Last active 1 month ago

Revision db05ed5fe5882121ca1cd0dfa6ca94523ff169ff

grafana.json Raw
1{
2 "annotations": [
3 {
4 "kind": "AnnotationQuery",
5 "spec": {
6 "builtIn": true,
7 "enable": true,
8 "hide": true,
9 "iconColor": "rgba(0, 211, 255, 1)",
10 "name": "Annotations & Alerts",
11 "query": {
12 "group": "grafana",
13 "kind": "DataQuery",
14 "spec": {},
15 "version": "v0"
16 }
17 }
18 }
19 ],
20 "cursorSync": "Off",
21 "editable": true,
22 "elements": {
23 "panel-1": {
24 "kind": "Panel",
25 "spec": {
26 "data": {
27 "kind": "QueryGroup",
28 "spec": {
29 "queries": [
30 {
31 "kind": "PanelQuery",
32 "spec": {
33 "hidden": false,
34 "query": {
35 "datasource": {
36 "name": "afoiuzkkxju2of"
37 },
38 "group": "influxdb",
39 "kind": "DataQuery",
40 "spec": {
41 "alias": "machine_login",
42 "groupBy": [
43 {
44 "params": [
45 "$interval"
46 ],
47 "type": "time"
48 },
49 {
50 "params": [
51 "domain::tag"
52 ],
53 "type": "tag"
54 },
55 {
56 "params": [
57 "null"
58 ],
59 "type": "fill"
60 }
61 ],
62 "measurement": "samba_auth",
63 "orderByTime": "ASC",
64 "policy": "default",
65 "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)",
66 "rawQuery": false,
67 "resultFormat": "time_series",
68 "select": [
69 [
70 {
71 "params": [
72 "client_account"
73 ],
74 "type": "field"
75 },
76 {
77 "params": [],
78 "type": "count"
79 }
80 ]
81 ],
82 "tags": [
83 {
84 "key": "status::tag",
85 "operator": "=",
86 "value": "NT_STATUS_OK"
87 },
88 {
89 "condition": "AND",
90 "key": "account::tag",
91 "operator": "=~",
92 "value": "/^MACHINE/"
93 }
94 ]
95 },
96 "version": "v0"
97 },
98 "refId": "A"
99 }
100 },
101 {
102 "kind": "PanelQuery",
103 "spec": {
104 "hidden": false,
105 "query": {
106 "datasource": {
107 "name": "afoiuzkkxju2of"
108 },
109 "group": "influxdb",
110 "kind": "DataQuery",
111 "spec": {
112 "alias": "user_login",
113 "groupBy": [
114 {
115 "params": [
116 "$interval"
117 ],
118 "type": "time"
119 },
120 {
121 "params": [
122 "domain::tag"
123 ],
124 "type": "tag"
125 },
126 {
127 "params": [
128 "null"
129 ],
130 "type": "fill"
131 }
132 ],
133 "measurement": "samba_auth",
134 "orderByTime": "ASC",
135 "policy": "default",
136 "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^user/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)",
137 "rawQuery": false,
138 "resultFormat": "time_series",
139 "select": [
140 [
141 {
142 "params": [
143 "client_account"
144 ],
145 "type": "field"
146 },
147 {
148 "params": [],
149 "type": "count"
150 }
151 ]
152 ],
153 "tags": [
154 {
155 "key": "status::tag",
156 "operator": "=",
157 "value": "NT_STATUS_OK"
158 },
159 {
160 "condition": "AND",
161 "key": "account::tag",
162 "operator": "=~",
163 "value": "/^user/"
164 },
165 {
166 "condition": "OR",
167 "key": "account::tag",
168 "operator": "=~",
169 "value": "/^loadtest/"
170 }
171 ]
172 },
173 "version": "v0"
174 },
175 "refId": "B"
176 }
177 }
178 ],
179 "queryOptions": {},
180 "transformations": []
181 }
182 },
183 "description": "Успешные входы в домен (samba_auth): машинные и пользовательские, разбивка по домену.",
184 "id": 1,
185 "links": [],
186 "title": "Logins OK",
187 "vizConfig": {
188 "group": "timeseries",
189 "kind": "VizConfig",
190 "spec": {
191 "fieldConfig": {
192 "defaults": {
193 "color": {
194 "mode": "palette-classic"
195 },
196 "custom": {
197 "axisBorderShow": false,
198 "axisCenteredZero": false,
199 "axisColorMode": "text",
200 "axisLabel": "",
201 "axisPlacement": "auto",
202 "barAlignment": 0,
203 "barWidthFactor": 0.6,
204 "drawStyle": "line",
205 "fillOpacity": 10,
206 "gradientMode": "none",
207 "hideFrom": {
208 "legend": false,
209 "tooltip": false,
210 "viz": false
211 },
212 "insertNulls": false,
213 "lineInterpolation": "smooth",
214 "lineWidth": 1,
215 "pointSize": 5,
216 "scaleDistribution": {
217 "type": "linear"
218 },
219 "showPoints": "auto",
220 "showValues": false,
221 "spanNulls": false,
222 "stacking": {
223 "group": "A",
224 "mode": "none"
225 },
226 "thresholdsStyle": {
227 "mode": "off"
228 }
229 },
230 "thresholds": {
231 "mode": "absolute",
232 "steps": [
233 {
234 "color": "green",
235 "value": 0
236 },
237 {
238 "color": "red",
239 "value": 80
240 }
241 ]
242 }
243 },
244 "overrides": []
245 },
246 "options": {
247 "annotations": {
248 "clustering": -1,
249 "multiLane": false
250 },
251 "legend": {
252 "calcs": [],
253 "displayMode": "list",
254 "placement": "bottom",
255 "showLegend": true
256 },
257 "tooltip": {
258 "hideZeros": false,
259 "mode": "single",
260 "sort": "none"
261 }
262 }
263 },
264 "version": "13.0.1+security-01"
265 }
266 }
267 },
268 "panel-2": {
269 "kind": "Panel",
270 "spec": {
271 "data": {
272 "kind": "QueryGroup",
273 "spec": {
274 "queries": [
275 {
276 "kind": "PanelQuery",
277 "spec": {
278 "hidden": false,
279 "query": {
280 "datasource": {
281 "name": "afoiuzkkxju2of"
282 },
283 "group": "influxdb",
284 "kind": "DataQuery",
285 "spec": {
286 "groupBy": [],
287 "measurement": "samba_dsdb",
288 "orderByTime": "ASC",
289 "policy": "default",
290 "query": "SELECT count(\"status_code\") FROM \"samba_dsdb\" WHERE $timeFilter GROUP BY time($interval), \"operation\"::tag fill(null)",
291 "rawQuery": true,
292 "resultFormat": "time_series",
293 "select": [],
294 "tags": []
295 },
296 "version": "v0"
297 },
298 "refId": "A"
299 }
300 }
301 ],
302 "queryOptions": {},
303 "transformations": []
304 }
305 },
306 "description": "Число изменений объектов каталога (samba_dsdb), разбивка по типу операции.",
307 "id": 2,
308 "links": [],
309 "title": "DSDB: изменения по операциям",
310 "vizConfig": {
311 "group": "timeseries",
312 "kind": "VizConfig",
313 "spec": {
314 "fieldConfig": {
315 "defaults": {
316 "color": {
317 "mode": "palette-classic"
318 },
319 "custom": {
320 "axisBorderShow": false,
321 "axisCenteredZero": false,
322 "axisColorMode": "text",
323 "axisLabel": "",
324 "axisPlacement": "auto",
325 "barAlignment": 0,
326 "barWidthFactor": 0.6,
327 "drawStyle": "bars",
328 "fillOpacity": 50,
329 "gradientMode": "none",
330 "hideFrom": {
331 "legend": false,
332 "tooltip": false,
333 "viz": false
334 },
335 "insertNulls": false,
336 "lineInterpolation": "linear",
337 "lineWidth": 1,
338 "pointSize": 5,
339 "scaleDistribution": {
340 "type": "linear"
341 },
342 "showPoints": "auto",
343 "showValues": false,
344 "spanNulls": false,
345 "stacking": {
346 "group": "A",
347 "mode": "normal"
348 },
349 "thresholdsStyle": {
350 "mode": "off"
351 }
352 },
353 "thresholds": {
354 "mode": "absolute",
355 "steps": [
356 {
357 "color": "green",
358 "value": 0
359 },
360 {
361 "color": "red",
362 "value": 80
363 }
364 ]
365 }
366 },
367 "overrides": []
368 },
369 "options": {
370 "annotations": {
371 "clustering": -1,
372 "multiLane": false
373 },
374 "legend": {
375 "calcs": [],
376 "displayMode": "list",
377 "placement": "bottom",
378 "showLegend": true
379 },
380 "tooltip": {
381 "hideZeros": false,
382 "mode": "multi",
383 "sort": "desc"
384 }
385 }
386 },
387 "version": "13.0.1+security-01"
388 }
389 }
390 },
391 "panel-3": {
392 "kind": "Panel",
393 "spec": {
394 "data": {
395 "kind": "QueryGroup",
396 "spec": {
397 "queries": [
398 {
399 "kind": "PanelQuery",
400 "spec": {
401 "hidden": false,
402 "query": {
403 "datasource": {
404 "name": "afoiuzkkxju2of"
405 },
406 "group": "influxdb",
407 "kind": "DataQuery",
408 "spec": {
409 "groupBy": [],
410 "measurement": "samba_dsdb",
411 "orderByTime": "ASC",
412 "policy": "default",
413 "query": "SELECT count(\"status_code\") FROM \"samba_dsdb\" WHERE $timeFilter GROUP BY time($interval), \"as_system\"::tag fill(null)",
414 "rawQuery": true,
415 "resultFormat": "time_series",
416 "select": [],
417 "tags": []
418 },
419 "version": "v0"
420 },
421 "refId": "A"
422 }
423 }
424 ],
425 "queryOptions": {},
426 "transformations": []
427 }
428 },
429 "description": "Изменения каталога с разбивкой по performedAsSystem (true = выполнено системой).",
430 "id": 3,
431 "links": [],
432 "title": "DSDB: система vs пользователь",
433 "vizConfig": {
434 "group": "timeseries",
435 "kind": "VizConfig",
436 "spec": {
437 "fieldConfig": {
438 "defaults": {
439 "color": {
440 "mode": "palette-classic"
441 },
442 "custom": {
443 "axisBorderShow": false,
444 "axisCenteredZero": false,
445 "axisColorMode": "text",
446 "axisLabel": "",
447 "axisPlacement": "auto",
448 "barAlignment": 0,
449 "barWidthFactor": 0.6,
450 "drawStyle": "line",
451 "fillOpacity": 20,
452 "gradientMode": "none",
453 "hideFrom": {
454 "legend": false,
455 "tooltip": false,
456 "viz": false
457 },
458 "insertNulls": false,
459 "lineInterpolation": "smooth",
460 "lineWidth": 1,
461 "pointSize": 5,
462 "scaleDistribution": {
463 "type": "linear"
464 },
465 "showPoints": "auto",
466 "showValues": false,
467 "spanNulls": false,
468 "stacking": {
469 "group": "A",
470 "mode": "none"
471 },
472 "thresholdsStyle": {
473 "mode": "off"
474 }
475 },
476 "thresholds": {
477 "mode": "absolute",
478 "steps": [
479 {
480 "color": "green",
481 "value": 0
482 },
483 {
484 "color": "red",
485 "value": 80
486 }
487 ]
488 }
489 },
490 "overrides": []
491 },
492 "options": {
493 "annotations": {
494 "clustering": -1,
495 "multiLane": false
496 },
497 "legend": {
498 "calcs": [],
499 "displayMode": "list",
500 "placement": "bottom",
501 "showLegend": true
502 },
503 "tooltip": {
504 "hideZeros": false,
505 "mode": "multi",
506 "sort": "desc"
507 }
508 }
509 },
510 "version": "13.0.1+security-01"
511 }
512 }
513 },
514 "panel-4": {
515 "kind": "Panel",
516 "spec": {
517 "data": {
518 "kind": "QueryGroup",
519 "spec": {
520 "queries": [
521 {
522 "kind": "PanelQuery",
523 "spec": {
524 "hidden": false,
525 "query": {
526 "datasource": {
527 "name": "afoiuzkkxju2of"
528 },
529 "group": "influxdb",
530 "kind": "DataQuery",
531 "spec": {
532 "groupBy": [],
533 "measurement": "samba_dsdb",
534 "orderByTime": "ASC",
535 "policy": "default",
536 "query": "SELECT count(\"status_code\") FROM \"samba_dsdb\" WHERE $timeFilter GROUP BY time($interval), \"user_sid\"::tag fill(null)",
537 "rawQuery": true,
538 "resultFormat": "time_series",
539 "select": [],
540 "tags": []
541 },
542 "version": "v0"
543 },
544 "refId": "A"
545 }
546 }
547 ],
548 "queryOptions": {},
549 "transformations": []
550 }
551 },
552 "description": "Кто инициировал изменения каталога — разбивка по userSid.",
553 "id": 4,
554 "links": [],
555 "title": "DSDB: топ инициаторов (SID)",
556 "vizConfig": {
557 "group": "timeseries",
558 "kind": "VizConfig",
559 "spec": {
560 "fieldConfig": {
561 "defaults": {
562 "color": {
563 "mode": "palette-classic"
564 },
565 "custom": {
566 "axisBorderShow": false,
567 "axisCenteredZero": false,
568 "axisColorMode": "text",
569 "axisLabel": "",
570 "axisPlacement": "auto",
571 "barAlignment": 0,
572 "barWidthFactor": 0.6,
573 "drawStyle": "bars",
574 "fillOpacity": 50,
575 "gradientMode": "none",
576 "hideFrom": {
577 "legend": false,
578 "tooltip": false,
579 "viz": false
580 },
581 "insertNulls": false,
582 "lineInterpolation": "linear",
583 "lineWidth": 1,
584 "pointSize": 5,
585 "scaleDistribution": {
586 "type": "linear"
587 },
588 "showPoints": "auto",
589 "showValues": false,
590 "spanNulls": false,
591 "stacking": {
592 "group": "A",
593 "mode": "normal"
594 },
595 "thresholdsStyle": {
596 "mode": "off"
597 }
598 },
599 "thresholds": {
600 "mode": "absolute",
601 "steps": [
602 {
603 "color": "green",
604 "value": 0
605 },
606 {
607 "color": "red",
608 "value": 80
609 }
610 ]
611 }
612 },
613 "overrides": []
614 },
615 "options": {
616 "annotations": {
617 "clustering": -1,
618 "multiLane": false
619 },
620 "legend": {
621 "calcs": [
622 "sum"
623 ],
624 "displayMode": "table",
625 "placement": "right",
626 "showLegend": true
627 },
628 "tooltip": {
629 "hideZeros": false,
630 "mode": "multi",
631 "sort": "desc"
632 }
633 }
634 },
635 "version": "13.0.1+security-01"
636 }
637 }
638 },
639 "panel-5": {
640 "kind": "Panel",
641 "spec": {
642 "data": {
643 "kind": "QueryGroup",
644 "spec": {
645 "queries": [
646 {
647 "kind": "PanelQuery",
648 "spec": {
649 "hidden": false,
650 "query": {
651 "datasource": {
652 "name": "afoiuzkkxju2of"
653 },
654 "group": "influxdb",
655 "kind": "DataQuery",
656 "spec": {
657 "groupBy": [],
658 "measurement": "samba_dsdb_tx",
659 "orderByTime": "ASC",
660 "policy": "default",
661 "query": "SELECT mean(\"duration\") AS \"mean\", max(\"duration\") AS \"max\" FROM \"samba_dsdb_tx\" WHERE $timeFilter GROUP BY time($interval) fill(null)",
662 "rawQuery": true,
663 "resultFormat": "time_series",
664 "select": [],
665 "tags": []
666 },
667 "version": "v0"
668 },
669 "refId": "A"
670 }
671 }
672 ],
673 "queryOptions": {},
674 "transformations": []
675 }
676 },
677 "description": "Длительность транзакций каталога (samba_dsdb_tx) в микросекундах.",
678 "id": 5,
679 "links": [],
680 "title": "Транзакции: длительность (mean/max)",
681 "vizConfig": {
682 "group": "timeseries",
683 "kind": "VizConfig",
684 "spec": {
685 "fieldConfig": {
686 "defaults": {
687 "color": {
688 "mode": "palette-classic"
689 },
690 "custom": {
691 "axisBorderShow": false,
692 "axisCenteredZero": false,
693 "axisColorMode": "text",
694 "axisLabel": "",
695 "axisPlacement": "auto",
696 "barAlignment": 0,
697 "barWidthFactor": 0.6,
698 "drawStyle": "line",
699 "fillOpacity": 10,
700 "gradientMode": "none",
701 "hideFrom": {
702 "legend": false,
703 "tooltip": false,
704 "viz": false
705 },
706 "insertNulls": false,
707 "lineInterpolation": "smooth",
708 "lineWidth": 1,
709 "pointSize": 5,
710 "scaleDistribution": {
711 "type": "linear"
712 },
713 "showPoints": "auto",
714 "showValues": false,
715 "spanNulls": false,
716 "stacking": {
717 "group": "A",
718 "mode": "none"
719 },
720 "thresholdsStyle": {
721 "mode": "off"
722 }
723 },
724 "thresholds": {
725 "mode": "absolute",
726 "steps": [
727 {
728 "color": "green",
729 "value": 0
730 },
731 {
732 "color": "red",
733 "value": 80
734 }
735 ]
736 },
737 "unit": "µs"
738 },
739 "overrides": []
740 },
741 "options": {
742 "annotations": {
743 "clustering": -1,
744 "multiLane": false
745 },
746 "legend": {
747 "calcs": [
748 "mean",
749 "max"
750 ],
751 "displayMode": "table",
752 "placement": "bottom",
753 "showLegend": true
754 },
755 "tooltip": {
756 "hideZeros": false,
757 "mode": "multi",
758 "sort": "desc"
759 }
760 }
761 },
762 "version": "13.0.1+security-01"
763 }
764 }
765 },
766 "panel-6": {
767 "kind": "Panel",
768 "spec": {
769 "data": {
770 "kind": "QueryGroup",
771 "spec": {
772 "queries": [
773 {
774 "kind": "PanelQuery",
775 "spec": {
776 "hidden": false,
777 "query": {
778 "datasource": {
779 "name": "afoiuzkkxju2of"
780 },
781 "group": "influxdb",
782 "kind": "DataQuery",
783 "spec": {
784 "groupBy": [],
785 "measurement": "samba_dsdb_tx",
786 "orderByTime": "ASC",
787 "policy": "default",
788 "query": "SELECT count(\"duration\") FROM \"samba_dsdb_tx\" WHERE $timeFilter GROUP BY time($interval), \"action\"::tag fill(null)",
789 "rawQuery": true,
790 "resultFormat": "time_series",
791 "select": [],
792 "tags": []
793 },
794 "version": "v0"
795 },
796 "refId": "A"
797 }
798 }
799 ],
800 "queryOptions": {},
801 "transformations": []
802 }
803 },
804 "description": "Число транзакций каталога, разбивка по action (commit / rollback / prepare commit / begin).",
805 "id": 6,
806 "links": [],
807 "title": "Транзакции по типу действия",
808 "vizConfig": {
809 "group": "timeseries",
810 "kind": "VizConfig",
811 "spec": {
812 "fieldConfig": {
813 "defaults": {
814 "color": {
815 "mode": "palette-classic"
816 },
817 "custom": {
818 "axisBorderShow": false,
819 "axisCenteredZero": false,
820 "axisColorMode": "text",
821 "axisLabel": "",
822 "axisPlacement": "auto",
823 "barAlignment": 0,
824 "barWidthFactor": 0.6,
825 "drawStyle": "bars",
826 "fillOpacity": 50,
827 "gradientMode": "none",
828 "hideFrom": {
829 "legend": false,
830 "tooltip": false,
831 "viz": false
832 },
833 "insertNulls": false,
834 "lineInterpolation": "linear",
835 "lineWidth": 1,
836 "pointSize": 5,
837 "scaleDistribution": {
838 "type": "linear"
839 },
840 "showPoints": "auto",
841 "showValues": false,
842 "spanNulls": false,
843 "stacking": {
844 "group": "A",
845 "mode": "normal"
846 },
847 "thresholdsStyle": {
848 "mode": "off"
849 }
850 },
851 "thresholds": {
852 "mode": "absolute",
853 "steps": [
854 {
855 "color": "green",
856 "value": 0
857 },
858 {
859 "color": "red",
860 "value": 80
861 }
862 ]
863 }
864 },
865 "overrides": []
866 },
867 "options": {
868 "annotations": {
869 "clustering": -1,
870 "multiLane": false
871 },
872 "legend": {
873 "calcs": [],
874 "displayMode": "list",
875 "placement": "bottom",
876 "showLegend": true
877 },
878 "tooltip": {
879 "hideZeros": false,
880 "mode": "multi",
881 "sort": "desc"
882 }
883 }
884 },
885 "version": "13.0.1+security-01"
886 }
887 }
888 },
889 "panel-7": {
890 "kind": "Panel",
891 "spec": {
892 "data": {
893 "kind": "QueryGroup",
894 "spec": {
895 "queries": [
896 {
897 "kind": "PanelQuery",
898 "spec": {
899 "hidden": false,
900 "query": {
901 "datasource": {
902 "name": "afoiuzkkxju2of"
903 },
904 "group": "influxdb",
905 "kind": "DataQuery",
906 "spec": {
907 "alias": "user_smb",
908 "groupBy": [
909 {
910 "params": [
911 "$interval"
912 ],
913 "type": "time"
914 },
915 {
916 "params": [
917 "domain::tag"
918 ],
919 "type": "tag"
920 },
921 {
922 "params": [
923 "null"
924 ],
925 "type": "fill"
926 }
927 ],
928 "measurement": "samba_authz",
929 "orderByTime": "ASC",
930 "policy": "default",
931 "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)",
932 "rawQuery": false,
933 "resultFormat": "time_series",
934 "select": [
935 [
936 {
937 "params": [
938 "auth_type"
939 ],
940 "type": "field"
941 },
942 {
943 "params": [],
944 "type": "count"
945 }
946 ]
947 ],
948 "tags": [
949 {
950 "key": "service::tag",
951 "operator": "=",
952 "value": "SMB2"
953 },
954 {
955 "condition": "AND",
956 "key": "auth_type::field",
957 "operator": "=",
958 "value": "krb5"
959 },
960 {
961 "condition": "AND",
962 "key": "account::tag",
963 "operator": "=~",
964 "value": "/^user-/"
965 }
966 ]
967 },
968 "version": "v0"
969 },
970 "refId": "A"
971 }
972 },
973 {
974 "kind": "PanelQuery",
975 "spec": {
976 "hidden": false,
977 "query": {
978 "datasource": {
979 "name": "afoiuzkkxju2of"
980 },
981 "group": "influxdb",
982 "kind": "DataQuery",
983 "spec": {
984 "alias": "machine_smb",
985 "groupBy": [
986 {
987 "params": [
988 "$interval"
989 ],
990 "type": "time"
991 },
992 {
993 "params": [
994 "domain::tag"
995 ],
996 "type": "tag"
997 },
998 {
999 "params": [
1000 "null"
1001 ],
1002 "type": "fill"
1003 }
1004 ],
1005 "measurement": "samba_authz",
1006 "orderByTime": "ASC",
1007 "policy": "default",
1008 "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)",
1009 "rawQuery": false,
1010 "resultFormat": "time_series",
1011 "select": [
1012 [
1013 {
1014 "params": [
1015 "auth_type"
1016 ],
1017 "type": "field"
1018 },
1019 {
1020 "params": [],
1021 "type": "count"
1022 }
1023 ]
1024 ],
1025 "tags": [
1026 {
1027 "key": "service::tag",
1028 "operator": "=",
1029 "value": "SMB2"
1030 },
1031 {
1032 "condition": "AND",
1033 "key": "auth_type::field",
1034 "operator": "=",
1035 "value": "krb5"
1036 },
1037 {
1038 "condition": "AND",
1039 "key": "account::tag",
1040 "operator": "=~",
1041 "value": "/^MACHINE/"
1042 }
1043 ]
1044 },
1045 "version": "v0"
1046 },
1047 "refId": "B"
1048 }
1049 }
1050 ],
1051 "queryOptions": {},
1052 "transformations": []
1053 }
1054 },
1055 "description": "",
1056 "id": 7,
1057 "links": [],
1058 "title": "SMB activity",
1059 "vizConfig": {
1060 "group": "timeseries",
1061 "kind": "VizConfig",
1062 "spec": {
1063 "fieldConfig": {
1064 "defaults": {
1065 "color": {
1066 "mode": "palette-classic"
1067 },
1068 "custom": {
1069 "axisBorderShow": false,
1070 "axisCenteredZero": false,
1071 "axisColorMode": "text",
1072 "axisLabel": "",
1073 "axisPlacement": "auto",
1074 "barAlignment": 0,
1075 "barWidthFactor": 0.6,
1076 "drawStyle": "line",
1077 "fillOpacity": 10,
1078 "gradientMode": "none",
1079 "hideFrom": {
1080 "legend": false,
1081 "tooltip": false,
1082 "viz": false
1083 },
1084 "insertNulls": false,
1085 "lineInterpolation": "smooth",
1086 "lineWidth": 1,
1087 "pointSize": 5,
1088 "scaleDistribution": {
1089 "type": "linear"
1090 },
1091 "showPoints": "auto",
1092 "showValues": false,
1093 "spanNulls": false,
1094 "stacking": {
1095 "group": "A",
1096 "mode": "none"
1097 },
1098 "thresholdsStyle": {
1099 "mode": "off"
1100 }
1101 },
1102 "thresholds": {
1103 "mode": "absolute",
1104 "steps": [
1105 {
1106 "color": "green",
1107 "value": 0
1108 },
1109 {
1110 "color": "red",
1111 "value": 80
1112 }
1113 ]
1114 }
1115 },
1116 "overrides": []
1117 },
1118 "options": {
1119 "annotations": {
1120 "clustering": -1,
1121 "multiLane": false
1122 },
1123 "legend": {
1124 "calcs": [],
1125 "displayMode": "list",
1126 "placement": "bottom",
1127 "showLegend": true
1128 },
1129 "tooltip": {
1130 "hideZeros": false,
1131 "mode": "single",
1132 "sort": "none"
1133 }
1134 }
1135 },
1136 "version": "13.0.1+security-01"
1137 }
1138 }
1139 },
1140 "panel-8": {
1141 "kind": "Panel",
1142 "spec": {
1143 "data": {
1144 "kind": "QueryGroup",
1145 "spec": {
1146 "queries": [
1147 {
1148 "kind": "PanelQuery",
1149 "spec": {
1150 "hidden": false,
1151 "query": {
1152 "datasource": {
1153 "name": "afoiuzkkxju2of"
1154 },
1155 "group": "influxdb",
1156 "kind": "DataQuery",
1157 "spec": {
1158 "alias": "rcode=0",
1159 "groupBy": [
1160 {
1161 "params": [
1162 "$interval"
1163 ],
1164 "type": "time"
1165 },
1166 {
1167 "params": [
1168 "null"
1169 ],
1170 "type": "fill"
1171 }
1172 ],
1173 "measurement": "samba_dns_rcode",
1174 "orderByTime": "ASC",
1175 "policy": "default",
1176 "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)",
1177 "rawQuery": false,
1178 "resultFormat": "time_series",
1179 "select": [
1180 [
1181 {
1182 "params": [
1183 "rcode"
1184 ],
1185 "type": "field"
1186 },
1187 {
1188 "params": [],
1189 "type": "count"
1190 }
1191 ]
1192 ],
1193 "tags": [
1194 {
1195 "key": "rcode::field",
1196 "operator": "=",
1197 "value": "0"
1198 }
1199 ]
1200 },
1201 "version": "v0"
1202 },
1203 "refId": "A"
1204 }
1205 },
1206 {
1207 "kind": "PanelQuery",
1208 "spec": {
1209 "hidden": false,
1210 "query": {
1211 "datasource": {
1212 "name": "afoiuzkkxju2of"
1213 },
1214 "group": "influxdb",
1215 "kind": "DataQuery",
1216 "spec": {
1217 "alias": "rcode=3",
1218 "groupBy": [
1219 {
1220 "params": [
1221 "$interval"
1222 ],
1223 "type": "time"
1224 },
1225 {
1226 "params": [
1227 "null"
1228 ],
1229 "type": "fill"
1230 }
1231 ],
1232 "measurement": "samba_dns_rcode",
1233 "orderByTime": "ASC",
1234 "policy": "default",
1235 "query": "SELECT count(\"client_account\") FROM \"samba_auth\" WHERE (\"status\"::tag = 'NT_STATUS_OK' AND \"account\"::tag =~ /^MACHINE/) AND $timeFilter GROUP BY time($interval), \"domain\"::tag fill(null)",
1236 "rawQuery": false,
1237 "resultFormat": "time_series",
1238 "select": [
1239 [
1240 {
1241 "params": [
1242 "rcode"
1243 ],
1244 "type": "field"
1245 },
1246 {
1247 "params": [],
1248 "type": "count"
1249 }
1250 ]
1251 ],
1252 "tags": [
1253 {
1254 "key": "rcode::field",
1255 "operator": "=",
1256 "value": "3"
1257 }
1258 ]
1259 },
1260 "version": "v0"
1261 },
1262 "refId": "B"
1263 }
1264 }
1265 ],
1266 "queryOptions": {},
1267 "transformations": []
1268 }
1269 },
1270 "description": "",
1271 "id": 8,
1272 "links": [],
1273 "title": "DNS activity",
1274 "vizConfig": {
1275 "group": "timeseries",
1276 "kind": "VizConfig",
1277 "spec": {
1278 "fieldConfig": {
1279 "defaults": {
1280 "color": {
1281 "mode": "palette-classic"
1282 },
1283 "custom": {
1284 "axisBorderShow": false,
1285 "axisCenteredZero": false,
1286 "axisColorMode": "text",
1287 "axisLabel": "",
1288 "axisPlacement": "auto",
1289 "barAlignment": 0,
1290 "barWidthFactor": 0.6,
1291 "drawStyle": "line",
1292 "fillOpacity": 10,
1293 "gradientMode": "none",
1294 "hideFrom": {
1295 "legend": false,
1296 "tooltip": false,
1297 "viz": false
1298 },
1299 "insertNulls": false,
1300 "lineInterpolation": "smooth",
1301 "lineWidth": 1,
1302 "pointSize": 5,
1303 "scaleDistribution": {
1304 "type": "linear"
1305 },
1306 "showPoints": "auto",
1307 "showValues": false,
1308 "spanNulls": false,
1309 "stacking": {
1310 "group": "A",
1311 "mode": "none"
1312 },
1313 "thresholdsStyle": {
1314 "mode": "off"
1315 }
1316 },
1317 "thresholds": {
1318 "mode": "absolute",
1319 "steps": [
1320 {
1321 "color": "green",
1322 "value": 0
1323 },
1324 {
1325 "color": "red",
1326 "value": 80
1327 }
1328 ]
1329 }
1330 },
1331 "overrides": []
1332 },
1333 "options": {
1334 "annotations": {
1335 "clustering": -1,
1336 "multiLane": false
1337 },
1338 "legend": {
1339 "calcs": [],
1340 "displayMode": "list",
1341 "placement": "bottom",
1342 "showLegend": true
1343 },
1344 "tooltip": {
1345 "hideZeros": false,
1346 "mode": "single",
1347 "sort": "none"
1348 }
1349 }
1350 },
1351 "version": "13.0.1+security-01"
1352 }
1353 }
1354 }
1355 },
1356 "layout": {
1357 "kind": "GridLayout",
1358 "spec": {
1359 "items": [
1360 {
1361 "kind": "GridLayoutItem",
1362 "spec": {
1363 "element": {
1364 "kind": "ElementReference",
1365 "name": "panel-1"
1366 },
1367 "height": 8,
1368 "width": 24,
1369 "x": 0,
1370 "y": 0
1371 }
1372 },
1373 {
1374 "kind": "GridLayoutItem",
1375 "spec": {
1376 "element": {
1377 "kind": "ElementReference",
1378 "name": "panel-7"
1379 },
1380 "height": 7,
1381 "width": 24,
1382 "x": 0,
1383 "y": 8
1384 }
1385 },
1386 {
1387 "kind": "GridLayoutItem",
1388 "spec": {
1389 "element": {
1390 "kind": "ElementReference",
1391 "name": "panel-8"
1392 },
1393 "height": 7,
1394 "width": 24,
1395 "x": 0,
1396 "y": 15
1397 }
1398 },
1399 {
1400 "kind": "GridLayoutItem",
1401 "spec": {
1402 "element": {
1403 "kind": "ElementReference",
1404 "name": "panel-2"
1405 },
1406 "height": 8,
1407 "width": 12,
1408 "x": 0,
1409 "y": 22
1410 }
1411 },
1412 {
1413 "kind": "GridLayoutItem",
1414 "spec": {
1415 "element": {
1416 "kind": "ElementReference",
1417 "name": "panel-3"
1418 },
1419 "height": 8,
1420 "width": 12,
1421 "x": 12,
1422 "y": 22
1423 }
1424 },
1425 {
1426 "kind": "GridLayoutItem",
1427 "spec": {
1428 "element": {
1429 "kind": "ElementReference",
1430 "name": "panel-4"
1431 },
1432 "height": 8,
1433 "width": 12,
1434 "x": 0,
1435 "y": 30
1436 }
1437 },
1438 {
1439 "kind": "GridLayoutItem",
1440 "spec": {
1441 "element": {
1442 "kind": "ElementReference",
1443 "name": "panel-5"
1444 },
1445 "height": 8,
1446 "width": 12,
1447 "x": 12,
1448 "y": 30
1449 }
1450 },
1451 {
1452 "kind": "GridLayoutItem",
1453 "spec": {
1454 "element": {
1455 "kind": "ElementReference",
1456 "name": "panel-6"
1457 },
1458 "height": 8,
1459 "width": 12,
1460 "x": 0,
1461 "y": 38
1462 }
1463 }
1464 ]
1465 }
1466 },
1467 "links": [],
1468 "liveNow": false,
1469 "preferences": {
1470 "layout": {
1471 "kind": "GridLayout",
1472 "spec": {
1473 "items": []
1474 }
1475 }
1476 },
1477 "preload": false,
1478 "tags": [
1479 "samba",
1480 "ad",
1481 "audit"
1482 ],
1483 "timeSettings": {
1484 "autoRefresh": "5s",
1485 "autoRefreshIntervals": [
1486 "5s",
1487 "10s",
1488 "30s",
1489 "1m",
1490 "5m",
1491 "15m",
1492 "30m",
1493 "1h",
1494 "2h",
1495 "1d"
1496 ],
1497 "fiscalYearStartMonth": 0,
1498 "from": "now-15m",
1499 "hideTimepicker": false,
1500 "timezone": "browser",
1501 "to": "now"
1502 },
1503 "title": "Samba AD audit",
1504 "variables": [
1505 {
1506 "kind": "IntervalVariable",
1507 "spec": {
1508 "auto": false,
1509 "auto_count": 30,
1510 "auto_min": "10s",
1511 "current": {
1512 "text": "1s",
1513 "value": "1s"
1514 },
1515 "hide": "dontHide",
1516 "name": "interval",
1517 "options": [
1518 {
1519 "selected": true,
1520 "text": "1s",
1521 "value": "1s"
1522 },
1523 {
1524 "selected": false,
1525 "text": "3s",
1526 "value": "3s"
1527 },
1528 {
1529 "selected": false,
1530 "text": "5s",
1531 "value": "5s"
1532 },
1533 {
1534 "selected": false,
1535 "text": "10s",
1536 "value": "10s"
1537 },
1538 {
1539 "selected": false,
1540 "text": "30s",
1541 "value": "30s"
1542 },
1543 {
1544 "selected": false,
1545 "text": "1m",
1546 "value": "1m"
1547 },
1548 {
1549 "selected": false,
1550 "text": "10m",
1551 "value": "10m"
1552 },
1553 {
1554 "selected": false,
1555 "text": "30m",
1556 "value": "30m"
1557 },
1558 {
1559 "selected": false,
1560 "text": "1h",
1561 "value": "1h"
1562 },
1563 {
1564 "selected": false,
1565 "text": "6h",
1566 "value": "6h"
1567 },
1568 {
1569 "selected": false,
1570 "text": "12h",
1571 "value": "12h"
1572 },
1573 {
1574 "selected": false,
1575 "text": "1d",
1576 "value": "1d"
1577 },
1578 {
1579 "selected": false,
1580 "text": "7d",
1581 "value": "7d"
1582 },
1583 {
1584 "selected": false,
1585 "text": "14d",
1586 "value": "14d"
1587 },
1588 {
1589 "selected": false,
1590 "text": "30d",
1591 "value": "30d"
1592 }
1593 ],
1594 "query": "1s,3s,5s,10s,30s,1m,10m,30m,1h,6h,12h,1d,7d,14d,30d",
1595 "refresh": "onTimeRangeChanged",
1596 "skipUrlSync": false
1597 }
1598 }
1599 ]
1600}