admin / ad exp

{ "apiVersion": "dashboard.grafana.app/v2", "kind": "Dashboard", "metadata": { "name": "ad-samba-audit", "generation": 1, "labels": {}, "annotations": {} }, "spec": { "annotations": [ { "kind": "AnnotationQuery", "spec": { "query": { "kind": "DataQuery", "group": "grafana", "version": "v0", "spec": {}, "labels": { "grafana.app/export-label": "grafana-1" } }, "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "builtIn": true } } ], "cursorSync": "Off", "editable": true, "elements": { "panel-1": { "kind": "Panel", "spec": { "id": 1, "title": "Logins OK", "description": "Успешные входы в домен (samba_auth): машинные и пользовательские, разбивка по домену.", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "machine_login", "groupBy": [ { "params": ["$interval"], "type": "time" }, { "params": ["domain::tag"], "type": "tag" }, { "params": ["null"], "type": "fill" } ], "measurement": "samba_auth", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": ["client_account"], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "status::tag", "operator": "=", "value": "NT_STATUS_OK" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^MACHINE/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } }, { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "user_login", "groupBy": [ { "params": ["$interval"], "type": "time" }, { "params": ["domain::tag"], "type": "tag" }, { "params": ["null"], "type": "fill" } ], "measurement": "samba_auth", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^user/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": ["client_account"], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "status::tag", "operator": "=", "value": "NT_STATUS_OK" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^user/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "B", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "single", "sort": "none" } }, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 10, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-2": { "kind": "Panel", "spec": { "id": 2, "title": "DSDB: изменения по операциям", "description": "Число изменений объектов каталога (samba_dsdb), разбивка по типу операции.", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "measurement": "samba_dsdb", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"status_code\") FROM \"samba_dsdb\" WHERE $timeFilter GROUP BY time($interval), \"operation\"::tag fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "groupBy": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "bars", "fillOpacity": 50, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "spanNulls": false, "stacking": { "group": "A", "mode": "normal" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-3": { "kind": "Panel", "spec": { "id": 3, "title": "DSDB: система vs пользователь", "description": "Изменения каталога с разбивкой по performedAsSystem (true = выполнено системой).", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "measurement": "samba_dsdb", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"status_code\") FROM \"samba_dsdb\" WHERE $timeFilter GROUP BY time($interval), \"as_system\"::tag fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "groupBy": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 20, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-4": { "kind": "Panel", "spec": { "id": 4, "title": "DSDB: топ инициаторов (SID)", "description": "Кто инициировал изменения каталога — разбивка по userSid.", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "measurement": "samba_dsdb", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"status_code\") FROM \"samba_dsdb\" WHERE $timeFilter GROUP BY time($interval), \"user_sid\"::tag fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "groupBy": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "legend": { "calcs": ["sum"], "displayMode": "table", "placement": "right", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "bars", "fillOpacity": 50, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "spanNulls": false, "stacking": { "group": "A", "mode": "normal" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-5": { "kind": "Panel", "spec": { "id": 5, "title": "Транзакции: длительность (mean/max)", "description": "Длительность транзакций каталога (samba_dsdb_tx) в микросекундах.", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "measurement": "samba_dsdb_tx", "orderByTime": "ASC", "policy": "default", "query": "SELECT mean(\"duration\") AS \"mean\", max(\"duration\") AS \"max\" FROM \"samba_dsdb_tx\" WHERE $timeFilter GROUP BY time($interval) fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "groupBy": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "legend": { "calcs": ["mean", "max"], "displayMode": "table", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "unit": "µs", "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 10, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-6": { "kind": "Panel", "spec": { "id": 6, "title": "Транзакции по типу действия", "description": "Число транзакций каталога, разбивка по action (commit / rollback / prepare commit / begin).", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "measurement": "samba_dsdb_tx", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"duration\") FROM \"samba_dsdb_tx\" WHERE $timeFilter GROUP BY time($interval), \"action\"::tag fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "groupBy": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "bars", "fillOpacity": 50, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "spanNulls": false, "stacking": { "group": "A", "mode": "normal" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } } }, "layout": { "kind": "GridLayout", "spec": { "items": [ { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 0, "width": 24, "height": 8, "element": { "kind": "ElementReference", "name": "panel-1" } } }, { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 8, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-2" } } }, { "kind": "GridLayoutItem", "spec": { "x": 12, "y": 8, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-3" } } }, { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 16, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-4" } } }, { "kind": "GridLayoutItem", "spec": { "x": 12, "y": 16, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-5" } } }, { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 24, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-6" } } } ] } }, "links": [], "liveNow": false, "preload": false, "tags": ["samba", "ad", "audit"], "timeSettings": { "timezone": "browser", "from": "now-6h", "to": "now", "autoRefresh": "", "autoRefreshIntervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"], "hideTimepicker": false, "fiscalYearStartMonth": 0 }, "title": "Samba AD audit", "variables": [ { "kind": "IntervalVariable", "spec": { "name": "interval", "query": "1s,3s,5s,10s,30s,1m,10m,30m,1h,6h,12h,1d,7d,14d,30d", "current": { "text": "1m", "value": "1m" }, "options": [ { "selected": true, "text": "1m", "value": "1m" }, { "selected": false, "text": "10m", "value": "10m" }, { "selected": false, "text": "30m", "value": "30m" }, { "selected": false, "text": "1h", "value": "1h" }, { "selected": false, "text": "6h", "value": "6h" }, { "selected": false, "text": "12h", "value": "12h" }, { "selected": false, "text": "1d", "value": "1d" } ], "auto": false, "auto_min": "10s", "auto_count": 30, "refresh": "onTimeRangeChanged", "hide": "dontHide", "skipUrlSync": false } } ], "preferences": { "layout": { "kind": "GridLayout", "spec": { "items": [] } } } } }

# Пример конфига AD-exporter. # Положить как /etc/ad-exporter/config.yaml и сделать: chmod 600 (внутри токен). influx: url: http://localhost:8086 org: my-organization # InfluxDB v2 organization bucket: my-initial-bucket # bucket для записи token: my-super-secret-admin-token-string # API-токен (Authorization: Token ...) batch: size: 100 # сколько точек копить до записи flush_interval_secs: 5 # либо записать по таймеру, если батч не набрался files: # Файл аудита Samba DC. В одном файле могут лежать несколько типов событий # (Authentication, Authorization, KDC Authorization) — этот блок мапит только # события Authentication (вход в домен). Строки других типов не содержат # ключей Authentication.* и просто молча пропускаются. - path: /var/log/samba/dc1-auth_audit.json measurement: samba_auth timestamp: timestamp # верхнеуровневое поле времени # Теги индексируются — для группировок в Grafana. # status обязателен: NT_STATUS_OK / код ошибки аутентификации. tags: status: Authentication.status account: Authentication.becameAccount # разрешённый аккаунт (user-288, MACHINE6$) domain: Authentication.becameDomain service: Authentication.serviceDescription # напр. "Kerberos KDC" # Поля — сырые значения. Тип (int/float/string/bool) определяется по JSON. fields: remote: Authentication.remoteAddress # ipv4:192.168.33.16:45230 (высокая кардинальность — поле, не тег) auth_desc: Authentication.authDescription client_account: Authentication.clientAccount # сырой клиентский логин logon_type: Authentication.logonType # int duration: Authentication.duration # int, микросекунды # --- dsdb-аудит: изменения объектов каталога (dsdbChange) --- # Файл dsdb_json_audit. Внутри один тип событий — dsdbChange (Add/Modify/Delete/Rename). - path: /var/log/samba/dc1-dsdb_audit.json measurement: samba_dsdb timestamp: timestamp tags: status: dsdbChange.status # Success / код ошибки operation: dsdbChange.operation # Add / Modify / Delete / Rename user_sid: dsdbChange.userSid # SID инициатора (S-1-5-18 = система) as_system: dsdbChange.performedAsSystem # bool: изменение выполнено системой fields: dn: dsdbChange.dn # объект (высокая кардинальность — поле) status_code: dsdbChange.statusCode # int, 0 = успех tx_id: dsdbChange.transactionId # для связи с журналом транзакций session_id: dsdbChange.sessionId # ВНИМАНИЕ: dsdbChange.remoteAddress намеренно НЕ берём. У системных # изменений он null, а null трактуется как отсутствие ключа => строка была # бы молча отброшена целиком. Если remoteAddress нужен — заведи под клиентские # изменения отдельный поток/файл или мирись с потерей системных событий. # --- dsdb-аудит: транзакции каталога (dsdbTransaction) --- # Файл dsdb_transaction_json_audit. Главная метрика — длительность транзакции. - path: /var/log/samba/dc1-dsdb_transaction.json measurement: samba_dsdb_tx timestamp: timestamp tags: action: dsdbTransaction.action # begin / prepare commit / commit / rollback fields: duration: dsdbTransaction.duration # int, микросекунды tx_id: dsdbTransaction.transactionId # ВНИМАНИЕ: один файл = один блок (маппинг). Один и тот же path нельзя # указать дважды — выживет только последний блок. Чтобы собирать другой тип # событий (Authorization, KDC Authorization), направь его в Samba в отдельный # файл и опиши своим блоком ниже. Пример для Authorization: # # - path: /var/log/samba/dc1-authz_audit.json # measurement: samba_authz # timestamp: timestamp # tags: # account: Authorization.account # domain: Authorization.domain # service: Authorization.serviceDescription # напр. "LDAP" # fields: # remote: Authorization.remoteAddress # auth_type: Authorization.authType