{"id": "sbt-sa-metric-unique-devices", "type": "visualization", "attributes": {"title": "Sparrow BT — Unique Devices", "visState": "{\"title\": \"Sparrow BT — Unique Devices\", \"type\": \"metric\", \"params\": {\"addTooltip\": true, \"addLegend\": false, \"type\": \"metric\", \"metric\": {\"percentageMode\": false, \"useRanges\": false, \"colorSchema\": \"Green to Red\", \"metricColorMode\": \"None\", \"colorsRange\": [{\"from\": 0, \"to\": 10000}], \"labels\": {\"show\": true}, \"invertColors\": false, \"style\": {\"bgFill\": \"#000\", \"bgColor\": false, \"labelColor\": false, \"subText\": \"\", \"fontSize\": 60}}}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"cardinality\", \"schema\": \"metric\", \"params\": {\"field\": \"source.mac\", \"customLabel\": \"Devices\"}}]}", "uiStateJSON": "{}", "description": "Count of distinct BT devices observed (by source.mac).", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-pie-type", "type": "visualization", "attributes": {"title": "Sparrow BT — BLE vs Classic", "visState": "{\"title\": \"Sparrow BT — BLE vs Classic\", \"type\": \"pie\", \"params\": {\"type\": \"pie\", \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"isDonut\": false, \"labels\": {\"show\": true, \"values\": true, \"last_level\": true, \"truncate\": 100}}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"bluetooth.type\", \"size\": 5, \"order\": \"desc\", \"orderBy\": \"1\", \"customLabel\": \"Type\"}}]}", "uiStateJSON": "{}", "description": "BT device type distribution.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-pie-mac-rand", "type": "visualization", "attributes": {"title": "Sparrow BT — MAC Randomization", "visState": "{\"title\": \"Sparrow BT — MAC Randomization\", \"type\": \"pie\", \"params\": {\"type\": \"pie\", \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"isDonut\": false, \"labels\": {\"show\": true, \"values\": true, \"last_level\": true, \"truncate\": 100}}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"bluetooth.mac.randomized\", \"size\": 3, \"order\": \"desc\", \"orderBy\": \"1\", \"customLabel\": \"Randomized MAC\"}}]}", "uiStateJSON": "{}", "description": "How many devices advertise with a randomized (privacy) MAC versus a public MAC.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-metric-new-devices", "type": "visualization", "attributes": {"title": "Sparrow BT — New Devices (< 5 min)", "visState": "{\"title\": \"Sparrow BT — New Devices\", \"type\": \"metric\", \"params\": {\"addTooltip\": true, \"addLegend\": false, \"type\": \"metric\", \"metric\": {\"percentageMode\": false, \"useRanges\": false, \"colorSchema\": \"Green to Red\", \"metricColorMode\": \"None\", \"colorsRange\": [{\"from\": 0, \"to\": 10000}], \"labels\": {\"show\": true}, \"invertColors\": false, \"style\": {\"bgFill\": \"#000\", \"bgColor\": false, \"labelColor\": false, \"subText\": \"\", \"fontSize\": 60}}}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"cardinality\", \"schema\": \"metric\", \"params\": {\"field\": \"source.mac\", \"customLabel\": \"New devices\"}}]}", "uiStateJSON": "{}", "description": "Count of distinct devices whose first_seen is within the last 5 minutes.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"observed.age_seconds < 300\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-pie-class", "type": "visualization", "attributes": {"title": "Sparrow BT — Device Class Distribution", "visState": "{\"title\": \"Sparrow BT — Device Class Distribution\", \"type\": \"pie\", \"params\": {\"type\": \"pie\", \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"isDonut\": false, \"labels\": {\"show\": true, \"values\": true, \"last_level\": true, \"truncate\": 100}}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"cardinality\", \"schema\": \"metric\", \"params\": {\"field\": \"source.mac\"}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"device.class_guess\", \"size\": 15, \"order\": \"desc\", \"orderBy\": \"1\", \"customLabel\": \"Device Class\"}}]}", "uiStateJSON": "{}", "description": "Breakdown of classifier device.class_guess (phone / headset / wearable / iot / unknown / ...).", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-pie-company", "type": "visualization", "attributes": {"title": "Sparrow BT — Top Manufacturers", "visState": "{\"title\": \"Sparrow BT — Top Manufacturers\", \"type\": \"pie\", \"params\": {\"type\": \"pie\", \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"isDonut\": false, \"labels\": {\"show\": true, \"values\": true, \"last_level\": true, \"truncate\": 100}}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"cardinality\", \"schema\": \"metric\", \"params\": {\"field\": \"source.mac\"}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"bluetooth.company\", \"size\": 15, \"order\": \"desc\", \"orderBy\": \"1\", \"customLabel\": \"Company\"}}]}", "uiStateJSON": "{}", "description": "Top 15 companies by unique device count.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-table-closest-range", "type": "visualization", "attributes": {"title": "Sparrow BT — Closest Devices (Estimated Range)", "visState": "{\"title\": \"Sparrow BT — Closest Devices\", \"type\": \"table\", \"params\": {\"perPage\": 20, \"showPartialRows\": false, \"showMetricsAtAllLevels\": false, \"sort\": {\"columnIndex\": 4, \"direction\": \"asc\"}, \"showTotal\": false, \"totalFunc\": \"sum\"}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Obs\"}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"source.mac\", \"size\": 20, \"order\": \"asc\", \"orderBy\": \"4\", \"customLabel\": \"MAC\"}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"bluetooth.name\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Name\"}}, {\"id\": \"6\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"bluetooth.company\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Company\"}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"min\", \"schema\": \"metric\", \"params\": {\"field\": \"bluetooth.ibeacon_range_m\", \"customLabel\": \"Range (m)\"}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"max\", \"schema\": \"metric\", \"params\": {\"field\": \"signal.strength_dbm\", \"customLabel\": \"Max RSSI\"}}, {\"id\": \"7\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"device.class_guess\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Class\"}}]}", "uiStateJSON": "{}", "description": "Estimated range for BLE devices advertising tx power (iBeacon Measured Power, Eddystone TX_POWER, AltBeacon, or AD Type 0x0A). Sorted by range ascending — closest first. Path-loss model assumes open air; indoor accuracy typically ±50%.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"bluetooth.ibeacon_range_m > 0\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-table-strongest", "type": "visualization", "attributes": {"title": "Sparrow BT — Strongest Signal (Closest Proxy)", "visState": "{\"title\": \"Sparrow BT — Strongest Signal\", \"type\": \"table\", \"params\": {\"perPage\": 20, \"showPartialRows\": false, \"showMetricsAtAllLevels\": false, \"sort\": {\"columnIndex\": 3, \"direction\": \"desc\"}, \"showTotal\": false, \"totalFunc\": \"sum\"}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Obs\"}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"source.mac\", \"size\": 20, \"order\": \"desc\", \"orderBy\": \"3\", \"customLabel\": \"MAC\"}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"max\", \"schema\": \"metric\", \"params\": {\"field\": \"signal.strength_dbm\", \"customLabel\": \"Max RSSI (dBm)\"}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"bluetooth.name\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Name\"}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"bluetooth.company\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Company\"}}, {\"id\": \"6\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"device.class_guess\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Class\"}}]}", "uiStateJSON": "{}", "description": "Ordinal proximity ranking by max(signal.strength_dbm). Works for devices that do NOT advertise tx power. Not a metric distance — just 'strongest = likely closest'.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-table-new-devices", "type": "visualization", "attributes": {"title": "Sparrow BT — New Devices (Last 5 Minutes)", "visState": "{\"title\": \"Sparrow BT — New Devices\", \"type\": \"table\", \"params\": {\"perPage\": 20, \"showPartialRows\": false, \"showMetricsAtAllLevels\": false, \"sort\": {\"columnIndex\": 5, \"direction\": \"desc\"}, \"showTotal\": false, \"totalFunc\": \"sum\"}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Obs\"}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"source.mac\", \"size\": 30, \"order\": \"desc\", \"orderBy\": \"5\", \"customLabel\": \"MAC\"}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"bluetooth.name\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Name\"}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"bluetooth.company\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Company\"}}, {\"id\": \"7\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"device.class_guess\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Class\"}}, {\"id\": \"5\", \"enabled\": true, \"type\": \"max\", \"schema\": \"metric\", \"params\": {\"field\": \"event.ingested\", \"customLabel\": \"Last seen\"}}, {\"id\": \"6\", \"enabled\": true, \"type\": \"max\", \"schema\": \"metric\", \"params\": {\"field\": \"signal.strength_dbm\", \"customLabel\": \"Max RSSI\"}}]}", "uiStateJSON": "{}", "description": "Devices whose observed.age_seconds < 300 — useful for detecting arrivals.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"observed.age_seconds < 300\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-table-top-named", "type": "visualization", "attributes": {"title": "Sparrow BT — Top Named Devices", "visState": "{\"title\": \"Sparrow BT — Top Named Devices\", \"type\": \"table\", \"params\": {\"perPage\": 25, \"showPartialRows\": false, \"showMetricsAtAllLevels\": false, \"sort\": {\"columnIndex\": 1, \"direction\": \"desc\"}, \"showTotal\": false, \"totalFunc\": \"sum\"}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Observations\"}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"bluetooth.name\", \"size\": 25, \"order\": \"desc\", \"orderBy\": \"1\", \"customLabel\": \"Name\"}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"top_hits\", \"schema\": \"metric\", \"params\": {\"field\": \"bluetooth.company\", \"size\": 1, \"sortField\": \"@timestamp\", \"sortOrder\": \"desc\", \"aggregate\": \"concat\", \"customLabel\": \"Company\"}}, {\"id\": \"4\", \"enabled\": true, \"type\": \"max\", \"schema\": \"metric\", \"params\": {\"field\": \"signal.strength_dbm\", \"customLabel\": \"Max RSSI\"}}]}", "uiStateJSON": "{}", "description": "Devices that advertise a name, ranked by observation count.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-line-obs-over-time", "type": "visualization", "attributes": {"title": "Sparrow BT — Observations Over Time", "visState": "{\"title\": \"Sparrow BT — Observations Over Time\", \"type\": \"line\", \"params\": {\"grid\": {\"categoryLines\": false}, \"categoryAxes\": [{\"id\": \"CategoryAxis-1\", \"type\": \"category\", \"position\": \"bottom\", \"show\": true, \"scale\": {\"type\": \"linear\"}, \"labels\": {\"show\": true, \"filter\": true, \"truncate\": 100}, \"title\": {}}], \"valueAxes\": [{\"id\": \"ValueAxis-1\", \"name\": \"LeftAxis-1\", \"type\": \"value\", \"position\": \"left\", \"show\": true, \"scale\": {\"type\": \"linear\", \"mode\": \"normal\"}, \"labels\": {\"show\": true, \"rotate\": 0, \"filter\": false, \"truncate\": 100}, \"title\": {\"text\": \"Observations\"}}], \"seriesParams\": [{\"show\": \"true\", \"type\": \"line\", \"mode\": \"normal\", \"data\": {\"label\": \"Observations\", \"id\": \"1\"}, \"valueAxis\": \"ValueAxis-1\", \"drawLinesBetweenPoints\": true, \"lineWidth\": 2, \"interpolate\": \"linear\", \"showCircles\": true}], \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"times\": [], \"addTimeMarker\": false, \"labels\": {}, \"thresholdLine\": {\"show\": false, \"value\": 10, \"width\": 1, \"style\": \"full\", \"color\": \"#E7664C\"}}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Observations\"}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"date_histogram\", \"schema\": \"segment\", \"params\": {\"field\": \"@timestamp\", \"useNormalizedEsInterval\": true, \"interval\": \"auto\", \"drop_partials\": false, \"min_doc_count\": 1, \"extended_bounds\": {}}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"group\", \"params\": {\"field\": \"observer.id\", \"size\": 5, \"order\": \"desc\", \"orderBy\": \"1\", \"customLabel\": \"Sensor\"}}]}", "uiStateJSON": "{}", "description": "Total BT observations per time bucket, split by observer (sensor).", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-line-obs-by-class", "type": "visualization", "attributes": {"title": "Sparrow BT — Observations Over Time by Device Class", "visState": "{\"title\": \"Sparrow BT — Observations Over Time by Device Class\", \"type\": \"line\", \"params\": {\"grid\": {\"categoryLines\": false}, \"categoryAxes\": [{\"id\": \"CategoryAxis-1\", \"type\": \"category\", \"position\": \"bottom\", \"show\": true, \"scale\": {\"type\": \"linear\"}, \"labels\": {\"show\": true, \"filter\": true, \"truncate\": 100}, \"title\": {}}], \"valueAxes\": [{\"id\": \"ValueAxis-1\", \"name\": \"LeftAxis-1\", \"type\": \"value\", \"position\": \"left\", \"show\": true, \"scale\": {\"type\": \"linear\", \"mode\": \"normal\"}, \"labels\": {\"show\": true, \"rotate\": 0, \"filter\": false, \"truncate\": 100}, \"title\": {\"text\": \"Observations\"}}], \"seriesParams\": [{\"show\": true, \"type\": \"line\", \"mode\": \"normal\", \"data\": {\"label\": \"Observations\", \"id\": \"1\"}, \"valueAxis\": \"ValueAxis-1\", \"drawLinesBetweenPoints\": true, \"lineWidth\": 2, \"interpolate\": \"linear\", \"showCircles\": true}], \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"times\": [], \"addTimeMarker\": false, \"labels\": {}, \"thresholdLine\": {\"show\": false, \"value\": 10, \"width\": 1, \"style\": \"full\", \"color\": \"#E7664C\"}}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Observations\"}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"date_histogram\", \"schema\": \"segment\", \"params\": {\"field\": \"@timestamp\", \"useNormalizedEsInterval\": true, \"interval\": \"auto\", \"drop_partials\": false, \"min_doc_count\": 1, \"extended_bounds\": {}}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"group\", \"params\": {\"field\": \"device.class_guess\", \"size\": 8, \"order\": \"desc\", \"orderBy\": \"1\", \"customLabel\": \"Device Class\"}}]}", "uiStateJSON": "{}", "description": "Time series of BT observations split by device.class_guess. Shows spikes per class (a new phone pops the phone trace; a passing vehicle pops the vehicle trace) for pattern-of-life analysis.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-sa-vega-truly-new", "type": "visualization", "attributes": {"title": "Sparrow BT — Truly New Devices (First-Ever Seen < 5 min)", "visState": "{\"title\": \"Sparrow BT — Truly New Devices (First-Ever Seen < 5 min)\", \"type\": \"vega\", \"params\": {\"spec\": \"{\\\"$schema\\\": \\\"https://vega.github.io/schema/vega-lite/v5.json\\\", \\\"title\\\": {\\\"text\\\": \\\"Truly New BT Devices — First-Ever Seen < 5 min\\\", \\\"anchor\\\": \\\"start\\\", \\\"fontSize\\\": 16}, \\\"config\\\": {\\\"view\\\": {\\\"stroke\\\": null}}, \\\"vconcat\\\": [{\\\"width\\\": 760, \\\"height\\\": 24, \\\"layer\\\": [{\\\"data\\\": {\\\"values\\\": [{\\\"col\\\": \\\"age\\\", \\\"x\\\": 0}, {\\\"col\\\": \\\"mac\\\", \\\"x\\\": 70}, {\\\"col\\\": \\\"name\\\", \\\"x\\\": 210}, {\\\"col\\\": \\\"vendor\\\", \\\"x\\\": 400}, {\\\"col\\\": \\\"class\\\", \\\"x\\\": 560}, {\\\"col\\\": \\\"rssi\\\", \\\"x\\\": 680}]}, \\\"mark\\\": {\\\"type\\\": \\\"text\\\", \\\"align\\\": \\\"left\\\", \\\"baseline\\\": \\\"middle\\\", \\\"fontSize\\\": 12, \\\"fontWeight\\\": \\\"bold\\\", \\\"color\\\": \\\"#666\\\"}, \\\"encoding\\\": {\\\"x\\\": {\\\"field\\\": \\\"x\\\", \\\"type\\\": \\\"quantitative\\\", \\\"axis\\\": null, \\\"scale\\\": {\\\"domain\\\": [0, 760]}}, \\\"text\\\": {\\\"field\\\": \\\"col\\\", \\\"type\\\": \\\"nominal\\\"}, \\\"y\\\": {\\\"datum\\\": 8}}}, {\\\"data\\\": {\\\"values\\\": [{\\\"x0\\\": 0, \\\"x1\\\": 760}]}, \\\"mark\\\": {\\\"type\\\": \\\"rule\\\", \\\"color\\\": \\\"#bbb\\\", \\\"strokeWidth\\\": 1}, \\\"encoding\\\": {\\\"x\\\": {\\\"field\\\": \\\"x0\\\", \\\"type\\\": \\\"quantitative\\\", \\\"axis\\\": null, \\\"scale\\\": {\\\"domain\\\": [0, 760]}}, \\\"x2\\\": {\\\"field\\\": \\\"x1\\\"}, \\\"y\\\": {\\\"datum\\\": 22}}}]}, {\\\"data\\\": {\\\"url\\\": {\\\"index\\\": \\\"sparrow-bt-*\\\", \\\"body\\\": {\\\"size\\\": 0, \\\"query\\\": {\\\"match_all\\\": {}}, \\\"aggs\\\": {\\\"new_macs\\\": {\\\"terms\\\": {\\\"field\\\": \\\"source.mac\\\", \\\"size\\\": 100, \\\"order\\\": {\\\"first_ever\\\": \\\"desc\\\"}}, \\\"aggs\\\": {\\\"first_ever\\\": {\\\"min\\\": {\\\"field\\\": \\\"@timestamp\\\"}}, \\\"last_seen\\\": {\\\"max\\\": {\\\"field\\\": \\\"@timestamp\\\"}}, \\\"name\\\": {\\\"top_hits\\\": {\\\"size\\\": 1, \\\"_source\\\": [\\\"bluetooth.name\\\"], \\\"sort\\\": [{\\\"@timestamp\\\": \\\"desc\\\"}]}}, \\\"vendor\\\": {\\\"top_hits\\\": {\\\"size\\\": 1, \\\"_source\\\": [\\\"bluetooth.company\\\"], \\\"sort\\\": [{\\\"@timestamp\\\": \\\"desc\\\"}]}}, \\\"class_guess\\\": {\\\"top_hits\\\": {\\\"size\\\": 1, \\\"_source\\\": [\\\"device.class_guess\\\"], \\\"sort\\\": [{\\\"@timestamp\\\": \\\"desc\\\"}]}}, \\\"max_signal\\\": {\\\"max\\\": {\\\"field\\\": \\\"signal.strength_dbm\\\"}}, \\\"only_truly_new\\\": {\\\"bucket_selector\\\": {\\\"buckets_path\\\": {\\\"f\\\": \\\"first_ever\\\"}, \\\"script\\\": {\\\"source\\\": \\\"params.f >= (System.currentTimeMillis() - 300000L)\\\", \\\"lang\\\": \\\"painless\\\"}}}}}}}}, \\\"format\\\": {\\\"property\\\": \\\"aggregations.new_macs.buckets\\\"}}, \\\"transform\\\": [{\\\"calculate\\\": \\\"datum.key\\\", \\\"as\\\": \\\"mac\\\"}, {\\\"calculate\\\": \\\"datum.name.hits.hits.length > 0 && datum.name.hits.hits[0]._source.bluetooth ? datum.name.hits.hits[0]._source.bluetooth.name : '(no name)'\\\", \\\"as\\\": \\\"name_txt\\\"}, {\\\"calculate\\\": \\\"datum.vendor.hits.hits.length > 0 && datum.vendor.hits.hits[0]._source.bluetooth ? datum.vendor.hits.hits[0]._source.bluetooth.company : '(unknown)'\\\", \\\"as\\\": \\\"vendor_txt\\\"}, {\\\"calculate\\\": \\\"datum.class_guess.hits.hits.length > 0 && datum.class_guess.hits.hits[0]._source.device ? datum.class_guess.hits.hits[0]._source.device.class_guess : '?'\\\", \\\"as\\\": \\\"class_txt\\\"}, {\\\"calculate\\\": \\\"round((now() - datum.first_ever.value) / 1000) + 's ago'\\\", \\\"as\\\": \\\"age_txt\\\"}, {\\\"calculate\\\": \\\"datum.max_signal.value != null ? round(datum.max_signal.value) + ' dBm' : ''\\\", \\\"as\\\": \\\"rssi_txt\\\"}, {\\\"window\\\": [{\\\"op\\\": \\\"row_number\\\", \\\"as\\\": \\\"row_num\\\"}]}], \\\"layer\\\": [{\\\"mark\\\": {\\\"type\\\": \\\"text\\\", \\\"align\\\": \\\"left\\\", \\\"baseline\\\": \\\"middle\\\", \\\"fontSize\\\": 12, \\\"font\\\": \\\"monospace\\\"}, \\\"encoding\\\": {\\\"y\\\": {\\\"field\\\": \\\"row_num\\\", \\\"type\\\": \\\"ordinal\\\", \\\"axis\\\": null, \\\"sort\\\": \\\"ascending\\\"}, \\\"x\\\": {\\\"datum\\\": 0, \\\"axis\\\": null}, \\\"text\\\": {\\\"field\\\": \\\"age_txt\\\", \\\"type\\\": \\\"nominal\\\"}, \\\"color\\\": {\\\"value\\\": \\\"#bd4c4c\\\"}}}, {\\\"mark\\\": {\\\"type\\\": \\\"text\\\", \\\"align\\\": \\\"left\\\", \\\"baseline\\\": \\\"middle\\\", \\\"fontSize\\\": 12, \\\"font\\\": \\\"monospace\\\"}, \\\"encoding\\\": {\\\"y\\\": {\\\"field\\\": \\\"row_num\\\", \\\"type\\\": \\\"ordinal\\\", \\\"axis\\\": null, \\\"sort\\\": \\\"ascending\\\"}, \\\"x\\\": {\\\"datum\\\": 70, \\\"axis\\\": null}, \\\"text\\\": {\\\"field\\\": \\\"mac\\\", \\\"type\\\": \\\"nominal\\\"}}}, {\\\"mark\\\": {\\\"type\\\": \\\"text\\\", \\\"align\\\": \\\"left\\\", \\\"baseline\\\": \\\"middle\\\", \\\"fontSize\\\": 12}, \\\"encoding\\\": {\\\"y\\\": {\\\"field\\\": \\\"row_num\\\", \\\"type\\\": \\\"ordinal\\\", \\\"axis\\\": null, \\\"sort\\\": \\\"ascending\\\"}, \\\"x\\\": {\\\"datum\\\": 210, \\\"axis\\\": null}, \\\"text\\\": {\\\"field\\\": \\\"name_txt\\\", \\\"type\\\": \\\"nominal\\\"}}}, {\\\"mark\\\": {\\\"type\\\": \\\"text\\\", \\\"align\\\": \\\"left\\\", \\\"baseline\\\": \\\"middle\\\", \\\"fontSize\\\": 12}, \\\"encoding\\\": {\\\"y\\\": {\\\"field\\\": \\\"row_num\\\", \\\"type\\\": \\\"ordinal\\\", \\\"axis\\\": null, \\\"sort\\\": \\\"ascending\\\"}, \\\"x\\\": {\\\"datum\\\": 400, \\\"axis\\\": null}, \\\"text\\\": {\\\"field\\\": \\\"vendor_txt\\\", \\\"type\\\": \\\"nominal\\\"}}}, {\\\"mark\\\": {\\\"type\\\": \\\"text\\\", \\\"align\\\": \\\"left\\\", \\\"baseline\\\": \\\"middle\\\", \\\"fontSize\\\": 12}, \\\"encoding\\\": {\\\"y\\\": {\\\"field\\\": \\\"row_num\\\", \\\"type\\\": \\\"ordinal\\\", \\\"axis\\\": null, \\\"sort\\\": \\\"ascending\\\"}, \\\"x\\\": {\\\"datum\\\": 560, \\\"axis\\\": null}, \\\"text\\\": {\\\"field\\\": \\\"class_txt\\\", \\\"type\\\": \\\"nominal\\\"}}}, {\\\"mark\\\": {\\\"type\\\": \\\"text\\\", \\\"align\\\": \\\"left\\\", \\\"baseline\\\": \\\"middle\\\", \\\"fontSize\\\": 12}, \\\"encoding\\\": {\\\"y\\\": {\\\"field\\\": \\\"row_num\\\", \\\"type\\\": \\\"ordinal\\\", \\\"axis\\\": null, \\\"sort\\\": \\\"ascending\\\"}, \\\"x\\\": {\\\"datum\\\": 680, \\\"axis\\\": null}, \\\"text\\\": {\\\"field\\\": \\\"rssi_txt\\\", \\\"type\\\": \\\"nominal\\\"}}}], \\\"height\\\": {\\\"step\\\": 20}, \\\"width\\\": 760}], \\\"spacing\\\": 2}\"}, \"aggs\": []}", "uiStateJSON": "{}", "description": "BT devices whose MIN(@timestamp) across the entire history is within the last 5 minutes. True 'never seen before' view. Columns: age, source.mac, bluetooth.name, bluetooth.company, device.class_guess, max RSSI.", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "sparrow-bt"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
{"id": "sbt-dashboard-situational-awareness", "type": "dashboard", "attributes": {"title": "Sparrow Bluetooth — Situational Awareness", "description": "At-a-glance BT situational awareness: device counts, classes, distances, arrivals, and activity over time. All fields ECS 8.17 against sparrow-bt-* index.", "panelsJSON": "[{\"panelIndex\": \"1\", \"gridData\": {\"x\": 0, \"y\": 0, \"w\": 12, \"h\": 12, \"i\": \"1\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-metric-unique-devices\", \"title\": \"Sparrow BT — Unique Devices\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"2\", \"gridData\": {\"x\": 12, \"y\": 0, \"w\": 12, \"h\": 12, \"i\": \"2\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-pie-type\", \"title\": \"Sparrow BT — BLE vs Classic\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"3\", \"gridData\": {\"x\": 24, \"y\": 0, \"w\": 12, \"h\": 12, \"i\": \"3\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-pie-mac-rand\", \"title\": \"Sparrow BT — MAC Randomization\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"4\", \"gridData\": {\"x\": 36, \"y\": 0, \"w\": 12, \"h\": 12, \"i\": \"4\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-metric-new-devices\", \"title\": \"Sparrow BT — New Devices (<5min)\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"5\", \"gridData\": {\"x\": 0, \"y\": 12, \"w\": 24, \"h\": 20, \"i\": \"5\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-pie-class\", \"title\": \"Sparrow BT — Device Class Distribution\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"6\", \"gridData\": {\"x\": 24, \"y\": 12, \"w\": 24, \"h\": 20, \"i\": \"6\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-pie-company\", \"title\": \"Sparrow BT — Top Manufacturers\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"7\", \"gridData\": {\"x\": 0, \"y\": 32, \"w\": 24, \"h\": 20, \"i\": \"7\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-table-closest-range\", \"title\": \"Sparrow BT — Closest Devices (Estimated Range)\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"8\", \"gridData\": {\"x\": 24, \"y\": 32, \"w\": 24, \"h\": 20, \"i\": \"8\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-table-strongest\", \"title\": \"Sparrow BT — Strongest Signal (Closest Proxy)\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"9\", \"gridData\": {\"x\": 0, \"y\": 52, \"w\": 24, \"h\": 18, \"i\": \"9\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-table-new-devices\", \"title\": \"Sparrow BT — New Devices (Last 5 Minutes)\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"10\", \"gridData\": {\"x\": 24, \"y\": 52, \"w\": 24, \"h\": 18, \"i\": \"10\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-table-top-named\", \"title\": \"Sparrow BT — Top Named Devices\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"11\", \"gridData\": {\"x\": 0, \"y\": 70, \"w\": 48, \"h\": 16, \"i\": \"11\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-line-obs-over-time\", \"title\": \"Sparrow BT — Observations Over Time\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"12\", \"gridData\": {\"x\": 0, \"y\": 86, \"w\": 48, \"h\": 16, \"i\": \"12\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-line-obs-by-class\", \"title\": \"Sparrow BT — Observations Over Time by Device Class\", \"embeddableConfig\": {\"enhancements\": {}}}, {\"panelIndex\": \"13\", \"gridData\": {\"x\": 0, \"y\": 102, \"w\": 48, \"h\": 24, \"i\": \"13\"}, \"version\": \"8.17.0\", \"type\": \"visualization\", \"id\": \"sbt-sa-vega-truly-new\", \"title\": \"Sparrow BT — Truly New Devices (First-Ever Seen < 5 min)\", \"embeddableConfig\": {\"enhancements\": {}}}]", "optionsJSON": "{\"useMargins\": true, \"syncColors\": false, \"syncCursor\": true, \"syncTooltips\": false, \"hidePanelTitles\": false}", "timeRestore": false, "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"}}, "references": [{"name": "panel_0", "type": "visualization", "id": "sbt-sa-metric-unique-devices"}, {"name": "panel_1", "type": "visualization", "id": "sbt-sa-pie-type"}, {"name": "panel_2", "type": "visualization", "id": "sbt-sa-pie-mac-rand"}, {"name": "panel_3", "type": "visualization", "id": "sbt-sa-metric-new-devices"}, {"name": "panel_4", "type": "visualization", "id": "sbt-sa-pie-class"}, {"name": "panel_5", "type": "visualization", "id": "sbt-sa-pie-company"}, {"name": "panel_6", "type": "visualization", "id": "sbt-sa-table-closest-range"}, {"name": "panel_7", "type": "visualization", "id": "sbt-sa-table-strongest"}, {"name": "panel_8", "type": "visualization", "id": "sbt-sa-table-new-devices"}, {"name": "panel_9", "type": "visualization", "id": "sbt-sa-table-top-named"}, {"name": "panel_10", "type": "visualization", "id": "sbt-sa-line-obs-over-time"}, {"name": "panel_11", "type": "visualization", "id": "sbt-sa-line-obs-by-class"}, {"name": "panel_12", "type": "visualization", "id": "sbt-sa-vega-truly-new"}], "coreMigrationVersion": "8.17.0", "typeMigrationVersion": "8.0.0", "managed": false}
