{
    "visualizations": {
        "viz_total_overtime": {
            "type": "splunk.line",
            "options": {
                "yAxisAbbreviation": "off",
                "y2AxisAbbreviation": "off",
                "showRoundedY2AxisLabels": false,
                "legendTruncation": "ellipsisMiddle",
                "showY2MajorGridLines": true,
                "xAxisTitleText": "status",
                "xAxisTitleVisibility": "show",
                "yAxisTitleText": "count",
                "yAxisTitleVisibility": "show",
                "y2AxisTitleVisibility": "show",
                "seriesColorsByField": {},
                "legendDisplay": "off",
                "nullValueDisplay": "zero"
            },
            "dataSources": {
                "primary": "ds_2OvlCBpy"
            },
            "eventHandlers": [],
            "title": "RMM - Timechart",
            "showProgressBar": true,
            "description": "Count of total RMM detections in the environment over time ( unapproved / unknown )"
        },
        "viz_alert_by_analyst": {
            "type": "splunk.line",
            "dataSources": {
                "primary": "ds_YTrlswJz"
            },
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature = $name|s$",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ],
            "title": "RMM - Timechart by RMM",
            "showProgressBar": true,
            "description": "Count of unique RMM detections seen in the environment over time ( unapproved / unknown )",
            "options": {
                "nullValueDisplay": "zero"
            }
        },
        "viz_alert_by_host": {
            "type": "splunk.bar",
            "dataSources": {
                "primary": "ds_4jEl4LX9"
            },
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature=$row.signature.value|s$",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ],
            "title": "Top RMM Software",
            "showProgressBar": true,
            "description": "Most frequent RMM Software detections",
            "showLastUpdated": false,
            "options": {
                "legendDisplay": "off",
                "stackMode": "stacked"
            }
        },
        "viz_alert_by_user": {
            "type": "splunk.table",
            "dataSources": {
                "primary": "ds_SDnZFhvW"
            },
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=$row.source.value|s$ signature=$row.signature.value|s$",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ],
            "title": "Risk Detection Events",
            "showProgressBar": false,
            "showLastUpdated": false,
            "hideWhenNoData": true
        },
        "viz_5zPh9TFb": {
            "type": "splunk.singlevalue",
            "showProgressBar": false,
            "showLastUpdated": false,
            "title": "Unique RMM Software Detected",
            "description": "Count of unique RMM software seen",
            "dataSources": {
                "primary": "ds_9UEKEzwj"
            },
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count values(src) as src, values(dest) as dest, values(user) as user, values(process_name) as process_name, values(file_name) as file_name, values(url) as url by source,signature,_time \n| stats count by signature\n| sort - count",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ]
        },
        "viz_B31XW5SU": {
            "type": "splunk.singlevalue",
            "title": "Monitored RRM Software",
            "description": "Total known and monitored RMM software",
            "dataSources": {
                "primary": "ds_XuRUkYYm"
            },
            "options": {},
            "context": {},
            "showProgressBar": false,
            "showLastUpdated": false,
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| inputlookup remote_access_software\n| stats values(*) as * by description\n| fields - last_update,isutility,category\n| sort description",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ]
        },
        "viz_pmYQoySR": {
            "type": "splunk.singlevalue",
            "title": "Total RMM Software Detections",
            "dataSources": {
                "primary": "ds_0ZD3LOc8"
            },
            "showProgressBar": false,
            "showLastUpdated": false,
            "description": "Total risk detections fired for RMM software",
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ]
        },
        "viz_wWQo64yc": {
            "type": "splunk.singlevalue",
            "showProgressBar": false,
            "showLastUpdated": false,
            "title": "Monitoring Exceptions",
            "description": "Total count of exceptions made for RRM software",
            "dataSources": {
                "primary": "ds_I4IUb8eZ"
            },
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| inputlookup remote_access_software_exceptions",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ]
        },
        "viz_8XkPozlC": {
            "type": "splunk.singlevalue",
            "title": "Total RMM Software Alerts",
            "dataSources": {
                "primary": "ds_AdgNL7xF"
            },
            "showProgressBar": false,
            "showLastUpdated": false,
            "description": "Total alerts triaged with RMM software detections",
            "eventHandlers": [
                {
                    "type": "drilldown.customUrl",
                    "options": {
                        "url": "/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=$time_picker.earliest$&latest=$time_picker.latest$&search=%2522ESCU%2520-%2520Detect%2520Remote%2520Access%2520Software%2520Usage*%2522",
                        "newTab": true
                    }
                }
            ]
        },
        "viz_xMCkeXlQ": {
            "type": "splunk.sankey",
            "dataSources": {
                "primary": "ds_LW7LiOhy"
            },
            "title": "Top Detections to RMM Software",
            "description": "RMM Software detection to software affinity"
        },
        "viz_NI1GGlJo": {
            "type": "splunk.bar",
            "dataSources": {
                "primary": "ds_rh3uALwl_ds_4jEl4LX9"
            },
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature=$row.signature.value|s$",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ],
            "title": "Rare RMM Software",
            "showProgressBar": true,
            "description": "Least seen RMM Software detections",
            "showLastUpdated": false,
            "options": {
                "stackMode": "stacked",
                "legendDisplay": "off"
            }
        },
        "viz_mOlKe0Wt": {
            "type": "splunk.singlevalue",
            "title": "Unique Users with $rmm_id$",
            "dataSources": {
                "primary": "ds_YUNfIx4j"
            },
            "hideWhenNoData": true,
            "options": {},
            "context": {},
            "showProgressBar": false,
            "showLastUpdated": false,
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature IN ($rmm_id|s$)",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ]
        },
        "viz_oaVWsWY8": {
            "type": "splunk.singlevalue",
            "title": "Unique Devices with $rmm_id$",
            "dataSources": {
                "primary": "ds_aBNX4sbQ"
            },
            "hideWhenNoData": true,
            "options": {},
            "context": {},
            "showProgressBar": false,
            "showLastUpdated": false,
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature IN ($rmm_id|s$)",
                        "earliest": "$time_picker.earliest$",
                        "latest": "$time_picker.latest$",
                        "type": "custom",
                        "newTab": true
                    }
                }
            ]
        }
    },
    "dataSources": {
        "ds_archiveSearch": {
            "type": "ds.search",
            "options": {
                "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count values(src) as src, values(dest) as dest, values(user) as user, values(process_name) as process_name, values(file_name) as file_name, values(url) as url by source,signature,_time",
                "queryParameters": {
                    "earliest": "$time_picker.earliest$",
                    "latest": "$time_picker.latest$"
                }
            },
            "name": "ds_rmm_risk_search"
        },
        "ds_vqe1IpW4": {
            "type": "ds.search",
            "options": {
                "query": "| tstats summariesonly=true count from datamodel=Risk.All_Risk where source=\"ESCU - Detect Remote Access Software Usage*\" by source \n| `drop_dm_object_name(\"All_Risk\")`",
                "queryParameters": {
                    "earliest": "$time_picker.earliest$",
                    "latest": "$time_picker.latest$"
                }
            },
            "name": "ds_alert_search"
        },
        "ds_4kVqbyrH": {
            "type": "ds.search",
            "options": {
                "queryParameters": {
                    "earliest": "$time_picker.earliest$",
                    "latest": "$time_picker.latest$"
                },
                "query": "| inputlookup remote_access_software\n| stats count by description\n| rename description as rmm_software"
            },
            "name": "ds_known_rmm_software"
        },
        "ds_fbY2wV7Q": {
            "type": "ds.search",
            "options": {
                "queryParameters": {
                    "earliest": "$time_picker.earliest$",
                    "latest": "$time_picker.latest$"
                },
                "query": "| tstats summariesonly=true count from datamodel=Risk.All_Risk where source = \"ESCU - Detect Remote Access Software Usage*\" by source,_time"
            },
            "name": "ds_rmm_risk_tstats_search"
        },
        "ds_YTrlswJz": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| timechart sum(count) by signature useother=false limit=20"
            },
            "name": "rmm_timechart_by_rmm"
        },
        "ds_2OvlCBpy": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| timechart sum(count) as total_rmm"
            },
            "name": "rmm_timechart_total"
        },
        "ds_LW7LiOhy": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| top limit=20 source,signature"
            },
            "name": "rmm_sankey"
        },
        "ds_axWH8wT0": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_4kVqbyrH"
            },
            "name": "total_rmm_lookup"
        },
        "ds_XuRUkYYm": {
            "type": "ds.search",
            "options": {
                "queryParameters": {
                    "earliest": "$time_picker.earliest$",
                    "latest": "$time_picker.latest$"
                },
                "query": "| inputlookup remote_access_software\n| stats count by description\n| stats count"
            },
            "name": "ds_rmm_software_total"
        },
        "ds_I4IUb8eZ": {
            "type": "ds.search",
            "options": {
                "queryParameters": {
                    "earliest": "$time_picker.earliest$",
                    "latest": "$time_picker.latest$"
                },
                "query": "| inputlookup remote_access_software_exceptions\n| stats count"
            },
            "name": "ds_rmm_exception_total"
        },
        "ds_0ZD3LOc8": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| stats sum(count) as count "
            },
            "name": "rmm_total_detections"
        },
        "ds_9UEKEzwj": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "| stats count by signature\n| stats count"
            },
            "name": "rmm_count_by_rmm"
        },
        "ds_AdgNL7xF": {
            "type": "ds.search",
            "options": {
                "queryParameters": {
                    "earliest": "$time_picker.earliest$",
                    "latest": "$time_picker.latest$"
                },
                "query": "index=notable | search orig_source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count"
            },
            "name": "total_notable_rmm"
        },
        "ds_SDnZFhvW": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "|  eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\")\n|  search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n"
            },
            "name": "rmm_full_table_data"
        },
        "ds_4jEl4LX9": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| top limit=10 signature\n| eval series=signature \n| chart values(count) over signature by series limit=100 useother=false\n| `sort_chart`\n\n",
                "enableSmartSources": true
            },
            "name": "rmm_top"
        },
        "ds_rh3uALwl_ds_4jEl4LX9": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| rare limit=10 signature\n| eval series=signature \n| chart values(count) over signature by series limit=100 useother=false\n| `sort_chart`\n"
            },
            "name": "rmm_rare"
        },
        "ds_YUNfIx4j": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "|  eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\"), user = upper(user)\n|  search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n| stats count by user\n| search NOT user IN (\"unknown\",\"*$\")\n| stats count\n| where count > 0"
            },
            "name": "rmm_unique_users"
        },
        "ds_aBNX4sbQ": {
            "type": "ds.chain",
            "options": {
                "extend": "ds_archiveSearch",
                "query": "| eval devices = upper(case(isnotnull(src),src,true(),dest))\n|  eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\")\n|  search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n| stats dc(devices) as count\n| where count > 0"
            },
            "name": "rmm_unique_devices"
        }
    },
    "inputs": {
        "input_AqBjBRiF": {
            "type": "input.multiselect",
            "options": {
                "clearDefaultOnSelection": "TRUE",
                "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
                "token": "alert_name",
                "defaultValue": [
                    "*"
                ]
            },
            "title": "Alert Name",
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix": ""
                    }
                },
                "formattedStatics": ">statics | formatByType(formattedConfig)",
                "statics": [
                    [
                        "All"
                    ],
                    [
                        "*"
                    ]
                ],
                "label": ">primary | seriesByName(\"source\") | renameSeries(\"label\") | formatByType(formattedConfig)",
                "value": ">primary | seriesByName(\"source\") | renameSeries(\"value\") | formatByType(formattedConfig)"
            },
            "dataSources": {
                "primary": "ds_vqe1IpW4"
            }
        },
        "input_adFMvLPg": {
            "type": "input.multiselect",
            "options": {
                "clearDefaultOnSelection": "TRUE",
                "defaultValue": "*",
                "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
                "token": "rmm_id"
            },
            "title": "RMM Software",
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix": ""
                    }
                },
                "formattedStatics": ">statics | formatByType(formattedConfig)",
                "statics": [
                    [
                        "All"
                    ],
                    [
                        "*"
                    ]
                ],
                "label": ">primary | seriesByName(\"rmm_software\") | renameSeries(\"label\") | formatByType(formattedConfig)",
                "value": ">primary | seriesByName(\"rmm_software\") | renameSeries(\"value\") | formatByType(formattedConfig)"
            },
            "dataSources": {
                "primary": "ds_4kVqbyrH"
            }
        },
        "input_ZIvNCkgw": {
            "type": "input.timerange",
            "options": {
                "token": "time_picker",
                "defaultValue": "-7d@h,now"
            },
            "title": "Time Range"
        }
    },
    "layout": {
        "type": "grid",
        "options": {
            "height": 1000,
            "width": 1440,
            "gutterSize": 10
        },
        "structure": [
            {
                "item": "viz_B31XW5SU",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 0,
                    "w": 287,
                    "h": 161
                }
            },
            {
                "item": "viz_total_overtime",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 161,
                    "w": 720,
                    "h": 265
                }
            },
            {
                "item": "viz_alert_by_host",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 426,
                    "w": 476,
                    "h": 437
                }
            },
            {
                "item": "viz_mOlKe0Wt",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 863,
                    "w": 720,
                    "h": 140
                }
            },
            {
                "item": "viz_alert_by_user",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 1003,
                    "w": 1440,
                    "h": 476
                }
            },
            {
                "item": "viz_5zPh9TFb",
                "type": "block",
                "position": {
                    "x": 287,
                    "y": 0,
                    "w": 279,
                    "h": 161
                }
            },
            {
                "item": "viz_NI1GGlJo",
                "type": "block",
                "position": {
                    "x": 476,
                    "y": 426,
                    "w": 485,
                    "h": 437
                }
            },
            {
                "item": "viz_pmYQoySR",
                "type": "block",
                "position": {
                    "x": 566,
                    "y": 0,
                    "w": 314,
                    "h": 161
                }
            },
            {
                "item": "viz_alert_by_analyst",
                "type": "block",
                "position": {
                    "x": 720,
                    "y": 161,
                    "w": 720,
                    "h": 265
                }
            },
            {
                "item": "viz_oaVWsWY8",
                "type": "block",
                "position": {
                    "x": 720,
                    "y": 863,
                    "w": 720,
                    "h": 140
                }
            },
            {
                "item": "viz_8XkPozlC",
                "type": "block",
                "position": {
                    "x": 880,
                    "y": 0,
                    "w": 295,
                    "h": 161
                }
            },
            {
                "item": "viz_xMCkeXlQ",
                "type": "block",
                "position": {
                    "x": 961,
                    "y": 426,
                    "w": 479,
                    "h": 437
                }
            },
            {
                "item": "viz_wWQo64yc",
                "type": "block",
                "position": {
                    "x": 1175,
                    "y": 0,
                    "w": 265,
                    "h": 161
                }
            }
        ],
        "globalInputs": [
            "input_AqBjBRiF",
            "input_adFMvLPg",
            "input_ZIvNCkgw"
        ]
    },
    "description": "Utilize this dashboard to assist with auditing and monitoring of Remote Monitoring and Management (RMM) alert content.",
    "title": "RMM Software Tracking"
}