{"attributes": {"allowHidden": false, "fieldAttrs": "{}", "fieldFormatMap": "{}", "fields": "[]", "name": "SecureSight (all)", "runtimeFieldMap": "{}", "sourceFilters": "[]", "timeFieldName": "@timestamp", "title": "securesight-*"}, "coreMigrationVersion": "8.8.0", "created_at": "2026-09-15T10:54:57.327Z", "id": "securesight-all", "managed": false, "references": [], "sort": [1789469697327, 13], "type": "index-pattern", "typeMigrationVersion": "8.0.0", "updated_at": "2026-09-15T10:54:57.327Z", "version": "WzcsMV0="}
{"attributes": {"allowHidden": false, "fieldAttrs": "{\"ss.deleted\":{\"customLabel\":\"Removed\"},\"ss.name\":{\"customLabel\":\"Asset\"},\"ss.type\":{\"customLabel\":\"Type\"},\"ss.deleted_at\":{\"customLabel\":\"Removed at\"},\"ss.business_value\":{\"customLabel\":\"Business value\"},\"ss.public_facing\":{\"customLabel\":\"Public facing\"}}", "fieldFormatMap": "{}", "fields": "[]", "name": "SecureSight assets", "runtimeFieldMap": "{}", "sourceFilters": "[]", "timeFieldName": "@timestamp", "title": "securesight-assets"}, "coreMigrationVersion": "8.8.0", "created_at": "2026-09-15T10:54:56.435Z", "id": "securesight-assets", "managed": false, "references": [], "sort": [1789469719342, 12], "type": "index-pattern", "typeMigrationVersion": "8.0.0", "updated_at": "2026-09-15T10:55:19.342Z", "version": "WzksMV0="}
{"attributes": {"allowHidden": false, "fieldAttrs": "{\"event.severity\":{\"customLabel\":\"Severity (0-4)\"},\"ss.cvss_score\":{\"customLabel\":\"CVSS\"},\"ss.status\":{\"customLabel\":\"Status\"},\"ss.module\":{\"customLabel\":\"Module\"},\"ss.asset.name\":{\"customLabel\":\"Asset\"},\"rule.name\":{\"customLabel\":\"Finding\"},\"threat.age_days\":{}}", "fieldFormatMap": "{\"event.severity\":{\"id\":\"color\",\"params\":{\"fieldType\":\"number\",\"colors\":[{\"range\":\"4:4\",\"text\":\"#ffffff\",\"background\":\"#bd271e\"},{\"range\":\"3:3\",\"text\":\"#000000\",\"background\":\"#f5a700\"},{\"range\":\"2:2\",\"text\":\"#000000\",\"background\":\"#fec514\"},{\"range\":\"0:1\",\"text\":\"#000000\",\"background\":\"#d3dae6\"}]}},\"ss.cvss_score\":{\"id\":\"number\",\"params\":{\"pattern\":\"0.0\"}}}", "fields": "[]", "name": "SecureSight threats", "runtimeFieldMap": "{}", "sourceFilters": "[]", "timeFieldName": "@timestamp", "title": "securesight-threats"}, "coreMigrationVersion": "8.8.0", "created_at": "2026-09-15T10:54:55.849Z", "id": "securesight-threats", "managed": false, "references": [], "sort": [1789469732035, 11], "type": "index-pattern", "typeMigrationVersion": "8.0.0", "updated_at": "2026-09-15T10:55:32.035Z", "version": "WzEwLDFd"}
{"attributes": {"columns": ["event.severity", "ss.status", "ss.module", "rule.name", "ss.asset.name", "threat.age_days"], "description": "Threats an analyst can still act on: unsolved or pending. Solved, false_positive and accepted are verdicts already reached.", "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\":{\"query\":\"ss.status: (\\\"unsolved\\\" or \\\"pending\\\")\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}, "sort": [["event.severity", "desc"], ["@timestamp", "desc"]], "title": "SecureSight \u2014 open threats"}, "coreMigrationVersion": "8.8.0", "created_at": "2026-09-15T10:55:53.268Z", "id": "securesight-open-threats", "managed": false, "references": [{"id": "securesight-threats", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern"}], "sort": [1789469753268, 8], "type": "search", "typeMigrationVersion": "10.4.0", "updated_at": "2026-09-15T10:55:53.268Z", "version": "WzExLDFd"}
{"attributes": {"columns": ["ss.name", "ss.type", "ss.business_value", "host.name", "destination.port"], "description": "Internet-reachable assets still in the inventory. The tombstone filter matters: without it, removed assets linger in any exposure count.", "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\":{\"query\":\"ss.public_facing: true and ss.deleted: false\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}, "sort": [["@timestamp", "desc"]], "title": "SecureSight \u2014 live public-facing assets"}, "coreMigrationVersion": "8.8.0", "created_at": "2026-09-15T10:55:54.389Z", "id": "securesight-public-exposure", "managed": false, "references": [{"id": "securesight-assets", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern"}], "sort": [1789469754389, 6], "type": "search", "typeMigrationVersion": "10.4.0", "updated_at": "2026-09-15T10:55:54.389Z", "version": "WzEzLDFd"}
{"attributes": {"columns": ["ss.name", "ss.type", "ss.deleted_at", "event.action"], "description": "Assets Secutec no longer tracks. Each arrived once with deleted=true; drop them and their threats from any mirrored copy.", "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\":{\"query\":\"ss.deleted: true\",\"language\":\"kuery\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}, "sort": [["@timestamp", "desc"]], "title": "SecureSight \u2014 removed assets (tombstones)"}, "coreMigrationVersion": "8.8.0", "created_at": "2026-09-15T10:55:53.388Z", "id": "securesight-removed-assets", "managed": false, "references": [{"id": "securesight-assets", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern"}], "sort": [1789469753388, 10], "type": "search", "typeMigrationVersion": "10.4.0", "updated_at": "2026-09-15T10:55:53.388Z", "version": "WzEyLDFd"}
{"id": "ss-metric-unsolved", "type": "lens", "managed": false, "coreMigrationVersion": "8.8.0", "typeMigrationVersion": "8.9.0", "attributes": {"title": "Unsolved findings", "description": "Findings with no disposition yet. The number an analyst owns.", "visualizationType": "lnsMetric", "state": {"datasourceStates": {"formBased": {"layers": {"l1": {"columns": {"m": {"label": "Unsolved", "dataType": "number", "operationType": "count", "isBucketed": false, "scale": "ratio", "sourceField": "___records___", "params": {"emptyAsNull": true}}}, "columnOrder": ["m"], "sampling": 1, "ignoreGlobalFilters": false, "incompleteColumns": {}}}}}, "internalReferences": [], "adHocDataViews": {}, "filters": [], "query": {"language": "kuery", "query": "ss.status: \"unsolved\""}, "visualization": {"layerId": "l1", "layerType": "data", "metricAccessor": "m", "color": "#BD271E"}}}, "references": [{"type": "index-pattern", "id": "securesight-threats", "name": "indexpattern-datasource-layer-l1"}]}
{"id": "ss-metric-aging-criticals", "type": "lens", "managed": false, "coreMigrationVersion": "8.8.0", "typeMigrationVersion": "8.9.0", "attributes": {"title": "Ageing criticals", "description": "Severity 4, unsolved, first seen more than 30 days ago. The SLA number \u2014 state, not change, which is why it belongs on a dashboard rather than in a rule.", "visualizationType": "lnsMetric", "state": {"datasourceStates": {"formBased": {"layers": {"l1": {"columns": {"m": {"label": "Critical > 30 days", "dataType": "number", "operationType": "count", "isBucketed": false, "scale": "ratio", "sourceField": "___records___", "params": {"emptyAsNull": true}}}, "columnOrder": ["m"], "sampling": 1, "ignoreGlobalFilters": false, "incompleteColumns": {}}}}}, "internalReferences": [], "adHocDataViews": {}, "filters": [], "query": {"language": "kuery", "query": "event.severity: 4 and ss.status: \"unsolved\" and threat.age_days > 30"}, "visualization": {"layerId": "l1", "layerType": "data", "metricAccessor": "m", "color": "#BD271E"}}}, "references": [{"type": "index-pattern", "id": "securesight-threats", "name": "indexpattern-datasource-layer-l1"}]}
{"id": "ss-metric-live-assets", "type": "lens", "managed": false, "coreMigrationVersion": "8.8.0", "typeMigrationVersion": "8.9.0", "attributes": {"title": "Live assets", "description": "Assets Secutec still tracks. Excludes tombstones \u2014 an inventory count that does not is wrong by the number of removals ever delivered.", "visualizationType": "lnsMetric", "state": {"datasourceStates": {"formBased": {"layers": {"l1": {"columns": {"m": {"label": "In inventory", "dataType": "number", "operationType": "count", "isBucketed": false, "scale": "ratio", "sourceField": "___records___", "params": {"emptyAsNull": true}}}, "columnOrder": ["m"], "sampling": 1, "ignoreGlobalFilters": false, "incompleteColumns": {}}}}}, "internalReferences": [], "adHocDataViews": {}, "filters": [], "query": {"language": "kuery", "query": "ss.deleted: false"}, "visualization": {"layerId": "l1", "layerType": "data", "metricAccessor": "m", "color": "#017D73"}}}, "references": [{"type": "index-pattern", "id": "securesight-assets", "name": "indexpattern-datasource-layer-l1"}]}
{"id": "ss-metric-tombstones", "type": "lens", "managed": false, "coreMigrationVersion": "8.8.0", "typeMigrationVersion": "8.9.0", "attributes": {"title": "Tombstones received", "description": "Assets delivered with deleted=true. Each one is a removal the stream made visible; before DEV-3298 every one of these was silently dropped.", "visualizationType": "lnsMetric", "state": {"datasourceStates": {"formBased": {"layers": {"l1": {"columns": {"m": {"label": "Removed", "dataType": "number", "operationType": "count", "isBucketed": false, "scale": "ratio", "sourceField": "___records___", "params": {"emptyAsNull": true}}}, "columnOrder": ["m"], "sampling": 1, "ignoreGlobalFilters": false, "incompleteColumns": {}}}}}, "internalReferences": [], "adHocDataViews": {}, "filters": [], "query": {"language": "kuery", "query": "ss.deleted: true"}, "visualization": {"layerId": "l1", "layerType": "data", "metricAccessor": "m", "color": "#6092C0"}}}, "references": [{"type": "index-pattern", "id": "securesight-assets", "name": "indexpattern-datasource-layer-l1"}]}
{"id": "ss-bar-status-by-module", "type": "lens", "managed": false, "coreMigrationVersion": "8.8.0", "typeMigrationVersion": "8.9.0", "attributes": {"title": "Findings by module and status", "description": "Where the work is, and how much of it has been dispositioned. A module that is nearly all unsolved is a triage backlog, not a noisy scanner.", "visualizationType": "lnsXY", "state": {"datasourceStates": {"formBased": {"layers": {"l1": {"columns": {"m": {"label": "Findings", "dataType": "number", "operationType": "count", "isBucketed": false, "scale": "ratio", "sourceField": "___records___", "params": {"emptyAsNull": true}}, "x": {"label": "Module", "dataType": "string", "operationType": "terms", "scale": "ordinal", "sourceField": "ss.module", "isBucketed": true, "params": {"size": 10, "orderBy": {"type": "column", "columnId": "m"}, "orderDirection": "desc", "otherBucket": false, "missingBucket": false, "parentFormat": {"id": "terms"}, "include": [], "exclude": [], "includeIsRegex": false, "excludeIsRegex": false}}, "s": {"label": "Status", "dataType": "string", "operationType": "terms", "scale": "ordinal", "sourceField": "ss.status", "isBucketed": true, "params": {"size": 5, "orderBy": {"type": "column", "columnId": "m"}, "orderDirection": "desc", "otherBucket": false, "missingBucket": false, "parentFormat": {"id": "terms"}, "include": [], "exclude": [], "includeIsRegex": false, "excludeIsRegex": false}}}, "columnOrder": ["x", "s", "m"], "sampling": 1, "ignoreGlobalFilters": false, "incompleteColumns": {}}}}}, "internalReferences": [], "adHocDataViews": {}, "filters": [], "query": {"language": "kuery", "query": ""}, "visualization": {"legend": {"isVisible": true, "position": "right"}, "valueLabels": "hide", "fittingFunction": "None", "preferredSeriesType": "bar_stacked", "layers": [{"layerId": "l1", "accessors": ["m"], "position": "top", "seriesType": "bar_stacked", "showGridlines": false, "layerType": "data", "xAccessor": "x", "splitAccessor": "s"}]}}}, "references": [{"type": "index-pattern", "id": "securesight-threats", "name": "indexpattern-datasource-layer-l1"}]}
{"id": "ss-bar-severity", "type": "lens", "managed": false, "coreMigrationVersion": "8.8.0", "typeMigrationVersion": "8.9.0", "attributes": {"title": "Open findings by severity", "description": "Severity distribution of everything still unsolved. event.severity is the ECS number (0 info to 4 critical) mapped from the API's severity string.", "visualizationType": "lnsXY", "state": {"datasourceStates": {"formBased": {"layers": {"l1": {"columns": {"m": {"label": "Findings", "dataType": "number", "operationType": "count", "isBucketed": false, "scale": "ratio", "sourceField": "___records___", "params": {"emptyAsNull": true}}, "x": {"label": "Severity", "dataType": "string", "operationType": "terms", "scale": "ordinal", "sourceField": "event.severity", "isBucketed": true, "params": {"size": 5, "orderBy": {"type": "column", "columnId": "m"}, "orderDirection": "desc", "otherBucket": false, "missingBucket": false, "parentFormat": {"id": "terms"}, "include": [], "exclude": [], "includeIsRegex": false, "excludeIsRegex": false}}}, "columnOrder": ["x", "m"], "sampling": 1, "ignoreGlobalFilters": false, "incompleteColumns": {}}}}}, "internalReferences": [], "adHocDataViews": {}, "filters": [], "query": {"language": "kuery", "query": "ss.status: \"unsolved\""}, "visualization": {"legend": {"isVisible": false, "position": "right"}, "valueLabels": "hide", "fittingFunction": "None", "preferredSeriesType": "bar_stacked", "layers": [{"layerId": "l1", "accessors": ["m"], "position": "top", "seriesType": "bar_stacked", "showGridlines": false, "layerType": "data", "xAccessor": "x"}]}}}, "references": [{"type": "index-pattern", "id": "securesight-threats", "name": "indexpattern-datasource-layer-l1"}]}
{"id": "ss-table-worst-assets", "type": "lens", "managed": false, "coreMigrationVersion": "8.8.0", "typeMigrationVersion": "8.9.0", "attributes": {"title": "Assets carrying the most open findings", "description": "The concentration view: which assets to fix first. ss.asset.id is the same id GET /v1/assets/{id} takes, so a row here is one API call from full context.", "visualizationType": "lnsDatatable", "state": {"datasourceStates": {"formBased": {"layers": {"l1": {"columns": {"r0": {"label": "Asset", "dataType": "string", "operationType": "terms", "scale": "ordinal", "sourceField": "ss.asset.name", "isBucketed": true, "params": {"size": 15, "orderBy": {"type": "column", "columnId": "m0"}, "orderDirection": "desc", "otherBucket": false, "missingBucket": false, "parentFormat": {"id": "terms"}, "include": [], "exclude": [], "includeIsRegex": false, "excludeIsRegex": false}}, "r1": {"label": "Type", "dataType": "string", "operationType": "terms", "scale": "ordinal", "sourceField": "securesight.asset.type", "isBucketed": true, "params": {"size": 5, "orderBy": {"type": "column", "columnId": "m0"}, "orderDirection": "desc", "otherBucket": false, "missingBucket": false, "parentFormat": {"id": "terms"}, "include": [], "exclude": [], "includeIsRegex": false, "excludeIsRegex": false}}, "m0": {"label": "Open findings", "dataType": "number", "operationType": "count", "isBucketed": false, "scale": "ratio", "sourceField": "___records___", "params": {"emptyAsNull": true}}, "m1": {"label": "Median CVSS", "dataType": "number", "operationType": "median", "sourceField": "ss.cvss_score", "isBucketed": false, "scale": "ratio", "params": {"emptyAsNull": false}}}, "columnOrder": ["r0", "r1", "m0", "m1"], "sampling": 1, "ignoreGlobalFilters": false, "incompleteColumns": {}}}}}, "internalReferences": [], "adHocDataViews": {}, "filters": [], "query": {"language": "kuery", "query": "ss.status: \"unsolved\""}, "visualization": {"layerId": "l1", "layerType": "data", "columns": [{"columnId": "r0"}, {"columnId": "r1"}, {"columnId": "m0"}, {"columnId": "m1"}], "sorting": {"columnId": "m0", "direction": "desc"}}}}, "references": [{"type": "index-pattern", "id": "securesight-threats", "name": "indexpattern-datasource-layer-l1"}]}
{"id": "ss-timeline-delta", "type": "lens", "managed": false, "coreMigrationVersion": "8.8.0", "typeMigrationVersion": "8.9.0", "attributes": {"title": "Delta stream activity", "description": "What each poll actually delivered, over resource time. @timestamp is the resource's updated_at, so a bar here is a resource that CHANGED \u2014 this is the delta contract made visible, not an event volume chart.", "visualizationType": "lnsXY", "state": {"datasourceStates": {"formBased": {"layers": {"l1": {"columns": {"m": {"label": "Documents delivered", "dataType": "number", "operationType": "count", "isBucketed": false, "scale": "ratio", "sourceField": "___records___", "params": {"emptyAsNull": true}}, "x": {"label": "Delivered", "dataType": "date", "operationType": "date_histogram", "sourceField": "@timestamp", "isBucketed": true, "scale": "interval", "params": {"interval": "auto", "includeEmptyRows": true, "dropPartials": false}}, "s": {"label": "Event", "dataType": "string", "operationType": "terms", "scale": "ordinal", "sourceField": "event.action", "isBucketed": true, "params": {"size": 5, "orderBy": {"type": "column", "columnId": "m"}, "orderDirection": "desc", "otherBucket": false, "missingBucket": false, "parentFormat": {"id": "terms"}, "include": [], "exclude": [], "includeIsRegex": false, "excludeIsRegex": false}}}, "columnOrder": ["x", "s", "m"], "sampling": 1, "ignoreGlobalFilters": false, "incompleteColumns": {}}}}}, "internalReferences": [], "adHocDataViews": {}, "filters": [], "query": {"language": "kuery", "query": ""}, "visualization": {"legend": {"isVisible": true, "position": "right"}, "valueLabels": "hide", "fittingFunction": "None", "preferredSeriesType": "bar_stacked", "layers": [{"layerId": "l1", "accessors": ["m"], "position": "top", "seriesType": "bar_stacked", "showGridlines": false, "layerType": "data", "xAccessor": "x", "splitAccessor": "s"}]}}}, "references": [{"type": "index-pattern", "id": "securesight-assets", "name": "indexpattern-datasource-layer-l1"}]}
{"id": "securesight-overview", "type": "dashboard", "managed": false, "coreMigrationVersion": "8.8.0", "typeMigrationVersion": "8.14.0", "attributes": {"title": "SecureSight \u2014 overview", "description": "Standing state of the SecureSight inventory and findings, as delivered by the External API. Rules answer 'what changed'; this answers 'where are we'. Default range is 1 year because @timestamp is the resource's updated_at, not ingest time \u2014 a 15-minute range shows only what moved.", "timeRestore": true, "timeFrom": "now-1y", "timeTo": "now", "refreshInterval": {"pause": true, "value": 60000}, "optionsJSON": "{\"useMargins\": true, \"syncColors\": false, \"syncCursor\": true, \"syncTooltips\": false, \"hidePanelTitles\": false}", "panelsJSON": "[{\"version\": \"8.15.0\", \"type\": \"lens\", \"gridData\": {\"x\": 0, \"y\": 0, \"w\": 12, \"h\": 7, \"i\": \"0\"}, \"panelIndex\": \"0\", \"embeddableConfig\": {\"enhancements\": {}}, \"panelRefName\": \"panel_0\"}, {\"version\": \"8.15.0\", \"type\": \"lens\", \"gridData\": {\"x\": 12, \"y\": 0, \"w\": 12, \"h\": 7, \"i\": \"1\"}, \"panelIndex\": \"1\", \"embeddableConfig\": {\"enhancements\": {}}, \"panelRefName\": \"panel_1\"}, {\"version\": \"8.15.0\", \"type\": \"lens\", \"gridData\": {\"x\": 24, \"y\": 0, \"w\": 12, \"h\": 7, \"i\": \"2\"}, \"panelIndex\": \"2\", \"embeddableConfig\": {\"enhancements\": {}}, \"panelRefName\": \"panel_2\"}, {\"version\": \"8.15.0\", \"type\": \"lens\", \"gridData\": {\"x\": 36, \"y\": 0, \"w\": 12, \"h\": 7, \"i\": \"3\"}, \"panelIndex\": \"3\", \"embeddableConfig\": {\"enhancements\": {}}, \"panelRefName\": \"panel_3\"}, {\"version\": \"8.15.0\", \"type\": \"lens\", \"gridData\": {\"x\": 0, \"y\": 7, \"w\": 24, \"h\": 14, \"i\": \"4\"}, \"panelIndex\": \"4\", \"embeddableConfig\": {\"enhancements\": {}}, \"panelRefName\": \"panel_4\"}, {\"version\": \"8.15.0\", \"type\": \"lens\", \"gridData\": {\"x\": 24, \"y\": 7, \"w\": 24, \"h\": 14, \"i\": \"5\"}, \"panelIndex\": \"5\", \"embeddableConfig\": {\"enhancements\": {}}, \"panelRefName\": \"panel_5\"}, {\"version\": \"8.15.0\", \"type\": \"lens\", \"gridData\": {\"x\": 0, \"y\": 21, \"w\": 28, \"h\": 15, \"i\": \"6\"}, \"panelIndex\": \"6\", \"embeddableConfig\": {\"enhancements\": {}}, \"panelRefName\": \"panel_6\"}, {\"version\": \"8.15.0\", \"type\": \"lens\", \"gridData\": {\"x\": 28, \"y\": 21, \"w\": 20, \"h\": 15, \"i\": \"7\"}, \"panelIndex\": \"7\", \"embeddableConfig\": {\"enhancements\": {}}, \"panelRefName\": \"panel_7\"}]", "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"}, "version": 1}, "references": [{"name": "0:panel_0", "type": "lens", "id": "ss-metric-unsolved"}, {"name": "1:panel_1", "type": "lens", "id": "ss-metric-aging-criticals"}, {"name": "2:panel_2", "type": "lens", "id": "ss-metric-live-assets"}, {"name": "3:panel_3", "type": "lens", "id": "ss-metric-tombstones"}, {"name": "4:panel_4", "type": "lens", "id": "ss-bar-status-by-module"}, {"name": "5:panel_5", "type": "lens", "id": "ss-bar-severity"}, {"name": "6:panel_6", "type": "lens", "id": "ss-table-worst-assets"}, {"name": "7:panel_7", "type": "lens", "id": "ss-timeline-delta"}]}