guest / grafana.json

{ "apiVersion": "dashboard.grafana.app/v2", "kind": "Dashboard", "metadata": { "name": "ad-samba-audit2", "generation": 14, "creationTimestamp": "2026-07-03T12:41:09Z", "labels": {}, "annotations": {} }, "spec": { "annotations": [ { "kind": "AnnotationQuery", "spec": { "query": { "kind": "DataQuery", "group": "grafana", "version": "v0", "spec": {} }, "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "builtIn": true } } ], "cursorSync": "Off", "editable": true, "elements": { "panel-1": { "kind": "Panel", "spec": { "id": 1, "title": "Logins OK", "description": "Успешные входы в домен (samba_auth): машинные и пользовательские, разбивка по домену.", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "machine_login", "groupBy": [ { "params": [ "$interval" ], "type": "time" }, { "params": [ "domain::tag" ], "type": "tag" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_auth", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "client_account" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "status::tag", "operator": "=", "value": "NT_STATUS_OK" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^MACHINE/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } }, { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "user_login", "groupBy": [ { "params": [ "$interval" ], "type": "time" }, { "params": [ "domain::tag" ], "type": "tag" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_auth", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^user/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "client_account" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "status::tag", "operator": "=", "value": "NT_STATUS_OK" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^user/" }, { "condition": "OR", "key": "account::tag", "operator": "=~", "value": "/^loadtest/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "B", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "annotations": { "clustering": -1, "multiLane": false }, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "single", "sort": "none" } }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": 80, "color": "red" } ] }, "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 10, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "showValues": false, "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-10": { "kind": "Panel", "spec": { "id": 10, "title": "SMB: подключённых клиентов", "description": "История числа подключённых SMB-клиентов (samba_clients.count).", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "clients", "groupBy": [ { "params": [ "$__interval" ], "type": "time" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_clients", "orderByTime": "ASC", "policy": "default", "query": "SELECT last(\"count\") FROM \"samba_clients\" WHERE $timeFilter GROUP BY time($__interval) fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "count" ], "type": "field" }, { "params": [], "type": "last" } ] ], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "annotations": { "clustering": -1, "multiLane": false }, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "single", "sort": "none" } }, "fieldConfig": { "defaults": { "unit": "none", "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" } ] }, "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 15, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "stepAfter", "lineWidth": 2, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "showValues": false, "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-11": { "kind": "Panel", "spec": { "id": 11, "title": "Authentifications", "description": "Успешные входы в домен (samba_auth): машинные и пользовательские, разбивка по домену.", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "machine_login_1s", "groupBy": [ { "params": [ "1s" ], "type": "time" }, { "params": [ "domain::tag" ], "type": "tag" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_auth", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "client_account" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "status::tag", "operator": "=", "value": "NT_STATUS_OK" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^MACHINE/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } }, { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "user_login_1s", "groupBy": [ { "params": [ "1s" ], "type": "time" }, { "params": [ "domain::tag" ], "type": "tag" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_auth", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^user/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "client_account" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "status::tag", "operator": "=", "value": "NT_STATUS_OK" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^user/" }, { "condition": "OR", "key": "account::tag", "operator": "=~", "value": "/^loadtest/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "B", "hidden": false } }, { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "machine_login_5m", "groupBy": [ { "params": [ "5m" ], "type": "time" }, { "params": [ "domain::tag" ], "type": "tag" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_auth", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "client_account" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "status::tag", "operator": "=", "value": "NT_STATUS_OK" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^MACHINE/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "C", "hidden": false } }, { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "user_login_5m", "groupBy": [ { "params": [ "5m" ], "type": "time" }, { "params": [ "domain::tag" ], "type": "tag" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_auth", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^user/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "client_account" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "status::tag", "operator": "=", "value": "NT_STATUS_OK" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^user/" }, { "condition": "OR", "key": "account::tag", "operator": "=~", "value": "/^loadtest/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "D", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "stat", "version": "13.0.1+security-01", "spec": { "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "vertical", "percentChangeColorMode": "standard", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "showPercentChange": false, "textMode": "auto", "wideLayout": true }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": 80, "color": "red" } ] }, "color": { "mode": "palette-classic" } }, "overrides": [] } } } } }, "panel-2": { "kind": "Panel", "spec": { "id": 2, "title": "DSDB: изменения по операциям", "description": "Число изменений объектов каталога (samba_dsdb), разбивка по типу операции.", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "groupBy": [], "measurement": "samba_dsdb", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"status_code\") FROM \"samba_dsdb\" WHERE $timeFilter GROUP BY time($interval), \"operation\"::tag fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "annotations": { "clustering": -1, "multiLane": false }, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": 80, "color": "red" } ] }, "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "bars", "fillOpacity": 50, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "showValues": false, "spanNulls": false, "stacking": { "group": "A", "mode": "normal" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-3": { "kind": "Panel", "spec": { "id": 3, "title": "DSDB: система vs пользователь", "description": "Изменения каталога с разбивкой по performedAsSystem (true = выполнено системой).", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "groupBy": [], "measurement": "samba_dsdb", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"status_code\") FROM \"samba_dsdb\" WHERE $timeFilter GROUP BY time($interval), \"as_system\"::tag fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "annotations": { "clustering": -1, "multiLane": false }, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": 80, "color": "red" } ] }, "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 20, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "showValues": false, "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-4": { "kind": "Panel", "spec": { "id": 4, "title": "DSDB: топ инициаторов (SID)", "description": "Кто инициировал изменения каталога — разбивка по userSid.", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "groupBy": [], "measurement": "samba_dsdb", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"status_code\") FROM \"samba_dsdb\" WHERE $timeFilter GROUP BY time($interval), \"user_sid\"::tag fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "annotations": { "clustering": -1, "multiLane": false }, "legend": { "calcs": [ "sum" ], "displayMode": "table", "placement": "right", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": 80, "color": "red" } ] }, "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "bars", "fillOpacity": 50, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "showValues": false, "spanNulls": false, "stacking": { "group": "A", "mode": "normal" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-5": { "kind": "Panel", "spec": { "id": 5, "title": "Транзакции: длительность (mean/max)", "description": "Длительность транзакций каталога (samba_dsdb_tx) в микросекундах.", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "groupBy": [], "measurement": "samba_dsdb_tx", "orderByTime": "ASC", "policy": "default", "query": "SELECT mean(\"duration\") AS \"mean\", max(\"duration\") AS \"max\" FROM \"samba_dsdb_tx\" WHERE $timeFilter GROUP BY time($interval) fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "annotations": { "clustering": -1, "multiLane": false }, "legend": { "calcs": [ "mean", "max" ], "displayMode": "table", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "unit": "µs", "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": 80, "color": "red" } ] }, "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 10, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "showValues": false, "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-6": { "kind": "Panel", "spec": { "id": 6, "title": "Транзакции по типу действия", "description": "Число транзакций каталога, разбивка по action (commit / rollback / prepare commit / begin).", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "groupBy": [], "measurement": "samba_dsdb_tx", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"duration\") FROM \"samba_dsdb_tx\" WHERE $timeFilter GROUP BY time($interval), \"action\"::tag fill(null)", "rawQuery": true, "resultFormat": "time_series", "select": [], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "annotations": { "clustering": -1, "multiLane": false }, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": 80, "color": "red" } ] }, "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "bars", "fillOpacity": 50, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "showValues": false, "spanNulls": false, "stacking": { "group": "A", "mode": "normal" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-7": { "kind": "Panel", "spec": { "id": 7, "title": "SMB activity", "description": "", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "user_smb", "groupBy": [ { "params": [ "$interval" ], "type": "time" }, { "params": [ "domain::tag" ], "type": "tag" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_authz", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "auth_type" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "service::tag", "operator": "=", "value": "SMB2" }, { "condition": "AND", "key": "auth_type::field", "operator": "=", "value": "krb5" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^user-/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } }, { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "machine_smb", "groupBy": [ { "params": [ "$interval" ], "type": "time" }, { "params": [ "domain::tag" ], "type": "tag" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_authz", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "auth_type" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "service::tag", "operator": "=", "value": "SMB2" }, { "condition": "AND", "key": "auth_type::field", "operator": "=", "value": "krb5" }, { "condition": "AND", "key": "account::tag", "operator": "=~", "value": "/^MACHINE/" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "B", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "annotations": { "clustering": -1, "multiLane": false }, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "single", "sort": "none" } }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": 80, "color": "red" } ] }, "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 10, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "showValues": false, "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-8": { "kind": "Panel", "spec": { "id": 8, "title": "DNS activity", "description": "", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "rcode=0", "groupBy": [ { "params": [ "$interval" ], "type": "time" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_dns_rcode", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "rcode" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "rcode::field", "operator": "=", "value": "0" }, { "condition": "AND", "key": "direction::tag", "operator": "=", "value": "out_packet" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } }, { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "rcode=3", "groupBy": [ { "params": [ "$interval" ], "type": "time" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_dns_rcode", "orderByTime": "ASC", "policy": "default", "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "rcode" ], "type": "field" }, { "params": [], "type": "count" } ] ], "tags": [ { "key": "rcode::field", "operator": "=", "value": "3" }, { "condition": "AND", "key": "direction::tag", "operator": "=", "value": "out_packet" } ] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "B", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "timeseries", "version": "13.0.1+security-01", "spec": { "options": { "annotations": { "clustering": -1, "multiLane": false }, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "hideZeros": false, "mode": "single", "sort": "none" } }, "fieldConfig": { "defaults": { "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": 80, "color": "red" } ] }, "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 10, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "showValues": false, "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } } }, "overrides": [] } } } } }, "panel-9": { "kind": "Panel", "spec": { "id": 9, "title": "SMB: клиентов сейчас", "description": "Текущее число подключённых SMB-клиентов (последний опрос smbstatus -v, первый блок).", "links": [], "data": { "kind": "QueryGroup", "spec": { "queries": [ { "kind": "PanelQuery", "spec": { "query": { "kind": "DataQuery", "group": "influxdb", "version": "v0", "spec": { "alias": "clients", "groupBy": [ { "params": [ "$interval" ], "type": "time" }, { "params": [ "null" ], "type": "fill" } ], "measurement": "samba_clients", "orderByTime": "ASC", "policy": "default", "query": "SELECT last(\"count\") FROM \"samba_clients\" WHERE $timeFilter GROUP BY time($interval) fill(null)", "rawQuery": false, "resultFormat": "time_series", "select": [ [ { "params": [ "count" ], "type": "field" }, { "params": [], "type": "last" } ] ], "tags": [] }, "labels": { "grafana.app/export-label": "influxdb-1" } }, "refId": "A", "hidden": false } } ], "transformations": [], "queryOptions": {} } }, "vizConfig": { "kind": "VizConfig", "group": "stat", "version": "13.0.1+security-01", "spec": { "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "percentChangeColorMode": "standard", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "showPercentChange": false, "textMode": "auto", "wideLayout": true }, "fieldConfig": { "defaults": { "unit": "none", "thresholds": { "mode": "absolute", "steps": [ { "value": 0, "color": "green" }, { "value": null, "color": "red" } ] }, "color": { "mode": "palette-classic" } }, "overrides": [] } } } } } }, "layout": { "kind": "GridLayout", "spec": { "items": [ { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 0, "width": 11, "height": 10, "element": { "kind": "ElementReference", "name": "panel-11" } } }, { "kind": "GridLayoutItem", "spec": { "x": 11, "y": 0, "width": 13, "height": 10, "element": { "kind": "ElementReference", "name": "panel-1" } } }, { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 10, "width": 12, "height": 7, "element": { "kind": "ElementReference", "name": "panel-7" } } }, { "kind": "GridLayoutItem", "spec": { "x": 12, "y": 10, "width": 12, "height": 7, "element": { "kind": "ElementReference", "name": "panel-8" } } }, { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 17, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-2" } } }, { "kind": "GridLayoutItem", "spec": { "x": 12, "y": 17, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-3" } } }, { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 25, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-4" } } }, { "kind": "GridLayoutItem", "spec": { "x": 12, "y": 25, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-5" } } }, { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 33, "width": 12, "height": 8, "element": { "kind": "ElementReference", "name": "panel-6" } } }, { "kind": "GridLayoutItem", "spec": { "x": 0, "y": 41, "width": 6, "height": 8, "element": { "kind": "ElementReference", "name": "panel-9" } } }, { "kind": "GridLayoutItem", "spec": { "x": 6, "y": 41, "width": 18, "height": 8, "element": { "kind": "ElementReference", "name": "panel-10" } } } ] } }, "links": [], "liveNow": false, "preload": false, "tags": [ "samba", "ad", "audit" ], "timeSettings": { "timezone": "browser", "from": "now-6h", "to": "now", "autoRefresh": "", "autoRefreshIntervals": [ "5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d" ], "hideTimepicker": false, "fiscalYearStartMonth": 0 }, "title": "Samba AD audit2", "variables": [ { "kind": "IntervalVariable", "spec": { "name": "interval", "query": "1s,3s,5s,10s,30s,1m,10m,30m,1h,6h,12h,1d,7d,14d,30d", "current": { "text": "1m", "value": "1m" }, "options": [ { "selected": true, "text": "1m", "value": "1m" }, { "selected": false, "text": "10m", "value": "10m" }, { "selected": false, "text": "30m", "value": "30m" }, { "selected": false, "text": "1h", "value": "1h" }, { "selected": false, "text": "6h", "value": "6h" }, { "selected": false, "text": "12h", "value": "12h" }, { "selected": false, "text": "1d", "value": "1d" } ], "auto": false, "auto_min": "10s", "auto_count": 30, "refresh": "onTimeRangeChanged", "hide": "dontHide", "skipUrlSync": false } } ], "preferences": { "layout": { "kind": "GridLayout", "spec": { "items": [] } } } } }