Grafana dashboard: Bitvise SFTP Logs
Description: Bitvise SFTP dashboard

# Bitvise SFTP Log Dashboard
Dashboard to visualize Bitvise SFTP Log data from [Bitvise](https://www.bitvise.com/ssh-server)

Dashboard is setup to filter based on a host name or by virtual account. The Logstash filter files have been provided on [Github](https://github.com/bhozar/grafana-dashboards/tree/master/bitvisesftplogs/logstash/conf.d), along with Filebeat config.

# Bugs, suggestions and feedback.
Bug reports, suggestions and feedback to [GitHub](https://github.com/bhozar/grafana-dashboards/tree/master/bitvisesftplogs) please!

# Gotchas
* Some panels formatting expect all accounts to begin with `sftp.` If a panel is all on the Y-axis, remove the formatting.
* All panels and variables are based on the VirtualUser. Nothing has been setup for the WindowsUser. If you use Windows accounts for logins you'll need to edit the panels.

# Logstash filter
```
filter {
  if "bitvise" in [tags] {
    xml {
      force_array => false
      source => "message"
      store_xml => true
      target => "sftp"
      remove_field => [ "message" ]
    }
mutate {
        convert => {"[sftp][parameters][channelBytesReceived]" => "integer"}
        convert => {"[sftp][parameters][channelBytesSent]" => "integer"}
        convert => {"[sftp][parameters][payloadBytesReceived]" => "integer"}
        convert => {"[sftp][parameters][payloadBytesSent]" => "integer"}
        convert => {"[sftp][parameters][socketBytesReceived]" => "integer"}
        convert => {"[sftp][parameters][socketBytesSent]" => "integer"}
        convert => {"[sftp][parameters][bytesReceived]" => "integer"}
        convert => {"[sftp][parameters][bytesSent]" => "integer"}
        convert => {"[sftp][seq]" => "integer"}
        convert => {"[sftp][session][id]" => "integer"}
        convert => {"[sftp][sessions][ftp]" => "integer"}
        convert => {"[sftp][sessions][ftpAuth]" => "integer"}
        convert => {"[sftp][sessions][ssh]" => "integer"}
        convert => {"[sftp][sessions][sshAut]" => "integer"}
        convert => {"[sftp][error][code]" => "integer"}
        convert => {"[sftp][sfs][code]" => "integer"}
        convert => {"[sftp][sfs][parameters][bytesRead]" => "integer"}
        convert => {"[sftp][sfs][parameters][bytesWritten]" => "integer"}
        convert => {"[sftp][sfs][parameters][finalSize]" => "integer"}
        convert => {"[sftp][sfs][parameters][readRangeLength]" => "integer"}
        convert => {"[sftp][sfs][parameters][readRangeOffset]" => "integer"}
        convert => {"[sftp][sfs][parameters][startSize]" => "integer"}
        convert => {"[sftp][sfs][parameters][timeMs]" => "integer"}
        convert => {"[sftp][sfs][parameters][upload]" => "integer"}
        convert => {"[sftp][sfs][parameters][writeRangeLength]" => "integer"}
        convert => {"[sftp][sfs][parameters][writeRangeOffset]" => "integer"}
          split => { "[sftp][session][remoteAddress]" => ":"}
            add_field => { "remoteIP" => "%{[sftp][session][remoteAddress][0]}"
          }
       }
  geoip {
    source => "remoteIP"
  }
  date{
    match => ["sftp.time" , "yyyy-MM-dd HH:mm:ss.SSS Z"]
  }
  }
}
```

# Screenshots
![Bitvise SFTP Log Dashboard](https://grafana.com/api/dashboards/11320/images/7220/image)
![Bitvise SFTP Log Dashboard](https://grafana.com/api/dashboards/11320/images/7221/image)

{
  "__inputs": [
    {
      "name": "DS_ELASTICSEARCH-BITVISE-LOGS",
      "label": "Elasticsearch-bitvise-logs",
      "description": "",
      "type": "datasource",
      "pluginId": "elasticsearch",
      "pluginName": "Elasticsearch"
    }
  ],
  "__requires": [
    {
      "type": "panel",
      "id": "bargauge",
      "name": "Bar Gauge",
      "version": ""
    },
    {
      "type": "datasource",
      "id": "elasticsearch",
      "name": "Elasticsearch",
      "version": "1.0.0"
    },
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "6.6.1"
    },
    {
      "type": "panel",
      "id": "grafana-worldmap-panel",
      "name": "Worldmap Panel",
      "version": "0.2.1"
    },
    {
      "type": "panel",
      "id": "graph",
      "name": "Graph",
      "version": ""
    },
    {
      "type": "panel",
      "id": "logs",
      "name": "Logs",
      "version": ""
    },
    {
      "type": "panel",
      "id": "singlestat",
      "name": "Singlestat",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "description": "Bitvise SFTP dashboard",
  "editable": true,
  "gnetId": 11320,
  "graphTooltip": 0,
  "id": null,
  "iteration": 1581505113447,
  "links": [],
  "panels": [
    {
      "collapsed": false,
      "datasource": null,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 39,
      "panels": [],
      "title": "Bitvise SFTP",
      "type": "row"
    },
    {
      "cacheTimeout": null,
      "colorBackground": false,
      "colorPrefix": false,
      "colorValue": false,
      "colors": [
        "#299c46",
        "rgba(237, 129, 40, 0.89)",
        "#d44a3a"
      ],
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "format": "none",
      "gauge": {
        "maxValue": 100,
        "minValue": 0,
        "show": false,
        "thresholdLabels": false,
        "thresholdMarkers": true
      },
      "gridPos": {
        "h": 3,
        "w": 12,
        "x": 0,
        "y": 1
      },
      "hideTimeOverride": true,
      "id": 16,
      "interval": null,
      "links": [],
      "mappingType": 1,
      "mappingTypes": [
        {
          "name": "value to text",
          "value": 1
        },
        {
          "name": "range to text",
          "value": 2
        }
      ],
      "maxDataPoints": 100,
      "maxPerRow": 4,
      "nullPointMode": "connected",
      "nullText": null,
      "options": {},
      "postfix": "",
      "postfixFontSize": "50%",
      "prefix": "<center>$host App Version</center><br>",
      "prefixFontSize": "50%",
      "rangeMaps": [
        {
          "from": "null",
          "text": "N/A",
          "to": "null"
        }
      ],
      "repeat": "host",
      "repeatDirection": "h",
      "sparkline": {
        "fillColor": "rgba(31, 118, 189, 0.18)",
        "full": false,
        "lineColor": "rgb(31, 120, 193)",
        "show": false,
        "ymax": null,
        "ymin": null
      },
      "tableColumn": "sftp.app.keyword",
      "targets": [
        {
          "bucketAggs": [
            {
              "field": "sftp.app.keyword",
              "id": "2",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "10"
              },
              "type": "terms"
            }
          ],
          "metrics": [
            {
              "field": "sftp.app.keyword",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "cardinality"
            }
          ],
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": "",
      "timeFrom": "10m",
      "timeShift": null,
      "title": "",
      "transparent": true,
      "type": "singlestat",
      "valueFontSize": "80%",
      "valueMaps": [
        {
          "op": "=",
          "text": "N/A",
          "value": "null"
        }
      ],
      "valueName": "current"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 1
      },
      "hiddenSeries": false,
      "id": 4,
      "legend": {
        "alignAsTable": true,
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "rightSide": true,
        "show": true,
        "sort": "total",
        "sortDesc": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "options": {
        "dataLinks": [
          {
            "title": "Filter on Username: ${username}",
            "url": "?var-username=${username}"
          }
        ]
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [
        {
          "alias": "/.*Written/",
          "transform": "negative-Y"
        }
      ],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "alias": "{{term sftp.session.virtualAccount.keyword}} / Read",
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "1",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "hide": false,
          "metrics": [
            {
              "field": "sftp.sfs.parameters.bytesRead",
              "id": "1",
              "meta": {},
              "pipelineVariables": [
                {
                  "name": "var1",
                  "pipelineAgg": "select metric"
                }
              ],
              "settings": {
                "missing": null
              },
              "type": "sum"
            }
          ],
          "query": "host.name.keyword:$host AND sftp.session.virtualAccount.keyword:$username",
          "refId": "A",
          "timeField": "@timestamp"
        },
        {
          "alias": "{{term sftp.session.virtualAccount.keyword}} / Write",
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "1",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "hide": false,
          "metrics": [
            {
              "field": "sftp.sfs.parameters.bytesWritten",
              "id": "1",
              "meta": {},
              "pipelineVariables": [
                {
                  "name": "var1",
                  "pipelineAgg": "select metric"
                }
              ],
              "settings": {
                "missing": null
              },
              "type": "sum"
            }
          ],
          "query": "host.name.keyword:$host AND sftp.session.virtualAccount.keyword:$username",
          "refId": "B",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Bytes read/write",
      "tooltip": {
        "shared": true,
        "sort": 2,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "cacheTimeout": null,
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 4
      },
      "id": 44,
      "links": [],
      "options": {
        "displayMode": "gradient",
        "fieldOptions": {
          "calcs": [
            "sum"
          ],
          "defaults": {
            "color": {
              "mode": "thresholds"
            },
            "mappings": [],
            "max": 10000,
            "thresholds": {
              "mode": "absolute",
              "steps": [
                {
                  "color": "green",
                  "value": null
                }
              ]
            },
            "title": "",
            "unit": "locale"
          },
          "overrides": [],
          "values": false
        },
        "orientation": "horizontal",
        "showUnfilled": true
      },
      "pluginVersion": "6.6.1",
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.parameters.clientVersion.keyword",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "10"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "select field",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Client Versions",
      "type": "bargauge"
    },
    {
      "columns": [],
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "fontSize": "100%",
      "gridPos": {
        "h": 9,
        "w": 24,
        "x": 0,
        "y": 12
      },
      "id": 35,
      "links": [],
      "options": {},
      "pageSize": null,
      "showHeader": true,
      "sort": {
        "col": 3,
        "desc": true
      },
      "styles": [
        {
          "alias": "Account",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.session.virtualAccount.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "File",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.sfs.parameters.path.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "BytesWritten",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": null,
          "mappingType": 1,
          "pattern": "sftp.sfs.parameters.bytesWritten",
          "thresholds": [],
          "type": "number",
          "unit": "decbytes"
        },
        {
          "alias": "BytesRead",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": null,
          "mappingType": 1,
          "pattern": "sftp.sfs.parameters.bytesRead",
          "thresholds": [],
          "type": "number",
          "unit": "decbytes"
        },
        {
          "alias": "",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "Count",
          "thresholds": [],
          "type": "hidden",
          "unit": "short"
        }
      ],
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "6",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.sfs.parameters.path.keyword",
              "id": "7",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.sfs.parameters.bytesWritten",
              "id": "8",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.sfs.parameters.bytesRead",
              "id": "9",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host AND sftp.name.keyword:I_SFS_TRANSFER_FILE",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "File Read/Writes",
      "transform": "table",
      "type": "table"
    },
    {
      "columns": [],
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "fontSize": "100%",
      "gridPos": {
        "h": 9,
        "w": 24,
        "x": 0,
        "y": 21
      },
      "id": 37,
      "links": [],
      "options": {},
      "pageSize": null,
      "showHeader": true,
      "sort": {
        "col": null,
        "desc": false
      },
      "styles": [
        {
          "alias": "Account",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.session.virtualAccount.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "File",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.sfs.parameters.path.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "BytesWritten",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": null,
          "mappingType": 1,
          "pattern": "sftp.sfs.parameters.bytesWritten",
          "thresholds": [],
          "type": "number",
          "unit": "decbytes"
        },
        {
          "alias": "BytesRead",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": null,
          "mappingType": 1,
          "pattern": "sftp.sfs.parameters.bytesRead",
          "thresholds": [],
          "type": "number",
          "unit": "decbytes"
        },
        {
          "alias": "",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "Count",
          "thresholds": [],
          "type": "hidden",
          "unit": "short"
        }
      ],
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "6",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.sfs.parameters.path.keyword",
              "id": "7",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host AND sftp.name.keyword:I_SFS_REMOVE_FILE",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "File deletes",
      "transform": "table",
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "decimals": 0,
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 24,
        "x": 0,
        "y": 30
      },
      "hiddenSeries": false,
      "id": 19,
      "legend": {
        "alignAsTable": true,
        "avg": false,
        "current": false,
        "max": true,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "options": {
        "dataLinks": []
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "host.name.keyword",
              "id": "5",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host",
          "refId": "A",
          "timeField": "@timestamp"
        },
        {
          "alias": "{{term host.name.keyword}} Errors",
          "bucketAggs": [
            {
              "fake": true,
              "field": "host.name.keyword",
              "id": "5",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host AND _exists_:sftp.error.message.keyword",
          "refId": "B",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Log Entry Counts",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": 0,
          "format": "none",
          "label": "Log Entries",
          "logBase": 10,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "decimals": 0,
          "format": "none",
          "label": "Errors",
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "columns": [],
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "fontSize": "100%",
      "gridPos": {
        "h": 5,
        "w": 24,
        "x": 0,
        "y": 40
      },
      "id": 2,
      "links": [],
      "options": {},
      "pageSize": null,
      "scroll": true,
      "showHeader": true,
      "sort": {
        "col": null,
        "desc": false
      },
      "styles": [
        {
          "alias": "Account",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.session.virtualAccount.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "Algorithm",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.authentication.keyAlgorithm.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "SHA-256",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.authentication.keySha256.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "AuthenticationMethod",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.authentication.method.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "KeyLength",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 0,
          "mappingType": 1,
          "pattern": "sftp.authentication.keyBits.keyword",
          "thresholds": [],
          "type": "number",
          "unit": "none"
        },
        {
          "alias": "MD5",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.authentication.keyMd5.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "Flags",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.authentication.flags.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        }
      ],
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.authentication.keyAlgorithm.keyword",
              "id": "5",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.authentication.keySha256.keyword",
              "id": "6",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.authentication.method.keyword",
              "id": "7",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.authentication.keyBits.keyword",
              "id": "8",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.authentication.flags.keyword",
              "id": "9",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.authentication.keyMd5.keyword",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host AND sftp.session.virtualAccount.keyword:$username AND _exists_:sftp.authentication.keyAlgorithm.keyword",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "SSH Key Usage",
      "transform": "table",
      "type": "table"
    },
    {
      "columns": [],
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "fontSize": "100%",
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 0,
        "y": 45
      },
      "id": 8,
      "links": [],
      "options": {},
      "pageSize": null,
      "scroll": true,
      "showHeader": true,
      "sort": {
        "col": 1,
        "desc": true
      },
      "styles": [
        {
          "alias": "Account",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.session.virtualAccount.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "Count",
          "thresholds": [],
          "type": "number",
          "unit": "locale"
        }
      ],
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            }
          ],
          "hide": false,
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Logon Count",
      "transform": "table",
      "type": "table"
    },
    {
      "circleMaxSize": "30",
      "circleMinSize": "3",
      "colors": [
        "rgba(0, 247, 0, 0.9)",
        "rgba(237, 129, 40, 0.89)",
        "rgba(240, 4, 45, 0.97)"
      ],
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "decimals": 0,
      "esGeoPoint": "geoip.location",
      "esLocationName": "geoip.city_name.keyword",
      "esMetric": "Count",
      "gridPos": {
        "h": 14,
        "w": 12,
        "x": 12,
        "y": 45
      },
      "height": "600px",
      "hideEmpty": true,
      "hideZero": true,
      "id": 24,
      "initialZoom": "2",
      "links": [],
      "locationData": "table",
      "mapCenter": "(0°, 0°)",
      "mapCenterLatitude": 0,
      "mapCenterLongitude": 0,
      "maxDataPoints": 1,
      "mouseWheelZoom": true,
      "options": {},
      "showLegend": true,
      "stickyLabels": false,
      "tableQueryOptions": {
        "geohashField": "geohash",
        "labelField": "geoip.city_name.keyword",
        "latitudeField": "geoip.latitude",
        "longitudeField": "geoip.longitude",
        "metricField": "Count",
        "queryType": "coordinates"
      },
      "targets": [
        {
          "alias": "count",
          "bucketAggs": [
            {
              "fake": true,
              "field": "geoip.latitude",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "geoip.longitude",
              "id": "5",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "geoip.city_name.keyword",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host AND sftp.session.virtualAccount.keyword:$username",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": "1000,10000",
      "title": "Geo Activity",
      "transparent": true,
      "type": "grafana-worldmap-panel",
      "unitPlural": "",
      "unitSingle": "",
      "valueName": "total"
    },
    {
      "columns": [],
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "fontSize": "100%",
      "gridPos": {
        "h": 13,
        "w": 12,
        "x": 0,
        "y": 54
      },
      "id": 29,
      "options": {},
      "pageSize": 100,
      "showHeader": true,
      "sort": {
        "col": 3,
        "desc": true
      },
      "styles": [
        {
          "alias": "RemoteIP",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 0,
          "mappingType": 1,
          "pattern": "remoteIP.keyword",
          "thresholds": [],
          "type": "number",
          "unit": "none"
        },
        {
          "alias": "Country",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "geoip.country_name.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "Account",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.session.virtualAccount.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        },
        {
          "alias": "",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 0,
          "mappingType": 1,
          "pattern": "Count",
          "thresholds": [],
          "type": "number",
          "unit": "locale"
        }
      ],
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "remoteIP.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "1000"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "geoip.country_name.keyword",
              "id": "5",
              "settings": {
                "min_doc_count": 1,
                "missing": "-",
                "order": "desc",
                "orderBy": "_count",
                "size": "100"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "10"
              },
              "type": "terms"
            }
          ],
          "hide": false,
          "metrics": [
            {
              "field": "select field",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "",
          "refId": "B",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Caller IP",
      "transform": "table",
      "type": "table"
    },
    {
      "columns": [],
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "fontSize": "100%",
      "gridPos": {
        "h": 12,
        "w": 12,
        "x": 12,
        "y": 59
      },
      "id": 32,
      "options": {},
      "pageSize": 100,
      "showHeader": true,
      "sort": {
        "col": 3,
        "desc": true
      },
      "styles": [
        {
          "alias": "IPs",
          "align": "auto",
          "colorMode": "value",
          "colors": [
            "rgba(50, 172, 45, 0.97)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(245, 54, 54, 0.9)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 0,
          "mappingType": 1,
          "pattern": "Unique Count",
          "thresholds": [
            "3",
            "4"
          ],
          "type": "number",
          "unit": "locale"
        },
        {
          "alias": "Count",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 0,
          "mappingType": 1,
          "pattern": "Count",
          "thresholds": [],
          "type": "number",
          "unit": "locale"
        },
        {
          "alias": "Remote IP",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 0,
          "mappingType": 1,
          "pattern": "remoteIP.keyword",
          "thresholds": [],
          "type": "number",
          "unit": "none"
        },
        {
          "alias": "Account",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "sftp.session.virtualAccount.keyword",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        }
      ],
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "remoteIP.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "1",
                "size": "30"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "7",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "1",
                "size": "30"
              },
              "type": "terms"
            }
          ],
          "metrics": [
            {
              "field": "remoteIP.keyword",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "cardinality"
            },
            {
              "field": "select field",
              "id": "6",
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host AND sftp.session.virtualAccount.keyword:$username",
          "refId": "B",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Users",
      "transform": "table",
      "type": "table"
    },
    {
      "columns": [
        {
          "text": "Total",
          "value": "total"
        }
      ],
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "fontSize": "100%",
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 0,
        "y": 67
      },
      "id": 5,
      "links": [],
      "options": {},
      "pageSize": null,
      "scroll": true,
      "showHeader": true,
      "sort": {
        "col": 1,
        "desc": true
      },
      "styles": [
        {
          "alias": "Time",
          "align": "auto",
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "pattern": "Time",
          "type": "date"
        },
        {
          "alias": "",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": null,
          "mappingType": 1,
          "pattern": "Total",
          "thresholds": [],
          "type": "number",
          "unit": "locale"
        }
      ],
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.error.message.keyword",
              "id": "6",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Error Counts",
      "transform": "timeseries_aggregations",
      "type": "table"
    },
    {
      "alert": {
        "alertRuleTags": {},
        "conditions": [
          {
            "evaluator": {
              "params": [
                5
              ],
              "type": "gt"
            },
            "operator": {
              "type": "and"
            },
            "query": {
              "params": [
                "A",
                "5m",
                "now"
              ]
            },
            "reducer": {
              "params": [],
              "type": "avg"
            },
            "type": "query"
          }
        ],
        "executionErrorState": "alerting",
        "for": "5m",
        "frequency": "1m",
        "handler": 1,
        "name": "SFTP Rejected login attempts alert",
        "noDataState": "ok",
        "notifications": [
          {
            "uid": "aFdm_XbWz"
          }
        ]
      },
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "decimals": 0,
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 5,
        "w": 12,
        "x": 12,
        "y": 71
      },
      "hiddenSeries": false,
      "id": 26,
      "legend": {
        "alignAsTable": true,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": true,
        "max": true,
        "min": false,
        "rightSide": true,
        "show": true,
        "sort": null,
        "sortDesc": null,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 5,
      "links": [],
      "nullPointMode": "null",
      "options": {
        "dataLinks": []
      },
      "percentage": false,
      "pointradius": 5,
      "points": true,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "alias": "{{term sftp.authentication.virtualAccount.keyword}} / {{term sftp.parameters.failureReason.keyword}}",
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.authentication.virtualAccount.keyword",
              "id": "5",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "fake": true,
              "field": "sftp.parameters.failureReason.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "sftp.name.keyword:I_LOGON_AUTH_FAILED",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": [
        {
          "colorMode": "critical",
          "fill": true,
          "line": true,
          "op": "gt",
          "value": 5
        }
      ],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Rejected login attempts",
      "tooltip": {
        "shared": true,
        "sort": 2,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": 0,
          "format": "none",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "decimals": 0,
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": true,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "decimals": 0,
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 7,
        "w": 12,
        "x": 0,
        "y": 76
      },
      "hiddenSeries": false,
      "id": 14,
      "legend": {
        "alignAsTable": true,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": true,
        "max": true,
        "min": false,
        "rightSide": true,
        "show": true,
        "sort": "max",
        "sortDesc": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "options": {
        "dataLinks": []
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [
        {
          "alias": "/^(?!sftp).*$/",
          "fill": 0,
          "linewidth": 0,
          "points": true,
          "yaxis": 2
        }
      ],
      "spaceLength": 10,
      "stack": true,
      "steppedLine": false,
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "missing": "-",
                "order": "desc",
                "orderBy": "1",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "hide": false,
          "metrics": [
            {
              "field": "sftp.session.id",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "cardinality"
            }
          ],
          "query": "",
          "refId": "B",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Sessions",
      "tooltip": {
        "shared": true,
        "sort": 2,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": 0,
          "format": "none",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": "0",
          "show": true
        },
        {
          "decimals": 0,
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": true,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "decimals": 0,
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 7,
        "w": 12,
        "x": 12,
        "y": 76
      },
      "hiddenSeries": false,
      "id": 34,
      "legend": {
        "alignAsTable": true,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": true,
        "max": true,
        "min": false,
        "rightSide": true,
        "show": true,
        "sort": null,
        "sortDesc": null,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 5,
      "links": [],
      "nullPointMode": "null",
      "options": {
        "dataLinks": []
      },
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": true,
      "steppedLine": false,
      "targets": [
        {
          "alias": "{{term sftp.session.virtualAccount.keyword}}",
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.session.virtualAccount.keyword",
              "id": "5",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "sftp.name.keyword:I_LOGON_AUTH_SUCCEEDED",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Accepted login attempts",
      "tooltip": {
        "shared": true,
        "sort": 2,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": 0,
          "format": "none",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "decimals": 0,
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": true,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {
        "I_LOGON_AUTH_FAILED": "semi-dark-red"
      },
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "decimals": 0,
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 8,
        "w": 24,
        "x": 0,
        "y": 83
      },
      "hiddenSeries": false,
      "id": 13,
      "interval": "30s",
      "legend": {
        "alignAsTable": true,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": true,
        "max": true,
        "min": false,
        "rightSide": true,
        "show": true,
        "sort": "max",
        "sortDesc": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "options": {
        "dataLinks": []
      },
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.name.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host AND sftp.name.keyword:I_LOGON_AUTH_*",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Authentication Attempts",
      "tooltip": {
        "shared": true,
        "sort": 2,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": 0,
          "format": "none",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "decimals": 0,
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": true,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
      "decimals": 0,
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 8,
        "w": 24,
        "x": 0,
        "y": 91
      },
      "hiddenSeries": false,
      "id": 12,
      "interval": "30s",
      "legend": {
        "alignAsTable": true,
        "avg": false,
        "current": false,
        "hideEmpty": true,
        "hideZero": true,
        "max": true,
        "min": false,
        "rightSide": true,
        "show": true,
        "sort": "max",
        "sortDesc": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "links": [],
      "nullPointMode": "null",
      "options": {
        "dataLinks": []
      },
      "percentage": false,
      "pointradius": 5,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "bucketAggs": [
            {
              "fake": true,
              "field": "sftp.name.keyword",
              "id": "4",
              "settings": {
                "min_doc_count": 1,
                "missing": null,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "field": "@timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 1,
                "trimEdges": null
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "field": "bytes_read",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "host.name.keyword:$host",
          "refId": "A",
          "timeField": "@timestamp"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Actions over time",
      "tooltip": {
        "shared": true,
        "sort": 2,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "decimals": 0,
          "format": "none",
          "label": "",
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "decimals": 0,
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": true,
        "alignLevel": null
      }
    },
    {
      "collapsed": true,
      "datasource": null,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 99
      },
      "id": 41,
      "panels": [
        {
          "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
          "gridPos": {
            "h": 16,
            "w": 24,
            "x": 0,
            "y": 1
          },
          "id": 21,
          "links": [],
          "options": {
            "showTime": true,
            "sortOrder": "Descending"
          },
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "logs"
                }
              ],
              "query": "",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "SFTP Log",
          "type": "logs"
        },
        {
          "columns": [
            {
              "text": "@timestamp",
              "value": "@timestamp"
            },
            {
              "text": "sftp.desc",
              "value": "sftp.desc"
            },
            {
              "text": "sftp.sfs.desc",
              "value": "sftp.sfs.desc"
            },
            {
              "text": "sftp.sfs.parameters.path",
              "value": "sftp.sfs.parameters.path"
            },
            {
              "text": "sftp.seq",
              "value": "sftp.seq"
            },
            {
              "text": "host.name",
              "value": "host.name"
            },
            {
              "text": "sftp.session.virtualAccount",
              "value": "sftp.session.virtualAccount"
            },
            {
              "text": "sftp.parameters.bytesReceived",
              "value": "sftp.parameters.bytesReceived"
            },
            {
              "text": "sftp.parameters.bytesSent",
              "value": "sftp.parameters.bytesSent"
            },
            {
              "text": "sftp.sfs.parameters.bytesWritten",
              "value": "sftp.sfs.parameters.bytesWritten"
            },
            {
              "text": "sftp.sfs.parameters.bytesRead",
              "value": "sftp.sfs.parameters.bytesRead"
            }
          ],
          "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
          "fontSize": "100%",
          "gridPos": {
            "h": 16,
            "w": 24,
            "x": 0,
            "y": 17
          },
          "id": 18,
          "links": [],
          "options": {},
          "pageSize": null,
          "scroll": true,
          "showHeader": true,
          "sort": {
            "col": 0,
            "desc": true
          },
          "styles": [
            {
              "alias": "Time",
              "align": "auto",
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "pattern": "@timestamp",
              "type": "date"
            },
            {
              "alias": "Description",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sftp.desc",
              "thresholds": [],
              "type": "string",
              "unit": "short"
            },
            {
              "alias": "Description 2",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sftp.sfs.desc",
              "thresholds": [],
              "type": "string",
              "unit": "short"
            },
            {
              "alias": "Path",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sftp.sfs.parameters.path",
              "thresholds": [],
              "type": "string",
              "unit": "short"
            },
            {
              "alias": "Log_Sequence",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "sftp.seq",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Host",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "host.name",
              "thresholds": [],
              "type": "string",
              "unit": "short"
            },
            {
              "alias": "Account",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sftp.session.virtualAccount",
              "thresholds": [],
              "type": "string",
              "unit": "short"
            },
            {
              "alias": "BytesRecvd",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "sftp.parameters.bytesReceived",
              "thresholds": [],
              "type": "number",
              "unit": "decbytes"
            },
            {
              "alias": "BytesSent",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "sftp.parameters.bytesSent",
              "thresholds": [],
              "type": "number",
              "unit": "decbytes"
            },
            {
              "alias": "BytesWriten",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "sftp.sfs.parameters.bytesWritten",
              "thresholds": [],
              "type": "number",
              "unit": "decbytes"
            },
            {
              "alias": "BytesRead",
              "align": "auto",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "sftp.sfs.parameters.bytesRead",
              "thresholds": [],
              "type": "number",
              "unit": "decbytes"
            }
          ],
          "targets": [
            {
              "bucketAggs": [],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "meta": {},
                  "settings": {
                    "size": 5000
                  },
                  "type": "raw_document"
                }
              ],
              "query": "host.name.keyword:$host AND sftp.session.virtualAccount.keyword:$username",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "SFTP Log",
          "transform": "json",
          "type": "table"
        }
      ],
      "title": "Verbose Logs",
      "type": "row"
    }
  ],
  "refresh": false,
  "schemaVersion": 22,
  "style": "dark",
  "tags": [
    "SFTP",
    "Windows",
    "ElasticSearch",
    "Bitvise"
  ],
  "templating": {
    "list": [
      {
        "allValue": null,
        "current": {},
        "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
        "definition": "{\"find\":\"terms\",\"field\":\"sftp.session.virtualAccount.keyword\"}",
        "hide": 0,
        "includeAll": true,
        "label": "Username",
        "multi": true,
        "name": "username",
        "options": [],
        "query": "{\"find\":\"terms\",\"field\":\"sftp.session.virtualAccount.keyword\"}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 6,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "${DS_ELASTICSEARCH-BITVISE-LOGS}",
        "definition": "{\"find\":\"terms\",\"field\":\"host.name.keyword\"}",
        "hide": 0,
        "includeAll": true,
        "label": "Host",
        "multi": true,
        "name": "host",
        "options": [],
        "query": "{\"find\":\"terms\",\"field\":\"host.name.keyword\"}",
        "refresh": 2,
        "regex": "/.*sftp.*/",
        "skipUrlSync": false,
        "sort": 6,
        "tagValuesQuery": "{\"find\":\"terms\",\"field\":\"host.name.keyword\",\"query\":\"tags.keyword:$tag\"}",
        "tags": [
          "_geoip_lookup_failure",
          "beats_input_codec_plain_applied",
          "bitvise"
        ],
        "tagsQuery": "{\"find\":\"terms\",\"field\":\"tags.keyword\"}",
        "type": "query",
        "useTags": true
      },
      {
        "datasource": "Elasticsearch-bitvise-logs",
        "filters": [],
        "hide": 0,
        "label": "",
        "name": "Filters",
        "skipUrlSync": false,
        "type": "adhoc"
      }
    ]
  },
  "time": {
    "from": "now-7d",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "",
  "title": "Bitvise SFTP Logs",
  "uid": "VxymKw4Zz",
  "version": 100
}