peterschretlen · January 16, 2020 22:16
diff --git a/1000_dummy_siem_rules.ndjson b/1000_dummy_siem_rules.ndjson
 {"created_at":"2020-01-16T20:22:12.380Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f602fcd6-4ee4-4122-989b-c3459126c20a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b9b5ddca-bd29-4b6e-9481-619c34d2c65c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:12.380Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:20.553Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"048a1b55-5be4-443f-b51b-259dc91c9d98","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8adf626d-f6fd-426e-94aa-54a33beb909a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:20.553Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:14.436Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8bc1692c-bd07-45de-93f0-344d997fa667","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dcc1972b-1637-401f-90a3-0ab5aea4c509","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:14.436Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:16.474Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"864e85ee-8249-4f98-95cf-cd8a63bdd730","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"72f8197c-d7f1-44cf-8278-bc3a427bc867","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:16.474Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:18.510Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"27679bcf-41c5-42b8-b645-e1c8facfee3d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5f00445f-fb3a-4f7c-89d6-bed45d574b2d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:18.510Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:38.918Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fc369337-86d0-41c0-a19c-60e44e4fac52","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"22d2ccb5-6082-46c9-af89-353edeecbdeb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:38.918Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:30.748Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9bdd8057-ce52-487c-ba1f-590fc7ebb806","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"934dd333-26f5-4c2a-b03c-2b6608d08846","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:30.748Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:34.839Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5fa6caf8-5270-47fc-b9f2-0767e1fae03e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bd1b882a-7eb0-4387-b599-a4bba2d1b2f2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:34.839Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:36.887Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e5232060-af9b-4f0c-bffc-777a468e2d39","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7b7991e9-9f96-4c1d-abb2-2569055e8fb5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:36.887Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:32.801Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d7964c92-3c1a-4af3-8454-ee6abb4fd7f1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"31e5b729-7987-41c0-8d91-9050e8d5a1d8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:32.801Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:59.313Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a96760bb-d90f-4029-a43b-58af760e7027","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2fdd79cc-b0ed-424f-8673-16f2aeb2a0ed","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:59.313Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:51.183Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b49f9642-5a79-4a5d-a979-454b4af13bd4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"22226bb7-320d-4fc4-8f08-c2b56636a0aa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:51.183Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:54.217Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9ae44cb2-f753-4f2b-aadb-e5bf97491112","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"72d6bd8f-a3a0-4d71-9bc9-eff05cd2640f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:54.217Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:49.122Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9b2d8800-010f-4d96-b004-522367fd0d81","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1c31a92e-d50a-49da-9c73-7ee5c6e286b2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:49.122Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:22:57.252Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"87dd4de3-1fba-4086-a051-1123b2e81eb9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"adcbc78e-4328-481f-8b2f-3cd3a98b46a7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:22:57.252Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:19.637Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0d837924-959a-4c72-bb22-bd9492baa946","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"82489427-838d-42db-8117-62b5f90452fc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:19.637Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:23.707Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"978e9ef2-16b1-44a1-a2a4-b806582bb995","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5bbcd964-af3c-4896-8572-0534f1909611","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:23.707Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:14.553Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2d0d72c9-4026-4a9d-8eff-7c9eae2b8949","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"864121c0-e4e0-4762-a10d-a8519aac7cb8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:14.553Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:17.601Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e81d8174-5fdd-4483-85a9-aaedf1d08914","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d9537c6f-a047-432f-8ee5-ce6fe4b4e01e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:17.601Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:21.673Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ad975ca2-b177-4769-8b7c-e68db4bfd915","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4f4043c4-25a8-4e65-806f-1c85aeed8503","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:21.673Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:37.977Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8702c4da-8c37-49f6-af78-26857c7bb74f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e8de1414-342e-4cf7-892b-ff1bfb3982b3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:37.977Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:33.893Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f5c89ab3-0130-401b-8764-635a68b9edaa","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7b455b4c-b963-4188-a29e-96caeead97fa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:33.893Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:35.946Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"eb0c23bc-01fa-4935-a250-9e87e9b1b84d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c286debe-70e6-435c-a8a5-a8b05ac1ae8a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:35.946Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:42.049Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6805535d-2682-4d68-aed6-48a056f75142","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5249d548-1d80-4e0b-950c-73d4b63b1b05","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:42.049Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:40.009Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"51d6848f-1ab2-4b1d-bc4c-3fcd173b3a97","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"836e9670-0db2-48a4-a0cd-c3790789b040","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:40.009Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:52.241Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ca3e0fb1-6ebe-4df8-adad-ab98bc53815d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b96d274b-6af4-4278-a62d-7810c7c9344f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:52.241Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:54.288Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d8c801c0-fcaf-4380-b98f-82229d19265c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"28f9254d-2fb6-48ca-b963-332c1918b2bf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:54.288Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:56.326Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"132ab0e0-8b90-4998-97fc-a3771cf05960","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a2ba6ff5-1204-42b8-9e29-7bcfa1edab0b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:56.326Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:58.364Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"56dfe06c-7dc7-4c1b-9726-a1c7bf193db4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"73114008-4f44-40ba-9284-c1d896f6cf5a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:58.364Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:00.387Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3586d432-e556-4e87-a0ab-3ee181885533","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b6f6b33d-6ed6-4549-aaab-fa3e3e20b5de","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:00.387Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:18.741Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9823adda-2c6a-408e-b607-2a75d42ccbfa","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b8068fe1-664d-4a6f-8de8-19089fad1a5f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:18.741Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:10.592Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7276b98c-fa4e-4568-8d7f-6b1b27d9ab58","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e0629c72-86e0-41ef-89f9-491fe3e93c03","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:10.592Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:12.636Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3dc70676-8d65-45b0-a536-84ea4ea82169","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0c5f9212-61d0-47d5-a0e0-5e2bbc4b10fa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:12.636Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:14.672Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"92f27b57-00cd-4d95-8ad9-278b82f09527","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c45e113f-a144-44af-b04b-3390647639cf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:14.672Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:16.707Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"49dbe809-2402-4edd-a9cb-4f8e660ce8d3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cd298c6b-31c8-4bfb-bae4-583a2b616434","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:16.707Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:28.924Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"86cbeb09-b27c-4b45-b602-a8261c28a920","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"be5dd358-cebb-4765-a7fe-acd7be30aad3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:28.924Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:30.982Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5b848a08-8301-4710-b0ec-593d8679b385","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1d53c0d9-25fe-48ae-b5cf-5764fb94440c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:30.982Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:35.056Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"193b1f0e-99ad-4cfa-972a-42e1929ac678","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"24441559-7d7e-4703-bc40-340c1c2b9347","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:35.056Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:37.078Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0f2e74b8-e1f3-4776-9c49-72526b5b48a3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"97c0646c-a08b-433e-9fd6-0123f95026c6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:37.078Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:33.010Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c0474bfd-5cee-41e3-9d7a-045a455c2bf6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9ddc5eb9-7cf4-4f96-8b7b-bc3136010622","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:33.010Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:52.354Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"939a038c-1048-4b3e-a10e-225ae514c616","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a0087ff2-e567-48b8-98be-da1e24a561cf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:52.354Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:49.318Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cd1f6c64-d44d-45d9-9524-b88558f8f829","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5f95d0a1-6956-4bbc-9273-c88b1bcfb9a3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:49.318Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:55.419Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fd9b110b-a5ee-4f43-8fd2-c8065afd00c3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dd67ebab-707e-4979-857a-308a6d4154e2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:55.419Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:58.496Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"05ffa8cc-86bb-43db-8e99-c98d9cd1a4e2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bed21bfa-3f4c-455f-8332-fd58f294c026","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:58.496Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:47.262Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"63e5a933-732c-4577-be54-b237f5fd7be3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"38d449d4-b266-4825-96a7-68baf8f5b8d0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:47.262Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:08.691Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bb71e88a-93a0-4e10-bfdb-7dcba4d602f4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9d9df3d5-fc79-40fb-80f7-a59253fd3366","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:08.691Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:10.744Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"536c2d85-d929-42d0-85c7-f64b8e8bb081","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"93254975-3710-482f-90e0-9f9412246d7b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:10.744Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:12.779Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ab43ee28-78e0-4632-bf00-2d34f3174604","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0ceccd2f-742c-4146-b303-3ba00a3d84bf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:12.779Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:14.815Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"dcf942da-ea4c-4bb0-b934-e107d50ebc06","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9f1ca66d-03ca-416f-8f1e-b3980bee11b6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:14.815Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:16.863Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0c69425f-d369-49f6-8bbe-43fb91101273","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b2317153-a4e5-4cbe-aaed-4d2f824a6530","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:16.863Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:29.117Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0c78ca5d-669c-4855-a532-e4a97dd668df","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ecbd8438-0272-44e0-8cff-2d33120296ea","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:29.117Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:27.045Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"39eb3dc9-fbe0-49d2-aef9-98e1dfc38aa3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6b12df9c-8059-4025-84a8-d3c7e29b550b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:27.045Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:33.177Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"408cf137-2632-4c3c-bad8-274ad0ab2549","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2e9304d0-95ac-482d-8352-6d00c0aed6d3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:33.177Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:35.198Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"296017f6-cb66-4480-aaf2-03894364767b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ce8e3b15-445a-40b5-b658-d4bc237c8d80","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:35.198Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:31.145Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a78fa2fd-06dd-4bfa-b976-0e77b54102e5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dd72fff8-3619-4a0f-a308-fe0f54385553","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:31.145Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:49.487Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1abdd4d0-8377-4138-9957-ef719a90d5f8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"33745efc-1994-4418-8203-c24895e23fcf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:49.487Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:51.498Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"79a8ff9b-1e32-4de0-96f2-af4916fb275c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5ec6f3cb-941d-42a0-a377-ae5d158d2e40","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:51.498Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:53.550Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8fee0284-84a1-4691-b9d3-898f0f42ea2e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"862d8705-52e6-44d2-99c1-1f4708f320b1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:53.550Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:45.390Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"72a509e0-baf7-4a93-b96e-d5b4b37246e7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7be8a26a-ec0a-4f78-9bff-63fdb0fd4698","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:45.390Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:47.438Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e4f95afa-b196-4145-b998-95c25245ac2e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"defd6132-0daf-4a58-89a7-9faf37c13f71","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:47.438Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:59.671Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"74af8ee4-ddd9-4671-829c-c30769ac6776","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e8e52a42-78c3-442d-990e-628702326b4b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:59.671Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:57.634Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"92dad7e1-b62b-47d2-bec2-4a4d35b0a4c6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7da06c3f-2544-48a4-a20e-5f636e0277da","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:57.634Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:01.703Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b1f8edac-e87c-4f39-8f16-18a30f276555","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"264110e8-022f-47de-80c2-fa469e6cb52e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:01.703Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:55.589Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d71e8ea6-251e-42e6-8d0b-730b6851fbf0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"674ab816-fab4-43b6-9a5f-730bb2ee15a3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:55.589Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:43.528Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cf7c695e-8c58-409a-aada-a71b6bee8119","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e723c146-b50c-4650-a2b7-1c19741be600","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:43.528Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:47.608Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8c829eb6-e3d6-4e57-a6a8-ddcae4dbfdb0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cb3a40d9-f43e-4088-ac0b-d46af064a9c4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:47.608Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:49.653Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4af9503d-7ce6-4d57-a06d-ffd0c3a24831","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3a8126d5-21e4-4c75-9d2f-eaa7ee1b7f0b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:49.653Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:45.571Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2cb6c681-1751-4661-8e48-1279e1ac5def","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5427ece4-6d7f-43a9-b619-024ad1aa0a50","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:45.571Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:51.688Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9065901a-ce72-4318-989d-dfe6770f9795","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ca760dd7-0b42-4b2b-b37a-fe78f105dbaa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:51.688Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:59.835Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2c374309-31af-40ea-83d4-a3adfc9157c8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e69c7a56-7e87-4484-8f88-1856397d622e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:59.835Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:55.770Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0d14e416-58b6-4ba7-a699-76eba03fedd9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4f1a0de4-a9e1-4932-820d-8005aaaa15a5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:55.770Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:57.805Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d5813ff1-fdf0-43b2-afd5-7edc301c5b3c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c6ffcacf-75d9-43a0-95c3-bde3ff4c14f7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:57.805Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:53.730Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e454fb65-16b4-44de-8883-826925f7c0ed","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cfc30eac-71ff-4989-a49b-3e6c6d846250","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:53.730Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:20.207Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"33f6e0ed-fa14-4d22-9260-66c86ec7aea9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8107baf7-c3c1-47eb-b88f-7770847bac40","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:20.207Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:24.294Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"aa030e08-01a0-4062-8c20-81d7f04143d7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ee52b830-8a6b-4692-bfe0-a5120a055cc0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:24.294Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:28.380Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5c1d48a5-b5fe-45be-9509-ce8eb10d3ba7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d0f542f2-8bf3-4bd7-8116-dd108457e8ab","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:28.381Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:26.341Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a65712f6-747e-418b-8e8b-cdd765aa40f2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aa56614e-5f73-4518-a6a3-14113380b9b1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:26.341Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:22.259Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"be114127-78f4-4c3b-99f6-14e268e53b49","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9de21c4b-2eda-4ca6-aa68-5e6eec13fe4f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:22.259Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:34.497Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e38874a0-29b4-4a58-9f88-077f07f47f5f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"19272f9c-7578-47b2-a514-05703061cb41","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:34.497Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:32.456Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c143a15f-4f9d-4a8e-97aa-baf42be59216","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1820bc90-760c-439f-ac3f-e784b7709548","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:32.456Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:36.536Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3223ae8c-4f4e-49f0-a175-bfae04030d25","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f250b4bc-ed68-4e6a-bdde-6bde1cce3d5f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:36.536Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:30.415Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d8af389f-6839-42cb-986e-fbe4a6228340","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"50a0ff42-2b46-486a-9e32-bd577ed19582","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:30.415Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:58.994Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7ccd904b-f805-4dc6-8cab-ee73bccaf585","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5b4a04a4-24d4-4e9f-add8-2dd9a7f54351","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:58.994Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:05.077Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"26856520-d681-4e03-b0a0-4b7fd9fc8fb4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0d4efa3e-15ac-4878-9f61-4f87ca31edf5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:05.077Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:08.111Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8998ec77-9cbc-4f8f-935a-d4dba55251cf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2de61e5d-1dee-4203-9bbf-29f815fc253c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:08.111Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:02.046Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c82042d3-72d1-4d6d-baf5-d09ca9c9949a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2888c808-8013-4721-807d-bbe66acc7b76","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:02.046Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:11.149Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"87e8d0da-c0a1-4f8d-ac6e-eec6b493ef23","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"edf6a694-7c52-4046-bd5b-213141831a2d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:11.149Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:20.318Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"99d736f3-fe54-4787-810f-c01ee0a3555d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0242e0ac-a53d-43d2-8583-52efa6e6c1cc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:20.318Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:14.216Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"50394373-b125-4059-81bd-3cea32d28955","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"88306f0c-e0cc-4e97-ac2f-572b4eccc201","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:14.216Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:16.252Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ed693513-e76c-4b9a-ab29-a519c9b166e5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"98cff25a-18f2-4f53-8101-400b497c567c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:16.252Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:18.284Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"dc440e4b-9c90-42d2-8a51-03c3fa5ffe77","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e6841343-bd71-48db-981d-1211140ea1e6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:18.284Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:40.696Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a3f8846b-7950-429c-8637-4f2f98392406","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"70e2ccdb-28c8-4df1-a5c1-0d4a7725aef7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:40.696Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:44.801Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a2c7f121-f537-4371-863b-3d391fba8f51","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6b7990ee-e817-454e-a5b8-4d7b59a026df","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:44.801Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:46.842Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fe7f923c-328f-41de-9dd9-4875b8db1738","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c65369d4-278b-4d3d-b4d3-c7fb40492f98","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:46.842Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:48.871Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"eac9cbad-d745-4ad2-8a69-315511514f94","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"56b7ec66-e39a-4ec0-8503-e9fc5f00c55e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:48.871Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:42.748Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fcfad071-2c05-455f-967b-a2dccc93591e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4dd87c3a-f98d-4394-8b45-82f4f8ec7e24","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:42.748Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:50.983Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"022d4be5-bdfc-4e7e-a9eb-2e26bbdabb2f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"33ae95e8-3db1-46d6-85d7-31ac44edd134","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:50.983Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:53.022Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b28e3a2e-bfde-479d-8e14-682c7f7aa2e3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5a8d9f0b-0345-4bb3-ba7b-232beb69bdaf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:53.022Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:57.096Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7b081811-cdd8-4b2e-81fd-994dae46e293","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1bd9eb94-9929-4f1f-83a4-2da3b14effcd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:57.096Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:55.050Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c7f74cf6-2c51-41c1-a279-29120cb85f36","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e7c476bd-a1dc-49c7-a6f5-23347fc60d79","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:55.050Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:25.623Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e3252946-80be-4c4b-9ef9-67eba3168c68","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ecc6154c-8150-4501-898e-ae7ccf82ab53","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:25.623Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:19.513Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3018ff15-e4da-4d71-8376-b198acd2de5a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"959f7fd5-25bb-4677-9796-100310c8ea6b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:19.513Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:17.459Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a3b53215-8a64-4a95-a4ba-fe7f2792a6a5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d658e873-3d93-4a70-bc45-e792c6d75dab","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:17.459Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:23.592Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"45a882e1-6a81-44e2-93e7-f351c97cb052","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6a4bb192-f047-4705-942f-a1869465585b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:23.592Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:21.548Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a3328cfc-e9a6-4ab9-a0e0-31e9c5575f30","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bb377516-ff10-4ef6-8078-5f1cb09e43dd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:21.548Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:31.762Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9a273549-20e2-4a89-b52e-839d0541f18c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ddda5265-52c3-42b3-a6cc-58b8585c5611","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:31.762Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:34.772Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"48f878c8-553b-4ce1-88bb-4a3b1ce270e1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"82d6b2a2-f5b6-4a5b-abc9-c35be82cdc0d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:34.772Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:27.657Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"69e93771-c67a-4238-bae7-ff121723f3f2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f4812c6b-fa82-4fa2-9de0-8b2f63f88546","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:27.657Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:29.693Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fb7069e3-fd13-4051-8a7c-cc2f49a06d6b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4011d14c-d280-43ec-8527-7639e551f722","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:29.693Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:09.353Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3c136b25-c649-4597-82d6-658b77ae8847","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"72904da0-743a-4aac-9bd4-1fd3c7c80685","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:09.353Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:01.185Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c36d40e6-3157-459a-84a5-5bc0cdb271c8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"592e2ad8-8468-4f3d-b7c4-0dc795772ee2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:01.185Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:03.231Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f27139dc-735a-483c-b8de-7bec110bc581","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0e395c5f-0056-4ee9-ac7e-95ff75439e13","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:03.231Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:05.371Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"88722fb8-79f6-429d-a445-ac3d1e152e3b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0e0d8e53-711a-4329-a89f-7c3b95a4dbd4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:05.371Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:07.318Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9c0f76ea-46c7-4d4d-800a-1e3ef23ec3d4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5dad5cb4-906f-4145-9af1-8f92a283abc8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:07.318Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:17.491Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9d34f81e-9023-4d06-a0d0-2784021dc491","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b386f01c-58c7-4779-b484-05046d7b83f6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:17.491Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:11.383Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2cb8d447-b671-450c-92e0-7f07edb35adf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b75ace50-3711-43e0-b9e5-4eea43d3924c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:11.383Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:13.427Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ae0743a3-1184-4036-9b22-1e110c31c4d1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"64a0c58c-de9b-4af3-ad29-e8086ce9bf42","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:13.427Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:15.455Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"580dbd71-5963-4e49-b8bf-43d0dd5db0a0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"41b012e3-bfa1-44ce-ac88-8eda9529c96e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:15.455Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:25.716Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"dae0022b-12d9-4317-a052-db90c0d13633","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5d5fafd1-08ea-467b-aeb2-647722422d87","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:25.716Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:26.694Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"20f75b97-42c6-45ca-a1e7-06b732ccb70c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8bdc40d4-3b6c-4d8b-b4db-911e589a2e7d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:26.694Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:26.696Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"643e6ac9-e1c0-4bf2-a26c-e0b71d01695a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"85aeef9a-5cad-4c92-bc27-36ab09062cfc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:26.696Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:29.785Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"818603da-092d-41d6-94d4-a72f4a99ed54","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"98f3086b-b1f2-449b-98f2-92fdbebf014d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:29.785Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:27.746Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"adfb2b42-6ab4-4e42-a8cb-5a22ba0803f4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ea04f1b3-4872-4ae6-9b6c-8f6f415c746a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:27.746Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:31.885Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f7acbe44-e18a-4a73-9d54-92914963b5c3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c03db4ce-a347-4b4d-b701-ba152165a6fd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:31.885Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:37.989Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0af058cb-f1e6-43b6-8cb9-b33c16b9a60f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f9be9f01-fa87-4811-a9d9-598d6904e938","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:37.989Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:35.953Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a86df540-489d-4781-9d80-36f14cb9367e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ce77e499-e754-493e-91cc-28fe6e25b97a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:35.953Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:33.908Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e1da10fa-5945-4d81-9ffe-4d2ee05208b1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9278f467-bded-4041-a199-0a8ed4a587af","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:33.908Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:40.026Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"733864ba-1449-4ea8-8e32-90557c4a9787","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"02977046-14da-4766-a347-00700d379f47","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:40.026Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:42.090Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"39a741e2-4773-46b4-a920-446ef7a5563e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"228e4e25-3364-4592-8174-f6c0fde02cc4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:42.090Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:46.174Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"90741de5-7af1-478c-8854-926a15b99768","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d6b5c517-cf18-441f-8c45-5e8fbedcf6c5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:46.174Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:48.205Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a6e00ab4-e080-492a-98b9-5869ecd9803f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0374ab98-3a05-462a-860a-d60d48dae94d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:48.205Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:44.125Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"dc03be8c-fc02-4618-a03f-29987261ba1a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fc18f6d1-fb2a-4e3a-b551-7feb397e6db2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:44.125Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:50.241Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d2239d08-ce73-4ff8-af84-efce1c55b5bf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"93719953-9e79-4a80-a86e-9348177702c6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:50.241Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:00.435Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5a09f269-9670-4007-a2d4-7f9540d81c6d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e20debe8-8a76-481f-bdac-008e797bf4d3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:00.435Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:54.331Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"05f70281-f343-4b59-8fe5-84f90087160e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a5dcf7d5-0136-472e-823c-06fd505bec50","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:54.331Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:58.400Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d511a940-8455-41e1-b68a-87c40c44a7d9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2c7d0fc2-7cc1-4eec-9c2c-eb2cdb6b2007","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:58.400Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:52.270Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"13c6360e-4f16-4529-ac4c-6b896f12f774","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"42f18b24-07be-49c1-97fa-016351f77621","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:52.270Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:56.363Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f1dea0cd-ed19-43f8-ae23-f9f5b060791b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8280391a-7c61-4b48-b8ef-f0665c202c34","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:56.363Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:06.558Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"915c61de-d6ed-4984-b078-3b04ff1354ac","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d6222fe0-5e24-450f-baf9-588eeefa9d99","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:06.558Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:02.468Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1197e23e-1fd1-4604-93f4-b6a57260cffe","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"19724d4c-5f01-4547-8983-ae447752f92b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:02.468Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:04.517Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"192383c7-d6ea-4ea6-90dd-6ecf41910fbf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b490afe3-2716-47e8-973f-7b9cfe263325","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:04.517Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:08.597Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"10fdc440-947e-461b-8193-9ac774038d45","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"20c614cb-8cb7-41c7-864c-9b2811796e57","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:08.597Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:38.155Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c7ca97c1-c5c4-48d7-9607-34104ae528ef","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3e039765-de1f-4382-b287-4b2c6f207d9b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:38.155Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:42.244Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e459b58b-39d2-402f-97b5-ace17e117d17","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b390c6b4-e6bb-4bc3-9908-09615974fb49","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:42.244Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:40.195Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7af1d975-1f8d-4ad8-82eb-4097b953cd4e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"63422b3c-210a-482c-8828-846994ec966f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:40.195Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:34.069Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1aea09c2-9677-417f-a4c6-67df2b6c7707","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f098861a-bab5-493e-aa1a-3c624d93c7c3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:34.069Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:36.124Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cdb3a90d-e945-4cd1-b9b5-d2f4199c0d36","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a2b2cd3d-fed9-4af1-8e4e-12ec7f608e3a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:36.124Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:50.411Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"34d54f13-8a52-4959-8f82-9ea42f5e5f58","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5fac0a5a-1cd7-489d-ae66-4f0bbc457836","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:50.411Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:46.319Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3a84037e-6415-492f-a015-f14ceb3879db","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fbbd7e02-69c8-4c8b-b4cd-f8d24427e036","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:46.319Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:48.362Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6612f060-2e04-4205-adf5-e7588759ae1a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"73fd15e2-b132-4613-8928-4a58f22f7366","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:48.362Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:44.278Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"890796a2-9d62-40cb-8140-dc874543a3cf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0a9f6aee-cf4a-4510-b6bf-6fc6c193f1ed","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:44.278Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:12.829Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d75b54db-2057-484b-a21c-3352c37414f6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fdd9513a-16f1-48ee-be43-3ad26536c515","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:12.830Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:10.786Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ddd7cfbd-17bf-40ed-8183-473dc91b9e6d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6eecd414-da03-4cb7-be16-8506d3d2a325","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:10.786Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:14.859Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f4366f85-7629-449e-81f3-dddb2b54d8a1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ce398405-e721-4712-bdef-87af05e8704d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:14.859Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:16.903Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1a161a54-cde0-4b1e-85be-d9103911df7f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a6a863a5-28ce-42a3-a9f8-ac8cd3cc3d1d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:16.903Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:18.927Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"aaf6b3db-35a5-48b4-847c-103efecb0f07","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"04175a61-93d9-4566-a556-e01dd0fa3045","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:18.927Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:23.408Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"68b012fa-29a9-4189-bd19-bcbd5ad742e0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"262aa41c-4c12-423a-b9f3-fc1a3cb1077b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:23.408Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:21.008Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1a6012be-e887-417c-a2d3-011909cb04b1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"53a1dd32-c99f-486f-98b9-05ed0e4fde6a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:21.008Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:26.122Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e930547c-8c05-4cb9-b2db-d8f19f8ae047","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"afc029d3-4015-4125-aff1-5bf1f109c5e9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:26.122Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:28.162Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"76c9a6e6-593b-4836-ab3f-1a867fa1e0c4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"abe6da01-0973-4279-b035-98281c0522df","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:28.162Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:49.524Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"95aa347b-229b-49a1-9956-b7014e4231ae","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9282e7a2-303a-4ae7-b73b-39b969209c93","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:49.524Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:00.716Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cb05d23a-ebd2-4352-9ca6-afb1b0018e23","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ae078699-c500-46ff-a4b8-b198bc33fe6e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:00.716Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:52.589Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"68dd6f14-387f-4e6a-9539-6dad4f2f3067","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8cda6f1f-3eb8-4992-baae-8fc45274c73f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:52.589Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:55.626Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3317f22e-1ffd-4b55-937b-0a2da53725dd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"07c268ff-9789-462e-8cc4-0895463832a9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:55.626Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:58.667Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b2a83ddb-8fac-4dfc-8d72-8f9907f56ab6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8cae6657-40e6-475f-bcf3-80523bb80452","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:58.667Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:04.793Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b84745e5-9a70-4dd9-8a8e-1c0818690958","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"98ac46b2-f5ba-4ba8-bd83-e023d4dab398","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:04.793Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:02.748Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b94945ed-edb4-4693-b058-9430922998c9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5170d373-b2d6-4afe-843f-35e8f4c8428d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:02.748Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:06.827Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a4e21024-8c0f-4461-9ac2-fe2ab3fe0bc9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1e66f9ef-5d15-48f1-a01f-80564c13d6b0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:06.827Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:08.864Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"571390d7-5cbf-4711-9926-d63c64b86cf7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"45d2183e-398f-46c3-b2b4-b7bfc29b6d9c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:08.864Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:29.281Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"26fb75fd-2a37-4503-bd97-f6e92d41d95a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e2867e7f-c164-4e60-88e4-07d9c0fb121d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:29.281Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:33.363Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"09357362-229a-41a4-91aa-64a8937bfc77","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cab3c17d-152d-41ff-979e-1fddf62ebe3b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:33.363Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:35.403Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"68008ce7-a5e8-4ec3-9496-181485ec53b3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"93a1bd7a-a013-46a0-a65e-d0d1ce0f4237","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:35.403Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:37.443Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bfd97c5b-8d12-4a74-b663-743c9f755320","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"16f3468b-e040-423f-a405-ff9bbf044ce8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:37.443Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:31.330Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b6409e04-de4a-41c7-80c6-fb87f3a41259","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"87179d8c-35e2-4e73-9c66-60ed4d74efb1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:31.330Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:41.593Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"14447132-a8a6-4bd6-997f-b34c74797357","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"eb6f67e7-1322-42fc-929a-dbd92c58a6ab","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:41.593Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:43.620Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b954c4f3-7d95-4660-bf5a-efa0a10aba77","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c6284a43-b550-4229-992b-a8c8676ed8e1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:43.620Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:45.661Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b7f9e40c-7a26-4ab2-ab98-91a661448bba","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a95563ce-99ad-4f0a-8fa1-912d27406ce9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:45.661Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:39.559Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d2867f05-cdff-40e1-b2cf-068df59718c3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"41d49ff2-b781-478c-8852-0acd54823e51","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:39.559Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:06.027Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2885d47c-69bb-4b29-85be-e809ab8e3d16","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5b571724-0e34-4052-ab3c-23c8348d38f4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:06.027Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:08.091Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d16e317d-378f-4b6d-89cf-ca5b3f0d35a3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6a4cf000-d295-4668-af6b-c0cfbd8f76d2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:08.091Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:12.199Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c53d4879-5569-487c-b5ca-71f128c8ab03","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"975a3d9c-95ea-4a19-8986-55861aa36263","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:12.199Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:10.123Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5a4b016a-750c-467c-82cd-5cdc943a6054","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"07dfb6c7-e1d9-4d3a-9e5f-4c4e16e6459c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:10.123Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:14.221Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a118fa8d-6d3b-4d7c-bde0-927b09dac46f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"de51f42e-a829-411c-ac51-caac076ebe26","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:14.221Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:18.307Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9825cb63-c6f1-4646-8f7a-32e8aa6beb20","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a7899627-53bb-49c8-8707-06863641650c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:18.307Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:21.364Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4feb6332-3536-4359-9acc-e967cb2738e1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9d0b448f-a461-4b60-88f3-474cd0c3151c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:21.364Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:24.422Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0bc12138-3ee5-4ec8-9431-661d1091afa3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"410a2f0a-4364-488e-a1b3-0ad3183cd576","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:24.422Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:16.257Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b7c3ab2d-3c2d-4fd6-bf3a-d68db99fdfbf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cb9b2ad6-3de6-4a75-b7dd-cbcb5d34dd9e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:16.257Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:51.896Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d31cb6ea-cbee-4d12-b88b-906d7e8b4788","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"afbbff97-4611-4280-b063-bbcb6b3f9859","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:51.897Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:55.958Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"27d9a836-701a-402f-b3ab-d66971ebae4d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b3c7e099-f01b-4bcd-b1b4-04f8ad42ca8d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:55.958Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:49.862Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a3fa3988-4110-4ce4-9920-7e9e8ca2b458","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"11226598-cf3c-4688-854c-5ec7c604de38","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:49.862Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:47.828Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"98da1d3c-175e-4957-84e1-8d2ac35a6099","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"214b370e-f46d-4aa4-99ce-94d5b59eda61","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:47.828Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:53.929Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"44a0020f-fac6-4e62-8592-a6f47c6e6998","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cb220847-1804-42e8-ba94-1c3f12e6b93d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:53.929Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:57.986Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bc1b3985-d59f-4e77-855d-cce07c21370b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0978e68d-db64-4885-9d7d-19e406d01320","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:57.986Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:00.042Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b25e3327-bec2-4a9f-bc9c-88f2b7359754","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7cc7dafe-2830-4f85-83d2-37eeda80d10b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:00.042Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:02.072Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8231d9c7-10cb-41b5-8c1f-36f782710b87","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"487b99ec-bf05-4416-b8d5-5b6b631ae212","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:02.072Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:04.102Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ba5d6d2c-9268-49fc-91b9-2c77ff70848c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"eb8a916a-4e5f-471e-b1f4-d924d9b5fc00","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:04.102Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:28.666Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"930d4125-56e9-4f37-942e-de76cb220f49","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f3f6169a-e6bf-41c3-a18e-a3f47edd6d86","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:28.666Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:32.750Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"33dc7810-56d7-45fc-97f8-f3957bb677e2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"208a2c18-03b3-4e4c-ba73-d62199db8529","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:32.750Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:24.573Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"953f2799-cff8-48ec-901c-be36a57f2bbf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"66cc2755-f550-4023-9dac-f35a44de6046","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:24.573Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:26.637Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5ea6e8a6-762e-494e-979b-5becc7e610c5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ca472a28-1b5d-469e-a4cc-10bba4ebd7fc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:26.637Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:30.726Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"18d21814-a5bd-48b3-bcc8-ab4692f10b72","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0119890a-3352-48ef-913d-540871ba6e8d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:30.726Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:38.864Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e65a5f10-0978-4021-8742-e8b6a75c2e04","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"955a576f-1063-4e41-909f-e565ae72d301","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:38.864Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:34.780Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2cc8dd0e-bcf1-441d-8b82-57cdbeaaad2d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"28a74321-7e5b-43f7-a5e1-3c64f9fad92c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:34.780Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:36.827Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8f0d18c1-a3bd-4c65-a0ad-b217a39303c9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"df210b34-9b6f-465b-86b7-ecb0089aee26","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:36.827Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:40.895Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9b91ff83-5c0a-44dc-a9da-9ffffe6ab73e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"21d7f92e-0957-46e0-a95c-d9daf3701c91","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:40.895Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:06.320Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d221e63d-33ed-4f56-84b1-aa8b91990ccc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0ecdcd4c-9a5d-4143-9ed6-87780d78655a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:06.320Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:08.553Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"850d6971-751e-45a0-bd25-19c9733a98ee","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d81e5185-486a-49ab-910f-cbb5a6c7a281","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:08.553Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:10.457Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d5268e30-2d69-48e9-948f-0e17c7a8d127","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d7ffe166-a6d5-436a-b879-dbee0e64f2ae","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:10.457Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:12.484Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7a24c356-0e91-4a98-814c-902860a43b9f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"465cf26a-4bcd-459e-bf8b-efad9c6ab0d0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:12.484Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:14.532Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"416b4418-7825-4984-9323-9a989a7842d3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"38484998-a9d3-4df0-b74d-efc1712fede1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:14.532Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:18.616Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"56fa7783-2e41-419a-a829-bc7dbaa0a82e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"414e2b75-c6cf-4181-a317-7166b7765514","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:18.616Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:20.909Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"857e0aee-48c2-4906-b91c-7a1d0d0ef7c6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6abc0289-1906-4be1-ad3a-70912fff70d0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:20.909Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:22.704Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9049c5c5-6f21-4f13-b2b4-86ca516e769e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"749014cd-2d4f-40f2-8d98-309915594ab8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:22.704Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:16.575Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5e131fcf-f9a6-41d2-92ee-8c8fa9192635","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2faad246-f52d-45b0-b68f-ddf1056a534e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:16.575Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:51.276Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8829182e-f501-4ead-ac5b-e0412028af31","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"439f03e8-db66-437e-a5e2-995f3dfc824b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:51.276Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:49.235Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"048dd965-402c-47e9-a4bd-c1f937a990c4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f6eaaa68-69ad-4f70-a3d7-4ac06ab8d9ee","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:49.235Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:43.107Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e6baa827-2330-4d75-8aea-db0a041bae76","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d15f4622-bd6f-42b8-9b94-39052bdc1393","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:43.107Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:45.196Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"da351a6e-a704-45ff-acbd-e99b7093b74b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a7aa170f-5dd9-4eaf-b504-52267a53dfa8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:45.196Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:47.194Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6100507a-49d9-42e7-8e5f-af530fafedf9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"022fbedd-355b-4e61-b629-c24904ebe916","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:47.194Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:59.461Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6a58a6ca-69e3-4899-80b1-eb14a5ee85be","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d1330d70-80b3-4915-b639-f64503c14136","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:59.461Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:53.309Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ce293f01-1103-44a9-88fe-8aaa4fd93dd4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f4deb6ef-1e09-4238-92a3-6b6e7cfd2917","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:53.309Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:57.389Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0b3fb379-168f-4f92-956a-5b0305e9852b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"132ce402-da19-48f0-bd48-63909611b85a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:57.389Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:55.358Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9cd356b8-66a4-4150-8c73-64176cf2b2f8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ed7c7ebd-5f2a-411d-90f5-e56eae3d91be","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:55.358Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:30.104Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"270ff261-aa23-42b6-8ffa-e9627dc61fdb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d6b3bcf5-2d10-43b5-b52e-8cad4ad5b01f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:30.104Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:21.192Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1a0840a2-206f-4521-a0be-8d7b5e378188","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"95069f31-9a9f-42e5-8013-cc00a11e5bd0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:21.192Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:23.888Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3001ccfd-cd3b-4903-987a-87cd739fa530","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"93b3840a-8a45-40f7-afad-80ebb9497988","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:23.888Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:25.921Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3caf530b-06b0-435a-9132-6f3ecf2b5a12","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ded6a48a-f4d8-43c5-831b-31dc6fb0a448","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:25.921Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:27.950Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"288724ed-db15-4301-88a8-01ae7b51982c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"de49f5f5-a78a-4ecd-86a5-97d009f2edfa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:27.950Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:39.129Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b21b6a4f-b1ac-49f7-898a-46403d854fdb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ad740170-172c-4c07-bc7e-67096aaa051d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:39.129Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:33.048Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b11b4c2b-abe2-42dd-aaa3-9e6f008e0a4b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ac242851-4185-4882-8fb0-8344d7556d68","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:33.048Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:36.368Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"54cc51d9-d08a-452c-8934-18cf98cba354","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9f89b70c-f0fe-4254-94b8-dbaa84b6cfb4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:36.368Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:41.164Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"05142691-4172-4905-bcf1-21c5f255a553","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a86e1f88-166f-46e6-b8b2-5e070985b4df","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:41.164Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:03.711Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1be45957-e2fb-475e-863d-7c85d8a3c61d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8a1da3d8-225b-4715-8ed7-ae440ad32360","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:03.711Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:07.766Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"79aef297-7599-4183-8b17-7c3d43a77f52","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a289b134-ca43-42ba-8feb-c41d827bb147","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:07.766Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:09.803Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"855f83a3-4e14-47bb-959f-f314d8266af5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"45876601-f20b-40f8-8337-a2b4be6f331f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:09.803Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:01.649Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c46f1f51-f227-4134-9624-683db2fc351a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5404a1d5-d068-4cfc-8944-d8fc0284b870","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:01.649Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:06.025Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3e70cf67-9750-4090-9ca0-0dcbb61412f9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"424683ab-0f73-4a45-81a7-85cc48e88f58","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:06.025Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:13.888Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2e1cb100-6502-4af9-a9cc-59ce7e050a09","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"39b2b66d-2284-4cf5-b019-bb846bdd3108","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:13.888Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:17.959Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"393c0bbc-9d2b-4eeb-835d-ce89dbaa6cdf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4c9f9f46-d105-434a-81e1-e2da250fc43c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:17.959Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:11.840Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"47d62860-43d3-49fe-b7f7-c64e388164d3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9410a62a-73e2-4530-842f-174d2d553602","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:11.840Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:15.927Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e06e655c-a83b-447a-b1f7-acf0edaa8350","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9a3ed3ff-11e9-4c0b-8c9b-331532dd4614","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:15.927Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:38.499Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"67db1f72-eb93-4105-b25b-e465707c9b79","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"de57ff4a-7aef-4441-aec5-4aecf673d521","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:38.499Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:40.542Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bd56cc52-245c-4d89-806a-be2905b06ac3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aa64cb9f-9ce9-410e-9a72-dc4277e00e58","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:40.542Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:44.651Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e0e21d37-b458-4f2c-9517-bf7f4737ff38","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b5ce6812-9473-4949-b428-7714a21f01f7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:44.651Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:46.668Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3ba9d0c3-cd89-4e1b-ab65-1ba4bf5b4050","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"62612e57-b4f6-4db5-a31a-cd841dec42bf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:46.668Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:42.578Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b43e7561-3f4e-4a4d-8ccd-b9c921e7e44f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3d2bf332-7da3-4a10-9529-760b14bd7510","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:42.578Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:48.709Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0cea82f0-60e4-47d9-8487-7e8ce0380ba2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a07351f7-4916-473c-ba35-27e31ecde23f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:48.709Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:50.756Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"af96c906-9922-46cc-85ba-07631cba967e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e56a6afd-c5b2-4d01-a3a3-4f7c736ec88d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:50.756Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:52.789Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5a64fba2-2b5f-422d-a8f0-efa1caf12794","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2408d6b2-77e5-4785-a9ac-a20a8bd0bb00","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:52.789Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:54.819Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"80c6816a-0127-4cc3-a610-1204880afdbd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ae8b6aaf-912b-4f1e-ab7c-1690125de0d3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:54.819Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:18.291Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"662b5cd9-c5af-4a08-a16f-9dafc299e4a5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5b65bcff-0b89-4510-a167-361c1660587a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:18.291Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:20.331Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"60c978be-e5d5-4b6d-b6d1-6257f225efdb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fdacbc70-8e43-40b0-a0a7-496e3e894bb1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:20.331Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:22.460Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"86016627-d066-4130-bbc8-bfb8f94f257b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bb259085-f9a8-494c-a96a-b025ee060d88","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:22.460Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:24.499Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8032689f-f9a3-4256-9a70-2bd8ac7f701e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1bcba52c-efe6-4d61-8601-3a0a6f7e078d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:24.499Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:26.535Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d751de28-73c7-46f3-894e-91cb9471ad94","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"59da508b-2684-4fb6-93ec-6a86eda66732","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:26.535Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:28.565Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"09f45ba8-b200-4d75-844b-18626987b50c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5d81b6f6-4ebf-43f6-aa36-91761fc83d12","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:28.565Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:30.632Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6897d58f-1127-4dc1-8c07-b88be3a7d365","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7ae1f379-0812-4436-b64a-72cabb77f60d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:30.632Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:33.112Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1b1191ae-5445-4b46-ab61-ab886ec070a2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d572c7a8-607b-4eaf-ba97-02cf0a5650bf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:33.112Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:34.748Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e9d9dd10-959d-4108-954c-92c4a3539a29","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fdc21e27-ce85-4871-888d-ad082191d5e4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:34.748Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:59.260Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"683244ae-a3b7-43e4-be3d-d45d7f8771f8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"76c53a2c-b09d-4916-b996-d3d3990b25aa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:59.260Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:55.281Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e67d4198-09d4-4aa0-83e4-91bf4cafc4dd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"17d8ef9e-5de1-4760-9997-faa71a02f033","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:55.281Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:01.299Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8940324a-38a5-420c-8c26-f1683b538be3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cdd37c6d-5bab-48d8-b4f6-dc7e0f72410a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:01.299Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:03.342Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fbd3c135-81cc-44d0-ba30-3ae5c600bd5e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1e39050c-c56f-4309-ac2b-56309e5d56b8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:03.342Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:57.224Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5770a2db-18d5-4acc-9ff8-5becb5ea07a1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cab215d5-ee4f-445f-8f45-1adc5aa60506","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:57.224Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:07.495Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"29151f13-ccf8-4f48-8ece-28fea1632330","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"068105fa-5f77-430e-8d0d-3bb33a5e7a01","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:07.495Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:05.369Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a962e46c-36bb-4e88-a4e7-c6723044a537","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bd30d5cc-f444-4cdb-8604-a698f681353e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:05.369Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:09.502Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"86321223-b94c-4b4d-9bc5-22ad5f5ab6f3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a918a369-3edc-4181-a1e0-aa31ca8f78dc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:09.502Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:11.534Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b8afe913-7aa4-46ce-9852-2f3ce21d6354","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"68781505-77a6-4e66-9f2c-61a304891184","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:11.534Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:41.068Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"71652f4f-fe05-4bcf-8616-dc17c5c78197","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dd97eeb2-8633-4dee-888b-8bf27d87961f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:41.069Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:36.979Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0c4763d4-8240-4274-bb31-2ad3e0fb9c20","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8eacbad8-3ae5-4c48-a66c-46f0ba57a8b3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:36.979Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:39.043Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a1f266e1-8c20-42a5-9237-1add8f2c3531","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"94b7d046-69c6-4631-a4f3-a2ff4a1096e0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:39.043Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:43.097Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b69d846b-a223-4ec2-baaa-2d078563402b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d05e5074-00be-4589-954e-00ff348842a2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:43.097Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:45.135Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8ae639c6-dbb1-49b2-87d9-ae9314a99889","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e6231656-13ca-436d-bbcb-6c8f95dea376","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:45.135Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:49.233Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f498b7dd-4296-4bf2-a477-3dddbaa8c01a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6454748a-568a-4d72-b584-97cfec595c0c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:49.233Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:47.180Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e9379068-71fb-4569-a261-836bc0adf29d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2d3a06f9-9821-49a9-ba5f-14df7512d50d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:47.180Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:51.265Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cc3dc3f2-0385-48f2-bdbc-bb23c31d64dc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c9c45423-5884-4d07-b419-77f4fdb89cb3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:51.265Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:53.300Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"844e3f02-fbbf-4ec3-9838-e6f4ff938559","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d4be5e0f-f02c-49a7-80e7-78617da7ee36","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:53.300Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:19.825Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0951fab6-9611-46d1-b8ad-8dffe018c146","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cd4661fd-aa0f-4ac8-80eb-2d0f34b8fcec","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:19.825Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:13.719Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4a4231d7-b21a-4c38-939b-c8f5b55963ec","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"421e5857-cecb-4adb-a288-9ca47691e405","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:13.719Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:21.882Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"db2d2a29-b2d1-4893-846b-9c4783ac5b4c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"df23cd36-a8ea-4b0f-af84-22f2122f83bf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:21.882Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:15.761Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1b9186b2-8718-4735-b183-8976c488769d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3b6f921a-6ebf-4a00-ab97-70b50d376403","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:15.761Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:17.800Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2da33d3e-25cf-4d4a-a187-a83698297da4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b2420e6f-6e67-49db-b1c3-ca3afc411d0d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:17.800Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:30.013Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b9a306b9-c4f6-4339-8343-2dc5de766722","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0bf379c9-a74f-4e6e-88cc-c0118a578fdc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:30.013Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:24.294Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"23dbd769-d708-48b0-8aed-f14b58450ce0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e39eeac1-3f76-4e47-ba3a-8869ffca9c29","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:24.294Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:27.330Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e6a5a5e0-c695-44e3-9482-4f4191b62b05","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"991e6ad4-0738-46d7-81f9-b39d76210c0d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:27.330Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:32.055Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ed391e52-03f6-44e5-9ca1-456f8dc5d7d5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b6070497-dcd7-414f-8263-637e44f9de8a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:32.055Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:59.505Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6cef990c-b6f2-476b-aa91-d5a1657ba413","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"96c938e1-346f-4752-83da-dbefb5585872","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:59.505Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:01.544Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"dc66d225-2b55-4683-9115-84c1cea0f550","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"02259005-854d-4456-9a8a-8d964ababcd1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:01.544Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:56.466Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"06f3a608-1e1d-4a64-bfc7-5c6b3905f9de","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6af0234f-389e-4cbc-b54e-a6408b5ecf88","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:56.466Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:03.572Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"582d56e2-620a-48b8-ae21-75e87670dcba","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1331b1b5-3cab-4e32-9a55-3f8e1b3bdf99","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:03.572Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:05.607Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"28413b99-351b-431a-ada0-2581d34bff78","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e789fb1f-6efd-4b19-b4c5-15c10ad39241","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:05.607Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:09.707Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ea5d11fd-3462-4712-90b7-1b1adcfe3c31","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"36d7be8b-b030-4e4f-b6c2-63357f495245","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:09.707Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:07.664Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5a508da3-326d-482f-8611-0c12a5f5d9c1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b179c1fe-1b5c-445c-a1c4-6ec161c4daa7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:07.664Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:11.747Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c06b2750-51f7-4ddd-aade-b52284990b1f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"07a48efc-3b05-4c1a-bf97-19e95b6c273a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:11.747Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:13.779Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e50131e2-c856-4e61-a65f-0f4237d12966","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dd260265-9fdd-4b06-8cb9-bdb495f721f6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:13.779Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:34.186Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5b57483c-a204-4837-a728-cda46bc810d1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ba968b76-996a-4d0c-9812-c2761408ced8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:34.186Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:38.260Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"53cd657e-cc72-493d-950b-04b99eb346a1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9839e05a-f9ec-425a-99ad-8b4a82a2a0e1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:38.260Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:40.296Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9fb7de99-a5f1-40df-b84c-1dc3a77f1064","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3997d2cd-687f-4b68-b5f7-d54531dd1429","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:40.296Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:42.369Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e7f96d4b-2c01-4cac-803d-e88ef26a4d45","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dfda3dd7-31fa-4617-a3e3-487c231b5064","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:42.369Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:36.222Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bd037557-a03b-4cca-a462-2a78fbb79012","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cb99234e-afda-4e3e-8d2d-a08f1d8bc8c0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:36.222Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:44.367Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"960ad56d-9ad9-4453-bbca-ee1a617e203d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f00c210f-40be-42a1-9006-7fc05c1831c6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:44.367Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:46.523Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b81a5095-4c39-41e5-bbbe-2627fe563e64","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1ec73544-ab75-4413-83c5-56be6692b5bd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:46.523Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:48.556Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ae92ef71-70a9-4aa8-86af-97e2f25d3904","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"562cab56-95b5-443b-9dce-8e2b5110b419","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:48.556Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:50.589Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3fca2d7d-5354-46a2-a76a-0fb42c179b58","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"891332c8-334e-4963-90ef-b3b15f9645f6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:50.589Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:19.156Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a34a7a9e-137b-474a-9ee1-cc681b377d88","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b2e5d967-396f-4aae-a339-f5ae71813649","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:19.156Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:10.984Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5fffba00-4e7c-4acd-9bb7-52f36d02b612","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e99c6043-644c-442f-9374-600ad522cd5a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:10.984Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:13.047Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c7add9c2-04f0-4c68-8c7c-631facbdabe9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6579a3f1-5245-4285-8bfc-efbd5afc09f9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:13.047Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:16.106Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"06373af7-3a0a-4bb7-886e-786d57d83bad","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"781fff43-f6ef-4d87-aca0-badcdb31bd3a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:16.106Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:22.257Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5f11ad52-8321-4561-adae-5063ae406058","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0fe6de2a-fcee-4569-a67a-231c3545f571","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:22.257Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:30.389Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e6462fd7-c791-43f4-8e34-dd4da2697341","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"431a1e4f-8847-4bc6-a515-803deb1076c5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:30.389Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:28.355Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6576fe10-b93c-4878-8c9b-3567e556277a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"00d885b5-6c0e-4563-bbf8-2629d0102d40","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:28.355Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:24.618Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"40d2f57d-efdf-4302-8cbe-3d42289bd3a7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"beff5d4b-719d-4f67-93e7-e84c9b09b14f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:24.618Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:26.315Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c38fb441-bf7f-4c03-95a4-b7844e1d0c9b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"71f8b8a8-8b79-4004-9f54-2e9e468c39aa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:26.315Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:57.029Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b12152d2-58e0-4162-8168-396b8ccc1ded","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7be025a7-563f-4c16-bf40-a2c43db032e1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:57.029Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:59.060Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c9d0bb36-1ebb-4ef9-9c96-83cf2c35901b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"01a586fc-895d-4ca4-ad98-e38b71309b1a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:59.060Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:50.787Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b0709edc-a100-4e75-8cb6-1ad426885a88","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"edf5519c-0032-40e9-81a8-22e37d3a138a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:50.787Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:52.955Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"804cedd6-74d6-408c-a4f7-df15dff9a5e9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"97d6c5ca-897b-49a9-b551-6e56514a6659","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:52.955Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:54.983Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"42ea9e67-0006-4357-8ff8-d42553660362","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e3f67ed5-b070-4e4d-a6cc-84271f828d67","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:54.983Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:01.100Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a69c61c2-de21-44fe-9dd1-203238d725c0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f9c09c1d-e3e5-4395-ac0b-b496893bdd37","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:01.100Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:03.143Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"31a4e753-3dd4-40fd-9e91-648edecb7997","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ff59ed9a-e033-437b-95ae-4c87a69644e3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:03.143Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:05.184Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"76a7483c-099f-451c-a4b3-5ec543e58acb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ab023606-b48e-4522-ada2-7b493f871b23","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:05.184Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:07.254Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"abca349b-355c-434c-9c47-6e0812d6675e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"637c3114-baac-41ba-98f2-f26d70318199","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:07.254Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:38.743Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"45aebb13-53b4-4cac-98e2-b63d23513dbe","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"20806d42-92e2-4249-94c1-afd2e9455ff6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:38.743Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:35.705Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"615a3326-da0e-411b-9a41-31286b280055","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f9cc1c17-ea88-4ad9-a207-da451259ab48","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:35.705Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:33.668Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5571ac8a-6128-4000-82c5-bc44b4f0fb72","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7c9e4273-eb48-4ad3-9075-5027aaf24d2b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:33.668Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:41.778Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7bdcc680-ceef-4f3e-a7a1-929ce74dbef0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a1291571-a1ea-4818-b81b-8204b0e9c263","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:41.778Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:31.004Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8e4c756c-e10f-4855-a5b9-8b3785a30882","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3e6624bb-af27-4419-a9d8-39e992ac5992","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:31.004Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:48.926Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b6b83b35-b75b-4bed-b945-7316227fdf30","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f4fd4ce8-5973-4163-90d7-78ce01db64b0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:48.926Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:44.820Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3c7fb806-012b-4914-b086-e9528aa65a06","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e31a46cd-28c6-4c83-869e-ff1dad8563c9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:44.820Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:46.900Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ce97b252-5619-4f7e-a703-2482b796abff","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5d578624-6481-4d04-a43b-1429fc6a1eba","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:46.900Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:50.957Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f6fadd2e-5de1-4847-932d-5d773a6c916e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ece2abe4-ea1a-4cf5-b5fd-e1e8c7380518","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:50.957Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:19.525Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8d9ced1d-764a-454a-993d-c3ec69be6072","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6b8f90eb-5bb2-4936-8d73-08cc5df733e4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:19.525Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:15.443Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ccf67fd3-72d4-41d8-a56a-42998b7a7011","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a3b70355-011b-44ec-bf3f-e26e10c54606","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:15.443Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:17.474Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fea126d5-8cdd-4302-92dc-9b898e444c75","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9ff024af-1592-4d78-b0e7-424452c60905","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:17.474Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:11.345Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"55f4002b-e6de-484b-bcd9-11569b5c3e46","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e0859608-63c7-4acf-bf06-5f99bb73fc21","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:11.345Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:13.412Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fb04377a-51c4-40fd-bb31-bedc3f3c2dec","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"32e89a7d-70f4-46c6-a2a1-6da95ae2fb6b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:13.412Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:24.644Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d1282085-27d0-4aa5-a93f-bed13ce11753","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9fada264-28d7-412f-ac1f-7fa33c6ceceb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:24.644Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:22.215Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7239ec9a-f975-45f5-98d6-e0624e7966ec","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ec8cea8e-8ec1-4a2a-997c-48b21eee622d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:22.215Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:26.677Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7d13a165-585e-4740-a00c-a4fbe03844eb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"284ad8a1-d3fa-4171-affb-1ece10f48301","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:26.677Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:28.711Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8b39a367-fd6f-4340-abec-c9f73debd19a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0431bbc7-f046-430b-9604-c3072bbadaba","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:28.711Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:59.536Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b71631ea-29dd-467c-80b7-61f04c087b66","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"86c7c9bf-65b1-4a08-8598-659ac4ee7d12","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:59.536Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:53.264Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0aaf41fe-f504-49aa-aa41-625e1c38bc5b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"37bd706f-aa4a-478f-8992-7235edb13eed","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:53.264Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:56.298Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c438fedd-d8a4-40b3-800c-d1b58f7f6994","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"39bae4be-1736-4ab4-a303-aac7ae5f608b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:56.298Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:49.176Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7e097a29-9d3e-4e0b-a434-e9b242033b42","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ffb5eeaa-50ad-4ae0-a694-59e5cb153882","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:49.176Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:51.228Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c4cb7eaa-e5c3-490f-98eb-5ace3073d193","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8377091b-2220-427a-8bd3-27d120596ac5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:51.228Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:01.539Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4477661f-a435-4352-b3aa-c9842bbfe96d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"18c5dad5-c3ac-4e2c-93e3-5dea44d1c1a2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:01.539Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:05.621Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"415dc2f8-d97a-4b72-9084-4431b7b1838b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1c636be8-6a0c-4ea3-af82-ba9d63c14f00","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:05.621Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:07.657Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"97c95623-4333-4c17-8dc6-2b33f79995b1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a74cd765-79ef-4123-b28a-55ecc15738f9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:07.657Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:03.974Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4f259e17-46bd-4850-be3f-8209ce5e1292","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bbf6473e-f422-4c88-a516-5081e431fcad","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:03.974Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:36.322Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a9ecad2b-f497-403e-9a54-9fd86ca2a476","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"73220362-0f45-4201-9e54-029a47597f05","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:36.322Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:28.157Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"993ecbcf-3497-4dc2-8e40-8da3c2db0547","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0676bdb6-046e-4670-9555-7c3394728356","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:28.157Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:30.208Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"60914ff8-cb68-4162-8533-32cb9699c516","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8de5a1cf-e28c-4a3b-abe6-de6ebc429268","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:30.208Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:32.257Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6bb95c2e-158a-45bf-9b0d-3aa949b1d92d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"eb40feb6-3d62-40f0-8048-061eda922a8a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:32.257Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:34.288Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e1812d55-fc18-42f8-81eb-38426ac3436e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5ef60c29-f271-457b-b01e-d486e935e06f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:34.288Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:44.467Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bea912f9-c791-4baa-8500-f6d6e19d7732","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"87c78485-2ba0-420d-abee-ea94d10ff50f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:44.467Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:38.355Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"450b1d6f-8c87-4553-a7ee-640ea082066c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"11dc7230-a758-4248-8b17-b005d661abdb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:38.355Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:40.400Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7d6cc454-dc32-4921-9ccd-744388576278","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f5473ec4-556d-4532-8cad-adaee1e3a9f6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:40.400Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:42.430Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c2b4b4ae-845a-46a6-8120-c9dd1baba40e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"26cd9c78-efa9-4e86-bf04-263e2d0a95c5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:42.430Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:18.088Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5b0f6290-7470-497b-aebc-2dbc73735855","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d04ae49d-7f0a-45cf-8961-85271232f041","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:18.088Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:11.981Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c2fca23f-06c5-443c-a481-1bdccd49b579","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9a4ea999-02b9-4012-807b-3b0d8556f0bc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:11.981Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:15.015Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cd3aae90-1a3c-47a4-90bc-9ea070b98175","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5b259e7c-a488-42a5-84a4-e5fe8385d5de","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:15.015Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:07.132Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e0e3e43e-0393-4cd3-813e-d52dde4ad540","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"164f2eef-2e13-4265-a2ac-f73827dd1784","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:07.132Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:09.951Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8ac0cd76-554a-4994-a972-133de5063274","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8303f51d-a78a-466b-b8c9-f5afad8d31e1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:09.951Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:29.266Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2fda3fd1-fba0-4045-bf37-9f5e52189408","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"db2ee9be-bbae-4f7d-88cd-51bc1d08bd59","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:29.266Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:21.125Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f6a31d57-f274-4a02-b4d1-3b651cfc2776","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c12ded75-f6e8-4ba0-95c7-4b90e4a3a807","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:21.125Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:27.237Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a6fd6720-7db7-4ccf-9248-31377e13bd48","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4e5795f0-9fd1-4a15-88b9-5ef46deca59d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:27.237Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:24.200Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7937a0c0-f6b4-4ce6-92d8-e98be640afc9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d1e1668a-7f27-42d6-99df-96721134e008","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:24.200Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:49.644Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8109dcb0-ae09-4cad-a77b-fad692ff82ee","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e9aedc17-bd2a-4776-8415-fda73ad192f6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:49.644Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:51.690Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ef531601-e879-47c5-a26a-8c5b4e9b0b63","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"86416911-7791-4254-b88a-bb82ec8f0e03","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:51.690Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:53.728Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d449974d-ac65-4c3a-8c86-2f63a9c8b53c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cbef9c6d-c025-48f5-b710-b601423eb074","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:53.728Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:55.761Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0a1ae091-bb3f-4c79-8519-53c376fe2c01","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8450ff1c-61c7-47b4-afaf-2d043ae70b9b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:55.761Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:57.934Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2f5b8137-efc8-4b2d-b8db-83482c8517c0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f16b2b0d-131a-4619-b399-814576d8deaa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:57.934Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:59.827Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f86d95ce-fbff-4d30-b17f-40492a58a9c6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"19a7829c-a934-4ec5-b32e-02cbf39f1e0b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:59.827Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:01.950Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"380c9836-d1ce-48d9-999d-61da7de6fe34","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"82576e20-d154-43eb-9f39-982ed734e002","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:01.950Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:06.020Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"aa7f4631-8c44-4260-b2cd-07371f6c0b5e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b90c8ff8-ab60-491c-9dc5-4a894dd8e931","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:06.020Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:04.141Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5ecbd919-b024-455c-bada-ff1b7528bde1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3ba7d33b-f963-4df8-a1d7-ab2a98894a4f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:04.141Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:28.594Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2d08cbdb-6907-444f-937e-62fb4c001616","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f03aa374-1fff-497a-82d2-4e5b35ec264d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:28.594Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:34.698Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"674e3d3d-bd26-4036-b94c-a1c5155a5c19","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f3ad2ff3-f151-416e-8aec-f34f5aadb242","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:34.698Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:26.541Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e2038344-f3ee-4b9f-bef7-1eedadeb20a0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dfea41ea-789f-481d-8a2f-fa8290f28883","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:26.541Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:30.632Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"139fdf63-e5dc-442d-a4fe-450e1043eadf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c2b6de78-b144-4982-a033-68bef60af599","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:30.632Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:32.664Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1b8065c9-34a5-42cd-9f5c-d5412097faaf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"96cfcb95-00e5-4203-a7f0-a1cf80200a35","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:32.664Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:39.823Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"982a7ba8-989c-4721-a4fd-63a5331f934f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"83815401-0993-4d72-a08b-b12c08fdb1ed","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:39.823Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:36.780Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8d7d654d-9cac-49fa-aabc-92b6ca10970c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5343a833-dca3-461e-bfb7-26b6f67a9f12","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:36.780Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:46.084Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3401d748-4d2c-4fed-a49f-618043ccd608","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"28e3da0a-d6c5-4ada-8df3-ed09d9e5cf74","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:46.084Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:43.052Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7b5d2c53-0163-4e0e-a0d7-c4cafcc13162","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1173a893-e426-4fec-92e8-aa6e9c89b407","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:43.052Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:14.393Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f4d3cf44-e461-49b5-aa9b-b3deed2985d9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"76ddf26b-69ef-42c1-a309-209af2389f70","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:14.393Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:20.555Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"80cf91f1-5c81-48f1-be2d-392c513bb9a2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bc7ca0e8-1aa1-4d49-abe8-5926ff1b03a4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:20.555Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:12.322Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4be326fe-268c-4f55-a9e5-f8701ef4215d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aa8a066f-f037-496b-9a04-fa1d51ab0b1b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:12.322Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:16.476Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"77b59c3d-0690-4d1f-855a-e86cbc517080","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7b82a6f4-83db-49a5-ab64-77d922dcdad8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:16.476Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:18.509Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3a4f2038-7952-4d79-8d9b-857474c1b838","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"59daaf3e-1548-40b7-b759-3a31a5b6f30a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:18.509Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:22.608Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4d2924d8-2b61-4167-a5ac-3a5151f2bb95","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f7ea4e9f-fe7b-4fbe-af0a-0e5d766dc1cb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:22.608Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:26.686Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f1e6aaa9-14be-49a3-a1c9-f403dd0868cf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1a51faf5-7ff7-4ac8-bfbf-e74f4749e89d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:26.686Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:28.721Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d0805891-042b-48f7-8698-966e4412b2db","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"73a52e98-3a05-48c5-9485-701ad4ed4c42","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:28.721Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:24.651Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0db1b357-c5a3-4ac0-a696-ba9d4abd67c8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f3a5ac65-1e0d-419a-8690-a22cc13b1759","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:24.651Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:51.360Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"72ecf5f9-ae97-47ce-bdc0-5eb476a409d6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e2bd298e-a489-4bee-855c-bdbd7c248d72","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:51.360Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:49.291Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c69254cd-8879-40ae-9edf-ccd5300ea650","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"51a98108-08dc-40c3-b57c-63bde30d58a0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:49.291Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:53.393Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0fc0ce49-c4e3-42bb-bef2-6af6a94972d2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4bf9bb91-31a4-4893-b2f4-9c6f6c3d90d4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:53.393Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:55.423Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d0b7b30f-a85a-4036-92ab-6058b881b392","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f0ea780b-2ecc-4679-b452-badf38778c8d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:55.423Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:57.453Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2ae1a045-59b1-4314-bc32-6775d69d5505","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a004507c-056f-46f5-92fc-027ba4569558","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:57.453Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:59.599Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"95f4d059-f390-4b75-93e3-e61dcdaf3efc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b4bf037d-3ac9-4e25-b518-1fbbba6c4481","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:59.599Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:02.722Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4ac83641-a95f-456f-b806-5b64a7e6d50c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7b936950-b332-4401-986a-6d4588657a6c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:02.722Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:07.792Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fa95b74e-14a0-43c5-90f1-bfd191604068","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"38169831-3195-4f11-b453-2bc66515b5d0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:07.792Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:05.754Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3d1bd060-be15-4950-9c5a-465c31286cdc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"391ece83-b24b-408b-8e7a-a1963dbfdc63","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:05.754Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:28.520Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1d390304-75ba-4e54-ad69-5e911c3f5003","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7da6959a-54a0-4d2d-a200-e54c9a618703","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:28.520Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:32.291Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cf6055d5-a7ed-4919-ba00-c4ede95a187a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3cc337d8-e8ad-48fe-a4b5-1df019cedde6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:32.291Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:34.761Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"04fcc6a3-7664-4324-8116-7824dff3181a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0d561e61-ae13-4135-897d-c0f497c997cd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:34.761Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:36.367Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fc68ded4-deb6-4596-87de-fbee1733ad5a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"af03dec4-ef7c-40c5-9b4f-3f3e907cc9a5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:36.367Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:30.258Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"35423720-3009-4f2c-9020-fd1874d9362e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aecb8d58-93f0-4098-91cf-9b015caf9e8e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:30.258Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:44.711Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e736ed26-9ade-4878-9733-1313936f839e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c44a42ab-19ee-4042-8443-9a79a8144d4e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:44.711Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:38.404Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"085065de-f27d-4652-bb02-29175fec655d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"588d667e-095e-4186-8aa8-c82fef598e98","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:38.404Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:40.516Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f1141392-d904-4f20-8492-f8703ed57bb3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ab06a271-e49e-4694-9b30-9b45008618a1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:40.516Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:42.483Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e288b4de-7b02-4269-9792-c17796bb712c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e7844288-1afc-455d-bd39-3758d05aa39a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:42.483Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:04.943Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e1c31372-b3e1-4231-85e3-c055e44b9302","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"19503abf-2389-463d-b7fe-b7beb4a084b9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:04.943Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:13.094Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"438d1ebd-7656-417b-9c97-a02e075015e3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a8a06bcf-e2c3-4353-8aa0-ee3024450641","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:13.094Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:06.987Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a9366660-5e64-4afd-a55d-3f6de6560092","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0edde527-8f00-4102-b35c-a9211344634c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:06.987Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:11.062Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"448ea006-024c-45c9-b61b-fb8edeb7caa7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8beb3b6c-9ce6-40b5-a379-e15c92f4d1b3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:11.062Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:09.019Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ee19f377-a534-478a-8625-79795cfefdaf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1e1469c8-71aa-48eb-99de-06675527a7c9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:09.019Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:19.631Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"24e49124-f7b9-42e3-b907-d502b93d3e54","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4915ee62-a6fb-4475-9da9-69f5e3d958e8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:19.631Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:17.200Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ec8300ca-5ede-443a-84cf-9c16f5553d04","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5e132458-5a27-4c91-a6da-cc56d6541efe","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:17.200Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:15.138Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"aa72e810-bc07-4463-a085-9572ae49c3d8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aed103fb-5255-4101-a672-3cf6107f537d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:15.138Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:22.336Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"eddfc4e3-b746-4e09-aacb-54bb96d8795c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e955ef78-fb2e-4088-a4fc-4de10cc8b8ab","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:22.336Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:51.763Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1373e89b-60c9-444f-a8ea-69eba3bda153","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6841ea2f-49b6-455c-bec1-0978aca7ae0c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:51.763Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:54.803Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"453e7ac2-984c-4831-910a-1806400c0716","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2ce42641-6cea-442f-b85d-1a96c46fe3f4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:54.803Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:58.875Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"70f8490a-2024-489c-a9f9-739c055118f4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5a922fdd-4608-44da-8cf2-888f5d610f74","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:58.875Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:00.911Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7ab489cc-2129-4316-97e3-28d04a4d7f64","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ce4b953d-e89f-44b5-8d54-dc2260cf03ec","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:00.911Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:56.846Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"660b6a7b-63a8-43d9-8379-155bae399ed7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"366fc009-dd6e-4801-ad62-f182a0f73c47","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:56.846Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:02.946Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fff06ed9-1edc-4c2c-9a18-65221eefe5b6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"801cc6bd-f0f8-47bb-8af5-ff46a399c44c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:02.946Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:04.988Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8f9c18d3-7bb5-4a50-ad39-d45235ee0a18","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f971da60-2308-43f9-b22d-997e39d46790","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:04.988Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:09.057Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"81d522c0-15ca-4f54-a5e3-132e57010826","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2302f502-0357-47f0-b489-8f1914676ded","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:09.057Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:07.026Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"76a508e6-e307-4173-b023-ed7a48aba0e9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bfc5489d-4262-4272-8ca1-28aca404d0a7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:07.026Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:31.858Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fdbac28d-df3c-41cf-8f7d-1316fd20bc8e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0e015adc-5043-4d08-86de-8f80def1f642","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:31.858Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:34.857Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c5fa8e49-715f-4631-ab48-e0bbe4b5dc05","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2ccb6f51-db0b-4d78-b34b-64b4e8c9bc58","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:34.857Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:29.510Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6496e33a-a98a-4c7e-b5b5-8c475df96339","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"45773d32-30f5-42be-8136-3e9d9bbb1643","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:29.510Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:39.658Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0ee739cf-6de0-4b17-8497-cc9cae5a53bb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"03e0cd41-cf5d-4e40-b20e-9622c05bb482","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:39.658Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:37.625Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b0fa9c23-9dac-4351-9f6d-54dbd45ede1a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3b5f705e-5221-4854-a316-2563976495eb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:37.625Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:41.688Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8d06f887-c69f-459b-9a77-494ea8f4cb4e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c8c59113-cba2-45d8-b7db-85f892b90e30","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:41.688Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:43.916Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"619fa5d0-7c4b-4b8a-80fc-a2101f5eecd8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"194a1778-7aea-4a36-a925-c31879d1686f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:43.916Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:48.812Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9973cb36-261e-4b7b-be2d-2b05feb8326d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"18e082ca-73b4-4462-b59b-8ad68df7a76e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:48.812Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:46.772Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a18b6d9a-e2d5-4ddc-abef-b4480cb187e6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"09b3f790-e70a-4bc1-bd5e-626ca32cdd56","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:46.772Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:12.284Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e87203bd-1275-4925-8217-f2184b4cf6cc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"86e9c200-f263-4b12-8cdf-8157dd863137","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:12.284Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:14.334Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6a4b50a9-96a9-4877-8d4a-9a4ac2b950df","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7b56e309-9e94-4329-8a17-53da2a46f464","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:14.334Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:16.365Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8e2b7e1e-4aa6-4e22-9823-635e046c68d6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4998dbc8-9f8c-4924-a78c-94fab7293409","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:16.365Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:18.399Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"adf82ba2-9e67-423a-bbbe-280623f446ff","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e24edeed-8a70-49d7-b9bb-f11ec3f15e31","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:18.399Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:20.433Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"029b7a3c-bbb0-430a-abcd-d34c8be8648a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b1c642d7-bc52-42b9-a76e-7c70317c7d35","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:20.433Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:22.563Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2dce9d5d-ac02-48ae-8ae2-d762e2d268a8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"77421b87-74fa-43b0-8c78-d94aac7ddc91","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:22.563Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:26.600Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"733e13df-940b-4b0c-aaf8-1ec4eab2c3fe","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b08c38f5-28ec-47c7-8dcd-026ce171e1ba","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:26.600Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:24.527Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f7e4e76f-ae76-4190-8a4b-6ca41aab0938","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9d9100ae-7860-4d98-8cf0-9bd763738cc2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:24.527Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:28.686Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"30878b7e-9539-441d-9dec-9d6dafa0a682","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dcdd84d1-9e5d-40a9-be8b-7841e1a0c340","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:28.686Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:57.230Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"862467a6-e437-43ef-a734-911c8e41a9a8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b61778f7-7754-4fc1-9adf-7f3b01c6fb21","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:57.230Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:51.141Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"84d6dcb5-aa36-4ef6-822a-8755853ebf33","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fae07da1-e234-42d4-94fc-3f91cf73f6c3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:51.141Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:49.100Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c673e1f4-e023-49df-9f94-202d3ce01af9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ce6031a6-cf69-4be8-abd5-d806a688d7e5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:49.100Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:53.173Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d8048b4b-c1e9-4761-897a-393ddd269102","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"36da6b3a-9256-4eb9-a342-8175dcf014ca","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:53.173Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:55.197Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f15f1907-4df0-4544-990f-01f2896826c8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cfbfa30f-6456-446a-957c-a4548adac1ee","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:55.197Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:59.274Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1af9588d-0495-4602-9cf8-3cd7b83f061b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d1dd859a-5381-47da-92fd-fbec7bd1ade9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:59.274Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:03.481Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"837fb265-0d5e-4912-a467-a3c71d5ee1e5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"372e4329-4018-47d1-9138-b4f209dad398","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:03.481Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:01.317Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"192ea111-fbee-47d0-8076-950571448274","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a14d0754-a1fa-4a73-9291-46107a3da537","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:01.317Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:05.524Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1e8d551d-e941-4e7a-975f-3788615d2a88","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5d108c3b-9b36-4b23-91fb-2f901c22e3a5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:05.524Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:29.943Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"687e879c-20bf-4ced-ad3a-3fa728b65e7b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d8d2c1d4-ec0a-426c-8426-71f1e8b212ab","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:29.943Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:26.891Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"95e5a678-b410-467d-b109-49d1849f0512","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"170a5ac0-e0ac-4c1b-b74f-08debd0e1f5f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:26.891Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:32.979Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c69a5edf-5f37-4327-8742-69efe2803365","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c3477eee-e223-4107-ab13-e74008145877","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:32.979Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:36.011Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"064de47d-d830-44cd-a94c-f0997b6a12a9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"006352cf-5fe0-4e00-9e4c-f3ea39e47d85","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:36.011Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:38.050Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"038b80bc-be61-4489-936b-c056a07fc883","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e53c1b34-1df8-4cd1-a275-f612e1f47532","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:38.050Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:42.159Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"52af8fe2-fe30-4442-b1d9-c282facdd520","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"026dfb2d-9edb-4ccf-8e7b-daa7a2328eeb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:42.159Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:44.425Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ed9b54c7-2bf6-4881-8d8c-356b5e425f0a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d50aaa9f-a957-4972-b120-644c9338d6dd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:44.425Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:46.236Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a0e48abe-8331-4527-8a76-15340b7f90ba","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ce1776a4-88a4-4022-94cd-fec422e6fe82","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:46.236Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:40.086Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d99124c8-4bbf-4428-83fc-cdf3319156fc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e0985c20-ab59-4d00-b4f7-65cf0ce5cea8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:40.086Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:12.920Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7e825b84-997d-446b-a465-eaaec6f688a2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"64d56d57-5350-4564-982b-556a2a020abf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:12.920Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:10.887Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b26373d6-8bb0-416e-a37a-c34dc3ee2909","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"634537b3-4cc7-4108-bbd8-1288e1e6fe49","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:10.887Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:06.805Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8cbda4f9-8015-49e6-a8c0-f409072a9905","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9069b220-7c5c-45b4-acc2-86ad6e6e86a7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:06.805Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:08.853Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"070f795e-536e-4c57-bdd0-e79a70885300","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"def4eb6c-3d35-43f8-9054-9013564225e9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:08.853Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:14.963Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"157b4a19-cfad-4eef-806e-ba6fd7026056","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e0ffb00f-7cb4-4a8a-8e55-db08426f2b8a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:14.963Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:16.989Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"00130027-615e-461c-a574-adcc60750f8c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c677831c-15d1-4970-bb6f-1e27ec3c0e6c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:16.989Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:19.031Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cc82b928-5c00-4e3b-a194-5f921e556c55","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"045568f7-17d1-4536-aa2e-93c93d44dc3d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:19.031Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:21.066Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a8fb2761-bff9-408d-84b1-9fe8d210be73","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4f69bce6-14e8-433b-98f8-040e1161de11","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:21.066Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:23.102Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"851b2366-9866-422c-a485-99b836e57a36","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"55d13658-309e-4413-ab2b-954ccacab242","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:23.102Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:48.607Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e18a54e1-68b5-4381-8653-69f34c2c0580","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"97570133-a81c-439c-b99b-79cc17b91ac8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:48.607Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:54.743Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a2f278de-c4b1-4de2-9d28-e65587cec055","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d1b66033-2ae8-48a1-8226-1952ffb676b3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:54.743Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:51.650Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0b6354d6-69e4-464f-93a4-2eeb395522cf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1227c956-e0d1-454a-b2e8-a13ad8a22c7a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:51.650Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:44.532Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"235b2cd9-b17a-4178-9645-bc5bea14ff15","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2d79750d-1258-4b68-96e6-7e578a62306b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:44.532Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:46.575Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"db3fe787-aec4-4c3a-bcf1-f3eafaa6a0a0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"18543f96-e486-4418-bc83-23eb7227dff6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:46.575Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:59.926Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"12706f5d-0241-470d-be3f-9a9091c7e6c3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b26f8b79-b358-46d9-9e77-2db388573b34","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:59.926Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:57.881Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8561a752-7f7a-4210-a49d-e5a19972a185","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ed47595f-b7d2-4a89-b13f-5dc851fee07e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:57.881Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:01.962Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"64cd6225-7d91-45de-97ed-b59d87d71525","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"638ba7c9-f1b8-4ce2-9705-165b1cca4343","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:01.962Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:04.020Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7a876231-0619-4bf1-8f45-9326ddf7bd8f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"08b5e375-aa19-48da-aebd-93a94ce7a050","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:04.020Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:30.607Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3ad6d892-bbe5-40c8-81f3-1a24e1f77814","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5c70e743-9dee-43c7-a6cb-0aa6a953d5ee","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:30.607Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:33.081Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a3212747-8bf2-49e9-90e8-4545f2085122","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e0bccf3c-f957-4ec8-b060-6de720e20d2b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:33.081Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:24.457Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a2d12364-6755-4c2f-a9cf-dac375cd9dad","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bcbf15cb-f62f-4f8e-8b42-10dc3481540c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:24.457Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:26.888Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c7bc038a-8bf5-4439-a52d-f6371d735009","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d462f48c-7614-4e50-88a3-eb35af95201a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:26.888Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:28.538Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"08eef48a-79f3-48ec-8eaf-1226f908c9de","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d82b44a5-800e-4043-89f9-320a60b092b3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:28.538Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:39.804Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"42b6b184-ae68-4c89-9731-82e05ffa6c58","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f0691ab0-4e8c-4445-9b4d-5630b9fd47a1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:39.805Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:37.775Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"aa47615b-1ad6-4081-a0ec-b8d78ac96b25","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"576623bf-4417-496e-a64b-c5fe446a75f5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:37.775Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:35.870Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bf992b16-468f-47bd-a408-b57ee8b0e7d5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b41fa47e-4732-4416-9267-55cdd7c98e6f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:35.870Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:41.842Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9d68999c-a192-4dda-88ba-3cebb211e26e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c906d0b7-6619-417f-afc2-c98cbeefac44","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:41.842Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:10.371Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c3918b1f-602b-476f-8ff1-ccb562c1d824","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4100218c-a190-42c9-85f7-fa872db4e719","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:10.371Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:13.408Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f1566936-7769-4b22-9549-9c7a7319bd75","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"328d60c2-4d62-44d8-b8ef-9add069b141a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:13.408Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:16.441Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"db33fafc-c2ad-4ba2-9b83-347c7512fb0f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a4b9bb2f-5577-4aa2-ad5f-53e8fc6ce210","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:16.441Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:04.287Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"70a9b163-2dfe-4e2e-8231-27e08f0e452f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"def50f4a-8787-45ec-8e5f-a5cb3dbcf362","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:04.287Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:07.336Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"64524c0c-8c38-4283-8098-e3d1bfea8bc5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c2477f54-2892-4218-8e6f-d6576cc2b283","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:07.336Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:25.616Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"55ea4f95-b0d2-4b14-b60f-57b337f2ac49","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"28f56d57-6cb3-4c19-ba75-be4a1e8a5c82","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:25.616Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:19.476Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"864dc8ec-a2e5-476e-98c4-3dca7f534d59","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4e53e31b-e7a4-4e0f-a443-65076c1ea6ce","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:19.476Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:23.586Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1a23ca7d-21d6-4dea-9fa7-be71256094f2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d1863343-9609-4edd-a8bf-cd1106427897","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:23.586Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:21.548Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"480c0a86-9a0f-46be-aaed-c36aff276098","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5c187787-3811-4b03-8f7a-2a32f6924d66","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:21.548Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:46.042Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e19aaed0-f96f-4b35-87d3-a5749d6dc74e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2aeb5ac9-56b4-4e91-ad04-ed5704c66994","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:46.042Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:48.093Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"12adbdf5-0271-4567-946e-9c02ef2f8cbe","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8086a238-d78a-4037-a2a2-dc6555ccf3f6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:48.093Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:50.122Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"eea7f745-89f8-4851-b478-d7f79ba61670","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8d77fbe4-02dd-409d-a37d-b7c440311507","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:50.122Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:52.154Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5c6901c9-2d52-4f67-af3d-1a00d720b130","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6624b009-c5dd-4099-b998-63db6b434af2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:52.154Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:54.280Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9311c3dd-7c79-4354-b777-8d38f157cab4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5bb97b6d-7fa3-4b01-a3b9-9b0573f865d5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:54.280Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:58.257Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"68f76734-bccc-43fe-92e6-49bc007ee983","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d5ec548e-f061-4aab-b927-39815ec7de34","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:58.257Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:56.221Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6557b52b-4d9c-4664-b965-ca333b9b9baf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d74c6daf-bbe9-4974-a7b6-b612b4c19634","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:56.221Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:00.287Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f742f09c-eecb-4171-938b-b97fdf670bea","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"34ee031f-32bf-4c86-a630-832c95e498a9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:00.287Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:02.332Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b563a631-93dc-4079-8e12-fe221c4800ea","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8386601c-dcfd-4c6f-8d7d-1c0516f7f852","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:02.332Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:50.205Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7c31dcf2-9f2e-4bc3-92ce-5a93713029b1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"58b475b2-59a1-43c1-9c3f-b21b5f2ee5b9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:50.205Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:44.083Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1a037197-9f19-4c1a-aae4-9323f0c1c63b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5fcbf69c-9b51-450a-a7b6-5592228d388b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:44.083Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:46.130Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c7a7d596-9f9e-46bd-9c0a-a1518cdc57d5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"913951f9-cf76-4799-970b-2f6378025bf9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:46.130Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:23:48.166Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"34c2147b-b428-47e3-8d66-e8c760456e65","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2e4d4a42-6c9e-4819-844b-17b043bcd1b9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:23:48.166Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:02.431Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"332005b9-ee05-4314-8a65-7b0125eb1e59","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"efb8ad6e-3837-4e8a-9455-ded81b6ba20d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:02.431Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:06.526Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7993eca9-af6d-4f62-9a7c-79a70811d020","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8718e5af-f728-4521-b4b2-0724e7a2ff49","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:06.526Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:04.480Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f6776ca9-849d-46f9-9313-73ed34faf142","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d0dbd196-8dc1-46be-a49c-05810aac01c6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:04.480Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:08.555Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4abe4fcb-9d6b-4ffd-966b-d9aa1c472384","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0ed49dc2-c40b-4f78-a2aa-3989941a7760","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:08.555Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:22.823Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ff7914ba-5a65-49d6-ad13-c3c0c0e89fc7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1e68752d-633d-46a4-9d7c-2ad7e71a4711","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:22.823Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:24.864Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"650fec9f-edf3-4201-8b42-066189d916d6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c8ffe56e-766c-408a-9be2-585f14db6073","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:24.864Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:20.778Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"91b0bd39-6564-4a4b-86fc-7c60fdb085d3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3c54534f-d245-4532-aae8-028fc7b17986","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:20.778Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:26.891Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2481a1f5-6aa0-4b9f-85ce-a6d732d747fd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2d70d2b1-1233-4299-afba-8507cc3ba664","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:26.891Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:39.116Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"94391687-e513-47de-b421-b1eb6aa3c00b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c8c899e0-3b48-4125-bda7-ef4fc63b098a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:39.116Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:41.162Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"97e992b3-019f-48b9-8451-e64c2e4b77dc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3924f467-911a-431d-853e-220583d4a141","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:41.162Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:43.192Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c2c62aff-d7cc-4a2b-b082-653b9620e809","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cdadd8f4-1cdf-4901-a79a-93925814072e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:43.192Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:24:45.221Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"97ba9a76-1fc1-4e97-9c4b-72e5e3cef4b9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"07e70094-6f56-4277-bdef-01c9586939aa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:24:45.221Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:06.653Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9ffb3595-0df0-4e11-bb75-db6d50c27cb4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"14ca1fcb-5016-434d-af96-c93eb97fdad5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:06.653Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:00.525Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f0357c9b-a90d-46dd-b387-07c2bdab2ec2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c3fb4677-0c9b-4556-bc30-f08f8245d5d1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:00.525Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:02.587Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d8b1fb5f-9327-4025-83a6-fd6720848cf3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e5479d3c-751f-4c7a-9329-0dc4689f8fee","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:02.587Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:04.622Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6f7b6b78-2076-45ce-bb41-84101dfdc528","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"38402a10-5146-4ebc-8815-a31ae8b3c506","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:04.622Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:22.978Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0c03070e-134b-4ba1-b038-f20222d7765a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f3ecd8f3-faf9-4b52-a29e-519a9d8afc05","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:22.978Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:18.898Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"869dbc6d-dbea-4f89-9fe7-011063790811","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c59038ff-08c0-48a7-ad48-e768313862a2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:18.898Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:20.945Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5e1cb2ef-53bb-43ca-a558-111722932289","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"07c7db93-a295-4ae7-af19-5d826bdb9f79","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:20.945Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:25.018Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d6b42f95-a99b-4242-830e-ec02989586bc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c25d149d-c6b9-4b1c-bcfb-5aa4d7e9f686","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:25.018Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:39.284Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e11b569a-3f55-4394-9715-cd74ebe4dfe4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"25ee811e-b180-4759-b355-21b141e32773","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:39.284Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:37.233Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d62e093a-ce4f-47ed-af98-9ec974dba462","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a26baad7-3bc9-43a5-9ab0-ba934e691b1f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:37.233Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:41.317Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f53da1e9-5138-412c-86d5-b6617dbd57e3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"06e7c6d4-9bb9-44b1-b076-0c604e8627ec","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:41.317Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:25:43.349Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"63aac503-436d-4818-905c-88bf648bced2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a1c20a4c-dd84-4325-b60a-a4e46b4a8897","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:25:43.349Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:09.871Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"095d4b5f-0910-4d32-8f28-fb62b3786164","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1c56451b-51ad-45d7-adf3-36f64465ce73","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:09.871Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:03.742Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"34b3930c-bfe6-4fb8-9e28-4fcc7429c69f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f35e9e74-1f31-421c-9767-618c2ae855dc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:03.742Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:11.899Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0a21a984-8a7f-422d-8a8b-11cbbbe460de","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e4ff9afc-05bb-4487-8817-b03214b77e8e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:11.899Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:05.799Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"874658d2-ba56-470e-97da-dc77c6a148b5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"40524b9a-90be-41ad-b948-97dc22848207","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:05.799Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:07.843Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f7ccc0c5-98c6-4215-a3b7-a7ea78d8cb09","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a1523da8-5f09-4dee-9967-ab221f25d375","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:07.843Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:13.936Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"67935140-5fb3-473c-864a-d0f43a1e0262","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bf98e78c-6a9a-42dc-83b7-dd85899910b7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:13.936Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:18.029Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"29f9ff4a-a5f0-4335-8d5c-51021bf47bf4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c3d2c312-51dc-4bf6-9d01-f8e604e7fe5f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:18.029Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:15.989Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"dd9287a9-417b-4f46-ba99-55b6addaf480","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3c8efa5e-3961-46ee-9816-8e8070a8ba13","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:15.989Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:21.076Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8b3788ea-52a0-47bb-b7fe-07af68bf9e06","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b9b52d8e-458e-4baf-a709-6005ddd937bb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:21.076Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:31.263Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b9782826-00af-40f4-95d6-58312c9bb7b0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"421d8b0b-41d4-4477-8933-bcdd5138d9b1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:31.263Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:24.125Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"01bcea4e-fb88-4599-91a0-7481aa48bb82","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"22d8e11c-0326-4969-bf11-d689660e762f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:24.125Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:29.222Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3a43cf06-8c97-4dce-b0e0-7a16673d9407","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b85ad3fd-fd63-4910-9a90-d782fd750f2a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:29.222Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:33.295Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d6693699-e314-46e9-831c-e1d9e20cdb5c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"72b49909-20c1-47e5-9a75-da6bcff22968","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:33.295Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:27.188Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"12ce27cf-7402-4b66-838f-51e19234b0e8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"52f9f138-df53-4355-bf4b-f73d8f442c35","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:27.188Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:35.345Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"44e3db25-2938-4416-9410-bd0f1f0a39cc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6adb03bb-2249-411a-b4bc-571be8f7ad65","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:35.345Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:39.434Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b3181728-6079-4724-96e3-a93086383d1a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"140a73a8-709e-430d-9477-5bf906ec0744","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:39.434Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:37.396Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ad40bd29-f116-4c64-912c-f8379c4868a2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3d4954cf-6bf7-46fa-bcdd-cdc85b656e97","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:37.396Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:26:41.462Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e94fc9ea-6592-4d80-9d17-6402ed9b54fc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"217a6bd7-10cd-4e91-bbab-3b30e19a6754","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:26:41.462Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:01.881Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4a42d251-6a36-4709-9b95-b4fc61b44bab","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f0b9934d-98cc-4974-a54d-bf3c33014a8d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:01.881Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:03.925Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1e178d6d-ecef-47b8-86d1-5ae8aa620fe4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5aa75183-6fd6-44b5-babb-19238e4654fc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:03.925Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:05.958Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"893e2128-ee5a-4c5d-b449-2d43bfbf458c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"664117d9-215a-4ca2-8b7d-8eb95f6291a1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:05.958Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:07.994Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"971bc87a-4a67-4f69-b965-86983c83c7e9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0f0e7cf3-2576-4dbf-926e-9e5c5a01e370","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:07.994Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:10.030Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4ec4ef94-0c70-405c-95bb-74eaada937eb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"270be2ff-bcbd-4c57-906d-173fbd399f71","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:10.030Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:16.140Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"15c2807f-43ac-4ce9-9cdd-ab128b0671d3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b8d354b3-3c3b-4caf-b5af-24431088fcdd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:16.140Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:12.070Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"36ecfb8b-7d2a-4780-83a3-f170271f711a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a919542e-5f92-470f-805d-df8d37a35104","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:12.070Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:14.116Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fc5c44b9-0894-420c-ba38-f280950f05d8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9eb574d2-74bd-4858-8b9f-95464fd401e5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:14.116Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:18.169Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ca91a7bb-78d3-4adc-be5c-aaf79ed04bae","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6e18cd74-95d9-4c39-9054-4f79ccf9f997","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:18.169Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:44.778Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b459e632-f867-408b-9741-41426a4a2b44","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d2e9dbf3-efbf-45c3-960d-dc83e8ae31a5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:44.778Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:38.616Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a72076b7-3466-43be-af40-dd46ab99c8cf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"11ee0268-c12f-4cba-83ea-50571507ec59","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:38.616Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:40.731Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"323ce798-d386-464f-8cd1-9f6071075af0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"df7f106c-7422-465d-a37b-6cdc17751493","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:40.731Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:42.739Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"42f8ae9f-1031-4aa4-95a6-764f7b419006","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0c77a348-0ebc-46ee-99dd-6e6d572d9e47","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:42.739Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:46.806Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ecf89079-042c-4e85-a707-bbd38629e2f9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cdc6a662-b1ce-4743-9164-0a3e4bbf97f1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:46.806Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:52.923Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2af77162-152a-4662-b285-3631861d9cbb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3afd841e-3cb5-4597-b7a3-4b5f2f3ed049","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:52.923Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:55.962Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"72c78c17-a3db-4379-a133-92f2388bab2d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f66dcc1e-c4b0-4e1b-8fc9-18ffbd84eb42","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:55.962Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:48.839Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"242f1a51-8c94-4cff-98af-f23976d0802d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"69f0ee05-8926-4003-a6d8-5b8deb83f527","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:48.839Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:27:50.887Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"dd0574fe-2581-419e-b894-27e4caf5f56b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1526de6e-96f6-44ff-89c9-c4b1f2b1fc84","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:27:50.887Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:30.508Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"14154680-e4ac-4031-abd4-c43868ce2e55","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"04ba201e-049a-4739-8b1b-2924a7c4e5c8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:30.508Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:26.440Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"201a6936-4cc9-4656-a337-bbe0a9c97248","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e8256ab7-02ec-450c-ab64-d0a95f049c9a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:26.440Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:22.376Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"17f4b61b-a061-42b2-bc0d-27afc2fcf962","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ed12f8d4-34a4-4485-925e-7cf4b2c76223","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:22.376Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:24.404Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c762e0ef-5cd8-4246-8321-03b7958f83fb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a40307e0-6a71-495d-abc5-22064227c12c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:24.404Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:28.471Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e331b5cd-fdf6-41db-b232-87642faa6869","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"006a9f1a-122b-46e2-b2f5-ac123defad59","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:28.471Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:36.621Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"32e75d66-2a1a-40a9-a51b-e5ce3b015ef1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e6f01cba-18c6-4119-9318-ede1d69e069b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:36.621Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:38.654Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b77016cf-b19b-4024-aec0-091e372e836c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5d0bb2a8-b182-4f5e-ae0f-a4d7295cf03b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:38.654Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:32.545Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4a54d869-bce5-456b-bf78-c2845497fa7f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"61b66493-6fce-4074-a26c-9713854b67eb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:32.545Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:34.590Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9af42700-fcfd-4787-aa44-3eb7d6b599c5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"450c3859-2b6d-4bc6-8109-127120816c7e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:34.590Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:28:59.123Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7e43f202-4def-492d-b780-a1275cac5792","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c4f9c204-26c0-4932-808f-e2a2b9368178","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:28:59.123Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:01.160Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"01fd6143-8edb-426d-8e31-0b5223ff1859","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3c2c78e2-7b1d-4763-976d-f17e323e1d1a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:01.160Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:05.243Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"878c548b-763b-44c5-a1c1-4ec6d009ee40","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"97bd4a09-c44d-4959-b73b-d8183f6de6cc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:05.243Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:03.194Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"02c9f0ff-08cd-4b2f-98fe-983753100e26","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1e4f821e-ba79-4e31-8bf8-8e9eb644f787","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:03.194Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:07.270Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fea51adf-31bc-4333-b9ee-c704b4e6db26","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"72ae39ab-1f48-45a1-b250-4cabe9a8c491","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:07.270Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:09.308Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7c4c83e0-ad96-4038-a77b-4913f38da7f4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0e7d06b0-7a19-4694-9b9f-6fe335fd2d8c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:09.308Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:11.359Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4dd34288-cd82-4f8c-a450-cdff06be4894","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a02c95fe-b522-49f4-945a-e8ffea905579","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:11.359Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:13.385Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ea948390-1553-4a39-8f1a-ebe2a7c286ac","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e8ed8274-1227-4f3d-9727-f7d0ea068fc7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:13.385Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:15.423Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a1019520-1e47-476b-9fed-c699a5fbae3b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e4eb757c-626b-403e-8551-030af699d285","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:15.423Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:46.942Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0f6a94cc-a12f-48f0-ba00-db96fad39872","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"579251af-f6a5-41e9-81b9-5df01c313478","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:46.942Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:48.977Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9d14cdf7-4e0b-4d70-86e4-f81a08fb36db","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9416fef2-14f8-465b-afb4-455100f63367","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:48.977Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:37.810Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"12556e9a-43d4-4458-922d-45b3feb83c02","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"09b467e0-a387-4d72-bf2e-050eccecc3e7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:37.810Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:40.857Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7473c8f9-fc1c-408d-b4bf-727505df2e32","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"20440735-f170-4fcd-aa15-1496b7a80ab3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:40.857Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:43.900Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"108c9dba-249f-448f-9c47-9683fe64461d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f3412756-b02b-4471-8041-e56dcfe4b37f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:43.900Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:55.077Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"43384a94-808f-42b3-969e-00c68f680d7d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2c5d0313-e55d-41d0-bbb2-dc165b273916","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:55.077Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:59.152Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"803ac595-d46a-4dab-a189-30c7b1c3e1b9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"081cd8e8-ffd7-4dcd-b186-46244dc11b1c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:59.152Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:52.031Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5127971e-59e4-4637-8242-9b1fb1cf036e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5b25f702-7db1-4143-9390-04905b34e1e1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:52.031Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:29:57.122Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c04478a6-7502-44a5-bd21-ea4f4190ee3c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"139de0fe-f633-435d-870a-b422e9fb4085","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:29:57.122Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:22.701Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f97794b4-cf9f-40c5-818a-8ed455871587","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e0bae4a5-6a09-4ff3-a1ba-ef5cd59ad78b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:22.701Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:22.695Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"25c39d8c-5b76-4be4-976e-1a3ef7a6dcc1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4354c02b-2e7f-4a6e-a8fa-9ed0571f0e24","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:22.695Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:22.700Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a67fe67a-bd55-447e-b626-1fd485ce976d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e6b1ba12-f9a0-4977-b569-38e88337805e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:22.700Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:22.698Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3adaeae1-294c-4b42-82bb-eeb113cd1f91","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3654e303-f973-46d1-a3df-df9e212ce994","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:22.698Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:22.697Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1e91b118-b174-46d8-8999-ece396d5677f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4d2ba30f-2ac5-4be4-8078-ff01dc8719b6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:22.697Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:22.696Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e5393e14-2f35-4351-934d-3edf41d990ca","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8876bf87-8361-4a60-85d6-759f3abb7ef1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:22.696Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:19.532Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"18b40657-5767-4d7a-b3a8-15c60622bc98","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4609b554-c176-40eb-8ed2-75a535e18e6c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:19.532Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:23.671Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"29eb2960-9eea-416d-b40d-06cfb38270bf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ac7754fb-a87c-4878-bfd4-8a4e3834fab6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:23.671Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:21.592Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5d33f066-170f-4fe2-a53c-18498fcabbbc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0fe7a3be-4384-4e41-a43c-ec5b44907caf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:21.592Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:24.729Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9939b3df-e482-4580-be97-afca05731a29","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b81ff9ab-8a16-49b3-97f9-de5f7590fd4f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:24.729Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:24.730Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"07823124-a336-486d-94d4-e13f0e929ee8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4499e0d4-5bbf-4d97-981e-15485aadf194","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:24.730Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:24.732Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f92e7b11-d12c-4932-ae36-2070ed1bc20a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4ff2201d-3e96-4460-94b4-1aa097e91bad","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:24.732Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:24.734Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cdf3ada5-d938-4fbf-b5e9-30237364c6f1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"44487134-ff85-43dc-9d4d-01ab31e6aa3c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:24.734Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:24.733Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8853b177-80d2-41c6-ab68-b51d277a62ea","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a64616d4-cc0a-4171-8e17-a355d0c1b6f8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:24.733Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:24.726Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fa19708e-3c69-46f5-b44f-5012cae00d88","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f4cc3acc-55c2-455e-a2a3-32d963e6051b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:24.726Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:20.411Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c991c200-72cd-401f-8e3d-ed1652b19f97","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7f2aeb8e-1fe0-44e0-8d67-7605cf1939c0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:20.411Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:20.398Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"26b903fa-d43e-4824-b816-aac1ef902f7f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cb5e093f-fe23-4b31-b6d9-970ccd8138d0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:20.398Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:20.409Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9a841a88-f54e-423c-a2b2-4e159b2f89fb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"03da89df-6544-4981-bba3-9d8dc5af60fe","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:20.409Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:20.395Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5937cfc9-f690-4cd6-b429-df50b589b1d5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"531d5a41-4304-4409-8903-381b8322b8a8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:20.395Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:20.397Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"63e488dd-c6dc-4c1c-911a-728d2be82809","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6a940683-df99-487a-b779-e23e2b8999aa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:20.397Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:30:20.413Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c85a0f68-c408-45be-9983-b036f100be33","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc [Duplicate]","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5fbdef6f-7aa6-4cfc-8f00-43456d8edad1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:30:20.413Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:18.739Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"34bef50a-9488-469c-8117-4906a7182478","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a346b322-f84d-4988-8c96-ca5b06f77abd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:18.739Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:15.705Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"44fbbba1-152f-47a2-9a5e-827eddbc64cf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"77ae2085-05f5-4bc6-bf38-43dcee3a730d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:15.705Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:21.778Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4418dab8-90f8-4587-b495-8ae0855a10b7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"024820fc-55ad-4846-b576-8e661c8eeb23","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:21.778Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:12.668Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f2d61e96-bc7b-461c-b0f7-15babc31f6b6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9287317c-34c0-490e-beff-a7f352772c29","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:12.668Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:10.626Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"568d9f69-e8b9-4f3d-8881-e4e0b339763f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cc62f1d7-0d53-4e41-ad75-4320d3ec3f35","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:10.626Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:29.986Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2784cfaf-a172-4438-a7c3-2a4496fbe1bd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"21ed13d6-068e-46f9-a101-341b114aa7e5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:29.986Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:24.807Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"00bbf965-d657-4f47-8156-6e64899a72c9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b7050b28-0d35-4380-996a-a335f8b1c400","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:24.807Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:27.909Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"80a2c86d-98c0-4356-b5fc-a11cde23017f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f227dc0b-b34a-41b0-8e60-305df9a5ecaa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:27.909Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:32.028Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c88bd671-8a86-4dd7-af42-88cd8c49fef5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8235dcd1-7ff5-44e8-a8a8-c619c38a0716","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:32.028Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:56.519Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d2e9e303-e0ca-4310-b788-5da2dde7ec16","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"461b25f6-ddcf-4a84-b4e9-af7253b63267","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:56.519Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:54.484Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7dc0bccd-2206-40e6-8b88-e3c10e41579a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0f5290c9-20df-4224-a7a3-1201959dcca7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:54.484Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:52.436Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3d8a5d11-4b42-4fa8-a9db-19db58d5f5bb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"db46cecc-4727-4f92-872d-26aec8ba3518","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:52.436Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:00.606Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ececed1c-dd42-4513-a0ac-bf51c206729a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"eacaa3f6-5c53-4b27-8499-3735a37ac5cc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:00.606Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:31:58.561Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"17c9047c-57d1-48c5-92c3-342077576842","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8c8270b2-7599-47e8-8429-8f3314ba5427","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:31:58.561Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:06.716Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e8c8cb40-af9a-4f61-b1e2-d7904bf1a436","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5b95a648-9db7-48d3-b99e-7e81cd50b36a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:06.716Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:08.751Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f32db280-df63-4964-9f9a-8d0c70a1656b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b423b40a-473e-4821-a504-1a265d86af1a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:08.751Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:02.636Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4953521d-519a-4ae0-b6cf-a4ddb8fe768a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ee6db114-9d09-4d99-937a-08a6ea795497","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:02.636Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:04.685Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8f8d4114-7fc7-4ebb-929d-ed863f61ce9d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aea47a4d-b9d1-4a0a-a73c-b19e3f13fb4f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:04.685Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:36.402Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"15a9af45-08e4-4d99-a75f-c021378112ec","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ea28701c-1bee-4ea6-9f72-fa35dad8cc70","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:36.402Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:39.348Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4cb75934-f4fa-4727-bbc3-19fad7005d1f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b28a5983-4e22-4695-b851-daae08485a77","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:39.348Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:30.198Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"813cf018-90b1-4624-b162-5a7ba7f29462","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2712a046-b327-466e-a6aa-48a9d8b75335","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:30.198Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:32.242Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5d96ea4c-4949-4eca-ae50-0ae6d5ea6cdd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5461e84a-399c-461b-8c1d-aeca4aa44c5e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:32.242Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:34.282Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"22385b06-2ffb-4a81-abad-0d3c8432041b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"480aeba1-eaf3-4997-983a-3da4d6f40f98","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:34.282Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:47.491Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4c21f353-4bfd-4f82-a911-771cf21e1cbb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f895a3f9-d96f-49b0-aabd-f099a2808bd9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:47.491Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:41.390Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a1768f95-df33-4366-a249-ef61a3616503","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9c648f7b-ea56-4b6e-807a-dead36adf7d1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:41.390Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:45.459Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c9da0b8b-9410-4669-996e-75eb3b9d160e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c0cac1fe-2ac7-48ed-ae0d-f2b479eadea1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:45.459Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:32:43.431Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a9e4c12c-5246-4a5d-a93f-53b12cc0b640","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ea82debb-961f-425d-b3e1-40b972240530","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:32:43.431Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:12.948Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"88e7b37e-2630-4acb-abc2-298c56f0da6a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4aed5009-306f-445c-a7c4-2ef99b39d855","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:12.948Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:10.902Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"aa85ebe3-ce27-449f-8db1-60a778325431","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"19e2d83d-f0ed-443b-8588-83e55d23a990","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:10.902Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:15.017Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c9b0c15c-42af-4eb5-a06a-94765b3adffd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"014fea19-4291-40ce-8a77-fd77c61dea59","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:15.017Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:17.049Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"da5db4f2-20ab-4955-b3b0-1b82b1ed553c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a3195b7f-b417-42a9-95f3-112901c0e70a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:17.049Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:19.085Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2c513206-e0ac-4c9c-b8f5-7fa26025726b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5a346f66-c693-4e06-a716-f4498a3ff5ea","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:19.085Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:21.121Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4edd6d36-f50c-4faa-a5ad-2c1463c5aebf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a2528ff5-c4e1-405f-ac8d-6de61ae5f502","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:21.121Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:23.546Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"09227e8e-3bb5-4c8a-8945-3cf882a290e6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2a03fd5c-9a03-45be-8e56-09278482c3f7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:23.546Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:25.212Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5b6bfb77-894c-43bd-9262-f0fdb32f8d8b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a147e701-9e18-44e6-9781-eb0f91ea62cc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:25.212Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:27.249Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d18ce187-fbb6-47b4-8bab-28d7fe325cdc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a0bb2690-ecfa-4aec-9c63-890c1112e302","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:27.249Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:49.742Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8e344bba-c2f9-456c-bcfa-6f24d0f6611a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1ee80511-7329-49e9-a822-30b22c066bd0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:49.742Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:55.845Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"effa0376-c43d-4023-9c3c-f7303d652dc5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f3384601-e086-4f69-b570-c430caa921e5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:55.845Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:51.776Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"98b36944-da50-402e-ab2f-81bd237ac153","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a36b1f09-daf6-454c-bb4d-5a80c80d0f8f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:51.776Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:47.704Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0af48e5e-b35e-4641-bdb9-972029520436","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f7c49a7c-8a03-470e-902d-2953ab2c5937","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:47.704Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:53.811Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"caddd677-5e55-4624-bd9e-392b989c22d0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"db5a50bc-5253-44c8-80ce-e0fa471d638a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:53.811Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:59.921Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"17ff45ec-d78e-412a-9849-87c309411bde","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"98b9ec46-efed-4e87-8108-8491a4de2bd5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:59.921Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:33:57.884Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"09989bd5-0f87-44d8-85e2-fe6464dfbca9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b8d3cc62-b5b8-4c43-a310-a7ee86265b5f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:33:57.884Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:03.988Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fd07ee6b-fb40-4f81-9832-852728f57df4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ab26d67f-6451-46bf-b48d-e315c7132d6b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:03.988Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:01.959Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a2299ac2-2104-492b-aa52-d0e87fdfb036","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5e46186a-d3ea-4e1b-a6c0-593cda134ea5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:01.959Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:30.511Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3d02cb91-468b-4a1a-9f82-92d983ff9476","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bb4a2716-145c-4ced-b942-4525de95c9b3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:30.511Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:27.446Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cfc3d10a-cc4e-42f1-a64f-e3d3681a6ad8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dc7bc2a9-f218-4fd4-990c-a3d638775c0a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:27.446Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:32.538Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a7e86480-8a7b-41a0-9e21-8c438b442880","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e443b0f5-95dc-491d-b5c3-fff15b2969e1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:32.538Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:34.569Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cb72d912-7a60-4ca0-b7e1-053bb17377e6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2ab5b082-779c-4425-aa88-4f2a1090065c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:34.569Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:37.620Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bb9b9fe4-d6bc-4f47-8242-8dd201c398ba","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5bc10b26-fe96-473a-bfa8-3565e45f8384","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:37.620Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:39.673Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"df89e265-fee7-4e96-9580-ddd9c3dbe317","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"db88b28f-ce90-4be4-8f49-9d30441143f5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:39.673Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:41.720Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"583534b1-1ee1-4186-b087-e9c69c5be094","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f64ee97c-8aea-483f-acb8-c5a662c0bfde","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:41.720Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:45.784Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5a92c16d-dcfd-41fa-99e0-516cee6e03df","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"794dea50-f5a3-42b1-95f4-c3ce467563bf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:45.784Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:34:43.753Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ae5d420c-8986-425b-9c3a-d74b37e09548","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"555332da-f29c-466f-857e-cba88c8f27be","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:34:43.753Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:12.246Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c62b91b2-49a7-4d30-a1d2-81f3f7f01237","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"52457a54-e91f-4532-8e2e-c2bd5d622229","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:12.246Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:08.193Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"27baaef9-660a-437d-865e-1584bade270a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1239bc2f-962b-407b-b777-b17d9eaff40e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:08.193Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:10.218Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ac06423f-7038-456c-bd52-21a2ccbceda8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"03291190-558c-4df9-99b6-b93dd886b95e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:10.218Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:14.288Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3ec8f842-3518-401f-8ea4-5deab4506b91","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ba86b7f1-133b-48e9-9321-aaa0974f30e4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:14.288Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:06.134Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3bfd76a0-ee97-4ea7-b3c1-b535d8704bf5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"36f1ffad-dd42-4cff-b9fc-38d2385b1d99","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:06.134Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:20.702Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"05e6ab27-deac-4659-aae4-5566ef28b29a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"67e064a6-0ba0-4a28-960c-43b2ab8c3609","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:20.702Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:18.449Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d2e1eb6f-0e73-481f-814c-7fc91116a6e9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"79ecec66-8a00-443d-86f4-6744a5104df1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:18.449Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:22.538Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fc23f274-ecfe-4d3a-85c4-c2a20db64ad1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f01d291d-7a77-4518-b23a-41bde4d08ef1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:22.538Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:16.332Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"642a389f-4d1f-401d-a71c-154409e733d4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"041218ae-deac-462a-9959-ececea18d008","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:16.332Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:51.074Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"87a7f3a5-cb1b-47d8-862c-f7c2cf4b702a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"681a02e1-fb58-44f2-962e-33c8e76c3aae","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:51.074Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:54.116Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4e35de76-0e67-4c70-acf4-08f2293afc6a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b785aa49-68ae-4c8a-926d-5874629a3459","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:54.116Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:45.102Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e422f9de-a9c0-42f3-9f52-ef6e6d5ffce0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aaf26497-9838-40fe-9b04-da330e77be19","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:45.102Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:48.085Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ec70eb01-7e2c-4acb-b9c8-2851d32920e2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8a4f4eb4-0bbe-4f77-b7f6-eb4eaeb81a28","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:48.085Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:42.932Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"baace813-6963-4b1e-87b2-fdaaeea02e03","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"44d75612-1a47-4e54-a1c4-1f4daed66a34","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:42.932Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:02.249Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"beca9ecc-416a-4a44-a77f-25fd37698f06","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1477b940-16cb-478e-875c-1252df2671c5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:02.249Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:00.212Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cad599d1-e43c-43a0-887b-0eca6f5a2c9b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7afdff0f-6103-4708-ab79-1fea6965a494","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:00.212Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:04.284Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"32ec9307-2897-4b05-9789-2a79b40fb94f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d72d57dc-a548-4058-9225-3c7537d5a234","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:04.284Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:35:57.156Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2639babf-a544-4bba-b205-a84cb7133c1c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"555147e2-7b32-4f0a-840c-0e9fa936a634","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:35:57.156Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:24.736Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3926ca86-c3c7-4d8c-9580-bc9d92784cef","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"582c9b5f-9cc1-422d-a260-767b9711c371","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:24.736Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:26.782Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e97541d3-d73c-442b-83d5-d53438a6e9d1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8e35ca12-5831-43b3-b858-ed24d3380ce0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:26.782Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:30.863Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"29837a11-4270-426f-8fb5-2b5a024dece1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a9d64c1b-f1b8-4722-b24e-ee83de2b17a9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:30.863Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:32.903Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"140e91a9-92d1-44c9-94fd-b2e7096e476d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fe694b79-fbaf-45d7-8786-1a9fd2cf38e1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:32.903Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:28.818Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1b8b7d25-9bb4-4135-8c5b-707aa7a048ac","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3b4b5921-87c0-44f6-bfc4-7129627f41fc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:28.818Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:34.940Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c6079127-7e56-4b88-b246-9cece7224a21","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"412e9577-85c1-40f4-921a-264e978dc9b3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:34.940Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:36.992Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"af66633a-31f5-49fe-851c-bed21feee357","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"14966058-ce67-42b1-b2c4-515b9aee75a1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:36.992Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:39.026Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6b93be17-d069-42f5-a36c-46dcf12542ed","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0667da1e-8683-4e8c-9ba8-b6cf3a33042f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:39.026Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:36:41.076Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"aec42406-5046-4efa-9dbb-c57678e043c3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fe975f02-8639-4926-922b-1983fb7a28f5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:36:41.076Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:05.743Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"da284b02-d2c5-4d7b-9bed-194b7b51053e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"802e2df7-85be-433e-afa6-9bf82d6e4263","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:05.743Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:01.466Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"74e01452-d32e-4864-8c6e-975c845f30f6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"70e3c3d5-3b8f-4526-8caa-0e9fb30b9e38","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:01.466Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:03.518Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0a1cd34b-f765-4b32-b4ff-687829d9d74f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"14e4a7f0-fc73-4863-9399-7cd48cf4e242","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:03.518Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:08.582Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"090d6966-3b39-4b50-be8a-d4aef3ca47a2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cc2c17c0-5fb5-4feb-9f0e-010450df52af","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:08.582Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:10.622Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3056ada7-2c0e-4946-a36a-3793075aa878","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e51d0c14-aef1-4286-b970-4aa7ed13a19b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:10.622Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:18.783Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"945acb7e-ba47-44dd-99c4-c814be92f8bd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3ccc2152-d4ae-4f39-b089-bc4d5cb4025a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:18.783Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:12.654Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"09ba0cad-4fb1-42dc-aaf4-a2a1d502b0c0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2f0bc06f-d7eb-438c-998b-b73a19bb684d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:12.654Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:14.703Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e8bc3e2a-a498-4d4d-ab72-e43b6286ce37","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"adde0e2a-f81c-4236-bceb-5f96aed1447c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:14.703Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:16.747Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a7757874-f89a-48e4-8e37-6f33da47508a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"84e78619-4d6f-457b-9b0c-af95d65b8a06","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:16.747Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:43.238Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5bf42c73-e30e-4144-af42-c041df16d4a9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ded72f8b-3023-4833-9d7c-e3ea75d873f9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:43.238Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:49.359Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cf8bb45c-1e17-4f5d-b0c9-13a6787fe53b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ced88f82-d41b-4bcb-b4bc-208cd9da0d3c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:49.359Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:45.299Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"15a29290-319d-4df5-ba18-5cf83bcafcd7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b3200e32-94fc-4318-95ce-e6a3442a43a6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:45.299Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:47.322Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"65dae3d3-0eb1-4492-ac0d-d8637f8fd07f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3127d0e3-a332-461e-9ba1-bb4225f10847","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:47.322Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:51.399Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"16a7e0cd-7f56-4efe-a1e0-d72b8d8e37f1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"857a4e63-f136-4bbc-81de-9d7bf3c2d3b7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:51.399Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:59.819Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ba13c094-f571-40d2-a0db-8b60c9829107","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0a8c02b8-6056-48d7-a9e8-0b5dd76156df","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:59.819Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:53.433Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c5255ea9-9d90-418a-9405-2cffe9947da0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"14ecb0eb-6bf2-423d-b7ea-3435a2024a9c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:53.433Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:57.503Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f2e93f61-23eb-4f13-8431-fc5c959d785a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"619a4ebc-c0e0-431d-ad5c-b0f699be6cff","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:57.503Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:37:55.480Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b5100fd6-40f5-4bcf-b816-e4bedf6efc11","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1a2cddb3-5129-471d-83b7-44171fef26a5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:37:55.480Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:19.990Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e2d85534-7438-4d29-8d2c-acef44603119","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"926d71c1-1350-403c-9116-862e48a276c6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:19.990Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:22.091Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"90387172-9912-4511-9ca0-73de02fffc58","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"299d73f2-08ab-4656-b3ff-824b11504f4a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:22.091Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:28.186Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"28bced25-9cbf-4296-bb85-d4361a3ea327","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d7bfb532-e965-4527-8335-ae424438f55c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:28.186Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:24.122Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"912ae52b-aa9b-45c9-ba7f-d9c5e3fa8029","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ac73bebd-1a4b-42d6-b9bf-568c692aac9f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:24.122Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:26.159Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c4d89c65-bc2b-4916-964e-025ff637ef0e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"762dff88-339c-46be-a384-b8f99767713b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:26.159Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:32.371Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0c2170fa-c2c5-472f-a3ab-b34ecea22ae4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6203b62d-60cb-4502-a183-09603231e36d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:32.371Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:36.465Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2edc97b4-aed4-4b4e-b61d-27394ebe3a5d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aec58774-01bc-4f23-8f81-7d13f168ffb9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:36.465Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:30.329Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bc0fa8ae-b220-439b-aa39-a1d5f67d059f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"845a95c6-ad7f-4345-a202-bf48f926504c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:30.329Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:34.427Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f74fe05a-1796-45f0-9725-0cdd5dae8bdf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c78c8cd5-c210-4d31-95e0-13cfbbae80b5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:34.427Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:00.970Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4b43eb31-d052-4fd9-b732-eb4742fe436e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c7a650cf-50f4-4e56-8d56-05a035b5963d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:00.970Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:58.897Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"25c9fbac-b8b3-4bbe-a99a-766196d28d57","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"52268482-8616-4a39-8283-a1803703b377","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:58.897Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:07.047Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"43d342e1-b86d-42c3-a492-1eaaaf44d66f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a4fe7b4d-925c-41b2-a105-3a21f089df41","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:07.047Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:38:56.861Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f0a388d5-77a2-499f-88c5-cf134de8cd9b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fbd3c169-1555-4e2e-ad57-52d4c515f6e4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:38:56.861Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:04.011Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6d0c199b-9387-492e-8145-583c33ecdfb0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"eb9d05db-a70c-4eb3-b50c-49a126b34f1b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:04.011Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:10.125Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4da357aa-e773-4e28-91c1-7d7ac8222ed6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a5f67cec-44e9-4e3d-9191-ae6578a89f80","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:10.125Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:12.179Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9cb3e951-edbb-4472-b785-9b7cc45ba447","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dc3fd157-b6f4-4dfb-9c12-20a2fef8ae59","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:12.179Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:14.218Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bc32d671-2f38-4559-9ea9-fd3c3ecce4fb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ba35fd99-c333-4988-be0d-5eb0aa42b549","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:14.218Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:16.270Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f82381a7-7a40-4122-9a44-ccc2a57a248f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f8b0a97c-6e3a-4b83-9dc6-7fc93206bf1b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:16.270Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:44.983Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0747bc8b-3438-4d29-83ce-015cb5655ffd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"98919643-8b57-4407-a126-4830a5cc929f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:44.983Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:38.878Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ff45a615-7967-4921-945d-eea8e314f9d1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c07fd4e0-f0a7-458f-b2b1-a24eb78ad302","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:38.878Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:40.914Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bfaa5362-461f-40ba-9761-cb0c1584cfa1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"65db7a4e-b541-4658-9b02-411f1c5e88bd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:40.914Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:36.786Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"816d8b69-a469-4f93-9fb8-515374263fe6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"93a3f62d-24f4-41c7-84c7-856f33be5c68","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:36.786Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:42.947Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1f727fcc-e17d-42a9-8229-eb4a090792c6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"395afaff-c8da-48a8-b26f-bbfa5af56dbc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:42.947Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:53.150Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"dd630637-03d6-4750-b813-c634a08a95b7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b978f6b5-ccce-499c-b37d-c9f16b0883dd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:53.150Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:47.043Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e9dd80e2-19be-4362-ab07-fb41c644ad38","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9cff4543-9582-4e89-84d9-a1869afffccd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:47.043Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:49.085Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"df70a98b-3dc8-4580-bd47-d85dc2d893d7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5f04be79-04d5-42bb-b969-9802fa2dcfeb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:49.085Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:39:51.119Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f08a3a03-5241-4b20-8315-20618a0621dd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1ad90805-a3ac-4b48-adb4-d4e10a02ea0c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:39:51.119Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:15.618Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6be3ba94-36d6-4cb4-8f52-10aa7f342d68","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7008960b-fbeb-48d1-82a0-2b08ec58b031","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:15.618Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:18.651Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"968335f9-7762-4d54-8467-1d1f4d5e3b65","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cff4cc71-8b40-4eac-8258-82c34ebdc10a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:18.651Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:24.761Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"eb10b36a-1a6d-45de-96c2-dbeb59f553c7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"193095bf-15bf-4e4a-be58-c5c36dacead0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:24.761Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:21.711Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0ccd2c1c-0ebf-4a90-a69e-17c6ea40d3c0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f800ec4c-e509-410b-82d3-bfa69eddde2a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:21.711Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:13.572Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c7edb9e7-f994-46cd-89bc-08cbb156ba4c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a931421d-d785-4e88-b1ab-338524938bfd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:13.572Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:27.821Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5edb5a47-c52d-4fdf-a8cb-982e6660b4a1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aca1d943-7a1a-47bd-87f5-339790607513","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:27.821Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:29.877Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9278f40c-78df-4f60-9209-30c386191e95","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ef20b465-ff4d-4d2d-b51b-9489ad18f311","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:29.877Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:31.905Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9e84e947-8636-4abf-aca0-e3b68a69aec0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a8fa99bc-37d6-4946-885c-db8697950cc6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:31.905Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:34.942Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ff901f86-ff68-43e4-8c9e-740f00b1553a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0136a0c4-8f3b-4085-b433-e5cd06aba93c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:34.942Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:59.410Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c2446039-285d-4707-8c48-bee74ec83f86","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8e56b25b-3ba9-4c85-b540-75f4667fca75","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:59.410Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:57.377Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d3963307-c301-41d1-8762-c9667c0d1285","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7e6fb53b-0646-4d16-a9e8-e6cfbfbec0e8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:57.377Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:40:55.332Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c1ec9301-0548-4b67-8e99-248d75b117cd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f5a71ba0-be4a-4ace-81f6-4f413a0426f0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:40:55.332Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:01.442Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"74cf5418-b40a-49a8-a4a4-86c430dcf48f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"32ce4a7a-f0eb-4b5d-80cf-7808ae472cba","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:01.442Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:03.532Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4ba6bfb6-d00b-4631-862d-684e3b6d0aea","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"40ef7738-cfe2-45b4-a607-69dc912f426d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:03.532Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:09.678Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"df5c3b35-ebeb-4795-a226-ba2ab37f3d4b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"55129516-05fa-4dd3-bf9f-345509e5c746","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:09.678Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:05.567Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"73baa60d-20b7-448b-88a6-99d6d0eaab3e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d0d26c80-8199-4be1-8729-32200f198bf1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:05.567Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:07.618Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2eee875d-e96e-4116-a3e3-1a33e36a1413","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"99a909c8-8839-43ac-82ce-b4a81b28a28a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:07.618Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:11.679Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"14237a0f-2b72-450e-a6a4-6dd1e321478d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8151da0a-8c58-4507-9afa-19b1f98e284c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:11.679Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:40.249Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cf98ebd6-a67d-4147-83a5-3361be781b80","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bcd16ff3-848f-4cfb-9caa-2838eef88277","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:40.249Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:34.086Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4f2d28e2-cf7c-40e1-a0bc-73ed15e08dc7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5141db95-9913-4599-a5a2-3a8033985a4e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:34.086Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:42.282Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0ecac1ef-dfd4-468f-b980-ec0506d2afae","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"460922b8-c5e8-4faf-9f1a-3592f57abea4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:42.282Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:36.130Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"39bbc4da-bdd9-448f-86ce-2f8ac9b92735","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a0aa140b-ff52-4ecf-81a2-568f79dd4a75","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:36.130Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:38.182Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"61a5bb60-a2fe-4695-8662-db119267f904","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"67daace5-a5f1-45bf-8956-a198ea1d414f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:38.182Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:50.395Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"28b14937-6530-49d0-92f3-5b81c7fb9675","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"928fb8f7-fc4e-4c45-9a7f-831d2df99457","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:50.395Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:44.518Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d9360aea-bcb0-4c7c-8366-27cb4427281a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"316526a9-e2e5-400f-b27e-c622a3f86be4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:44.518Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:47.362Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5452b82c-3d3e-468b-8b29-03830ff6de38","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"24cef2a4-3980-4496-8d10-c1b4192bbba2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:47.362Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:41:53.431Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"704777bf-ac7c-4f0a-9f0c-d242060c1726","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e5cca02f-b874-43d3-bb29-39d7cf4cafea","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:41:53.431Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:19.909Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"666f180e-cc1b-46fe-a967-782bb13010c6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"47e0abec-ca16-4d47-b992-00f31cd49bc9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:19.909Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:15.820Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2813c737-35ea-48eb-b649-0d403ea50230","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ee562dab-e7fa-483e-a5bd-a75d049e62ba","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:15.820Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:17.905Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"09a196d2-9af9-44a6-bbbb-9f67152ec7e2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a9f18cfd-da23-42fe-978e-c84ca7dba5ad","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:17.905Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:21.966Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ed389a37-d1f5-4275-9e80-555a4033ece0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"30e39d07-282d-4a99-847e-9328478ee485","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:21.966Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:24.460Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9307ec6b-27fe-4a3d-b356-e3face9f7a74","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d47a8311-c8b1-4591-b285-55ef325714fa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:24.460Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:30.100Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"59022009-e1b0-4ba4-92c8-91370d151c14","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5dd3f153-3d3b-449a-8508-a3468e0d44e9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:30.100Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:32.133Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1f543d0f-2dcd-4397-bbee-1950a77eca5d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"863331ea-8efe-4d51-a7a9-c81e9c462858","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:32.133Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:26.008Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0147956d-443f-44a1-a96a-797825b2335d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"77263752-3bb0-4570-b200-ccff009e8bf3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:26.008Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:28.066Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0dccdc44-c427-4764-8faa-85ad4e5bbe47","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8a60f206-bddd-4bdc-99af-fdc934b99cee","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:28.066Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:52.615Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"27d5998b-e95c-420f-a0ad-c6e2863beafc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"70b64326-d0fb-4868-8bae-0c482371bb6f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:52.615Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:54.663Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"79b304e4-9172-43cc-b77d-6b73acd277df","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cb4e131d-e4f9-4db8-b8d5-c8b3f8482d72","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:54.663Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:58.724Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fa4ccfc6-e1fd-4f35-a222-7bee7dd8d8c9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e213a932-4f0a-4a00-b931-4be8359131b4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:58.724Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:42:56.693Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"186a46c8-8352-46ae-ab1e-faf5e36d91e2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e28b558b-14f5-4c76-ab6d-e931a3b543d7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:42:56.693Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:00.758Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"638c6a8d-1680-4c93-a6d2-425f61ab3565","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a9096800-bb95-4cd7-a285-557a1f2323f4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:00.758Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:08.953Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"844ae7af-2a02-41ac-8568-bb2fdf21ebea","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3d4bd71c-b6ae-46a5-a6cb-44dad86f2120","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:08.953Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:02.796Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6dcf1472-3bcb-4674-ab03-10d04199ceed","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d0674023-f282-4644-8836-007cee4aed54","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:02.796Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:04.890Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"93a346bd-bc48-43bf-9e57-375ca214c463","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"14981d97-1038-4c65-8e01-80e278ca2da7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:04.890Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:06.927Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"51a5eef6-e844-464d-803b-78b369a786c7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"190ea5b0-1113-4775-bcbd-7ffd753020b6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:06.927Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:38.535Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b5d894c3-c500-472b-a6f1-79d24599d222","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a6cd8a90-b599-44f6-9cdc-1106d4d5cb5d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:38.536Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:40.575Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"233e2f02-4f74-409c-b315-0da90b505474","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c14a8b5c-3cd3-42f2-97a1-4bd1b0efa317","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:40.575Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:32.427Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"65f01c62-8595-4ecb-937f-948fc869c5b5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"93463f58-e6a3-49e9-a576-2cd8eeee71da","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:32.427Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:34.473Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6d62bdda-926c-4d86-a5ba-3a6b99d3800c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5344106d-ad6f-49ba-9d73-5c4ecd5a5aaf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:34.473Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:36.502Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ea59cf71-6eb9-4d98-9c02-267700049ff1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"61df62a4-b373-4f11-85ef-90397f9cda37","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:36.502Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:44.648Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0dcb62ff-b2b6-4428-a925-b3eb5e4aa7d6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"704c0a72-ef5e-48d5-a08b-4f9593dc2f8e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:44.648Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:42.604Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bd0f2363-d68e-46b4-b199-75974e80bf86","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6da7c787-6cf1-464d-aa1f-819e5015ee8c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:42.604Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:46.681Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c55c9bc4-8c0a-44bc-844b-0a426434f81d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d5f1a394-07a6-40c1-ba32-692202e220cb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:46.681Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:43:48.756Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3e19a76d-3306-45f3-9c3f-a831a3d5ae85","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cf51ec11-af20-4f1b-ae61-823436e17613","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:43:48.756Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:11.332Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4c29cb2b-cf3c-46ed-9023-79452f9bdbd6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9972f0a4-7f00-4165-a476-3862f5b27fca","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:11.332Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:15.404Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"911b9388-d926-40cb-9afd-65d2ed881222","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9fca821d-8607-4dce-aa24-83928d89896d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:15.404Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:09.287Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7a76929d-2eb1-499c-a98c-5d12bbac77de","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"83e0f595-67a0-4a1d-84a2-bc17899ed7dd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:09.287Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:17.432Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c69fa90d-3993-47a1-8053-bc5b4116a55e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d8a0ec7f-c39d-4212-81c3-c0cf7c900e39","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:17.432Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:13.366Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3877d8f5-d743-4df1-9c11-2ce139d87258","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4fb16de1-0e8e-4f65-bb29-3beb065aaa38","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:13.366Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:24.556Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"10ff2a9b-0571-4f47-9617-5450d0b17dc6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"dd0357f9-b105-42cc-9c83-7680afa25fe4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:24.556Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:21.504Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f14940ad-62e1-4ea5-a9a0-ef43595bf07e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0f51faa6-9b11-46fd-acb9-80ecf09241c2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:21.504Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:27.583Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"52f5a857-fafb-4025-a40d-b0e94deceb9f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"68a7abb5-2728-40ce-a6ee-4202bd976c82","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:27.583Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:19.462Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"de55078a-fdfd-4f5e-81de-68ca1d173b07","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bd31f7fd-d5ca-4b51-8dc0-aa29a6989446","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:19.462Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:59.146Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8b158260-fa1f-4036-a163-845f610af666","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e0a0a260-e112-48d5-9ac3-bfc5542ce1d6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:59.146Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:57.102Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4d3ddb86-d948-4f68-b47e-51b64f290b6b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"773654af-2044-466a-94a6-82ed5737170a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:57.102Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:52.990Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"20a1a459-0739-4e0c-850a-271ce8b68d48","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ae078ad8-81c7-462d-a518-4383ab3598b0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:52.990Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:44:55.086Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"26e0cac7-18b4-4561-8bf0-a6cfb59d9606","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"86f6c5e6-0140-4bb8-ad80-45a6956666e0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:44:55.086Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:01.169Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"52432aab-44de-4a8a-9fde-c9120f25b6c5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6c1cca38-e29d-4079-bba3-cd3fb34a6f39","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:01.169Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:09.313Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8ec02a51-fb51-4c1d-8a2b-023132da36e5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1ee7eb31-8965-4cf3-b468-163db2e7bab1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:09.313Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:05.248Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"69f0536c-0408-482a-83b7-5ab8979b82a8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3b6cda86-f16e-4685-8329-38018ba33c08","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:05.248Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:07.279Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4735672d-bb14-405f-b711-7a764b598b9f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1bfaf128-60bd-43c6-9ece-c4e475ce99d8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:07.279Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:03.195Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d4912ec4-fe55-4c80-84be-d7996a66a5c4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6d59ddbd-aece-4558-af7b-a0f6a99c6435","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:03.195Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:34.825Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fe7377f7-1691-418c-a622-ad6b0edc99ca","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5dfe0940-c4de-4457-a917-7ba202afc652","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:34.825Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:30.739Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"959b5e4c-9669-4759-9d16-9524ccef5b93","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"34c5741b-2397-44de-93f2-a16c99f12d87","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:30.739Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:38.893Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6305267a-a6e0-48fc-aed6-61bcac1c5e99","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5b24a753-04f9-44f7-b783-3b6fca5a43ce","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:38.893Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:32.793Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c7196f2d-3dc0-40fe-88e1-e26d246873ef","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2e1049b9-0392-458f-b8f2-d92844412510","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:32.793Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:36.868Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e8ef2049-a989-4d69-a72d-0f56ffa14727","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c0a88f96-ff3b-451f-9b13-f2db1bce796d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:36.868Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:40.926Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a4306035-7982-41aa-86db-283330980b79","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3ad63057-5a9a-405d-9b8f-3a83458a00be","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:40.926Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:43.072Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d7f3bc52-4460-4674-b787-81f76805576d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ebf56e79-4867-44cd-86af-3faa841c7d78","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:43.072Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:45.108Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8cf3cbea-025f-42bf-ae46-d94a3edeb6f9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"48a0a53a-201b-4f66-82fc-be4043a4c227","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:45.108Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:45:47.141Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c042931e-4391-4aea-ae3c-b904a3b6f341","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9b167464-e4d6-467e-8e62-d6d7e54e6207","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:45:47.141Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:09.692Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7339c909-a3e3-4257-adbe-50a79a940a3f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a05fe26d-04ae-47f6-a799-870e5156c000","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:09.692Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:13.851Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0ec560bf-4553-4309-8a92-a11375977a66","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"024b7d23-5981-43eb-ab6b-3e8f18f5702a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:13.851Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:11.735Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d0060725-4b4e-409e-b18b-29967d6c92c5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1739f264-ca65-481f-b988-9c8722aaf765","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:11.735Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:15.882Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"babe6630-3779-44b8-93b0-a61ad01a1d5e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4b75684f-8dd3-47d7-a72a-c6fc7905b3f3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:15.882Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:17.912Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b4e340cb-4bee-4136-b200-8d0cce16551c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f16388b5-8b25-41a6-a3c5-012bf5b4f0e0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:17.912Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:19.948Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"78eca1bb-8dd8-4da7-b771-8c1ab152280f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"89cef9cf-a94b-4350-acd9-ab9e9eea1661","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:19.948Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:24.030Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d0cf904e-7013-46e8-a6d7-151335bfd9e6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0176097a-f158-48ed-b53c-8cdcebe7a690","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:24.030Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:21.995Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e3c67d7a-7b1b-4fb5-8364-de7a1f202ff4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f5bf02a6-c64a-4499-ab09-9429ec9a05a9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:21.995Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:26.067Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2c1471b5-bce9-44e1-9674-e65e30cdeb92","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"83f00f7f-3282-45e9-bd32-eaab7559852e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:26.067Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:48.545Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bf6035bd-8c44-4be5-8ca3-a331ca581eb9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"eb6cfdb5-406d-4d4f-b8f0-990dc385207a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:48.545Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:52.666Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"17573ef0-e2d1-43a0-b608-944178ac721e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bc3c4b85-7ced-4128-a2ff-2b915eb22881","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:52.666Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:46.502Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"96bdd98a-e08b-44a5-83b3-c502c5d3c1ca","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c0089fc8-dadc-4418-a39c-5a38683ca4dc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:46.502Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:50.574Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a15d8405-3d31-4a77-a57f-28a8ba98a214","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7b8ee8e4-fdde-4af7-b959-491a0261ee61","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:50.574Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:55.453Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e6877edc-2724-445e-9986-46f7630fe2b4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"91baa8f7-5d8a-407a-892c-cfe67f525f80","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:55.453Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:59.795Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"92f44bdb-6752-424d-a3d2-2d7b02a7c6cc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"aa2adb68-c352-4a3b-9910-f9a6db97ee1b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:59.795Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:01.832Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1b5db2df-0f37-4935-89e3-de3ea04f18f5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8a8cf2c3-d7ed-4bbe-a71a-ee734e022221","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:01.832Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:03.954Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"57757887-1109-40ae-8fa3-d814cc364c1b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"81ba144a-8965-4519-8e50-831bc0a2ca65","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:03.954Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:46:57.837Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"13ba6581-e744-4981-9ff3-abfa6a81c3fb","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a1f90876-2441-4a69-bafa-689de241d77e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:46:57.837Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:39.474Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e0562e2f-f5bb-4983-a992-ee22e1702ab5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"56b24fc4-3570-4587-96dc-5e46483c3411","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:39.474Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:35.405Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e1f61272-e310-422f-8890-a0c033575583","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"47409911-6cfe-4dae-9357-102fe893fdad","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:35.405Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:37.440Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"32ac3676-2375-4a49-9e00-a9e83b779b15","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"03dc4c3f-316b-48dd-bf20-84da3832205b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:37.440Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:31.301Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bb99707d-a303-4df2-ab9a-bf7a7dc014a7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"70ddb205-817a-463a-b193-d6a37374a4c6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:31.301Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:33.344Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"910a5c2c-f6ca-4085-9225-d05ed1221ab4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f9bd363f-9c9f-403d-b165-6d7a1bf59b94","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:33.344Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:41.518Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6096f35e-4cfb-4e0a-a35d-c6608b0e4afc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bfb0dd96-b081-4b56-861f-0ad7864358e9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:41.518Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:45.587Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"43ff00f4-2564-4a15-9aff-608695a2433f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3582978c-61a4-4f34-8a79-206c3bd1fb7b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:45.587Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:47.618Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9a3af1b5-de71-493b-80aa-170ac49835cd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"857742b7-0b68-4775-9314-b6d943c6b5c5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:47.618Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:47:43.561Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e97c50d8-0f55-4177-9c4e-43301984364e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b7dc7bdc-46a0-4918-b78d-8baa95705fca","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:47:43.561Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:14.233Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a74c212f-651d-47a9-8d64-dd154b10d000","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c5309403-c5db-4f1d-8048-414b428f976b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:14.233Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:08.047Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4c1da6d6-c879-40d3-9340-54ce19d31a6a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"670f092a-3c4b-475e-843e-d5b9eacff0f9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:08.047Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:10.089Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a7d0826f-f73d-4bbd-9617-8d612c15b308","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0bf078e3-90ba-49aa-b218-e94726a79b66","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:10.089Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:12.124Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"dbfe2c62-ef13-43c7-b4b4-81a9b4fb2db7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8ff3842b-252c-4633-b037-6036d67eeaa2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:12.124Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:16.363Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cc131374-60b8-47ed-8020-f7c921a57751","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b1ef629f-c00f-462a-abc4-a04b3e9f29ab","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:16.363Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:18.395Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ecc41146-f74a-46af-aff2-f1e9b94ee1e3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e27b3736-e7a8-431e-b4ec-746282eedfe8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:18.395Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:20.453Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a98c52eb-3ddf-467a-b9b7-2377fc642d1e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9b14d4ca-7234-4b74-93b4-de6392564894","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:20.453Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:24.510Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"03eb4f48-0c48-487a-bad6-50974d45b249","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d5b6791a-179d-4e8c-abaf-82dda1cac9a1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:24.510Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:22.478Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"daa2edd8-424c-4f98-a521-cd93f20462ae","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e418de73-b9ec-4785-9e21-e6abe1387874","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:22.478Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:48.917Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e9226561-9459-43f7-aa50-be33efd24489","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6f031500-bdeb-4324-8de1-17f4ef8ca6f1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:48.917Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:51.965Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"08198878-0416-4908-8ce0-588fdfb12f94","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"65828059-6adb-46df-a4e6-b793306207f7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:51.965Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:57.044Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d3e5aea8-571b-4a58-9ac3-86fd095e38e5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ad8650b1-387e-4eb9-95e0-0ab012f4aff1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:57.044Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:00.081Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"230f188f-7580-461a-91a1-790184290f67","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6294cfe6-3771-4fe4-b5ed-633af877075b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:00.081Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:48:54.001Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"88af4ff7-7d78-4754-a305-91f58d8c7bc2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0c15bd54-5ba7-4012-acbc-f286c1298b6e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:48:54.001Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:03.126Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a57bf6c0-c685-41aa-b2e1-58cd1ec8f181","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c0467a9e-3372-401d-846f-6ebea9809f3e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:03.126Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:06.176Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8f97dad9-68a0-4180-9d65-b4034a437b3c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e0acb9e7-1122-4241-8867-bbcf0eda7613","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:06.176Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:08.253Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7d44fb9d-0aa1-46bb-9b49-7992be9ad8d0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"59c7a493-bffd-4829-8fba-4603ab80fdb3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:08.253Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:10.287Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"baf43eac-7143-4f0a-8905-adcd14b4b104","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ce47971f-e9ac-4fa5-a7fe-c1536eb56090","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:10.287Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:30.761Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"030ac748-8576-48ea-9fd1-2bf0200e3905","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e92ae4d1-7b1c-4038-acb1-388a6d1640b6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:30.761Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:38.991Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ec676ed3-8bda-4e5d-b9d4-bd9f9bfc5744","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7d99476e-1837-4a16-b11b-6bb89cbcaf49","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:38.991Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:32.816Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"96ad6598-f4d6-4f22-b744-fe2e051d7582","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a83fd54f-5bee-410c-9ce1-02b37cda9a71","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:32.816Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:34.879Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3eadd732-882b-4b08-8dd4-970818e458cf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"39a94d61-9afb-4c5e-aeb2-c742fa6bcffe","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:34.879Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:37.316Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b4a3c194-b92d-4647-b27b-e5579a21cbbd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7e9e2807-9f4c-4693-8fd4-21974e39c57b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:37.316Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:41.060Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d9b6c709-742e-48b3-b473-02fe90dc18b3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b3562a5e-5eac-4df0-9b16-a205f8c96e87","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:41.060Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:47.264Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"eecb78ef-7533-4a28-88de-494ad23adf06","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"da2eefad-c38a-4aae-9b25-394885fab22e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:47.264Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:43.255Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"151c901c-871a-4d08-a8c9-b540ef5f078d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"0fa4c946-ce59-4131-9ab7-4adb46071a13","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:43.255Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:49:45.175Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"03b18c98-59d5-47c8-b9bd-67cc0b3f3a74","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"98f277cd-6c2a-4598-9f5b-56a3c21f4a25","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:49:45.175Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:09.844Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bdb2dcd2-8ffa-4cce-94d4-d72da254e9ab","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7673ca1d-b50b-437d-b89d-af77e55e5f6b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:09.844Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:13.920Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3b76c87d-2d7f-4665-b0bd-35d1cb12b671","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"76475567-0969-4180-aef0-86b89704f597","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:13.920Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:11.889Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8e3c4cef-5826-42bb-84bd-8494bae29121","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5050e3e3-67f3-4999-896b-3166db9750cb","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:11.889Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:15.957Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6b4d48fd-a567-4c8d-a882-851b038c8581","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"408cffa4-e4ee-4eb1-82f3-d8b57ee509ee","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:15.957Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:17.990Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b47ec749-5548-4c8a-9e66-f7f6270238f4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4587417e-d319-4fd0-9be0-dfe4c2c24f16","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:17.990Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:22.142Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f24dbafd-9d61-4cfb-af1b-96b2281f6e4a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f7241f0d-b709-4a10-b82f-97b310b222ac","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:22.142Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:24.151Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4ce9291c-3622-4661-b25f-3fd2e5cd7a2e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"476989bf-5be9-49c2-b5df-7acf85c036be","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:24.151Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:26.183Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"59347d91-d658-40e0-abb8-9ce5cc4f4d0c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"928b6b70-579c-4bdb-8424-02ea6e983327","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:26.183Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:20.036Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"324ab54d-9b20-4847-a40c-c870b2ad40ba","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"02dd628f-55dc-43ce-85e7-d6d24ff640f6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:20.036Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:50.649Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e58acd00-e2e8-49b9-86c9-29990741a00f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a41e5971-a2d4-4447-9530-ca7b243f4e08","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:50.649Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:52.707Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8a18b64f-29d1-4ea9-87f3-d495d7242d27","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1f752461-ae91-4c0f-97fd-5729ecfd5551","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:52.707Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:46.653Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c6a0e1ca-3031-48e1-83fd-7a20dce0645f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"822c35d7-1f6f-44cc-a013-6477c32f81f5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:46.653Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:54.732Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7156375f-90b7-4c55-93cd-3e255b9d4a6b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"589bdb06-01a8-4103-92db-ad9a1347a3f9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:54.732Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:48.621Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"3e72b5e6-f6ac-4f41-832d-9f7d5c8d7564","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b993d6d7-b9c2-4eac-8c3c-81fa9a1f8e10","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:48.621Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:58.794Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0e9cc39e-683c-4093-b8f9-5d15a58ddf18","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fd4600d1-e6c3-4224-abe5-9e72f711b559","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:58.794Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:00.823Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6ed267e5-858f-4dbf-8375-11a629eab21f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7324877c-2449-41e9-b560-81e06b174757","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:00.823Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:50:56.757Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7704c307-1629-4f8b-af2b-9af0c36adbe8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"eaf01066-81a5-4412-814a-42f3003b881e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:50:56.757Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:02.866Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"957f53f4-ecea-4566-b9e8-4cb5ef4ac110","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4839b9de-283f-4664-acdb-4eb17dbed692","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:02.866Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:24.370Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d49bbdd9-a772-417b-bc02-4384a5337a3a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d98b967b-76cc-4591-83d7-1e594fd3a7ae","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:24.370Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:27.418Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"93b85aed-30f6-48c5-b8c9-f04f3c6f04cd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8c3e951e-5554-41db-bdd3-36c7a7d0c2a2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:27.418Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:30.464Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"66dd0745-ed3f-4d3f-b373-457b570dd46b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3749931d-3064-492c-a7a4-e06576067125","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:30.464Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:36.557Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b5efee04-5d48-44d6-9365-e56835817139","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ee79fd4b-902f-4a65-9318-a8d7a01aebd4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:36.557Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:33.498Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0b8cdff7-5646-40c0-9e0b-10e579a7d984","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c4fbcff5-f82e-4730-a3b4-5d33be6032db","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:33.498Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:39.593Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f255c218-186b-4d1c-9dfc-9fe7ebdfe2ba","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"521d98ff-e300-4602-b597-31965845da39","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:39.593Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:48.718Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e2582925-b1c1-4b47-b2cf-d2cbd29c9895","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"208e5232-483f-4d03-9317-d7271a5a8874","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:48.718Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:45.683Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"37b95294-a5b5-4f72-a8d4-179e7283fa60","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"808cfb6b-1099-4422-b704-db5d2cbe1ede","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:45.683Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:51:42.642Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2befbf44-8ab7-49fc-b764-5e3bbe03e00d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"54c2de30-2c3d-4886-b702-1bf6742f4cf2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:51:42.642Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:19.278Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"60c8ee24-1a9e-4be5-8d13-a95397cbad73","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f59d7b17-5d41-45b5-977a-56214e9c93be","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:19.278Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:11.097Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4b61c65c-db3f-4569-ac1e-b857a30b3f9f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7107b2af-363c-49c5-a202-aa750afb7ba4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:11.097Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:13.149Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c79d3c7e-2a95-44c4-85c1-9258abf7db47","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"39767728-aa07-44ff-9a25-ad8e2b7b0c3d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:13.149Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:17.216Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"630e136b-b406-466b-878a-c1690b1554b9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"cdffd71b-5112-4613-8731-37fc61479413","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:17.216Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:15.177Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ee2bc141-4ffd-4099-b2f4-a4eee3baab55","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c5088160-3830-4fe5-ba60-36dfe3b4c5b3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:15.177Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:27.570Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"8a897488-bbe6-4354-9b96-8530ee090567","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"379b8df3-79c3-4048-8af6-943888f21c2a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:27.570Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:21.309Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"af3f778e-29c4-4af7-86d6-776c90355da2","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6c4cefe7-f846-427b-84dc-50baec897068","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:21.309Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:23.400Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"837ea860-07be-462f-b888-fee1ca720542","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6942b351-bb7e-43ad-af47-807312c1ee6c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:23.400Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:25.627Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"661cd9d2-9c21-421a-bbd8-4307644989a3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e0183852-073b-4a79-80a0-1bcbd43c1be8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:25.627Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:56.955Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"763d847e-8d11-4ac9-86bb-dc796b11c368","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7c1ad120-d960-4ff8-a6db-0fa244920f11","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:56.955Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:58.990Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"69dc76f0-bb2d-44db-99a0-dba6cd235579","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"e4ce62dc-ca9d-4fd3-8237-ad556335721f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:58.990Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:54.935Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bf6763b5-3c0a-4eb4-9e05-a8f6fffffc3b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"9dd94464-ae54-4e19-a2df-7c5ba5b3832a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:54.935Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:50.856Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"486ee0ee-b0b8-4500-9c62-7dfda41fa311","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ee59eb00-c6b8-4718-b020-edf2225decc7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:50.856Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:52:52.893Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"438daa6e-539f-4b61-b343-5e9eb890bf47","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bd6688e4-edfa-4d69-9bab-377caae77cc0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:52:52.893Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:09.172Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c0dd68e0-bc27-46db-9be1-0b3958de8e79","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5f2b3518-e3b6-41bb-9f12-3d6669471770","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:09.172Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:01.071Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c0b1fe67-f19a-4db5-b91d-3a1687688a3d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"02abaabf-b43e-4d48-8e1e-d3e353633d5b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:01.071Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:04.104Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"26439bf1-0b57-45ad-9716-25b54f5a603a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8ecf386d-7dc9-4250-8f45-796b8f57e7ca","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:04.104Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:07.142Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7850bd46-0f63-41e4-92b0-be69eddee658","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d6018828-8fd1-42a9-9bfe-d69343b39416","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:07.142Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:36.808Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ef6201ef-e8cf-48ec-84b5-3bacca59a550","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fbd3c691-e6ea-45d7-b0c1-1e2b62bb1e1a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:36.808Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:32.740Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"bc9f6032-bc11-41de-90eb-12148071d882","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"27799886-e084-49f3-8a2e-08ba19e1c6bc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:32.740Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:38.893Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d1795ef5-2903-44fe-b06a-04e329a30ecd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1903cc98-cdc8-4041-909c-b085c0b263bc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:38.893Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:30.684Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2a3d4392-119f-4f75-9b87-4e5e5cf32023","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d95c536b-771d-4916-932f-2cf91f2f363e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:30.684Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:35.284Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"35eb80c6-9b00-4a64-9397-c0fbe6d2e73a","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8c88aba7-77e1-4485-9f8d-b9a538631944","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:35.284Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:42.992Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"cecea4c3-4a64-41cf-8a48-d293f191d3da","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"00ed69c3-444c-4264-a316-b2161db36957","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:42.992Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:45.029Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"fecaaa4f-e4b2-4660-94e4-1cb08a39dedd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b89ef9fb-faf3-44f1-9025-668f0de93a5c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:45.029Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:47.068Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d77bc784-a17b-4919-a35a-9a63fae9a150","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a23787e4-c669-439a-9d7c-272bbd27153d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:47.068Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:53:41.152Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"22ae68f9-7513-47c2-9341-3b7d1c210df6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c5fb8745-2847-4312-b562-552de2fe38c1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:53:41.152Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:15.695Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7bb17226-0921-4a9c-a20a-a54b09b53f77","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"58916f87-b0a0-4c84-a25c-d61029d302d0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:15.695Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:09.603Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"49a5f9f4-600c-41a1-8a45-775a10cd35a9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"18a07f14-b290-4183-91da-56c9fe64c6b9","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:09.603Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:11.628Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2b8e84dc-eb47-4dc1-bdf9-75b326782c25","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c122597e-2d73-4e50-8ae1-62cfbdabba5c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:11.628Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:13.664Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b9ad8c2c-383d-43e4-b18d-a3b3053ce0e8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"31dfcd7c-433a-4f9d-b291-f4579eea7b76","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:13.664Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:07.561Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f2738717-7821-498c-a877-73371e533da9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"91512591-bfae-473e-8f6d-741f4e97ba97","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:07.561Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:19.775Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6b91b0ea-89ed-4639-890f-ed9bb88ae6e1","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"72eb42fe-96f9-40af-a45f-0fe84eb8f0df","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:19.775Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:23.851Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"97517dc4-9c19-4707-99bb-c48da1fdff6d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4d0c4262-5378-42b6-9500-7ebd858dd877","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:23.851Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:17.740Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9b55e7a8-8718-418b-89da-728d6a71592c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"93d5149b-12c9-4c6c-b529-dcfccb447de6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:17.740Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:21.812Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"023dd746-2569-4236-9ddb-7337550f8f7f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ef1725b0-9b37-4a09-9386-462b91ff2d0d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:21.812Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:52.412Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"06502d78-6b11-4708-8122-0be640c3f4f4","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d2a7158f-f07e-4084-b5cb-8dd7a1c9bd5c","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:52.412Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:48.285Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"adf38f92-fdac-42a1-90ac-fa9dd732d515","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"26560aba-060d-4c8f-b7d2-4c3c1104f8b1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:48.285Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:56.707Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"41dfd04e-8945-4bb9-a98b-3a664fd6dd3e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"3369371e-5fa7-4025-99f2-a0e011fe8d9d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:56.707Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:54.441Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"4b614561-c800-42c8-abf4-a8fdab387960","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d10b9d76-e8e6-4727-a17e-12af2b7700c3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:54.441Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:50.845Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"507c3a52-d824-4370-aa87-e77879b46aa5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"65cfb5ff-841c-4e2d-b0d5-274760fe7151","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:50.845Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:00.565Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0d6b1a16-2206-459b-97af-8c9b0ffb538f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"442eb07e-2f5e-4539-b46e-1f3197b14642","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:00.565Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:02.599Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"da1ede1f-e7d8-499f-9a37-2c39cb8f6cf5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"342cf0ba-e1ad-4e3e-8f70-7a21d52b48a8","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:02.599Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:04.633Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f81f8aaa-55d7-495c-85b2-83ee1ebfde80","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ed00e474-18c1-4b57-9e72-0bd94005896d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:04.633Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:54:58.520Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"87ebe779-4f4b-462c-821b-787ddacd9b4f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6cea8fac-9880-41ad-9646-91d7562dbefc","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:54:58.520Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:29.714Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"5fb5bf4e-b0bf-420e-8967-61914712817c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a450fdcb-009d-4fbc-ad03-443ec31f61c3","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:29.714Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:25.155Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"76e33b62-e766-498b-9b4c-47b2746d9548","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"fb7e10a4-fc22-466a-8725-37b2c805b82a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:25.155Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:34.307Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ab38b6c8-7165-431b-9433-96c754c9cb34","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"37794dd2-7490-482c-becd-cd2a379e8e08","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:34.307Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:27.181Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a41c50d3-fe7b-4c0b-bceb-7a36e4b8c984","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a02fa0c0-684d-4bc4-ab14-abf5aed920df","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:27.181Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:32.316Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"635a0083-a14d-431b-9b6a-704e98e58783","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"4adb0339-8e11-4f72-a7cb-f03399164a58","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:32.316Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:36.377Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f45c2ee8-122e-42c3-8a32-577855fbe551","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"01fb5a0c-2ebf-4e37-ba4c-3c2ba444da06","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:36.377Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:38.416Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"2c86bd3b-b0d6-42ac-aeeb-25e56666757e","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7b49fbbd-4780-493a-840e-f17c37b39373","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:38.416Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:40.458Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"131fd836-1b7c-4287-866b-a0fba0353147","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1e56a567-e943-4f87-bd0a-a71a817e51a4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:40.458Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:55:42.488Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7765439b-bd3b-496a-8cf7-04c0994f44db","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f290ec27-e88e-461b-af5d-aa46f2e56bd7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:55:42.488Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:10.142Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"6084f638-f0cb-462e-8ea0-1fb7c33186ae","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c6d81f92-f1f3-483d-8191-d3fc16187585","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:10.142Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:14.211Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"734dd511-3f1e-411b-82f9-4ef39991fa74","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d12e8406-7a18-419f-a76d-3f4fee937e49","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:14.211Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:06.042Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"0b8ca50d-fda8-4b95-9278-7e0b73a97b86","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"98600c7f-cb3b-4a03-a712-7f97b19021a6","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:06.042Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:08.101Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1ccb02c6-95a3-445b-ac6a-63a0db2dc9dd","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"030b6802-e347-4c50-8f02-1762d0d86abd","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:08.101Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:12.179Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"58884b09-df92-4201-b598-ef6f7c3716b3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5dfd3168-0d73-45d4-a159-8edd4fa90b4e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:12.179Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:20.374Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"32fd4e45-5f9c-448d-bedd-9a294fbd8870","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"13600842-9bee-4223-9649-ab7008f04fd7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:20.374Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:16.246Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"90ec37e4-c6f3-4c8a-9206-fa1ed50839bf","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"76b5f20e-7dea-419c-9c32-4868ccab3354","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:16.246Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:22.381Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"ea1e7473-9680-4045-97c5-6a6839427cbc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"80e0e8db-9947-4aaa-a451-8a1c280d63e4","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:22.381Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:18.288Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9a0b0326-1ef8-4359-9dad-541baf97cb1f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bf9bce38-118e-4e8b-8bac-6431f238f95e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:18.288Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:45.944Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e9064f6d-810c-4417-8225-9da1d41e5bb7","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"62e97410-fdeb-42a7-85ad-d9c03be0ba2e","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:45.944Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:47.977Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f7cfcf99-ba29-4b86-bc70-763c0ef14800","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b1df81bb-5b82-4d57-b20e-43b04d53b008","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:47.977Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:43.882Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"641d33d1-3ba0-4d5e-bad1-e74d7765aa9d","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"f972d3dd-5e70-4a0b-a2ed-67725bd16f84","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:43.882Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:50.005Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"648e6aee-37b4-4718-aee3-46c31fc9ba5b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5178468a-86af-4657-bd89-4f651e6db224","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:50.005Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:52.065Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"93b02697-069e-4bd2-9b89-1cae17b1d29b","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7a2266ea-7ff1-452c-9f41-ebf358005bd7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:52.065Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:59.211Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"69a835fc-66cd-4204-84f9-e5d722b06ba8","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"2443a9ae-fb41-4a57-8c5a-a5a46edaca34","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:59.211Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:01.253Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"9717ccfc-26ae-4148-98eb-01d661c8ae25","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"c81741af-3bdb-4309-bf30-dfe0276f62fa","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:01.253Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:54.122Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"79477cf4-a443-429c-b4b9-b1ca41f8b5ca","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5390c0e3-e53d-4f60-b44a-95306d84c6a5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:54.122Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:56:56.295Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"53e94e76-15be-44a0-a273-b7f46763f9c6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a1e6f891-7f3e-44a3-8d2c-75e2e9b3a801","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:56:56.295Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:27.651Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"1ef80b59-45a1-4be3-8c5e-a0f10a244b3c","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d43447d7-63fa-487d-811e-0fe89f377aee","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:27.651Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:31.781Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b11fe819-0044-435e-a561-cf84750a5e7f","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"58e9ea11-06ca-4fd3-aae8-f0ca52a8d67b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:31.781Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:33.818Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"98742fb8-eae7-407a-9af2-c2462cc4d920","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8f8ce4c0-c3d3-457c-b464-2e3b1f6e2e0d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:33.818Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:30.173Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e6e1ca85-2540-40a8-ad0a-4ef18c7611b5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"ec4f67c3-3258-4f86-86aa-9d4a4d7d7cb7","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:30.173Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:36.022Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"e02d8e53-ae78-4337-87b4-629c63ed7152","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"623af3e5-35d4-4a9c-83d4-81669644a8f0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:36.022Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:39.934Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"63c7c0f2-6ff7-4c62-a0dc-e7a56b70d455","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"1a332d95-6e4e-4f90-b914-4160603b615f","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:39.934Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:37.888Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"7d3423e1-0dd5-4d99-b983-4e2c5d0d0ca6","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"8e6741ba-cfa8-4f36-bbf2-d427876461e0","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:37.888Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:41.967Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"a92b12a1-41b9-4d06-8007-c17224c939c0","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"d023f910-16aa-4a28-96dd-6eca9d41a70b","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:41.967Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:57:44.003Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"522751f7-60a7-4f7b-8e6b-7e82031201e9","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"7f1d9c28-c2aa-44f6-8c44-7b610838c42a","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:57:44.003Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:04.577Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"044140a7-3b42-48ed-94d0-c034aebb83dc","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"bd6b37a3-bda1-466c-9483-c19843b408d2","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:04.577Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:06.539Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"52bf3881-3a0e-48b3-92af-00a483789663","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"67b1ca54-7c1e-46b0-a492-4b2694a609c5","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:06.539Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:08.574Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"540a29f0-3c2e-4144-95ef-bc8b2213cef3","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"83ca49b7-11c0-4e65-b8b4-7f8f828966d1","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:08.574Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:12.639Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"b321a398-273c-4864-8ecd-925305a92994","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"6d18c443-a2f8-4c87-b086-eeb364768fdf","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:12.639Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:10.606Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"f56ed5d3-3863-49bf-b51a-33a4c33d04e5","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"5c446641-a9f2-42c7-88c6-53e344d20c96","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:10.606Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:18.756Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"c26b1b58-4cfa-4576-9d9b-d92ca1b6b950","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"409ab498-7312-4f8b-ab9c-3960e507c188","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:18.756Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:14.673Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"d5eb5dec-1ad5-4d64-905c-3c5fdfe15586","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"a1ee2aa8-0d4d-4729-9f30-82493e9bc99d","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:14.673Z","updated_by":"elastic","version":1}
 {"created_at":"2020-01-16T20:58:16.720Z","created_by":"elastic","description":"abc","enabled":true,"false_positives":[],"filters":[],"from":"now-240s","id":"711b4665-16c6-4bb3-9bb8-279c604e1696","immutable":false,"index":["auditbeat-*"],"interval":"1m","language":"kuery","max_signals":8000,"meta":{"from":"3m"},"name":"abc","output_index":".siem-signals-default","query":"agent.name : \"abc\"","references":[],"risk_score":21,"rule_id":"b49e2a4b-25c7-4bb7-89b1-3e9ff1dd2f41","severity":"low","tags":[],"threats":[],"to":"now","type":"query","updated_at":"2020-01-16T20:58:16.720Z","updated_by":"elastic","version":1}