Thanks for your support Garrett (@spong). I can't seem to attach the export as an ndjson file as it seems to only allow for image uploads so the json code is below, hopefully you can just copy that in to an ndjson file and import that? Trying to view the JSON myself I think it looks like the columns are there but this isn't my skillset!
If its easier for me to share this with you another way let me know.
Appreciate your help
Phil
{"savedObjectId":"c548bf70-b654-11ec-8a31-7ba9a7f2f52c","version":"WzE5MjE4NSwyXQ==","columns":[{"columnHeaderType":"not-filtered","id":"@timestamp","type":"number"},{"columnHeaderType":"not-filtered","id":"event.action"},{"aggregatable":true,"description":"Short name or login of the user.","columnHeaderType":"not-filtered","id":"source.user.name","category":"source","type":"string","example":"a.einstein"},{"columnHeaderType":"not-filtered","id":"source.ip"},{"aggregatable":true,"description":"Bytes sent from the source to the destination.","columnHeaderType":"not-filtered","id":"source.bytes","category":"source","type":"number"},{"columnHeaderType":"not-filtered","id":"destination.ip"},{"aggregatable":true,"description":"Port of the destination.","columnHeaderType":"not-filtered","id":"destination.port","category":"destination","type":"number"},{"aggregatable":true,"description":"Bytes sent from the destination to the source.","columnHeaderType":"not-filtered","id":"destination.bytes","category":"destination","type":"number"}],"dataProviders":[{"excluded":false,"and":[],"kqlQuery":"","name":"{source.ip}","queryMatch":{"field":"source.ip","value":"{source.ip}","operator":":"},"id":"timeline-1-1210648b-8456-4012-8fae-92597b54c9c7","type":"template","enabled":true}],"description":"View outbound blocked traffic through the Palo","eventType":"all","filters":[],"kqlMode":"filter","timelineType":"template","kqlQuery":{"filterQuery":{"serializedQuery":"{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"match\":{\"event.module\":\"panw\"}}],\"minimum_should_match\":1}},{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"match\":{\"event.action\":\"flow_dropped\"}}],\"minimum_should_match\":1}},{\"bool\":{\"should\":[{\"match\":{\"event.action\":\"flow_denied\"}}],\"minimum_should_match\":1}}],\"minimum_should_match\":1}}]}}","kuery":{"expression":"event.module : panw and event.action : (flow_dropped or flow_denied) ","kind":"kuery"}}},"title":"Palo Outbound Blocked","sort":[{"columnType":"number","sortDirection":"desc","columnId":"@timestamp"}],"templateTimelineId":"2829c772-fe8e-470c-bac4-7b960ac797a1","templateTimelineVersion":1,"created":1649324049393,"createdBy":"soc","updated":1649424529242,"updatedBy":"soc","dateRange":{"start":"2022-04-06T09:10:18.488Z","end":"2022-04-07T09:10:18.488Z"},"indexNames":["filebeat-*"],"eqlOptions":{"tiebreakerField":"","size":100,"query":"","eventCategoryField":"event.category","timestampField":"@timestamp"},"favorite":[],"savedQueryId":null,"dataViewId":"filebeat-*","eventNotes":[],"globalNotes":[],"pinnedEventIds":[]}
