diff --git a/package.json b/package.json index c2507d8fc..4cb4128c1 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "wazuh", "version": "2.0.0-beta1", "kibana": { - "version" : "5.1.1" + "version" : "5.1.2" }, "description": "Wazuh App", "main": "index.js", diff --git a/public/app.js b/public/app.js index 626ab24b0..4812fa1a8 100644 --- a/public/app.js +++ b/public/app.js @@ -35,15 +35,25 @@ require('plugins/wazuh/directives/kibanaDashboardDirective.js'); require('plugins/wazuh/directives/kibanaSearchbarDirective.js'); // Require controllers +// Global require('plugins/wazuh/controllers/general.js'); + +// Overview require('plugins/wazuh/controllers/overview.js'); -require('plugins/wazuh/controllers/agents.js'); -require('plugins/wazuh/controllers/settings.js'); + +// Manager require('plugins/wazuh/controllers/manager.js'); -require('plugins/wazuh/controllers/fim.js'); -require('plugins/wazuh/controllers/policy-monitoring.js'); require('plugins/wazuh/controllers/ruleset.js'); require('plugins/wazuh/controllers/osseclog.js'); + +// Agents +require('plugins/wazuh/controllers/agentsOverview.js'); +require('plugins/wazuh/controllers/agentsPreview.js'); +require('plugins/wazuh/controllers/agentsFim.js'); +require('plugins/wazuh/controllers/agentsPm.js'); + +// Settings +require('plugins/wazuh/controllers/settings.js'); require('plugins/wazuh/controllers/testController.js'); //Bootstrap and font awesome diff --git a/public/controllers/fim.js b/public/controllers/agentsFim.js similarity index 94% rename from public/controllers/fim.js rename to public/controllers/agentsFim.js index 1537f03f6..8bf4dadba 100644 --- a/public/controllers/fim.js +++ b/public/controllers/agentsFim.js @@ -23,10 +23,6 @@ app.controller('fimController', function ($scope, $q, DataFactory, $mdToast, err }; //Functions - - $scope.setTimer = function (time) { - $scope.timerFilterValue = time; - }; $scope.setSort = function (field) { if ($scope._sort === field) { @@ -149,7 +145,6 @@ app.controller('fimController', function ($scope, $q, DataFactory, $mdToast, err //Load try { load(); - $scope.setTimer($scope.$parent.timeFilter); } catch (e) { $mdToast.show({ template: ' Unexpected exception loading controller ', @@ -159,13 +154,7 @@ app.controller('fimController', function ($scope, $q, DataFactory, $mdToast, err errlog.log('Unexpected exception loading controller', e); } - - // Timer filter watch - var timerWatch = $scope.$watch(function () { - return $scope.$parent.timeFilter; - }, function () { - $scope.setTimer($scope.$parent.timeFilter); - }); + //Destroy $scope.$on("$destroy", function () { @@ -174,7 +163,6 @@ app.controller('fimController', function ($scope, $q, DataFactory, $mdToast, err }); $scope.files.length = 0; loadWatch(); - timerWatch(); }); }); \ No newline at end of file diff --git a/public/controllers/agentsOverview.js b/public/controllers/agentsOverview.js new file mode 100644 index 000000000..f2e15e9fe --- /dev/null +++ b/public/controllers/agentsOverview.js @@ -0,0 +1,75 @@ +// Require config +var app = require('ui/modules').get('app/wazuh', []); + +app.controller('agentsController', function ($scope, DataFactory, $mdToast) { + + //Initialisation + $scope.load = true; + $scope.agentInfo = []; + + var objectsArray = []; + var loadWatch; + + //Print Error + var printError = function (error) { + $mdToast.show({ + template: '' + error.html + '', + position: 'bottom left', + hideDelay: 5000, + }); + if ($scope.blocked) { + $scope.blocked = false; + } + }; + + //Functions + + + $scope.fetchAgent = function (agent) { + DataFactory.getAndClean('get', '/agents/' + agent.id, {}) + .then(function (data) { + $scope.agentInfo = data.data; + $scope.$parent._agent.status = data.data.status; + if (agent.id != '000') { + DataFactory.getAndClean('get', '/agents/' + agent.id + '/key', {}) + .then(function (data) { + $scope.agentInfo.key = data.data; + $scope.load = false; + $scope.$parent.load = false; + }, printError); + } + }, printError); + $scope.fetchFim(agent); + $scope.fetchRootcheck(agent); + }; + + $scope.fetchFim = function (agent) { + DataFactory.getAndClean('get', '/syscheck/' + agent.id, { 'offset': 0, 'limit': 5 }) + .then(function (data) { + $scope.agentInfo.syscheckEvents = data.data.items; + }, printError); + }; + + $scope.fetchRootcheck = function (agent) { + DataFactory.getAndClean('get', '/rootcheck/' + agent.id, { 'offset': 0, 'limit': 5 }) + .then(function (data) { + $scope.agentInfo.rootcheckEvents = data.data.items; + }, printError); + }; + + //Load + loadWatch = $scope.$watch(function () { + return $scope.$parent._agent; + }, function () { + $scope.fetchAgent($scope.$parent._agent); + }); + + //Destroy + $scope.$on("$destroy", function () { + angular.forEach(objectsArray, function (value) { + DataFactory.clean(value) + }); + //loadWatch(); + }); + +}); diff --git a/public/controllers/policy-monitoring.js b/public/controllers/agentsPm.js similarity index 96% rename from public/controllers/policy-monitoring.js rename to public/controllers/agentsPm.js index 7f4a32759..66e481b89 100644 --- a/public/controllers/policy-monitoring.js +++ b/public/controllers/agentsPm.js @@ -1,155 +1,156 @@ -// Require config -var app = require('ui/modules').get('app/wazuh', []); - -app.controller('pmController', function ($scope, DataFactory, $mdToast, errlog, appState) { //Initialisation - $scope.load = true; - var objectsArray = []; - var loadWatch; - $scope.defaultManagerName = appState.getDefaultManager().name; - $scope.events = []; - - //Print Error - var printError = function (error) { - $mdToast.show({ - template: '' + error.html + '', - position: 'bottom left', - hideDelay: 5000, - }); - if ($scope._eblocked) { - $scope._eblocked = false; - } - } - - //Functions - - $scope.setTimer = function (time) { - $scope.timerFilterValue = time; - }; - - - $scope.setSort = function (field) { - if ($scope._sort === field) { - if ($scope._sortOrder) { - $scope._sortOrder = false; - $scope._sort = ''; - DataFactory.filters.unset(objectsArray['/rootcheck'], 'filter-sort'); - } else { - $scope._sortOrder = true; - DataFactory.filters.set(objectsArray['/rootcheck'], 'filter-sort', field); - } - } else { - $scope._sortOrder = false; - $scope._sort = field; - DataFactory.filters.set(objectsArray['/rootcheck'], 'filter-sort', '-' + field); - } - } - - $scope.eventSearchFilter = function (search) { - if (search) { - DataFactory.filters.set(objectsArray['/rootcheck'], 'search', search); - } else { - DataFactory.filters.unset(objectsArray['/rootcheck'], 'search'); - } - }; - - $scope.eventsObj = { - //Obj with methods for virtual scrolling - getItemAtIndex: function (index) { - if ($scope._eblocked) { - return null; - } - var _pos = index - DataFactory.getOffset(objectsArray['/rootcheck']); - if (DataFactory.filters.flag(objectsArray['/rootcheck'])) { - $scope._eblocked = true; - DataFactory.scrollTo(objectsArray['/rootcheck'], 200) - .then(function (data) { - $scope.events.length = 0; - $scope.events = data.data.items; - DataFactory.filters.unflag(objectsArray['/rootcheck']); - $scope._eblocked = false; - }, printError); - } else if ((_pos > 150) || (_pos < 0)) { - $scope._eblocked = true; - DataFactory.scrollTo(objectsArray['/rootcheck'], index) - .then(function (data) { - $scope.events.length = 0; - $scope.events = data.data.items; - $scope._eblocked = false; - }, printError); - } else { - return $scope.events[_pos]; - } - }, - getLength: function () { - return DataFactory.getTotalItems(objectsArray['/rootcheck']); - }, - }; - - var createWatch = function () { - loadWatch = $scope.$watch(function () { - return $scope.$parent._agent; - }, function () { - DataFactory.initialize('get', '/rootcheck/' + $scope.$parent._agent.id, {}, 200, 0) - .then(function (data) { - DataFactory.clean(objectsArray['/rootcheck']); - objectsArray['/rootcheck'] = data; - DataFactory.get(objectsArray['/rootcheck']) - .then(function (data) { - $scope.events.length = 0; - $scope.events = data.data.items; - DataFactory.filters.register(objectsArray['/rootcheck'], 'search', 'string'); - DataFactory.filters.register(objectsArray['/rootcheck'], 'filter-sort', 'string'); - $scope._sort = ''; - $scope.eventSearchFilter($scope._eventSearch); - }, printError); - }, printError); - }); - }; - - var load = function () { - DataFactory.initialize('get', '/rootcheck/' + $scope.$parent._agent.id, {}, 200, 0) - .then(function (data) { - objectsArray['/rootcheck'] = data; - DataFactory.get(objectsArray['/rootcheck']) - .then(function (data) { - $scope.events = data.data.items; - $scope.totalEvents = data.data.totalItems; - DataFactory.filters.register(objectsArray['/rootcheck'], 'search', 'string'); - DataFactory.filters.register(objectsArray['/rootcheck'], 'filter-sort', 'string'); - createWatch(); - $scope.load = false; - }, printError); - }, printError); - }; - - //Load - try { - load(); - $scope.setTimer($scope.$parent.timeFilter); - } catch (e) { - $mdToast.show({ - template: ' Unexpected exception loading controller ', - position: 'bottom left', - hideDelay: 5000, - }); - errlog.log('Unexpected exception loading controller', e); - } - - // Timer filter watch - var timerWatch = $scope.$watch(function () { - return $scope.$parent.timeFilter; - }, function () { - $scope.setTimer($scope.$parent.timeFilter); - }); - - //Destroy - $scope.$on("$destroy", function () { - angular.forEach(objectsArray, function (value) { - DataFactory.clean(value) - }); - $scope.events.length = 0; - loadWatch(); - timerWatch(); - }); - -}) +// Require config +var app = require('ui/modules').get('app/wazuh', []); + +app.controller('pmController', function ($scope, DataFactory, $mdToast, errlog, appState) { + //Initialisation + $scope.load = true; + var objectsArray = []; + var loadWatch; + $scope.defaultManagerName = appState.getDefaultManager().name; + $scope.events = []; + + //Print Error + var printError = function (error) { + $mdToast.show({ + template: '' + error.html + '', + position: 'bottom left', + hideDelay: 5000, + }); + if ($scope._eblocked) { + $scope._eblocked = false; + } + } + + //Functions + + $scope.setTimer = function (time) { + $scope.timerFilterValue = time; + }; + + + $scope.setSort = function (field) { + if ($scope._sort === field) { + if ($scope._sortOrder) { + $scope._sortOrder = false; + $scope._sort = ''; + DataFactory.filters.unset(objectsArray['/rootcheck'], 'filter-sort'); + } else { + $scope._sortOrder = true; + DataFactory.filters.set(objectsArray['/rootcheck'], 'filter-sort', field); + } + } else { + $scope._sortOrder = false; + $scope._sort = field; + DataFactory.filters.set(objectsArray['/rootcheck'], 'filter-sort', '-' + field); + } + } + + $scope.eventSearchFilter = function (search) { + if (search) { + DataFactory.filters.set(objectsArray['/rootcheck'], 'search', search); + } else { + DataFactory.filters.unset(objectsArray['/rootcheck'], 'search'); + } + }; + + $scope.eventsObj = { + //Obj with methods for virtual scrolling + getItemAtIndex: function (index) { + if ($scope._eblocked) { + return null; + } + var _pos = index - DataFactory.getOffset(objectsArray['/rootcheck']); + if (DataFactory.filters.flag(objectsArray['/rootcheck'])) { + $scope._eblocked = true; + DataFactory.scrollTo(objectsArray['/rootcheck'], 200) + .then(function (data) { + $scope.events.length = 0; + $scope.events = data.data.items; + DataFactory.filters.unflag(objectsArray['/rootcheck']); + $scope._eblocked = false; + }, printError); + } else if ((_pos > 150) || (_pos < 0)) { + $scope._eblocked = true; + DataFactory.scrollTo(objectsArray['/rootcheck'], index) + .then(function (data) { + $scope.events.length = 0; + $scope.events = data.data.items; + $scope._eblocked = false; + }, printError); + } else { + return $scope.events[_pos]; + } + }, + getLength: function () { + return DataFactory.getTotalItems(objectsArray['/rootcheck']); + }, + }; + + var createWatch = function () { + loadWatch = $scope.$watch(function () { + return $scope.$parent._agent; + }, function () { + DataFactory.initialize('get', '/rootcheck/' + $scope.$parent._agent.id, {}, 200, 0) + .then(function (data) { + DataFactory.clean(objectsArray['/rootcheck']); + objectsArray['/rootcheck'] = data; + DataFactory.get(objectsArray['/rootcheck']) + .then(function (data) { + $scope.events.length = 0; + $scope.events = data.data.items; + DataFactory.filters.register(objectsArray['/rootcheck'], 'search', 'string'); + DataFactory.filters.register(objectsArray['/rootcheck'], 'filter-sort', 'string'); + $scope._sort = ''; + $scope.eventSearchFilter($scope._eventSearch); + }, printError); + }, printError); + }); + }; + + var load = function () { + DataFactory.initialize('get', '/rootcheck/' + $scope.$parent._agent.id, {}, 200, 0) + .then(function (data) { + objectsArray['/rootcheck'] = data; + DataFactory.get(objectsArray['/rootcheck']) + .then(function (data) { + $scope.events = data.data.items; + $scope.totalEvents = data.data.totalItems; + DataFactory.filters.register(objectsArray['/rootcheck'], 'search', 'string'); + DataFactory.filters.register(objectsArray['/rootcheck'], 'filter-sort', 'string'); + createWatch(); + $scope.load = false; + }, printError); + }, printError); + }; + + //Load + try { + load(); + $scope.setTimer($scope.$parent.timeFilter); + } catch (e) { + $mdToast.show({ + template: ' Unexpected exception loading controller ', + position: 'bottom left', + hideDelay: 5000, + }); + errlog.log('Unexpected exception loading controller', e); + } + + // Timer filter watch + var timerWatch = $scope.$watch(function () { + return $scope.$parent.timeFilter; + }, function () { + $scope.setTimer($scope.$parent.timeFilter); + }); + + //Destroy + $scope.$on("$destroy", function () { + angular.forEach(objectsArray, function (value) { + DataFactory.clean(value) + }); + $scope.events.length = 0; + loadWatch(); + timerWatch(); + }); + +}) diff --git a/public/controllers/agents.js b/public/controllers/agentsPreview.js similarity index 70% rename from public/controllers/agents.js rename to public/controllers/agentsPreview.js index abcab60b3..baf23af48 100644 --- a/public/controllers/agents.js +++ b/public/controllers/agentsPreview.js @@ -2,79 +2,6 @@ require('plugins/wazuh/utils/infinite_scroll/infinite-scroll.js'); var app = require('ui/modules').get('app/wazuh', []); -app.controller('agentsController', function ($scope, DataFactory, $mdToast) { - - //Initialisation - $scope.load = true; - $scope.agentInfo = []; - - var objectsArray = []; - var loadWatch; - - //Print Error - var printError = function (error) { - $mdToast.show({ - template: '' + error.html + '', - position: 'bottom left', - hideDelay: 5000, - }); - if ($scope.blocked) { - $scope.blocked = false; - } - }; - - //Functions - - - $scope.fetchAgent = function (agent) { - DataFactory.getAndClean('get', '/agents/' + agent.id, {}) - .then(function (data) { - $scope.agentInfo = data.data; - $scope.$parent._agent.status = data.data.status; - if (agent.id != '000') { - DataFactory.getAndClean('get', '/agents/' + agent.id + '/key', {}) - .then(function (data) { - $scope.agentInfo.key = data.data; - $scope.load = false; - $scope.$parent.load = false; - }, printError); - } - }, printError); - $scope.fetchFim(agent); - $scope.fetchRootcheck(agent); - }; - - $scope.fetchFim = function (agent) { - DataFactory.getAndClean('get', '/syscheck/' + agent.id, { 'offset': 0, 'limit': 5 }) - .then(function (data) { - $scope.agentInfo.syscheckEvents = data.data.items; - }, printError); - }; - - $scope.fetchRootcheck = function (agent) { - DataFactory.getAndClean('get', '/rootcheck/' + agent.id, { 'offset': 0, 'limit': 5 }) - .then(function (data) { - $scope.agentInfo.rootcheckEvents = data.data.items; - }, printError); - }; - - //Load - loadWatch = $scope.$watch(function () { - return $scope.$parent._agent; - }, function () { - $scope.fetchAgent($scope.$parent._agent); - }); - - //Destroy - $scope.$on("$destroy", function () { - angular.forEach(objectsArray, function (value) { - DataFactory.clean(value) - }); - //loadWatch(); - }); - -}); - app.factory('Agents', function($http, DataFactory) { var Agents = function(objectsArray, items) { this.items = items; @@ -232,4 +159,4 @@ app.controller('agentsPreviewController', function ($scope, DataFactory, $mdToas }); $scope.agents.length = 0; }); -}); +}); \ No newline at end of file diff --git a/public/controllers/overview.js b/public/controllers/overview.js index 7a2bf13f1..c3836ea57 100644 --- a/public/controllers/overview.js +++ b/public/controllers/overview.js @@ -5,47 +5,7 @@ app.controller('overviewGeneralController', function ($scope, DataFactory, gener $scope.load = true; $scope.defaultManager = $scope.$parent.state.getDefaultManager().name; - $scope.stats = []; - //Print Error - var printError = function (error) { - $mdToast.show({ - template: '' + error.html + '', - position: 'bottom left', - hideDelay: 5000, - }); - }; - - //Functions - $scope.setTimer = function (time) { - $scope.timerFilterValue = time; - }; - - //Load - try { - $scope.setTimer($scope.$parent.timeFilter); - } catch (e) { - $mdToast.show({ - template: ' Unexpected exception loading controller ', - position: 'bottom left', - hideDelay: 5000, - }); - errlog.log('Unexpected exception loading controller', e); - } - - // Timer filter watch - var loadWatch = $scope.$watch(function () { - return $scope.$parent.timeFilter; - }, function () { - $scope.setTimer($scope.$parent.timeFilter); - }); - - - //Destroy - $scope.$on("$destroy", function () { - $scope.stats.length = 0; - loadWatch(); - }); }); @@ -53,9 +13,7 @@ app.controller('overviewGeneralController', function ($scope, DataFactory, gener app.controller('overviewFimController', function ($scope, DataFactory, genericReq, $mdToast, errlog) { //Initialisation $scope.load = true; - $scope.$parent.state.setOverviewState('fim'); $scope.defaultManager = $scope.$parent.state.getDefaultManager().name; - $scope.stats = []; //Print Error var printError = function (error) { @@ -67,27 +25,8 @@ app.controller('overviewFimController', function ($scope, DataFactory, genericRe }; //Functions - $scope.setTimer = function (time) { - $scope.timerFilterValue = time; - }; - var load_tops = function () { - - var daysAgo = 1; - if ($scope.timerFilterValue == "24h") { - daysAgo = 1; - } else if ($scope.timerFilterValue == "7d") { - daysAgo = 7; - } else if ($scope.timerFilterValue == "30d") { - daysAgo = 30; - } else { - daysAgo = 1; - } - - var date = new Date(); - date.setDate(date.getDate() - daysAgo); - var timeAgo = date.getTime(); // Last fields @@ -110,7 +49,6 @@ app.controller('overviewFimController', function ($scope, DataFactory, genericRe //Load try { - $scope.setTimer($scope.$parent.timeFilter); load_tops(); } catch (e) { $mdToast.show({ @@ -121,20 +59,6 @@ app.controller('overviewFimController', function ($scope, DataFactory, genericRe errlog.log('Unexpected exception loading controller', e); } - // Timer filter watch - var loadWatch = $scope.$watch(function () { - return $scope.$parent.timeFilter; - }, function () { - $scope.setTimer($scope.$parent.timeFilter); - load_tops(); - }); - - //Destroy - $scope.$on("$destroy", function () { - $scope.stats.length = 0; - loadWatch(); - }); - }); @@ -143,7 +67,6 @@ app.controller('overviewPMController', function ($scope, DataFactory, genericReq $scope.load = true; $scope.$parent.state.setOverviewState('pm'); $scope.defaultManager = $scope.$parent.state.getDefaultManager().name; - $scope.stats = []; //Print Error var printError = function (error) { @@ -154,36 +77,9 @@ app.controller('overviewPMController', function ($scope, DataFactory, genericReq }); }; - //Functions - $scope.setTimer = function (time) { - $scope.timerFilterValue = time; - }; var load_tops = function () { - - var daysAgo = 1; - if ($scope.timerFilterValue == "24h") { - daysAgo = 1; - } else if ($scope.timerFilterValue == "7d") { - daysAgo = 7; - } else if ($scope.timerFilterValue == "30d") { - daysAgo = 30; - } else { - daysAgo = 1; - } - - var date = new Date(); - date.setDate(date.getDate() - daysAgo); - var timeAgo = date.getTime(); - - - // Top fields - genericReq.request('GET', '/api/wazuh-elastic/top/'+$scope.defaultManager+'/AgentName/'+timeAgo) - .then(function (data) { - $scope.topagent = data.data; - }, printError); - // Last fields @@ -206,14 +102,11 @@ app.controller('overviewPMController', function ($scope, DataFactory, genericReq .then(function (data) { $scope.lastEventAgentIP = (data.data != "") ? data.data : ""; }, printError); - - }; //Load try { - $scope.setTimer($scope.$parent.timeFilter); load_tops(); } catch (e) { $mdToast.show({ @@ -224,18 +117,5 @@ app.controller('overviewPMController', function ($scope, DataFactory, genericReq errlog.log('Unexpected exception loading controller', e); } - // Timer filter watch - var loadWatch = $scope.$watch(function () { - return $scope.$parent.timeFilter; - }, function () { - $scope.setTimer($scope.$parent.timeFilter); - load_tops(); - }); - - //Destroy - $scope.$on("$destroy", function () { - $scope.stats.length = 0; - loadWatch(); - }); }); diff --git a/public/templates/agents-fim.html b/public/templates/agents-fim.html index ec6ce034c..2863c3306 100644 --- a/public/templates/agents-fim.html +++ b/public/templates/agents-fim.html @@ -103,7 +103,7 @@ - Last events + Alerts summary - Last events + Alerts summary - diff --git a/public/templates/overview-fim.html b/public/templates/overview-fim.html index 604f576df..f6f80dcaf 100644 --- a/public/templates/overview-fim.html +++ b/public/templates/overview-fim.html @@ -10,7 +10,7 @@ - + @@ -60,7 +60,7 @@ -
Last file changed
+
Last file modified
@@ -86,7 +86,7 @@ -
Top changed
+
Top file changes
 @@ -94,7 +94,7 @@ -
Top root related changes
+
Root user file changes
 @@ -102,7 +102,7 @@ -
Top world writable
+
World writable modified files
 @@ -133,7 +133,7 @@ -
Most changed file
+
Most modified file
 diff --git a/public/templates/overview-general.html b/public/templates/overview-general.html index d86cc6394..67cf9689b 100644 --- a/public/templates/overview-general.html +++ b/public/templates/overview-general.html @@ -54,8 +54,8 @@
- Agents - Alerts evolution - Top 10 agents + @@ -67,7 +67,7 @@ Agents status - diff --git a/public/templates/overview-pm.html b/public/templates/overview-pm.html index 4cf27e0a5..97e416fb0 100644 --- a/public/templates/overview-pm.html +++ b/public/templates/overview-pm.html @@ -36,7 +36,7 @@ Events per agent evolution - @@ -52,8 +52,8 @@ - + diff --git a/server/scripts/integration_files/kibana_fields_file.json b/server/scripts/integration_files/kibana_fields_file.json index 749b6655c..8ffa5204d 100644 --- a/server/scripts/integration_files/kibana_fields_file.json +++ b/server/scripts/integration_files/kibana_fields_file.json @@ -1,4 +1,4 @@ { - "wazuh_alerts": "[{\"name\":\"rule.id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"dstport\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.latitude\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.cve\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.perm_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"action\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"agent.name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"dstip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.accumulate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.return_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.uid_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.size_before\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"agent.ip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.profile.title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.size_after\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.sha1_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.gname_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.area_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.path\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"srcuser\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"agent.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.md5_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.sha1_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.frequency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"status\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.inode_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.diff\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.longitude\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"manager.name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.postal_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.gname_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.pci_dss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.uname_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.references\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.rationale\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.ftscomment\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.country_code2\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.country_code3\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.profile.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.firedtimes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.level\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.event\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.ip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"srcip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"data\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.coordinates\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.city_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"program_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.timezone\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"previous_log\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"protocol\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"AlertsFile\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.parent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.dma_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"offset\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.oval.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.cis\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.uname_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.continent_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.perm_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.country_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.fts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.groups\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.region_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.benchmark.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.inode_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.result\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.mtime_after\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"full_log\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.mtime_before\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.identifiers\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.gid_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"dstuser\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"@version\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.content\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.location\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"system_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.md5_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.uid_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.info\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"location\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.real_region_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.severity\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"ip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true}]", + "wazuh_alerts": "[{\"name\":\"rule.id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.directory.name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"dstport\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.tty\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.latitude\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.cve\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"path\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.exe\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.perm_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"action\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"agent.name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"dstip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.accumulate\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.suid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.return_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.uid_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.size_before\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"agent.ip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.profile.title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.size_after\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.sha1_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.old-auid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.gname_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.directory.mode\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.area_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.path\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"srcuser\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"agent.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.md5_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.sha1_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.frequency\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"status\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.gid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.inode_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.diff\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.old_enforcing\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"logon_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"file\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.longitude\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"manager.name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"account_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.postal_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.egid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.gname_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.pci_dss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.uname_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.file.name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.acct\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.res\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.references\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.rationale\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.ftscomment\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.ppid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.fsuid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.country_code2\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.country_code3\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.subj\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.profile.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.enforcing\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.exit\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.firedtimes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.level\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.event\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.ip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"srcip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"data\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.coordinates\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.city_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.directory.inode\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"program_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.success\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.timezone\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.sgid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"previous_log\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"protocol\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.srcip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.pid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.session\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"AlertsFile\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.key\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.parent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.dma_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"offset\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.auid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.oval.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.cis\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.old_prom\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.uname_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.continent_code\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.perm_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.cwd\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.country_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"decoder.fts\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.syscall\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.file.mode\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.groups\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.gid_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.region_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.prom\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.benchmark.id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.inode_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.result\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.mtime_after\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.file.inode\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"full_log\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.mtime_before\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.identifiers\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.uid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.old-ses\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.gid_before\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"dstuser\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.euid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"@version\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.scan.content\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.location\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"account_domain\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"system_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.md5_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.dev\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"syscheck.uid_after\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.fsgid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"rule.info\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.op\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"location\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"audit.list\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"GeoLocation.real_region_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"oscap.check.severity\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"ip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true}]", "wazuh_monitoring": "[{\"name\":\"ip\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":false,\"aggregatable\":false},{\"name\":\"id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"status\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":false,\"aggregatable\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":true,\"aggregatable\":true},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":false,\"aggregatable\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false,\"searchable\":false,\"aggregatable\":false}]" } \ No newline at end of file