Re-apply fix for auditd dashboard (#27672)

adriansr · web-flow · commit a389f383da38 · 2021-08-31T21:38:53.000+02:00
Re-applies the fix introduced by #27646, as it's been reverted in #27636. This is caused by merging PRs in a different order than in master.
diff --git a/filebeat/module/auditd/_meta/kibana/7/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858-ecs.json b/filebeat/module/auditd/_meta/kibana/7/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858-ecs.json
@@ -7,7 +7,7 @@
                 "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index",
                 "query": {
                     "language": "kuery",
-                    "query": "event.action:EXECVE"
+                    "query": "event.action:execve"
                 }
             }
         },

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@`
`7`	`7`	`"indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index",`
`8`	`8`	`"query": {`
`9`	`9`	`"language": "kuery",`
`10`		`- "query": "event.action:EXECVE"`
	`10`	`+ "query": "event.action:execve"`
`11`	`11`	`}`
`12`	`12`	`}`
`13`	`13`	`},`