Azure Network Security Group (NSG) Flows
https://github.com/bhozar/grafana-dashboards
Azure NSG flow log visualization dashboard.
# Azure NSG Flow Log Dashboard
Dashboard to visualize Azure NSG Flow Logs data from [Logstash Event Hubs plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-azure_event_hubs.html)

Deploy Microsofts [Azure Network Watcher NSG Flow Logs Connector](https://github.com/microsoft/AzureNetworkWatcherNSGFlowLogsConnector) Function App to gather the data. Enabling Application Insights to troubleshoot the Function app is helpful at the start but the cost can quickly add up.

Setup Azure NSG FLow Logs to stream data in an Azure EventHub so the ES plugin can pickup the data.

To control the costs and increase throughput you will want to increase the batch sizes of how often the Logstash Event Hub data source saves the checkpoints to storage, and increase the number of `pipeline.workers` and `pipeline.batch.size` options.

# Bugs, suggestions and feedback
Bug reports, suggestions and feedback to [GitHub](https://github.com/bhozar/grafana-dashboards/tree/master/azurensgflowlog) please!

# Logstash Filters
## 00-input-azureeventhubs.conf
```
input {
   azure_event_hubs {
   event_hub_connections => ["Endpoint=sb://xxxxxxx.servicebus.windows.net/;SharedAccessKeyName=logstash-ro;SharedAccessKey=..."]
   threads => 32
   max_batch_size => 1000
#   checkpoint_interval => 30
   initial_position => "end"
   decorate_events => true
   consumer_group => "logstash-nsglogs"
## Storage account required to store starting point between restarts
   storage_connection => "DefaultEndpointsProtocol=https;AccountName=...EndpointSuffix=core.windows.net"
   tags => ["azurensglogs"]
   }
}
```

## 01-filter-azure-nsg-logs.conf
```
filter {
if [@metadata][azure_event_hubs][consumer_group] == "logstash-nsglogs" {
# if "azurensglogs" in [tags] {
 mutate {
   gsub => [ "message", "^{\"records\":\[{", "" ]
   gsub => [ "message", "},{.*}]}$", "" ]
   gsub => [ "message", "[\"]", "" ]
}
 kv {
   field_split_pattern => ","
   value_split => ":"
}
  mutate {
   convert => {"startTime" => "integer"}
   convert => {"sourcePort" => "integer"}
   convert => {"destinationPort" => "integer"}
   convert => {"packetsStoD" => "integer"}
   convert => {"bytesStoD" => "integer"}
   convert => {"packetsDtoS" => "integer"}
   convert => {"bytesDtoS" => "integer"}
   split => { "[resourceId]" => "/"}
     add_field => { "Subscription" => "%{[resourceId][2]}"
       "ResourceGroup" => "%{[resourceId][4]}"
       "NetworkSecurityGroup" => "%{[resourceId][8]}"
       }
   convert => {"Subscription" => "string"}
   convert => {"ResourceGroup" => "string"}
   convert => {"NetworkSecurityGroup" => "string"}
   remove_field => [ "[resourceId]" ]
   remove_field => [ "message" ]
   copy => { "sourceAddress" => "sourceHost" }
   copy => { "destinationAddress" => "destinationHost" }
 }
  date{
    match => ["startTime" , "UNIX"]
  }
 translate {
      field => "destinationPort"
      destination => "destinationServiceName"
      dictionary_path => '/etc/logstash/dictionary.d/iana_service_names_tcp.yml'
    }
 translate {
      field => "destinationPort"
      destination => "destinationServiceName"
      dictionary_path => '/etc/logstash/dictionary.d/custom_service_names_tcp.yml'
    }
  cidr {
    address => [ "%{[sourceAddress]}" ]
    network => [ "0.0.0.0/32", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fc00::/7", "127.0.0.0/8", "::1/128","169.254.0.0/16", "fe80::/10","224.0.0.0/4", "ff00::/8","255.255.255.255/32" ]
    add_field => { "[sourceLocality]" => "private" }
  }
  if [sourceLocality] != "private" {
    geoip {
      source => "[sourceAddress]"
          }
  }
#  if [sourceLocality] == "private" {
   dns {
     reverse => [ "sourceHost" ]
     action => "replace"
     hit_cache_size => 10000
     hit_cache_ttl => 3000
     failed_cache_size => 2000
     failed_cache_ttl => 600
   }
#   }
  dns {
    reverse => [ "destinationHost" ]
    action => "replace"
    hit_cache_size => 10000
    hit_cache_ttl => 3000
    failed_cache_size => 2000
    failed_cache_ttl => 600
  }
  translate {
    field => "sourceAddress"
    destination => "sourceAddressMaliciousIP"
    dictionary_path => '/etc/logstash/dictionary.d/maliciousIP.yaml'
  }
  translate {
    field => "destinationAddress"
    destination => "destinationsAddressMaliciousIP"
    dictionary_path => '/etc/logstash/dictionary.d/maliciousIP.yaml'
  }
  translate {
    field => "sourceAddress"
    destination => "sourceAddressTorExit"
    dictionary_path => '/etc/logstash/dictionary.d/torexit.yaml'
  }
  translate {
    field => "destinationAddress"
    destination => "destinationAddressTorExit"
    dictionary_path => '/etc/logstash/dictionary.d/torexit.yaml'
  }
# Monitoring system IP addresses
  translate {
    field => "sourceAddress"
    destination => "sourceAddressStatusCake"
    dictionary_path => '/etc/logstash/dictionary.d/statuscakeIP.yaml'
  }
  translate {
    field => "destinationAddress"
    destination => "destinationAddressStatusCake"
    dictionary_path => '/etc/logstash/dictionary.d/statuscakeIP.yaml'
  }
 }
}
```
## Logstash pipelines.yml
```
- pipeline.id: main
  path.config: "/etc/logstash/conf.d/*.conf"
  pipeline.workers: 16
  pipeline.batch.size: 500
```

## Dictionary Files
Example files an scripts to allow download/updating of files are available on [GitHub](https://github.com/bhozar/grafana-dashboards/tree/master/azurensgflowlog/logstash/dictionary.d)

# Screenshots
![Azure NSG Flow Log Dashboard](https://grafana.com/api/dashboards/11369/images/7280/image)

![Azure NSG Flow Log Dashboard](https://grafana.com/api/dashboards/11369/images/7281/image)

Network Security Group (NSG) flows
{
  "__inputs": [
    {
      "name": "DS_ELASTICSEARCH-NSG-FLOWS",
      "label": "Elasticsearch-nsg-flows",
      "description": "",
      "type": "datasource",
      "pluginId": "elasticsearch",
      "pluginName": "Elasticsearch"
    }
  ],
  "__requires": [
    {
      "type": "panel",
      "id": "bargauge",
      "name": "Bar Gauge",
      "version": ""
    },
    {
      "type": "datasource",
      "id": "elasticsearch",
      "name": "Elasticsearch",
      "version": "1.0.0"
    },
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "6.5.1"
    },
    {
      "type": "panel",
      "id": "graph",
      "name": "Graph",
      "version": ""
    },
    {
      "type": "panel",
      "id": "singlestat",
      "name": "Singlestat",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "description": "https://github.com/bhozar/grafana-dashboards\nAzure NSG flow log visualization dashboard.",
  "editable": true,
  "gnetId": 11369,
  "graphTooltip": 0,
  "id": 227,
  "iteration": 1575840026326,
  "links": [],
  "panels": [
    {
      "collapsed": true,
      "datasource": null,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 78,
      "panels": [
        {
          "aliasColors": {
            "Inbound Bytes": "semi-dark-green",
            "Outbound Bytes": "semi-dark-yellow"
          },
          "bars": false,
          "dashLength": 10,
          "dashes": false,
          "datasource": "MetaQueries",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 6,
            "w": 24,
            "x": 0,
            "y": 1
          },
          "hiddenSeries": false,
          "id": 53,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": true,
            "min": false,
            "rightSide": true,
            "show": true,
            "sort": "total",
            "sortDesc": false,
            "total": true,
            "values": true
          },
          "lines": true,
          "linewidth": 1,
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [
            {
              "alias": "/.*Outbound.*/",
              "transform": "negative-Y"
            },
            {
              "alias": "/.*Total.*/",
              "lines": false
            },
            {
              "alias": "/.*Packets.*/",
              "yaxis": 2
            }
          ],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "alias": "Bytes Inbound",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "datasource": "Elasticsearch-nsg-flows",
              "metrics": [
                {
                  "field": "bytesDtoS",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            },
            {
              "alias": "Bytes Outbound",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "datasource": "Elasticsearch-nsg-flows",
              "hide": false,
              "metrics": [
                {
                  "field": "bytesStoD",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "B",
              "timeField": "@timestamp"
            },
            {
              "datasource": "MetaQueries",
              "expression": "A['Bytes Inbound']+B['Bytes Outbound']",
              "hide": false,
              "outputMetricName": "Bytes Total",
              "periods": 7,
              "queryType": "Arithmetic",
              "refId": "C",
              "timeshiftUnit": "days"
            },
            {
              "alias": "Packets Inbound",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "datasource": "Elasticsearch-nsg-flows",
              "metrics": [
                {
                  "field": "packetsDtoS",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "D",
              "timeField": "@timestamp"
            },
            {
              "alias": "Packets Outbound",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "datasource": "Elasticsearch-nsg-flows",
              "hide": false,
              "metrics": [
                {
                  "field": "packetsStoD",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "E",
              "timeField": "@timestamp"
            },
            {
              "datasource": "MetaQueries",
              "expression": "D['Packets Inbound']+E['Packets Outbound']",
              "hide": false,
              "outputMetricName": "Total Packets",
              "periods": 7,
              "queryType": "Arithmetic",
              "refId": "F",
              "timeshiftUnit": "days"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Bytes and Packet flow",
          "tooltip": {
            "shared": true,
            "sort": 0,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "decbytes",
              "label": "Bytes",
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": "Packets",
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": true,
            "alignLevel": null
          }
        },
        {
          "cacheTimeout": null,
          "datasource": "Elasticsearch-nsg-flows",
          "gridPos": {
            "h": 8,
            "w": 11,
            "x": 0,
            "y": 7
          },
          "id": 70,
          "links": [],
          "options": {
            "displayMode": "gradient",
            "fieldOptions": {
              "calcs": [
                "sum"
              ],
              "defaults": {
                "mappings": [],
                "max": 500000,
                "min": 0,
                "thresholds": [
                  {
                    "color": "green",
                    "value": null
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ],
                "unit": "locale"
              },
              "override": {},
              "values": false
            },
            "orientation": "horizontal"
          },
          "pluginVersion": "6.5.1",
          "targets": [
            {
              "alias": "{{term destinationPort}} ({{term destinationServiceName.keyword}})",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "destinationPort",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationServiceName.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "20m",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "Top 10 Services by Destination",
          "type": "bargauge"
        },
        {
          "cacheTimeout": null,
          "datasource": "Elasticsearch-nsg-flows",
          "gridPos": {
            "h": 16,
            "w": 13,
            "x": 11,
            "y": 7
          },
          "id": 118,
          "links": [],
          "options": {
            "displayMode": "gradient",
            "fieldOptions": {
              "calcs": [
                "sum"
              ],
              "defaults": {
                "mappings": [],
                "max": 500000,
                "min": 0,
                "thresholds": [
                  {
                    "color": "green",
                    "value": null
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ],
                "unit": "locale"
              },
              "override": {},
              "values": false
            },
            "orientation": "horizontal"
          },
          "pluginVersion": "6.5.1",
          "targets": [
            {
              "alias": "{{term destinationPort}} ({{term destinationServiceName.keyword}})",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "destinationPort",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "20"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationServiceName.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "20"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "20m",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "Top 20 Low Port Number Services by Destination",
          "type": "bargauge"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 11,
            "x": 0,
            "y": 15
          },
          "id": 7,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "",
          "postfixFontSize": "70%",
          "prefix": "Flow Count<br>🧮",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "circleMaxSize": "30",
          "circleMinSize": "3",
          "colors": [
            "rgba(0, 247, 0, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(240, 4, 45, 0.97)"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": 0,
          "esGeoPoint": "geoip.location",
          "esLocationName": "geoip.city_name.keyword",
          "esMetric": "Count",
          "gridPos": {
            "h": 14,
            "w": 11,
            "x": 0,
            "y": 17
          },
          "height": "600px",
          "hideEmpty": true,
          "hideZero": true,
          "id": 51,
          "initialZoom": "2",
          "links": [],
          "locationData": "table",
          "mapCenter": "(0°, 0°)",
          "mapCenterLatitude": 0,
          "mapCenterLongitude": 0,
          "maxDataPoints": 1,
          "mouseWheelZoom": true,
          "options": {},
          "showLegend": true,
          "stickyLabels": false,
          "tableQueryOptions": {
            "geohashField": "geohash",
            "labelField": "geoip.city_name.keyword",
            "latitudeField": "geoip.latitude",
            "longitudeField": "geoip.longitude",
            "metricField": "Count",
            "queryType": "coordinates"
          },
          "targets": [
            {
              "alias": "count",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "geoip.latitude",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "0"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "geoip.longitude",
                  "id": "5",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "0"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "geoip.city_name.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "0"
                  },
                  "type": "terms"
                }
              ],
              "dsType": "elasticsearch",
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "!sourceLocality.keyword:private AND deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "1000,10000",
          "title": "Public IP's",
          "transparent": true,
          "type": "grafana-worldmap-panel",
          "unitPlural": "",
          "unitSingle": "",
          "valueName": "total"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorPrefix": false,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 4,
            "x": 11,
            "y": 23
          },
          "id": 25,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>Denied Flows",
          "postfixFontSize": "50%",
          "prefix": "❌",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceAction.keyword:D AND deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "1,2",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 4,
            "x": 15,
            "y": 23
          },
          "id": 26,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br><right>Accepted Flows</right>",
          "postfixFontSize": "50%",
          "prefix": "✔️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceAction.keyword:A AND deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 5,
            "x": 19,
            "y": 23
          },
          "id": 67,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 4,
            "x": 11,
            "y": 25
          },
          "id": 64,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>Src Malicious IPs",
          "postfixFontSize": "50%",
          "prefix": "😈",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "sourceAddressMaliciousIP.keyword",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "cardinality"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "1,2",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorPostfix": false,
          "colorPrefix": false,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 4,
            "x": 15,
            "y": 25
          },
          "id": 63,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>Dest Malicious IPs",
          "postfixFontSize": "50%",
          "prefix": "😈",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "destinationAddressMaliciousIP.keyword",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "cardinality"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "1,2",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 5,
            "x": 19,
            "y": 25
          },
          "id": 24,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "",
          "postfixFontSize": "70%",
          "prefix": "Oldest Flow<br>📅",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "asc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 4,
            "x": 11,
            "y": 27
          },
          "id": 66,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>Src Tor IPs",
          "postfixFontSize": "50%",
          "prefix": "🧅",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "sourceAddressTorExit.keyword",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "cardinality"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "1,2",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 4,
            "x": 15,
            "y": 27
          },
          "id": 65,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>Dest Tor IPs",
          "postfixFontSize": "50%",
          "prefix": "🧅",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "destinationAddressTorExit.keyword",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "cardinality"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "1,2",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 5,
            "x": 19,
            "y": 27
          },
          "id": 23,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 4,
            "x": 11,
            "y": 29
          },
          "id": 85,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>Src StatusCake IPs",
          "postfixFontSize": "50%",
          "prefix": "🍰",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "sourceAddressStatusCake.keyword",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "cardinality"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "1,2",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 2,
            "w": 4,
            "x": 15,
            "y": 29
          },
          "id": 86,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>Dest StatusCake IPs",
          "postfixFontSize": "50%",
          "prefix": "🍰",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 0,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "DestinationAddressStatusCake.keyword",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "cardinality"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "1,2",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        }
      ],
      "title": "Overview",
      "type": "row"
    },
    {
      "collapsed": true,
      "datasource": null,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 1
      },
      "id": 32,
      "panels": [
        {
          "cacheTimeout": null,
          "datasource": "Elasticsearch-nsg-flows",
          "gridPos": {
            "h": 8,
            "w": 8,
            "x": 0,
            "y": 2
          },
          "id": 73,
          "links": [],
          "options": {
            "displayMode": "gradient",
            "fieldOptions": {
              "calcs": [
                "sum"
              ],
              "defaults": {
                "mappings": [],
                "max": 500000,
                "min": 0,
                "thresholds": [
                  {
                    "color": "green",
                    "value": null
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ],
                "unit": "locale"
              },
              "override": {},
              "values": false
            },
            "orientation": "horizontal"
          },
          "pluginVersion": "6.4.4",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "sourceHost.keyword",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "10m",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "Top 10 Hosts by Source",
          "type": "bargauge"
        },
        {
          "cacheTimeout": null,
          "datasource": "Elasticsearch-nsg-flows",
          "gridPos": {
            "h": 8,
            "w": 8,
            "x": 8,
            "y": 2
          },
          "id": 72,
          "links": [],
          "options": {
            "displayMode": "gradient",
            "fieldOptions": {
              "calcs": [
                "sum"
              ],
              "defaults": {
                "mappings": [],
                "max": 500000,
                "min": 0,
                "thresholds": [
                  {
                    "color": "green",
                    "value": null
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ],
                "unit": "locale"
              },
              "override": {},
              "values": false
            },
            "orientation": "horizontal"
          },
          "pluginVersion": "6.4.4",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "destinationHost.keyword",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "10m",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "Top 10 Hosts by Destination",
          "type": "bargauge"
        },
        {
          "cacheTimeout": null,
          "datasource": "Elasticsearch-nsg-flows",
          "gridPos": {
            "h": 8,
            "w": 8,
            "x": 16,
            "y": 2
          },
          "id": 74,
          "links": [],
          "options": {
            "displayMode": "gradient",
            "fieldOptions": {
              "calcs": [
                "sum"
              ],
              "defaults": {
                "mappings": [],
                "max": 500000,
                "min": 0,
                "thresholds": [
                  {
                    "color": "green",
                    "value": null
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ],
                "unit": "locale"
              },
              "override": {},
              "values": false
            },
            "orientation": "horizontal"
          },
          "pluginVersion": "6.4.4",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "nsgRuleName.keyword",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "10m",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "Top 10 NSG Rules",
          "type": "bargauge"
        },
        {
          "aliasColors": {},
          "bars": false,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": 0,
          "fill": 8,
          "fillGradient": 0,
          "gridPos": {
            "h": 8,
            "w": 12,
            "x": 0,
            "y": 10
          },
          "id": 62,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": true,
            "min": false,
            "rightSide": true,
            "show": true,
            "total": true,
            "values": true
          },
          "lines": true,
          "linewidth": 0,
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": true,
          "steppedLine": false,
          "targets": [
            {
              "alias": "Source Malicious IP",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "sourceAddressMaliciousIP.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "5"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            },
            {
              "alias": "Dest Malicious IP",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "destinationAddressMaliciousIP.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "5"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "B",
              "timeField": "@timestamp"
            },
            {
              "alias": "Src Tor Exit",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "sourceAddressTorExit.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "5"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "C",
              "timeField": "@timestamp"
            },
            {
              "alias": "Dest Tor Exit",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "destinationAddressTorExit.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "5"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "D",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Malicious/Tor Requests/Responses",
          "tooltip": {
            "shared": true,
            "sort": 2,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "decimals": 0,
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "decimals": null,
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "cacheTimeout": null,
          "columns": [],
          "datasource": "Elasticsearch-nsg-flows",
          "fontSize": "100%",
          "gridPos": {
            "h": 8,
            "w": 24,
            "x": 0,
            "y": 18
          },
          "id": 43,
          "links": [],
          "options": {},
          "pageSize": null,
          "scroll": true,
          "showHeader": true,
          "sort": {
            "col": 4,
            "desc": true
          },
          "styles": [
            {
              "alias": "Time",
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "pattern": "Time",
              "type": "date"
            },
            {
              "alias": "Source",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sourceAddress.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Destination",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "destinationAddress.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Destination Port",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "destinationPort",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "Count",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "NSG Rule",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "nsgRuleName.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            },
            {
              "alias": "Source Hostname",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sourceHost.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            },
            {
              "alias": "Destination Hostname",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "destinationHost.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            },
            {
              "alias": "",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "decimals": 2,
              "pattern": "/.*/",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            }
          ],
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "sourceAddress.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "sourceHost.keyword",
                  "id": "5",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationAddress.keyword",
                  "id": "7",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationHost.keyword",
                  "id": "6",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "Top talking pairs",
          "transform": "table",
          "type": "table"
        },
        {
          "cacheTimeout": null,
          "columns": [],
          "datasource": "Elasticsearch-nsg-flows",
          "fontSize": "100%",
          "gridPos": {
            "h": 7,
            "w": 24,
            "x": 0,
            "y": 26
          },
          "id": 22,
          "links": [],
          "options": {},
          "pageSize": null,
          "scroll": true,
          "showHeader": true,
          "sort": {
            "col": 6,
            "desc": true
          },
          "styles": [
            {
              "alias": "Time",
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "pattern": "Time",
              "type": "date"
            },
            {
              "alias": "Source",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sourceAddress.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Destination",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "destinationAddress.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Destination Port",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "destinationPort",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "Count",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "NSG Rule",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "nsgRuleName.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            },
            {
              "alias": "Source Hostname",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sourceHost.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            },
            {
              "alias": "L7 Protocol",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "destinationServiceName.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            },
            {
              "alias": "",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "decimals": 2,
              "pattern": "/.*/",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            }
          ],
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "sourceAddress.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "sourceHost.keyword",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationAddress.keyword",
                  "id": "5",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationPort",
                  "id": "6",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationServiceName.keyword",
                  "id": "7",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "field": "nsgRuleName.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "!deviceAction.keyword:D AND deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "Top Accept Rules",
          "transform": "table",
          "type": "table"
        },
        {
          "cacheTimeout": null,
          "columns": [],
          "datasource": "Elasticsearch-nsg-flows",
          "fontSize": "100%",
          "gridPos": {
            "h": 7,
            "w": 24,
            "x": 0,
            "y": 33
          },
          "id": 47,
          "links": [],
          "options": {},
          "pageSize": null,
          "scroll": true,
          "showHeader": true,
          "sort": {
            "col": 0,
            "desc": true
          },
          "styles": [
            {
              "alias": "Time",
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "pattern": "Time",
              "type": "date"
            },
            {
              "alias": "Source",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sourceAddress.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Destination",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "destinationAddress.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Destination Port",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "destinationPort",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "Count",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "NSG Rule",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "nsgRuleName.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            },
            {
              "alias": "Source Hostname",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "sourceHost.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            },
            {
              "alias": "L7 Protocol",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "destinationServiceName.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            },
            {
              "alias": "",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "decimals": 2,
              "pattern": "/.*/",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            }
          ],
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "sourceAddress.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "sourceHost.keyword",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationAddress.keyword",
                  "id": "5",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationPort",
                  "id": "6",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "destinationServiceName.keyword",
                  "id": "7",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "field": "nsgRuleName.keyword",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceAction.keyword:D AND deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "Top Deny Rules",
          "transform": "table",
          "type": "table"
        },
        {
          "aliasColors": {
            "I": "semi-dark-green",
            "O": "semi-dark-yellow"
          },
          "bars": true,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 8,
            "w": 12,
            "x": 0,
            "y": 40
          },
          "id": 4,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": true,
            "min": false,
            "rightSide": true,
            "show": true,
            "total": true,
            "values": true
          },
          "lines": false,
          "linewidth": 1,
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [
            {
              "alias": "/O/",
              "transform": "negative-Y"
            }
          ],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "deviceDirection.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "2"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Flows by Direction Over Time",
          "tooltip": {
            "shared": true,
            "sort": 0,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "aliasColors": {
            "A": "semi-dark-green",
            "D": "semi-dark-red"
          },
          "bars": true,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 8,
            "w": 12,
            "x": 12,
            "y": 40
          },
          "id": 3,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": true,
            "min": false,
            "rightSide": true,
            "show": true,
            "total": true,
            "values": true
          },
          "lines": false,
          "linewidth": 1,
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "deviceAction.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "2"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Flows by Decision Over Time",
          "tooltip": {
            "shared": true,
            "sort": 0,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "aliasColors": {
            "Inbound Bytes": "semi-dark-green",
            "Outbound Bytes": "semi-dark-yellow"
          },
          "bars": false,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 8,
            "w": 12,
            "x": 0,
            "y": 48
          },
          "id": 30,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": true,
            "min": false,
            "rightSide": true,
            "show": true,
            "total": true,
            "values": true
          },
          "lines": true,
          "linewidth": 1,
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [
            {
              "alias": "/Outbound.*/",
              "transform": "negative-Y"
            }
          ],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "alias": "Inbound Packets (DtoS)",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "packetsDtoS",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:I AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction AND flowState.keyword:E",
              "refId": "A",
              "timeField": "@timestamp"
            },
            {
              "alias": "Outbound Packets (DtoS)",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "packetsDtoS",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:O AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction AND flowState.keyword:E",
              "refId": "B",
              "timeField": "@timestamp"
            },
            {
              "alias": "Inbound Packets (StoD)",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "packetsStoD",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:I AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction AND flowState.keyword:E",
              "refId": "C",
              "timeField": "@timestamp"
            },
            {
              "alias": "Outbound Packets (StoD)",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "packetsStoD",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:O AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction AND flowState.keyword:E",
              "refId": "D",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Packets Transferred Over Time",
          "tooltip": {
            "shared": true,
            "sort": 0,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "none",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "aliasColors": {
            "Inbound Bytes": "semi-dark-green",
            "Outbound Bytes": "semi-dark-yellow"
          },
          "bars": false,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 8,
            "w": 12,
            "x": 12,
            "y": 48
          },
          "id": 9,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": true,
            "min": false,
            "rightSide": true,
            "show": true,
            "total": true,
            "values": true
          },
          "lines": true,
          "linewidth": 1,
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [
            {
              "alias": "/Outbound.*/",
              "transform": "negative-Y"
            }
          ],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "alias": "Inbound Bytes (DtoS)",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "bytesDtoS",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:I AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction AND flowState.keyword:E",
              "refId": "A",
              "timeField": "@timestamp"
            },
            {
              "alias": "Outbound Bytes (DtoS)",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "bytesDtoS",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:O AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction AND flowState.keyword:E",
              "refId": "B",
              "timeField": "@timestamp"
            },
            {
              "alias": "Inbound Bytes (StoD)",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "bytesStoD",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:I AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction AND flowState.keyword:E",
              "refId": "C",
              "timeField": "@timestamp"
            },
            {
              "alias": "Outbound Bytes (StoD)",
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "bytesStoD",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:O AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction AND flowState.keyword:E",
              "refId": "D",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Bytes Transferred Over Time",
          "tooltip": {
            "shared": true,
            "sort": 0,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "decbytes",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "aliasColors": {},
          "bars": true,
          "cacheTimeout": null,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 6,
            "w": 24,
            "x": 0,
            "y": 56
          },
          "id": 8,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": false,
            "min": false,
            "rightSide": true,
            "show": false,
            "total": true,
            "values": true
          },
          "lines": false,
          "linewidth": 1,
          "links": [],
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "destinationPort",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 100,
                    "order": "asc",
                    "orderBy": "_term",
                    "size": "50"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "20m",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Flows by Destination Port",
          "tooltip": {
            "shared": false,
            "sort": 0,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "series",
            "name": null,
            "show": true,
            "values": [
              "total"
            ]
          },
          "yaxes": [
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "aliasColors": {},
          "bars": true,
          "cacheTimeout": null,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 6,
            "w": 24,
            "x": 0,
            "y": 62
          },
          "id": 44,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": false,
            "min": false,
            "rightSide": true,
            "show": false,
            "total": true,
            "values": true
          },
          "lines": false,
          "linewidth": 1,
          "links": [],
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "destinationPort",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "1",
                    "size": "20"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "20m",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "bytesDtoS",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "sum"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND flowState.keyword:E AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Bytes (D to S) transferred by port",
          "tooltip": {
            "shared": false,
            "sort": 0,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "series",
            "name": null,
            "show": true,
            "values": [
              "total"
            ]
          },
          "yaxes": [
            {
              "format": "decbytes",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "aliasColors": {},
          "bars": true,
          "cacheTimeout": null,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 6,
            "w": 18,
            "x": 0,
            "y": 68
          },
          "id": 19,
          "legend": {
            "avg": false,
            "current": false,
            "max": false,
            "min": false,
            "show": false,
            "total": false,
            "values": false
          },
          "lines": false,
          "linewidth": 1,
          "links": [],
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "sourceAddress.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "15"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "20m",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Top Source IPs",
          "tooltip": {
            "shared": false,
            "sort": 0,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "series",
            "name": null,
            "show": true,
            "values": [
              "total"
            ]
          },
          "yaxes": [
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 6,
            "x": 18,
            "y": 68
          },
          "id": 15,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "",
          "postfixFontSize": "50%",
          "prefix": "",
          "prefixFontSize": "50%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "destinationAddress.keyword",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "cardinality"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "Number of Destination IPs",
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "none",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 6,
            "x": 18,
            "y": 71
          },
          "id": 16,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "",
          "postfixFontSize": "50%",
          "prefix": "",
          "prefixFontSize": "50%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "sourceAddress.keyword",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "cardinality"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "Number of Source IPs",
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "total"
        },
        {
          "aliasColors": {},
          "bars": true,
          "cacheTimeout": null,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 7,
            "w": 18,
            "x": 0,
            "y": 74
          },
          "id": 12,
          "legend": {
            "avg": false,
            "current": false,
            "max": false,
            "min": false,
            "show": false,
            "total": false,
            "values": false
          },
          "lines": false,
          "linewidth": 1,
          "links": [],
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "destinationAddress.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "15"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "20m",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Top Destination IPs",
          "tooltip": {
            "shared": false,
            "sort": 0,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "series",
            "name": null,
            "show": true,
            "values": [
              "total"
            ]
          },
          "yaxes": [
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "cacheTimeout": null,
          "datasource": "Elasticsearch-nsg-flows",
          "gridPos": {
            "h": 7,
            "w": 6,
            "x": 18,
            "y": 74
          },
          "id": 71,
          "links": [],
          "options": {
            "displayMode": "gradient",
            "fieldOptions": {
              "calcs": [
                "sum"
              ],
              "defaults": {
                "mappings": [],
                "max": 100,
                "min": 0,
                "thresholds": [
                  {
                    "color": "green",
                    "value": null
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ]
              },
              "override": {},
              "values": false
            },
            "orientation": "horizontal"
          },
          "pluginVersion": "6.4.4",
          "targets": [
            {
              "alias": "",
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "sourcePort",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "asc",
                    "orderBy": "_term",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "Top 10 Flows by Source Port",
          "type": "bargauge"
        },
        {
          "aliasColors": {},
          "bars": true,
          "cacheTimeout": null,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 9,
            "w": 9,
            "x": 0,
            "y": 81
          },
          "id": 18,
          "legend": {
            "avg": false,
            "current": false,
            "max": false,
            "min": false,
            "show": true,
            "total": false,
            "values": false
          },
          "lines": false,
          "linewidth": 1,
          "links": [],
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": true,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "sourceAddress.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "15"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "15m",
                    "min_doc_count": 1,
                    "offset": "",
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Top Source IPs Over Time",
          "tooltip": {
            "shared": false,
            "sort": 2,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "aliasColors": {},
          "bars": true,
          "cacheTimeout": null,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 9,
            "w": 9,
            "x": 9,
            "y": 81
          },
          "id": 17,
          "legend": {
            "avg": false,
            "current": false,
            "max": false,
            "min": false,
            "show": true,
            "total": false,
            "values": false
          },
          "lines": false,
          "linewidth": 1,
          "links": [],
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": true,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "destinationAddress.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "15"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "15m",
                    "min_doc_count": 1,
                    "offset": "",
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Top Destination IPs Over Time",
          "tooltip": {
            "shared": false,
            "sort": 2,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        }
      ],
      "title": "NSG Flows",
      "type": "row"
    },
    {
      "collapsed": true,
      "datasource": null,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 2
      },
      "id": 82,
      "panels": [
        {
          "aliasColors": {},
          "bars": false,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 1,
          "fillGradient": 0,
          "gridPos": {
            "h": 7,
            "w": 12,
            "x": 0,
            "y": 4
          },
          "id": 2,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": true,
            "min": false,
            "rightSide": false,
            "show": true,
            "total": true,
            "values": true
          },
          "lines": true,
          "linewidth": 1,
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": true,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "NetworkSecurityGroup.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "10"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Flows Over Time",
          "tooltip": {
            "shared": true,
            "sort": 2,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        },
        {
          "cacheTimeout": null,
          "columns": [],
          "datasource": "Elasticsearch-nsg-flows",
          "description": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview",
          "fontSize": "100%",
          "gridPos": {
            "h": 7,
            "w": 12,
            "x": 12,
            "y": 4
          },
          "id": 29,
          "links": [],
          "options": {},
          "pageSize": null,
          "scroll": true,
          "showHeader": true,
          "sort": {
            "col": null,
            "desc": false
          },
          "styles": [
            {
              "alias": "Resource Group",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 2,
              "mappingType": 1,
              "pattern": "ResourceGroup.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Network Security Group",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "NetworkSecurityGroup.keyword",
              "thresholds": [],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Version",
              "colorMode": "cell",
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "version.keyword",
              "thresholds": [
                "1",
                "2"
              ],
              "type": "number",
              "unit": "none"
            },
            {
              "alias": "Flow Count",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "dateFormat": "YYYY-MM-DD HH:mm:ss",
              "decimals": 0,
              "mappingType": 1,
              "pattern": "Count",
              "thresholds": [],
              "type": "number",
              "unit": "locale"
            },
            {
              "alias": "",
              "colorMode": null,
              "colors": [
                "rgba(245, 54, 54, 0.9)",
                "rgba(237, 129, 40, 0.89)",
                "rgba(50, 172, 45, 0.97)"
              ],
              "decimals": 2,
              "pattern": "/.*/",
              "thresholds": [],
              "type": "number",
              "unit": "short"
            }
          ],
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "ResourceGroup.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "20"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "NetworkSecurityGroup.keyword",
                  "id": "5",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "20"
                  },
                  "type": "terms"
                },
                {
                  "fake": true,
                  "field": "version.keyword",
                  "id": "4",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "20"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "version.keyword",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "timeFrom": null,
          "timeShift": null,
          "title": "NSG Flow Log Version",
          "transform": "table",
          "type": "table"
        },
        {
          "bgColor": "#8F3BB8",
          "clockType": "24 hour",
          "countdownSettings": {
            "customFormat": null,
            "endCountdownTime": "2019-10-23T19:56:00.000Z",
            "endText": "00:00:00"
          },
          "datasource": null,
          "dateSettings": {
            "dateFormat": "YYYY-MM-DD",
            "fontSize": "20px",
            "fontWeight": "normal",
            "showDate": false
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 0,
            "y": 11
          },
          "id": 100,
          "mode": "time",
          "options": {},
          "refreshSettings": {
            "syncWithDashboard": true
          },
          "timeFrom": null,
          "timeSettings": {
            "customFormat": "HH:mm:ss",
            "fontSize": "60px",
            "fontWeight": "normal"
          },
          "timeShift": null,
          "timezone": "GB",
          "timezoneSettings": {
            "fontSize": "12px",
            "fontWeight": "normal",
            "showTimezone": false,
            "zoneFormat": "offsetAbbv"
          },
          "title": "Last Dashboard Load",
          "transparent": true,
          "type": "grafana-clock-panel"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 8,
            "y": 11
          },
          "id": 205,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 69,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "AKS-VNET-BACKENDSUBNET-NSG",
              "value": "AKS-VNET-BACKENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 16,
            "y": 11
          },
          "id": 206,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 69,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "AKS-VNET-FRONTENDSUBNET-NSG",
              "value": "AKS-VNET-FRONTENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 0,
            "y": 14
          },
          "id": 69,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": "nsg",
          "repeatDirection": "h",
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "AKS-AGENTPOOL-24932411-NSG",
              "value": "AKS-AGENTPOOL-24932411-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 8,
            "y": 14
          },
          "id": 208,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 69,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "IKS-VNET-BACKENDSUBNET-NSG",
              "value": "IKS-VNET-BACKENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 16,
            "y": 14
          },
          "id": 209,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 69,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "IKS-VNET-FRONTENDSUBNET-NSG",
              "value": "IKS-VNET-FRONTENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 0,
            "y": 17
          },
          "id": 207,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 69,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "CKS-VNET-CORESUBNET-NSG",
              "value": "CKS-VNET-CORESUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 8,
            "y": 17
          },
          "id": 211,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 69,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "VKS-VNET-FRONTENDSUBNET-NSG",
              "value": "VKS-VNET-FRONTENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 16,
            "y": 17
          },
          "id": 212,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 69,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "VKS-VNET-SANDBOXSUBNET-NSG",
              "value": "VKS-VNET-SANDBOXSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#d44a3a",
            "rgba(237, 129, 40, 0.89)",
            "#299c46"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "format": "dateTimeAsUS",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 0,
            "y": 20
          },
          "id": 210,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Latest Flow<br>📆",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 69,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "VKS-VNET-BACKENDSUBNET-NSG",
              "value": "VKS-VNET-BACKENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "0,10",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 8,
            "y": 20
          },
          "id": 213,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 76,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "AKS-VNET-BACKENDSUBNET-NSG",
              "value": "AKS-VNET-BACKENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 16,
            "y": 20
          },
          "id": 214,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 76,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "AKS-VNET-FRONTENDSUBNET-NSG",
              "value": "AKS-VNET-FRONTENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 0,
            "y": 23
          },
          "id": 76,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": "nsg",
          "repeatDirection": "h",
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "AKS-AGENTPOOL-24932411-NSG",
              "value": "AKS-AGENTPOOL-24932411-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 8,
            "y": 23
          },
          "id": 216,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 76,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "IKS-VNET-BACKENDSUBNET-NSG",
              "value": "IKS-VNET-BACKENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 16,
            "y": 23
          },
          "id": 217,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 76,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "IKS-VNET-FRONTENDSUBNET-NSG",
              "value": "IKS-VNET-FRONTENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 0,
            "y": 26
          },
          "id": 215,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 76,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "CKS-VNET-CORESUBNET-NSG",
              "value": "CKS-VNET-CORESUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 8,
            "y": 26
          },
          "id": 219,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 76,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "VKS-VNET-FRONTENDSUBNET-NSG",
              "value": "VKS-VNET-FRONTENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 16,
            "y": 26
          },
          "id": 220,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 76,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "VKS-VNET-SANDBOXSUBNET-NSG",
              "value": "VKS-VNET-SANDBOXSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "cacheTimeout": null,
          "colorBackground": true,
          "colorValue": false,
          "colors": [
            "#299c46",
            "rgba(237, 129, 40, 0.89)",
            "#d44a3a"
          ],
          "datasource": "Elasticsearch-nsg-flows",
          "decimals": null,
          "description": "The difference between now and the most recent flow timestamp",
          "format": "dateTimeFromNow",
          "gauge": {
            "maxValue": 100,
            "minValue": 0,
            "show": false,
            "thresholdLabels": false,
            "thresholdMarkers": true
          },
          "gridPos": {
            "h": 3,
            "w": 8,
            "x": 0,
            "y": 29
          },
          "id": 218,
          "interval": null,
          "links": [],
          "mappingType": 1,
          "mappingTypes": [
            {
              "name": "value to text",
              "value": 1
            },
            {
              "name": "range to text",
              "value": 2
            }
          ],
          "maxDataPoints": 100,
          "maxPerRow": 3,
          "nullPointMode": "connected",
          "nullText": null,
          "options": {},
          "postfix": "<br>$nsg ",
          "postfixFontSize": "50%",
          "prefix": "Flow Drift<br>⏲️",
          "prefixFontSize": "70%",
          "rangeMaps": [
            {
              "from": "null",
              "text": "N/A",
              "to": "null"
            }
          ],
          "repeat": null,
          "repeatDirection": "h",
          "repeatIteration": 1573553457388,
          "repeatPanelId": 76,
          "scopedVars": {
            "nsg": {
              "selected": false,
              "text": "VKS-VNET-BACKENDSUBNET-NSG",
              "value": "VKS-VNET-BACKENDSUBNET-NSG"
            }
          },
          "sparkline": {
            "fillColor": "rgba(31, 118, 189, 0.18)",
            "full": false,
            "lineColor": "rgb(31, 120, 193)",
            "show": false,
            "ymax": null,
            "ymin": null
          },
          "tableColumn": "@timestamp",
          "targets": [
            {
              "bucketAggs": [
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_term",
                    "size": "1"
                  },
                  "type": "terms"
                }
              ],
              "metrics": [
                {
                  "field": "startTime",
                  "id": "1",
                  "meta": {},
                  "settings": {},
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": "600000000000,1800000000000",
          "timeFrom": null,
          "timeShift": null,
          "title": "",
          "transparent": true,
          "type": "singlestat",
          "valueFontSize": "80%",
          "valueMaps": [
            {
              "op": "=",
              "text": "N/A",
              "value": "null"
            }
          ],
          "valueName": "max"
        },
        {
          "aliasColors": {},
          "bars": false,
          "dashLength": 10,
          "dashes": false,
          "datasource": "Elasticsearch-nsg-flows",
          "fill": 8,
          "fillGradient": 0,
          "gridPos": {
            "h": 8,
            "w": 12,
            "x": 0,
            "y": 32
          },
          "id": 28,
          "legend": {
            "alignAsTable": true,
            "avg": false,
            "current": false,
            "max": true,
            "min": false,
            "rightSide": true,
            "show": true,
            "total": true,
            "values": true
          },
          "lines": true,
          "linewidth": 0,
          "nullPointMode": "null",
          "options": {
            "dataLinks": []
          },
          "percentage": false,
          "pointradius": 2,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": true,
          "steppedLine": false,
          "targets": [
            {
              "bucketAggs": [
                {
                  "fake": true,
                  "field": "flowState.keyword",
                  "id": "3",
                  "settings": {
                    "min_doc_count": 1,
                    "order": "desc",
                    "orderBy": "_count",
                    "size": "5"
                  },
                  "type": "terms"
                },
                {
                  "field": "@timestamp",
                  "id": "2",
                  "settings": {
                    "interval": "auto",
                    "min_doc_count": 1,
                    "trimEdges": 0
                  },
                  "type": "date_histogram"
                }
              ],
              "metrics": [
                {
                  "field": "select field",
                  "id": "1",
                  "type": "count"
                }
              ],
              "query": "deviceDirection.keyword:$devicedirection AND NetworkSecurityGroup.keyword:$nsg AND nsgRuleName.keyword:$nsgrule AND sourceHost.keyword:$sourcehost AND destinationHost.keyword:$destinationhost AND destinationPort:$destinationport AND deviceAction.keyword:$deviceaction",
              "refId": "A",
              "timeField": "@timestamp"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Flow State",
          "tooltip": {
            "shared": true,
            "sort": 2,
            "value_type": "individual"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": true
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        }
      ],
      "title": "Dashboard Troubleshooting",
      "type": "row"
    }
  ],
  "refresh": false,
  "schemaVersion": 21,
  "style": "dark",
  "tags": [
    "Azure",
    "Network",
    "Security"
  ],
  "templating": {
    "list": [
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": [
            "$__all"
          ]
        },
        "datasource": "Elasticsearch-nsg-flows",
        "definition": "{\"find\":\"terms\",\"field\":\"NetworkSecurityGroup.keyword\"}",
        "hide": 0,
        "includeAll": true,
        "label": "Network Security Group",
        "multi": true,
        "name": "nsg",
        "options": [],
        "query": "{\"find\":\"terms\",\"field\":\"NetworkSecurityGroup.keyword\"}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": [
            "$__all"
          ]
        },
        "datasource": "Elasticsearch-nsg-flows",
        "definition": "{\"find\":\"terms\",\"field\":\"nsgRuleName.keyword\"}",
        "hide": 0,
        "includeAll": true,
        "label": "NSG Rule",
        "multi": true,
        "name": "nsgrule",
        "options": [],
        "query": "{\"find\":\"terms\",\"field\":\"nsgRuleName.keyword\"}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 1,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": [
            "$__all"
          ]
        },
        "datasource": "Elasticsearch-nsg-flows",
        "definition": "{\"find\":\"terms\",\"field\":\"sourceHost.keyword\"}",
        "hide": 0,
        "includeAll": true,
        "label": "Source",
        "multi": true,
        "name": "sourcehost",
        "options": [],
        "query": "{\"find\":\"terms\",\"field\":\"sourceHost.keyword\"}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 1,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": [
            "$__all"
          ]
        },
        "datasource": "Elasticsearch-nsg-flows",
        "definition": "{\"find\":\"terms\",\"field\":\"destinationHost.keyword\"}",
        "hide": 0,
        "includeAll": true,
        "label": "Destination",
        "multi": true,
        "name": "destinationhost",
        "options": [],
        "query": "{\"find\":\"terms\",\"field\":\"destinationHost.keyword\"}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 1,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": [
            "$__all"
          ]
        },
        "datasource": "Elasticsearch-nsg-flows",
        "definition": "{\"find\":\"terms\",\"field\":\"destinationPort\"}",
        "hide": 0,
        "includeAll": true,
        "label": "Destination Port",
        "multi": true,
        "name": "destinationport",
        "options": [],
        "query": "{\"find\":\"terms\",\"field\":\"destinationPort\"}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 3,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": [
            "$__all"
          ]
        },
        "datasource": "Elasticsearch-nsg-flows",
        "definition": "{\"find\":\"terms\",\"field\":\"deviceDirection.keyword\"}",
        "hide": 0,
        "includeAll": true,
        "label": "Action",
        "multi": true,
        "name": "devicedirection",
        "options": [],
        "query": "{\"find\":\"terms\",\"field\":\"deviceDirection.keyword\"}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 3,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "text": "All",
          "value": [
            "$__all"
          ]
        },
        "datasource": "Elasticsearch-nsg-flows",
        "definition": "{\"find\":\"terms\",\"field\":\"deviceAction.keyword\"}",
        "hide": 0,
        "includeAll": true,
        "label": "Action",
        "multi": true,
        "name": "deviceaction",
        "options": [],
        "query": "{\"find\":\"terms\",\"field\":\"deviceAction.keyword\"}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 3,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      }
    ]
  },
  "time": {
    "from": "now-1h",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "5s",
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ]
  },
  "timezone": "",
  "title": "Azure Network Security Group (NSG) Flows",
  "uid": "7z1H2E-Zk",
  "version": 1
}