Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Auditbeat] System module dashboards #10511

Merged
merged 14 commits into from
Feb 5, 2019

Conversation

cwurm
Copy link
Contributor

@cwurm cwurm commented Feb 3, 2019

7 dashboards for the System module - one for each dataset, and an overall overview dashboards.

1/7 System Overview Dashboard

auditbeat-system-overview-dashboard

2/7 Host Dashboard

auditbeat-system-host-dashboard

3/7 Login Dashboard

auditbeat-system-login-dashboard

4/7 User Dashboard

auditbeat-system-user-dashboard

5/7 Process Dashboard

auditbeat-system-process-dashboard

6/7 Socket Dashboard

auditbeat-system-socket-dashboard

7/7 Package Dashboard

auditbeat-system-package-dashboard

Depends on #10500 for {entity}.entity_id fields.

Supersedes #10160 (Host Dashboard).

@cwurm cwurm added review needs_backport PR is waiting to be backported to other branches. Auditbeat SecOps labels Feb 3, 2019
@cwurm cwurm requested review from a team as code owners February 3, 2019 23:24
@elasticmachine
Copy link
Collaborator

Pinging @elastic/secops

@cwurm
Copy link
Contributor Author

cwurm commented Feb 3, 2019

I forgot to mention this dashboard depends on the {entity}.entity_id fields proposed in #10500 and this PR is therefore blocked for now.

@@ -29,7 +30,12 @@ do
mkdir -p "$dest_dir"
params="--chunk=1"
if [ "$PREVIEW" = "1" ]; then
params="--chunk=1 -open chunk=1 -open"
params+=" -open chunk=1 -open"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the double -open needed here? I would say not, but not sure.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems to work without it as well. And the chunk=1 also seems superfluous since right above it already sets --chunk=1. It works without both of them for me, so I'm removing both.

Copy link
Contributor

@tsg tsg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like the dashboard :)

@cwurm cwurm changed the title [Auditbeat] System Overview dashboard [Auditbeat] System module dashboards Feb 4, 2019
@cwurm
Copy link
Contributor Author

cwurm commented Feb 4, 2019

Updated PR description to reflect there are now 7 dashboards after all.

Copy link
Contributor

@webmat webmat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cwurm cwurm force-pushed the auditbeat_system_overview_dashboard branch from ed5e418 to 6068113 Compare February 5, 2019 14:12
@cwurm cwurm merged commit 38d5f43 into elastic:master Feb 5, 2019
@cwurm cwurm deleted the auditbeat_system_overview_dashboard branch February 5, 2019 16:21
@cwurm cwurm removed the needs_backport PR is waiting to be backported to other branches. label Feb 5, 2019
cwurm pushed a commit to cwurm/beats that referenced this pull request Feb 5, 2019
Seven dashboards for the Auditbeat System module - one for each dataset, and an overall overview dashboards.

(cherry picked from commit 38d5f43)
@cwurm cwurm added the v6.7.0 label Feb 5, 2019
cwurm pushed a commit that referenced this pull request Feb 5, 2019
cwurm pushed a commit that referenced this pull request Feb 5, 2019
Cherry-pick of PR #10511 to 6.x branch. Original message: 

Seven dashboards for the Auditbeat System module - one for each dataset, and an overall overview dashboards.

(cherry picked from commit 38d5f43)
@cwurm cwurm mentioned this pull request Feb 9, 2019
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants