{
  "name": "Windows server estate",
  "description": "IIS, SQL Server, Exchange and the file servers -- the Windows tier as services rather than a Security channel",
  "default_earliest": "-24h",
  "default_latest": "now",
  "panels": [
    {
      "title": "IIS requests",
      "query": "service=iis | stats count",
      "viz_type": "single_stat",
      "position_x": 0,
      "position_y": 0,
      "width": 3,
      "height": 3,
      "query_language": "spl",
      "sort_order": 0
    },
    {
      "title": "IIS 5xx",
      "query": "service=iis | where status>=500 | stats count",
      "viz_type": "single_stat",
      "position_x": 3,
      "position_y": 0,
      "width": 3,
      "height": 3,
      "query_language": "spl",
      "sort_order": 1
    },
    {
      "title": "SQL deadlocks",
      "query": "service=mssql event_kind=deadlock | stats count",
      "viz_type": "single_stat",
      "position_x": 6,
      "position_y": 0,
      "width": 3,
      "height": 3,
      "query_language": "spl",
      "sort_order": 2
    },
    {
      "title": "Mail bounces",
      "query": "service=exchange event_kind=bounce | stats count",
      "viz_type": "single_stat",
      "position_x": 9,
      "position_y": 0,
      "width": 3,
      "height": 3,
      "query_language": "spl",
      "sort_order": 3
    },
    {
      "title": "IIS requests by site and host",
      "query": "service=iis | stats count by site, host | sort -count",
      "viz_type": "bar",
      "position_x": 0,
      "position_y": 3,
      "width": 12,
      "height": 5,
      "viz_config": {
        "x_column": "site",
        "value_column": "count",
        "series_column": "host",
        "stacked": "true"
      },
      "query_language": "spl",
      "sort_order": 4
    },
    {
      "title": "IIS status mix",
      "query": "service=iis | stats count by status | sort -count",
      "viz_type": "bar",
      "position_x": 0,
      "position_y": 8,
      "width": 6,
      "height": 5,
      "viz_config": {
        "x_column": "status",
        "value_column": "count"
      },
      "query_language": "spl",
      "sort_order": 5
    },
    {
      "title": "SQL Server events by database",
      "query": "service=mssql | stats count by db, event_kind",
      "viz_type": "bar",
      "position_x": 6,
      "position_y": 8,
      "width": 6,
      "height": 5,
      "viz_config": {
        "x_column": "db",
        "value_column": "count",
        "series_column": "event_kind",
        "stacked": "true"
      },
      "query_language": "spl",
      "sort_order": 6
    },
    {
      "title": "Busiest shares",
      "query": "service=smb | stats count by share | sort -count | head 10",
      "viz_type": "top_n",
      "position_x": 0,
      "position_y": 13,
      "width": 6,
      "height": 5,
      "viz_config": {
        "label_column": "share",
        "value_column": "count"
      },
      "query_language": "spl",
      "sort_order": 7
    },
    {
      "title": "Denied share access",
      "query": "service=smb event_kind=share_denied | sort -timestamp | head 25 | fields timestamp, host, share, winevt.target_user, message",
      "viz_type": "table",
      "position_x": 6,
      "position_y": 13,
      "width": 6,
      "height": 5,
      "query_language": "spl",
      "sort_order": 8
    },
    {
      "title": "SQL login failures and deadlocks",
      "query": "service=mssql event_kind!=login | sort -timestamp | head 25 | fields timestamp, host, db, event_kind, message",
      "viz_type": "table",
      "position_x": 0,
      "position_y": 18,
      "width": 12,
      "height": 5,
      "query_language": "spl",
      "sort_order": 9
    }
  ]
}