLs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 71
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Policies"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 82
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "details.violation.parameter_data.name.keyword"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 362
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "details.violation.parameter_data.value.keyword"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 251
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Parameters"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 110
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 8,
            "w": 13,
            "x": 0,
            "y": 6
          },
          "id": 39,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 1,
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "details.sig_data.kw_data.buffer.keyword",
                  "id": "6",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "100"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                },
                {
                  "field": "source_host",
                  "id": "3",
                  "type": "cardinality"
                },
                {
                  "field": "uri.keyword",
                  "id": "4",
                  "type": "cardinality"
                },
                {
                  "field": "policy_name.keyword",
                  "id": "5",
                  "type": "cardinality"
                }
              ],
              "query": "details.context:url && signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Keyword Detected",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count": 1,
                  "Unique Count policy_name.keyword": 3,
                  "Unique Count source_host": 4,
                  "Unique Count uri.keyword": 2,
                  "details.sig_data.kw_data.buffer.keyword": 0
                },
                "renameByName": {
                  "Count": "Hits",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "IPs",
                  "Unique Count details.parameter_data.name.keyword": "Parameters",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count source_host": "IPs",
                  "Unique Count uri.keyword": "URLs",
                  "details.parameter_data.name.keyword": "Parameter Name",
                  "details.parameter_data.value.keyword": "Parameter Value",
                  "details.sig_data.kw_data.buffer.keyword": "Keyword Detected",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            }
          ],
          "type": "table"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "links": [],
              "mappings": [],
              "thresholds": {
                "mode": "absolute",
                "steps": [
                  {
                    "color": "green"
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ]
              }
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Length"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 77
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Offset"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 73
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "JSON"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 97
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Signature ID"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  },
                  {
                    "id": "links",
                    "value": [
                      {
                        "targetBlank": true,
                        "title": "Relax this Signature",
                        "url": "http://192.168.3.50/nap/index.php?SignatureID=${__value.raw}&Policy=${__data.fields[\"Policy Name\"]}&SupportID=${__data.fields[\"Support ID\"]}&type=Signature&Context=URL"
                      }
                    ]
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Client IP"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Support ID"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "json-view"
                  },
                  {
                    "id": "custom.width",
                    "value": 192
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Staging"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 122
                  },
                  {
                    "id": "mappings",
                    "value": [
                      {
                        "options": {
                          "3": {
                            "index": 0,
                            "text": "Blocking Mode"
                          }
                        },
                        "type": "value"
                      }
                    ]
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Date"
                },
                "properties": [
                  {
                    "id": "unit",
                    "value": "dateTimeAsIsoNoDateIfToday"
                  },
                  {
                    "id": "custom.width",
                    "value": 139
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Sig Accuracy"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 125
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Sig Risk"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 99
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Client Class"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 176
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Request Status"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 137
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Response Code"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 135
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "method"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 115
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Sig Name"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 240
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "method"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "image"
                  },
                  {
                    "id": "mappings",
                    "value": [
                      {
                        "options": {
                          "GET": {
                            "index": 0,
                            "text": "http://192.168.1.49/sca/assets/F5.png"
                          }
                        },
                        "type": "value"
                      }
                    ]
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 9,
            "w": 24,
            "x": 0,
            "y": 14
          },
          "id": 40,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "settings": {
                    "limit": "500"
                  },
                  "type": "logs"
                }
              ],
              "query": "details.context:url && signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "URL Context Logs",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {
                  "@timestamp": true,
                  "@version": true,
                  "_id": true,
                  "_index": true,
                  "_type": true,
                  "blocking_exception_reason": true,
                  "bot_signature_name": true,
                  "count": true,
                  "dest_port": true,
                  "details.context": true,
                  "details.cookie.cookie_name": true,
                  "details.cookie.cookie_pattern": true,
                  "details.cookie.cookie_value": true,
                  "details.cookie.staging": true,
                  "details.http_sanity_checks_status": true,
                  "details.http_sub_violation": true,
                  "details.http_sub_violation_status": true,
                  "details.parameter_data.auto_detected_type": true,
                  "details.staging": true,
                  "details.viol_index": true,
                  "details.viol_name": true,
                  "highlight": true,
                  "host": true,
                  "ip_client": true,
                  "is_truncated": true,
                  "logsource": true,
                  "method": false,
                  "outcome": true,
                  "outcome_reason": true,
                  "policy_name": false,
                  "protocol": true,
                  "request_status": false,
                  "severity": true,
                  "severity_label": true,
                  "sig_cves": true,
                  "sig_id": true,
                  "sig_names": true,
                  "signature-details.sig_id": true,
                  "sort": true,
                  "source_host": false,
                  "src_port": true,
                  "sub_violations": true,
                  "support_id": false,
                  "threat_campaign_names": true,
                  "timestamp": true,
                  "type": true,
                  "unit_hostname": true,
                  "violation_rating": true,
                  "vs_name": true,
                  "x_forwarded_for_header_value": true
                },
                "indexByName": {
                  "@timestamp": 16,
                  "@version": 17,
                  "_id": 18,
                  "_index": 19,
                  "_source": 13,
                  "_type": 20,
                  "blocking_exception_reason": 21,
                  "bot_signature_name": 22,
                  "client_class": 10,
                  "count": 23,
                  "date_time": 0,
                  "dest_port": 24,
                  "details.context": 25,
                  "details.sig_data.blocking_mask": 11,
                  "details.sig_data.kw_data.buffer": 2,
                  "details.sig_data.kw_data.length": 4,
                  "details.sig_data.kw_data.offset": 3,
                  "details.sig_data.sig_id": 6,
                  "details.viol_index": 26,
                  "details.viol_name": 27,
                  "highlight": 28,
                  "host": 29,
                  "ip_client": 30,
                  "is_truncated": 31,
                  "logsource": 32,
                  "method": 33,
                  "outcome": 34,
                  "outcome_reason": 35,
                  "policy_name": 36,
                  "protocol": 37,
                  "request_status": 14,
                  "response_code": 15,
                  "severity": 38,
                  "severity_label": 39,
                  "sig_cves": 40,
                  "sig_id": 51,
                  "signature-details.accuracy": 7,
                  "signature-details.name": 5,
                  "signature-details.risk": 8,
                  "signature-details.sig_id": 52,
                  "sort": 41,
                  "source_host": 1,
                  "src_port": 42,
                  "sub_violations": 43,
                  "support_id": 12,
                  "threat_campaign_names": 44,
                  "timestamp": 45,
                  "type": 46,
                  "unit_hostname": 47,
                  "uri": 9,
                  "violation_rating": 48,
                  "vs_name": 49,
                  "x_forwarded_for_header_value": 50
                },
                "renameByName": {
                  "_source": "JSON",
                  "_type": "",
                  "client_class": "Client Class",
                  "count": "",
                  "date_time": "Date",
                  "details.parameter_data.name": "Parameter Name",
                  "details.parameter_data.value": "Parameter Value",
                  "details.sig_data.blocking_mask": "Staging",
                  "details.sig_data.kw_data.buffer": "Detected Buffer",
                  "details.sig_data.kw_data.length": "Length",
                  "details.sig_data.kw_data.offset": "Offset",
                  "details.sig_data.sig_id": "Signature ID",
                  "details.viol_index": "",
                  "method": "",
                  "policy_name": "Policy Name",
                  "request_status": "Request Status",
                  "response_code": "Response Code",
                  "signature-details.accuracy": "Sig Accuracy",
                  "signature-details.name": "Sig Name",
                  "signature-details.risk": "Sig Risk",
                  "source_host": "Client IP",
                  "support_id": "Support ID",
                  "type": "",
                  "uri": "URL"
                }
              }
            }
          ],
          "type": "table"
        }
      ],
      "title": "URL Context",
      "type": "row"
    },
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 37
      },
      "id": 59,
      "panels": [
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "mappings": [],
              "thresholds": {
                "mode": "percentage",
                "steps": [
                  {
                    "color": "red"
                  },
                  {
                    "color": "green",
                    "value": 90
                  }
                ]
              },
              "unit": "short"
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Violations"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 285
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Hits"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 87
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Blocked"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 114
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Signatures"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 556
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "IPs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 69
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "URLs"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 71
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Policies"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 82
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "details.violation.parameter_data.name.keyword"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 362
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "details.violation.parameter_data.value.keyword"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 251
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Parameters"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 110
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 8,
            "w": 13,
            "x": 0,
            "y": 7
          },
          "id": 60,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 1,
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "field": "details.sig_data.kw_data.buffer.keyword",
                  "id": "6",
                  "settings": {
                    "min_doc_count": "1",
                    "order": "desc",
                    "orderBy": "1",
                    "size": "100"
                  },
                  "type": "terms"
                }
              ],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "type": "count"
                },
                {
                  "field": "source_host",
                  "id": "3",
                  "type": "cardinality"
                },
                {
                  "field": "uri.keyword",
                  "id": "4",
                  "type": "cardinality"
                },
                {
                  "field": "policy_name.keyword",
                  "id": "5",
                  "type": "cardinality"
                }
              ],
              "query": "details.context:request && signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Request Keyword Detected",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {},
                "indexByName": {
                  "Count": 1,
                  "Unique Count policy_name.keyword": 3,
                  "Unique Count source_host": 4,
                  "Unique Count uri.keyword": 2,
                  "details.sig_data.kw_data.buffer.keyword": 0
                },
                "renameByName": {
                  "Count": "Hits",
                  "Count 1": "Hits",
                  "Count 2": "Blocked",
                  "Unique Count": "IPs",
                  "Unique Count details.parameter_data.name.keyword": "Parameters",
                  "Unique Count ip_client": "IPs",
                  "Unique Count policy_name.keyword": "Policies",
                  "Unique Count source_host": "IPs",
                  "Unique Count uri.keyword": "URLs",
                  "details.parameter_data.name.keyword": "Parameter Name",
                  "details.parameter_data.value.keyword": "Parameter Value",
                  "details.sig_data.kw_data.buffer.keyword": "Keyword Detected",
                  "details.violation.viol_name.keyword": "Violations",
                  "ip_client": "IP address",
                  "sig_names.keyword": "Signatures",
                  "violations.keyword": "Violations"
                }
              }
            }
          ],
          "type": "table"
        },
        {
          "datasource": {
            "type": "elasticsearch",
            "uid": "${DS_WAF-DECODED}"
          },
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true
              },
              "links": [],
              "mappings": [],
              "thresholds": {
                "mode": "absolute",
                "steps": [
                  {
                    "color": "green"
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ]
              }
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Length"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 77
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Offset"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 73
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "JSON"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 97
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Signature ID"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  },
                  {
                    "id": "links",
                    "value": [
                      {
                        "targetBlank": true,
                        "title": "Relax this Signature",
                        "url": "http://192.168.3.50/nap/index.php?SignatureID=${__value.raw}&Policy=${__data.fields[\"Policy Name\"]}&SupportID=${__data.fields[\"Support ID\"]}&type=Signature&Context=URL"
                      }
                    ]
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Client IP"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 113
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Support ID"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "json-view"
                  },
                  {
                    "id": "custom.width",
                    "value": 192
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Staging"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 122
                  },
                  {
                    "id": "mappings",
                    "value": [
                      {
                        "options": {
                          "3": {
                            "index": 0,
                            "text": "Blocking Mode"
                          }
                        },
                        "type": "value"
                      }
                    ]
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Date"
                },
                "properties": [
                  {
                    "id": "unit",
                    "value": "dateTimeAsIsoNoDateIfToday"
                  },
                  {
                    "id": "custom.width",
                    "value": 139
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Sig Accuracy"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 125
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Sig Risk"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 99
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Client Class"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 176
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Request Status"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 137
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Response Code"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 135
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "method"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 115
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "Sig Name"
                },
                "properties": [
                  {
                    "id": "custom.width",
                    "value": 240
                  }
                ]
              },
              {
                "matcher": {
                  "id": "byName",
                  "options": "method"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "image"
                  },
                  {
                    "id": "mappings",
                    "value": [
                      {
                        "options": {
                          "GET": {
                            "index": 0,
                            "text": "http://192.168.1.49/sca/assets/F5.png"
                          }
                        },
                        "type": "value"
                      }
                    ]
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 9,
            "w": 24,
            "x": 0,
            "y": 15
          },
          "id": 61,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "showHeader": true,
            "sortBy": []
          },
          "pluginVersion": "8.3.6",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [],
              "datasource": {
                "type": "elasticsearch",
                "uid": "${DS_WAF-DECODED}"
              },
              "metrics": [
                {
                  "id": "1",
                  "settings": {
                    "limit": "500"
                  },
                  "type": "logs"
                }
              ],
              "query": "details.context:request && signature-details.accuracy.keyword:$Accuracy && details.context.keyword:$Context && signature-details.risk.keyword:$Risk && client_class.keyword:$Bots && sig_cves.keyword:$CVEs && policy_name.keyword:$Policy && logsource.keyword:$Device",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "title": "Request Context Logs",
          "transformations": [
            {
              "id": "organize",
              "options": {
                "excludeByName": {
                  "@timestamp": true,
                  "@version": true,
                  "_id": true,
                  "_index": true,
                  "_type": true,
                  "blocking_exception_reason": true,
                  "bot_signature_name": true,
                  "count": true,
                  "dest_port": true,
                  "details.context": true,
                  "details.cookie.cookie_name": true,
                  "details.cookie.cookie_pattern": true,
                  "details.cookie.cookie_value": true,
                  "details.cookie.staging": true,
                  "details.http_sanity_checks_status": true,
                  "details.http_sub_violation": true,
                  "details.http_sub_violation_status": true,
                  "details.parameter_data.auto_detected_type": true,
                  "details.staging": true,
                  "details.viol_index": true,
                  "details.viol_name": true,
                  "highlight": true,
                  "host": true,
                  "ip_client": true,
                  "is_truncated": true,
                  "logsource": true,
                  "method": false,
                  "outcome": true,
                  "outcome_reason": true,
                  "policy_name": false,
                  "protocol": true,
                  "request_status": false,
                  "severity": true,
                  "severity_label": true,
                  "sig_cves": true,
                  "sig_id": true,
                  "sig_names": true,
                  "signature-details.sig_id": true,
                  "sort": true,
                  "source_host": false,
                  "src_port": true,
                  "sub_violations": true,
                  "support_id": false,
                  "threat_campaign_names": true,
                  "timestamp": true,
                  "type": true,
                  "unit_hostname": true,
                  "violation_rating": true,
                  "vs_name": true,
                  "x_forwarded_for_header_value": true
                },
                "indexByName": {
                  "@timestamp": 16,
                  "@version": 17,
                  "_id": 18,
                  "_index": 19,
                  "_source": 13,
                  "_type": 20,
                  "blocking_exception_reason": 21,
                  "bot_signature_name": 22,
                  "client_class": 10,
                  "count": 23,
                  "date_time": 0,
                  "dest_port": 24,
                  "details.context": 25,
                  "details.sig_data.blocking_mask": 11,
                  "details.sig_data.kw_data.buffer": 2,
                  "details.sig_data.kw_data.length": 4,
                  "details.sig_data.kw_data.offset": 3,
                  "details.sig_data.sig_id": 6,
                  "details.viol_index": 26,
                  "details.viol_name": 27,
                  "highlight": 28,
                  "host": 29,
                  "ip_client": 30,
                  "is_truncated": 31,
                  "logsource": 32,
                  "method": 33,
                  "outcome": 34,
                  "outcome_reason": 35,
                  "policy_name": 36,
                  "protocol": 37,
                  "request_status": 14,
                  "response_code": 15,
                  "severity": 38,
                  "severity_label": 39,
                  "sig_cves": 40,
                  "sig_id": 51,
                  "signature-details.accuracy": 7,
                  "signature-details.name": 5,
                  "signature-details.risk": 8,
                  "signature-details.sig_id": 52,
                  "sort": 41,
                  "source_host": 1,
                  "src_port": 42,
                  "sub_violations": 43,
                  "support_id": 12,
                  "threat_campaign_names": 44,
                  "timestamp": 45,
                  "type": 46,
                  "unit_hostname": 47,
                  "uri": 9,
                  "violation_rating": 48,
                  "vs_name": 49,
                  "x_forwarded_for_header_value": 50
                },
                "renameByName": {
                  "_source": "JSON",
                  "_type": "",
                  "client_class": "Client Class",
                  "count": "",
                  "date_time": "Date",
                  "details.parameter_data.name": "Parameter Name",
                  "details.parameter_data.value": "Parameter Value",
                  "details.sig_data.blocking_mask": "Staging",
                  "details.sig_data.kw_data.buffer": "Detected Buffer",
                  "details.sig_data.kw_data.length": "Length",
                  "details.sig_data.kw_data.offset": "Offset",
                  "details.sig_data.sig_id": "Signature ID",
                  "details.viol_index": "",
                  "method": "",
                  "policy_name": "Policy Name",
                  "request_status": "Request Status",
                  "response_code": "Response Code",
                  "signature-details.accuracy": "Sig Accuracy",
                  "signature-details.name": "Sig Name",
                  "signature-details.risk": "Sig Risk",
                  "source_host": "Client IP",
                  "support_id": "Support ID",
                  "type": "",
                  "uri": "URL"
                }
              }
            }
          ],
          "type": "table"
        }
      ],
      "title": "Request Context",
      "type": "row"
    }
  ],
  "refresh": false,
  "schemaVersion": 34,
  "style": "dark",
  "tags": [
    "nginx",
    "nap"
  ],
  "templating": {
    "list": [
      {
        "current": {},
        "datasource": {
          "type": "elasticsearch",
          "uid": "${DS_WAF-DECODED}"
        },
        "definition": "{\"find\": \"terms\", \"field\": \"signature-details.accuracy.keyword\", \"size\": 1000}",
        "hide": 0,
        "includeAll": true,
        "multi": true,
        "name": "Accuracy",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\": \"signature-details.accuracy.keyword\", \"size\": 1000}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {},
        "datasource": {
          "type": "elasticsearch",
          "uid": "${DS_WAF-DECODED}"
        },
        "definition": "{\"find\": \"terms\", \"field\": \"details.context.keyword\", \"size\": 1000}",
        "hide": 0,
        "includeAll": true,
        "multi": true,
        "name": "Context",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\": \"details.context.keyword\", \"size\": 1000}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {},
        "datasource": {
          "type": "elasticsearch",
          "uid": "${DS_WAF-DECODED}"
        },
        "definition": "{\"find\": \"terms\", \"field\": \"signature-details.risk.keyword\", \"size\": 1000}",
        "hide": 0,
        "includeAll": true,
        "multi": false,
        "name": "Risk",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\": \"signature-details.risk.keyword\", \"size\": 1000}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {},
        "datasource": {
          "type": "elasticsearch",
          "uid": "${DS_WAF-DECODED}"
        },
        "definition": "{\"find\": \"terms\", \"field\": \"client_class.keyword\", \"size\": 1000}",
        "hide": 0,
        "includeAll": true,
        "multi": false,
        "name": "Bots",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\": \"client_class.keyword\", \"size\": 1000}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {},
        "datasource": {
          "type": "elasticsearch",
          "uid": "${DS_WAF-DECODED}"
        },
        "definition": "{\"find\": \"terms\", \"field\": \"sig_cves.keyword\", \"size\": 1000}",
        "hide": 0,
        "includeAll": true,
        "multi": false,
        "name": "CVEs",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\": \"sig_cves.keyword\", \"size\": 1000}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {},
        "datasource": {
          "type": "elasticsearch",
          "uid": "${DS_WAF-DECODED}"
        },
        "definition": "{\"find\": \"terms\", \"field\": \"policy_name.keyword\", \"size\": 1000}",
        "hide": 0,
        "includeAll": true,
        "multi": false,
        "name": "Policy",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\": \"policy_name.keyword\", \"size\": 1000}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {},
        "datasource": {
          "type": "elasticsearch",
          "uid": "${DS_WAF-DECODED}"
        },
        "definition": "{\"find\": \"terms\", \"field\": \"logsource.keyword\", \"size\": 1000}",
        "hide": 0,
        "includeAll": true,
        "multi": false,
        "name": "Device",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\": \"logsource.keyword\", \"size\": 1000}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "datasource": {
          "type": "elasticsearch",
          "uid": "AED4mLQnz"
        },
        "filters": [],
        "hide": 0,
        "name": "Filters",
        "skipUrlSync": false,
        "type": "adhoc"
      }
    ]
  },
  "time": {
    "from": "now-90d",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "",
  "title": "NGINX NAP - Attack Signatures",
  "uid": "nap-signatures",
  "version": 4,
  "weekStart": "",
  "gnetId": 15677,
  "description": "This Dashboard provides more visibility into the logs generated by NGINX App Protect. This is part of a series of NGINX App Protect Dashboards"
}