diff --git a/ansible/inventory.ini b/ansible/inventory.ini
index 4512c86..d66f87c 100644
--- a/ansible/inventory.ini
+++ b/ansible/inventory.ini
@@ -5,7 +5,7 @@ pve-detmir ansible_host=10.10.10.2 ansible_user=igor ansible_password=04091968 a
 aw-prod ansible_host=10.10.10.13 ansible_user=igor ansible_password=04091968 ansible_connection=ssh ansible_become=true ansible_become_method=sudo ansible_become_password=04091968
 
 [grafana]
-grafana-main grafana_url=http://10.10.10.11:3000 grafana_validate_tls=false
+grafana-main grafana_url=http://10.10.10.11:3000 grafana_validate_tls=false grafana_folder_title=DLP grafana_detmir_folder_uid=efk080s0lfc3ka grafana_pfsense_folder_uid=bfcx6gg70sagwc
 
 [aw_windows]
 rdp-prod ansible_host=192.168.100.18 ansible_user=Администратор ansible_password=Sergei2009@ ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore
diff --git a/grafana/detmir-aw-main-dashboard.json b/grafana/detmir-aw-main-dashboard.json
index 3ed9480..44696c5 100644
--- a/grafana/detmir-aw-main-dashboard.json
+++ b/grafana/detmir-aw-main-dashboard.json
@@ -16,7 +16,7 @@
       "fieldConfig": {
         "defaults": {
           "decimals": 0,
-          "unit": "s"
+          "unit": "suffix: мин"
         },
         "overrides": []
       },
@@ -39,11 +39,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "value_and_name"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => (r._measurement == \"aw_window_event\" or r._measurement == \"aw_afk_event\") and r._field == \"duration_s\")\n  |> last()\n  |> group()\n  |> sort(columns: [\"_time\"], desc: true)\n  |> limit(n: 1)\n  |> map(fn: (r) => ({ r with _value: float(v: uint(v: now()) - uint(v: r._time)) / 1000000000.0 }))\n  |> keep(columns: [\"_value\"])\n  |> yield(name: \"freshness_seconds\")",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => (r._measurement == \"aw_window_event\" or r._measurement == \"aw_afk_event\") and r._field == \"duration_s\")\n  |> last()\n  |> group()\n  |> sort(columns: [\"_time\"], desc: true)\n  |> limit(n: 1)\n  |> map(fn: (r) => ({ r with _value: (float(v: uint(v: now()) - uint(v: r._time)) / 1000000000.0) / 60.0 }))\n  |> set(key: \"_field\", value: \"Свежесть данных\")\n  |> keep(columns: [\"_value\", \"_field\"])\n  |> yield(name: \"freshness_minutes\")\n",
           "refId": "A"
         }
       ],
@@ -57,7 +58,8 @@
       },
       "fieldConfig": {
         "defaults": {
-          "unit": "s"
+          "unit": "suffix: мин",
+          "displayName": "${__field.labels.host}"
         },
         "overrides": []
       },
@@ -81,7 +83,7 @@
       },
       "targets": [
         {
-          "query": "import \"date\"\nstartBound = if v.timeRangeStart > date.sub(d: 2h, from: now()) then date.sub(d: 2h, from: now()) else v.timeRangeStart\nfrom(bucket: \"aw_metrics\")\n  |> range(start: startBound, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"aw_window_event\" and r._field == \"duration_s\")\n  |> aggregateWindow(every: 5m, fn: sum, createEmpty: false)\n  |> keep(columns: [\"_time\", \"_value\", \"host\"])\n  |> group(columns: [\"host\"])\n  |> yield(name: \"active\")",
+          "query": "import \"date\"\nstartBound = if v.timeRangeStart > date.sub(d: 2h, from: now()) then date.sub(d: 2h, from: now()) else v.timeRangeStart\nfrom(bucket: \"aw_metrics\")\n  |> range(start: startBound, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"aw_window_event\" and r._field == \"duration_s\")\n  |> aggregateWindow(every: 5m, fn: sum, createEmpty: false)\n  |> map(fn: (r) => ({ r with _value: r._value / 60.0 }))\n  |> set(key: \"_field\", value: \"Активность, мин\")\n  |> keep(columns: [\"_time\", \"_value\", \"_field\", \"host\"])\n  |> group(columns: [\"host\"])\n  |> yield(name: \"active_minutes\")\n",
           "refId": "A"
         }
       ],
@@ -95,7 +97,8 @@
       },
       "fieldConfig": {
         "defaults": {
-          "unit": "s"
+          "unit": "suffix: мин",
+          "displayName": "${__field.labels.host}"
         },
         "overrides": []
       },
@@ -119,7 +122,7 @@
       },
       "targets": [
         {
-          "query": "import \"date\"\nstartBound = if v.timeRangeStart > date.sub(d: 2h, from: now()) then date.sub(d: 2h, from: now()) else v.timeRangeStart\nfrom(bucket: \"aw_metrics\")\n  |> range(start: startBound, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"aw_afk_event\" and r._field == \"duration_s\" and r.status == \"afk\")\n  |> aggregateWindow(every: 5m, fn: sum, createEmpty: false)\n  |> keep(columns: [\"_time\", \"_value\", \"host\"])\n  |> group(columns: [\"host\"])\n  |> yield(name: \"afk\")",
+          "query": "import \"date\"\nstartBound = if v.timeRangeStart > date.sub(d: 2h, from: now()) then date.sub(d: 2h, from: now()) else v.timeRangeStart\nfrom(bucket: \"aw_metrics\")\n  |> range(start: startBound, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"aw_afk_event\" and r._field == \"duration_s\" and r.status == \"afk\")\n  |> aggregateWindow(every: 5m, fn: sum, createEmpty: false)\n  |> map(fn: (r) => ({ r with _value: r._value / 60.0 }))\n  |> set(key: \"_field\", value: \"AFK, мин\")\n  |> keep(columns: [\"_time\", \"_value\", \"_field\", \"host\"])\n  |> group(columns: [\"host\"])\n  |> yield(name: \"afk_minutes\")\n",
           "refId": "A"
         }
       ],
@@ -133,7 +136,8 @@
       },
       "fieldConfig": {
         "defaults": {
-          "unit": "s"
+          "unit": "suffix: ч",
+          "displayName": "${__field.labels.category_view}"
         },
         "overrides": []
       },
@@ -157,7 +161,7 @@
       },
       "targets": [
         {
-          "query": "import \"date\"\nstartBound = if v.timeRangeStart > date.sub(d: 2h, from: now()) then date.sub(d: 2h, from: now()) else v.timeRangeStart\nfrom(bucket: \"aw_metrics\")\n  |> range(start: startBound, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"aw_window_event\" and r._field == \"duration_s\")\n  |> map(fn: (r) => ({ r with category_view: if r.category == \"erp_1c\" then \"1С-Бухгалтерия\" else if r.category == \"file_manager\" then \"Файловый менеджер\" else if r.category == \"terminal_shell\" then \"Терминальная оболочка\" else if r.category == \"browser\" then \"Интернет-браузер\" else if r.category == \"office_docs\" then \"Офисные документы\" else if r.category == \"remote_admin\" then \"Удаленное администрирование\" else if r.category == \"development\" then \"Разработка и программирование\" else if r.category == \"communication\" then \"Средства связи\" else if r.category == \"database\" then \"Работа с базами данных\" else if r.category == \"monitoring\" then \"Мониторинг и диагностика\" else if r.category == \"virtualization\" then \"Виртуализация\" else if r.category == \"system\" or r.category == \"misc_user\" or r.category == \"other\" or r.category == \"\" then \"Системные приложения\" else r.category }))\n  |> group(columns: [\"category_view\"])\n  |> sum()\n  |> group()\n  |> sort(columns: [\"_value\"], desc: true)\n  |> yield(name: \"categories\")",
+          "query": "import \"date\"\nstartBound = if v.timeRangeStart > date.sub(d: 2h, from: now()) then date.sub(d: 2h, from: now()) else v.timeRangeStart\nfrom(bucket: \"aw_metrics\")\n  |> range(start: startBound, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"aw_window_event\" and r._field == \"duration_s\")\n  |> map(fn: (r) => ({ r with category_view: if r.category == \"erp_1c\" then \"1С-Бухгалтерия\" else if r.category == \"file_manager\" then \"Файловый менеджер\" else if r.category == \"terminal_shell\" then \"Терминальная оболочка\" else if r.category == \"browser\" then \"Интернет-браузер\" else if r.category == \"office_docs\" then \"Офисные документы\" else if r.category == \"remote_admin\" then \"Удаленное администрирование\" else if r.category == \"development\" then \"Разработка и программирование\" else if r.category == \"communication\" then \"Средства связи\" else if r.category == \"database\" then \"Работа с базами данных\" else if r.category == \"monitoring\" then \"Мониторинг и диагностика\" else if r.category == \"virtualization\" then \"Виртуализация\" else if r.category == \"system\" or r.category == \"misc_user\" or r.category == \"other\" or r.category == \"\" then \"Системные приложения\" else r.category }))\n  |> group(columns: [\"category_view\"])\n  |> sum()\n  |> map(fn: (r) => ({ r with _value: r._value / 3600.0 }))\n  |> set(key: \"_field\", value: \"Часы\")\n  |> keep(columns: [\"_value\", \"_field\", \"category_view\"])\n  |> sort(columns: [\"_value\"], desc: true)\n  |> yield(name: \"categories_hours\")\n",
           "refId": "A"
         }
       ],
@@ -172,7 +176,7 @@
       "fieldConfig": {
         "defaults": {
           "decimals": 0,
-          "unit": "s"
+          "unit": "suffix: ч"
         },
         "overrides": []
       },
@@ -195,11 +199,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "import \"date\"\nstartBound = if v.timeRangeStart > date.sub(d: 2h, from: now()) then date.sub(d: 2h, from: now()) else v.timeRangeStart\nfrom(bucket: \"aw_metrics\")\n  |> range(start: startBound, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"aw_window_event\" and r._field == \"duration_s\")\n  |> group()\n  |> sum()\n  |> yield(name: \"total_active\")",
+          "query": "import \"date\"\nstartBound = if v.timeRangeStart > date.sub(d: 2h, from: now()) then date.sub(d: 2h, from: now()) else v.timeRangeStart\nfrom(bucket: \"aw_metrics\")\n  |> range(start: startBound, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"aw_window_event\" and r._field == \"duration_s\")\n  |> group()\n  |> sum()\n  |> map(fn: (r) => ({ r with _value: r._value / 3600.0 }))\n  |> set(key: \"_field\", value: \"Активное время\")\n  |> keep(columns: [\"_value\", \"_field\"])\n  |> yield(name: \"total_active_hours\")\n",
           "refId": "A"
         }
       ],
diff --git a/grafana/detmir-dlp-management-dashboard.json b/grafana/detmir-dlp-management-dashboard.json
index e4277b2..79838c2 100644
--- a/grafana/detmir-dlp-management-dashboard.json
+++ b/grafana/detmir-dlp-management-dashboard.json
@@ -46,7 +46,10 @@
       },
       "title": "Как читать экран",
       "transparent": true,
-      "type": "text"
+      "type": "text",
+      "fieldConfig": {
+        "defaults": {}
+      }
     },
     {
       "datasource": {
@@ -95,11 +98,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"open\")\n  |> group()\n  |> count()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"open\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -153,11 +157,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"investigating\")\n  |> group()\n  |> count()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"investigating\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -211,11 +216,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n  |> sum()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -269,11 +275,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> sum()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -327,11 +334,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_review\" and r._field == \"count\" and r.verdict == \"review_needed\")\n  |> sum()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_review\" and r._field == \"count\" and r.verdict == \"review_needed\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -385,11 +393,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -24h)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"send_failures\")\n  |> group()\n  |> last()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -24h)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"send_failures\")\n  |> group()\n  |> last()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -466,7 +475,8 @@
           "fields": "",
           "values": false
         },
-        "showUnfilled": true
+        "showUnfilled": true,
+        "noValue": "0"
       },
       "targets": [
         {
@@ -505,7 +515,8 @@
           "fields": "",
           "values": false
         },
-        "showUnfilled": true
+        "showUnfilled": true,
+        "noValue": "0"
       },
       "targets": [
         {
@@ -544,7 +555,8 @@
           "fields": "",
           "values": false
         },
-        "showUnfilled": true
+        "showUnfilled": true,
+        "noValue": "0"
       },
       "targets": [
         {
@@ -623,7 +635,7 @@
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and (r._field == \"count\" or r._field == \"title\"))\n  |> group(columns:[\"case_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"case_id\",\"host\",\"status\",\"severity\",\"assignee\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> filter(fn:(r)=> r.status == \"open\" or r.status == \"investigating\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:10)",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and (r._field == \"count\" or r._field == \"title\"))\n  |> group(columns:[\"case_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"case_id\",\"host\",\"status\",\"severity\",\"assignee\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> filter(fn:(r)=> r.status == \"open\" or r.status == \"investigating\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:10)\n  |> group()\n  |> drop(columns:[\"_start\",\"_stop\"])",
           "refId": "A"
         }
       ],
@@ -689,7 +701,7 @@
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and (r._field == \"count\" or r._field == \"message\" or r._field == \"document_name\" or r._field == \"printer_name\"))\n  |> group(columns:[\"event_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"host\",\"username\",\"signal_type\",\"severity\",\"action\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:15)",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and (r._field == \"count\" or r._field == \"message\" or r._field == \"document_name\" or r._field == \"printer_name\"))\n  |> group(columns:[\"event_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"host\",\"username\",\"signal_type\",\"severity\",\"action\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:15)\n  |> group()\n  |> drop(columns:[\"_start\",\"_stop\"])",
           "refId": "A"
         }
       ],
diff --git a/grafana/detmir-dlp-security-dashboard.json b/grafana/detmir-dlp-security-dashboard.json
index ae2b839..0156164 100644
--- a/grafana/detmir-dlp-security-dashboard.json
+++ b/grafana/detmir-dlp-security-dashboard.json
@@ -41,7 +41,10 @@
       },
       "title": "ИБ: как смотреть этот дашборд",
       "transparent": true,
-      "type": "text"
+      "type": "text",
+      "fieldConfig": {
+        "defaults": {}
+      }
     },
     {
       "datasource": {
@@ -90,11 +93,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> sum()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -126,7 +130,8 @@
                 "value": 3
               }
             ]
-          }
+          },
+          "displayName": "Сработок"
         },
         "overrides": []
       },
@@ -148,11 +153,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n  |> sum()",
+          "query": "import \"array\"\n\nhigh = from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n  |> group()\n  |> sum()\n  |> keep(columns: [\"_value\"])\n\nfallback = array.from(rows: [{_value: 0}])\n\nunion(tables: [fallback, high])\n  |> group()\n  |> sum()\n  |> set(key: \"_field\", value: \"Сработок\")\n  |> keep(columns: [\"_value\", \"_field\"])\n  |> yield(name: \"high_or_critical_count\")\n",
           "refId": "A"
         }
       ],
@@ -206,11 +212,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"open\")\n  |> group()\n  |> count()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"open\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -264,11 +271,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"investigating\")\n  |> group()\n  |> count()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"investigating\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -322,11 +330,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -24h)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_signal\" and r._field == \"count\")\n  |> sum()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -24h)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_signal\" and r._field == \"count\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -380,11 +389,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -24h)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"send_failures\")\n  |> sum()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -24h)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"send_failures\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -419,7 +429,8 @@
           "fields": "",
           "values": false
         },
-        "showUnfilled": true
+        "showUnfilled": true,
+        "noValue": "0"
       },
       "targets": [
         {
@@ -458,7 +469,8 @@
           "fields": "",
           "values": false
         },
-        "showUnfilled": true
+        "showUnfilled": true,
+        "noValue": "0"
       },
       "targets": [
         {
@@ -497,7 +509,8 @@
           "fields": "",
           "values": false
         },
-        "showUnfilled": true
+        "showUnfilled": true,
+        "noValue": "0"
       },
       "targets": [
         {
@@ -536,7 +549,8 @@
           "fields": "",
           "values": false
         },
-        "showUnfilled": true
+        "showUnfilled": true,
+        "noValue": "0"
       },
       "targets": [
         {
@@ -575,7 +589,8 @@
           "fields": "",
           "values": false
         },
-        "showUnfilled": true
+        "showUnfilled": true,
+        "noValue": "0"
       },
       "targets": [
         {
@@ -774,7 +789,7 @@
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and (r._field == \"count\" or r._field == \"title\" or r._field == \"incident_id\" or r._field == \"has_forensics\"))\n  |> group(columns:[\"case_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"case_id\",\"host\",\"status\",\"severity\",\"assignee\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:20)",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and (r._field == \"count\" or r._field == \"title\" or r._field == \"incident_id\" or r._field == \"has_forensics\"))\n  |> group(columns:[\"case_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"case_id\",\"host\",\"status\",\"severity\",\"assignee\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:20)\n  |> group()\n  |> drop(columns:[\"_start\",\"_stop\"])",
           "refId": "A"
         }
       ],
@@ -844,7 +859,7 @@
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and (r._field == \"count\" or r._field == \"message\" or r._field == \"document_name\" or r._field == \"printer_name\" or r._field == \"incident_verdict\"))\n  |> group(columns:[\"event_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"host\",\"username\",\"signal_type\",\"severity\",\"action\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:20)",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and (r._field == \"count\" or r._field == \"message\" or r._field == \"document_name\" or r._field == \"printer_name\" or r._field == \"incident_verdict\"))\n  |> group(columns:[\"event_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"host\",\"username\",\"signal_type\",\"severity\",\"action\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:20)\n  |> group()\n  |> drop(columns:[\"_start\",\"_stop\"])",
           "refId": "A"
         }
       ],
diff --git a/grafana/detmir-rdp-user-activity-dashboard.json b/grafana/detmir-rdp-user-activity-dashboard.json
index df40c64..c681397 100644
--- a/grafana/detmir-rdp-user-activity-dashboard.json
+++ b/grafana/detmir-rdp-user-activity-dashboard.json
@@ -36,12 +36,15 @@
       },
       "id": 1,
       "options": {
-        "content": "### Как читать дашборд\n- **Верхний блок** показывает **вчерашний завершённый день**. Это основной управленческий срез.\n- **Средний блок** показывает **сегодня с начала дня**. Эти цифры оперативные и к вечеру будут меняться.\n- Если утром по блоку **сегодня** мало часов или нули, это не ошибка: день ещё не завершён.\n- Нижние графики нужны для ответа на два вопроса: **как меняется нагрузка по дням** и **кто сколько времени работал**.",
+        "content": "### Работа пользователей в RDP\nВерхний блок — завершённый вчерашний день. Средний блок — текущий день. Нижний блок — детализация по сотрудникам и доказанным действиям.",
         "mode": "markdown"
       },
-      "title": "Руководителю: как смотреть этот экран",
+      "title": "Сводка для руководителя",
       "transparent": true,
-      "type": "text"
+      "type": "text",
+      "fieldConfig": {
+        "defaults": {}
+      }
     },
     {
       "datasource": {
@@ -84,7 +87,8 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
@@ -115,7 +119,7 @@
               }
             ]
           },
-          "unit": "h"
+          "unit": "suffix: ч"
         },
         "overrides": []
       },
@@ -138,11 +142,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -14d)\n  |> filter(fn: (r) => r._measurement == \"aw_rdp_worktime_summary_daily\" and r._field == \"total_active_seconds\" and r.host == \"${host}\")\n  |> group(columns:[\"report_date\"])\n  |> last()\n  |> group()\n  |> sort(columns:[\"report_date\"])\n  |> tail(n:2)\n  |> limit(n:1)\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -14d)\n  |> filter(fn: (r) => r._measurement == \"aw_rdp_worktime_summary_daily\" and r._field == \"total_active_seconds\" and r.host == \"${host}\")\n  |> group(columns:[\"report_date\"])\n  |> last()\n  |> group()\n  |> sort(columns:[\"report_date\"])\n  |> tail(n:2)\n  |> limit(n:1)\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -169,7 +174,7 @@
               }
             ]
           },
-          "unit": "h"
+          "unit": "suffix: ч"
         },
         "overrides": []
       },
@@ -192,7 +197,8 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
@@ -223,7 +229,7 @@
               }
             ]
           },
-          "unit": "h"
+          "unit": "suffix: ч"
         },
         "overrides": []
       },
@@ -246,11 +252,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -14d)\n  |> filter(fn: (r) => r._measurement == \"aw_rdp_worktime_summary_daily\" and r._field == \"total_active_seconds\" and r.host == \"${host}\")\n  |> group(columns:[\"report_date\"])\n  |> last()\n  |> group()\n  |> sort(columns:[\"report_date\"])\n  |> tail(n:1)\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -14d)\n  |> filter(fn: (r) => r._measurement == \"aw_rdp_worktime_summary_daily\" and r._field == \"total_active_seconds\" and r.host == \"${host}\")\n  |> group(columns:[\"report_date\"])\n  |> last()\n  |> group()\n  |> sort(columns:[\"report_date\"])\n  |> tail(n:1)\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -267,7 +274,7 @@
         "defaults": {
           "decimals": 1,
           "displayName": "${__field.labels.user}",
-          "unit": "h"
+          "unit": "suffix: ч"
         },
         "overrides": []
       },
@@ -291,7 +298,8 @@
           "values": false
         },
         "showUnfilled": true,
-        "sizing": "auto"
+        "sizing": "auto",
+        "noValue": "0"
       },
       "targets": [
         {
@@ -312,7 +320,7 @@
         "defaults": {
           "decimals": 1,
           "displayName": "${__field.labels.user}",
-          "unit": "h"
+          "unit": "suffix: ч"
         },
         "overrides": []
       },
@@ -336,7 +344,8 @@
           "values": false
         },
         "showUnfilled": true,
-        "sizing": "auto"
+        "sizing": "auto",
+        "noValue": "0"
       },
       "targets": [
         {
@@ -363,7 +372,7 @@
           },
           "decimals": 1,
           "displayName": "Команда",
-          "unit": "h"
+          "unit": "suffix: ч"
         },
         "overrides": []
       },
@@ -409,7 +418,7 @@
             "showPoints": "auto"
           },
           "displayName": "${__field.labels.user}",
-          "unit": "h"
+          "unit": "suffix: ч"
         },
         "overrides": []
       },
@@ -480,18 +489,18 @@
             "indexByName": {
               "Дата": 0,
               "Пользователь": 1,
-              "Учётная_запись": 2,
+              "Учётная запись": 2,
               "Часы": 3
             },
             "renameByName": {
-              "Учётная_запись": "Учётная запись"
+              "Учётная запись": "Учётная запись"
             }
           }
         }
       ],
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -14d)\n  |> filter(fn: (r) => r._measurement == \"aw_rdp_worktime_daily\" and r._field == \"active_seconds\" and r.host == \"${host}\")\n  |> group(columns:[\"report_date\",\"user\"])\n  |> last()\n  |> sort(columns:[\"report_date\",\"user\"], desc:true)\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))\n  |> keep(columns:[\"report_date\",\"user\",\"user_id\",\"_value\"])\n  |> rename(columns:{report_date:\"Дата\", user:\"Пользователь\", user_id:\"Учётная_запись\", _value:\"Часы\"})",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -14d)\n  |> filter(fn: (r) => r._measurement == \"aw_rdp_worktime_daily\" and r._field == \"active_seconds\" and r.host == \"${host}\")\n  |> group(columns:[\"report_date\",\"user\"])\n  |> last()\n  |> sort(columns:[\"report_date\",\"user\"], desc:true)\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))\n  |> group()\n  |> keep(columns:[\"report_date\",\"user\",\"user_id\",\"_value\"])\n  |> rename(columns:{report_date:\"Дата\", user:\"Пользователь\", user_id:\"Учётная запись\", _value:\"Часы\"})",
           "refId": "A"
         }
       ],
@@ -518,7 +527,7 @@
               }
             ]
           },
-          "unit": "h"
+          "unit": "suffix: ч"
         },
         "overrides": []
       },
@@ -541,11 +550,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nfrom(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r._field == \"proved_work_seconds\" and r.host == \"${host}\" and r.report_date == today)\n  |> group(columns:[\"application\"])\n  |> last()\n  |> group()\n  |> sum()\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))",
+          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nfrom(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r._field == \"proved_work_seconds\" and r.host == \"${host}\" and r.report_date == today)\n  |> set(key: \"_field\", value: \"Доказанная работа\")\n  |> group(columns:[\"application\"])\n  |> last()\n  |> group()\n  |> sum()\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -577,7 +587,7 @@
             "properties": [
               {
                 "id": "unit",
-                "value": "h"
+                "value": "suffix: ч"
               },
               {
                 "id": "decimals",
@@ -588,7 +598,7 @@
           {
             "matcher": {
               "id": "byName",
-              "options": "Evidence"
+              "options": "Подтверждений"
             },
             "properties": [
               {
@@ -620,7 +630,7 @@
       },
       "targets": [
         {
-          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nbase = from(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n\nnums = base\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\ntexts = base\n  |> filter(fn: (r) => r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\njoin(tables: {n: nums, t: texts}, on: [\"application\", \"report_date\"])\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"proved_work_seconds\"], desc:true)\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Часы\", last_action_local:\"Последнее действие\", last_action:\"Контекст\", evidence_events:\"Evidence\"})",
+          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nbase = from(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n\nnums = base\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\ntexts = base\n  |> filter(fn: (r) => r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\njoin(tables: {n: nums, t: texts}, on: [\"application\", \"report_date\"])\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"proved_work_seconds\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})",
           "refId": "A"
         }
       ],
@@ -666,7 +676,8 @@
               "mode": "off"
             }
           },
-          "unit": "h"
+          "unit": "suffix: ч",
+          "displayName": "${__field.labels.application}"
         },
         "overrides": []
       },
@@ -691,7 +702,7 @@
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -14d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r._field == \"proved_work_seconds\" and r.host == \"${host}\")\n  |> group(columns:[\"application\",\"report_date\"])\n  |> last()\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))\n  |> group(columns:[\"application\"])",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -14d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r._field == \"proved_work_seconds\" and r.host == \"${host}\")\n  |> group(columns:[\"application\",\"report_date\"])\n  |> last()\n  |> map(fn:(r)=>({ r with _value: float(v:r._value) / 3600.0 }))\n  |> set(key: \"_field\", value: \"Доказанная работа\")\n  |> group(columns:[\"application\"])",
           "refId": "A"
         }
       ],
diff --git a/grafana/dlp-dashboard.json b/grafana/dlp-dashboard.json
index f0ce769..52e3f88 100644
--- a/grafana/dlp-dashboard.json
+++ b/grafana/dlp-dashboard.json
@@ -56,11 +56,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> sum()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -92,7 +93,8 @@
                 "value": 3
               }
             ]
-          }
+          },
+          "displayName": "Сработок"
         },
         "overrides": []
       },
@@ -114,11 +116,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n  |> sum()",
+          "query": "import \"array\"\n\nhigh = from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n  |> group()\n  |> sum()\n  |> keep(columns: [\"_value\"])\n\nfallback = array.from(rows: [{_value: 0}])\n\nunion(tables: [fallback, high])\n  |> group()\n  |> sum()\n  |> set(key: \"_field\", value: \"Сработок\")\n  |> keep(columns: [\"_value\", \"_field\"])\n  |> yield(name: \"high_or_critical_count\")\n",
           "refId": "A"
         }
       ],
@@ -172,11 +175,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"open\")\n  |> group()\n  |> count()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"open\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -230,11 +234,12 @@
           "fields": "",
           "values": false
         },
-        "textMode": "auto"
+        "textMode": "value",
+        "noValue": "0"
       },
       "targets": [
         {
-          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"investigating\")\n  |> group()\n  |> count()",
+          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"investigating\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
           "refId": "A"
         }
       ],
@@ -311,7 +316,8 @@
           "fields": "",
           "values": false
         },
-        "showUnfilled": true
+        "showUnfilled": true,
+        "noValue": "0"
       },
       "targets": [
         {
diff --git a/grafana/pfsense-loki-dashboard.json b/grafana/pfsense-loki-dashboard.json
index a55544c..dedcd49 100644
--- a/grafana/pfsense-loki-dashboard.json
+++ b/grafana/pfsense-loki-dashboard.json
@@ -87,11 +87,12 @@
           "fields": ""
         },
         "orientation": "auto",
-        "textMode": "auto",
+        "textMode": "value",
         "wideLayout": true,
         "colorMode": "value",
         "graphMode": "area",
-        "justifyMode": "auto"
+        "justifyMode": "auto",
+        "noValue": "0"
       }
     },
     {
@@ -157,11 +158,12 @@
           "fields": ""
         },
         "orientation": "auto",
-        "textMode": "auto",
+        "textMode": "value",
         "wideLayout": true,
         "colorMode": "value",
         "graphMode": "area",
-        "justifyMode": "auto"
+        "justifyMode": "auto",
+        "noValue": "0"
       }
     },
     {
@@ -223,11 +225,12 @@
           "fields": ""
         },
         "orientation": "auto",
-        "textMode": "auto",
+        "textMode": "value",
         "wideLayout": true,
         "colorMode": "value",
         "graphMode": "area",
-        "justifyMode": "auto"
+        "justifyMode": "auto",
+        "noValue": "0"
       }
     },
     {
@@ -289,16 +292,17 @@
           "fields": ""
         },
         "orientation": "auto",
-        "textMode": "auto",
+        "textMode": "value",
         "wideLayout": true,
         "colorMode": "value",
         "graphMode": "area",
-        "justifyMode": "auto"
+        "justifyMode": "auto",
+        "noValue": "0"
       }
     },
     {
       "id": 5,
-      "title": "Динамика block/pass",
+      "title": "Динамика блокировок и разрешений",
       "type": "timeseries",
       "datasource": {
         "type": "loki",
@@ -369,12 +373,9 @@
         },
         "legend": {
           "showLegend": true,
-          "displayMode": "table",
+          "displayMode": "list",
           "placement": "bottom",
-          "calcs": [
-            "lastNotNull",
-            "max"
-          ]
+          "calcs": []
         }
       }
     },
@@ -451,12 +452,9 @@
         },
         "legend": {
           "showLegend": true,
-          "displayMode": "table",
+          "displayMode": "list",
           "placement": "bottom",
-          "calcs": [
-            "lastNotNull",
-            "max"
-          ]
+          "calcs": []
         }
       }
     },
@@ -517,7 +515,8 @@
         "minVizWidth": 0,
         "minVizHeight": 10,
         "namePlacement": "auto",
-        "valueMode": "color"
+        "valueMode": "color",
+        "noValue": "0"
       }
     },
     {
@@ -577,7 +576,8 @@
         "minVizWidth": 0,
         "minVizHeight": 10,
         "namePlacement": "auto",
-        "valueMode": "color"
+        "valueMode": "color",
+        "noValue": "0"
       }
     },
     {
@@ -637,7 +637,8 @@
         "minVizWidth": 0,
         "minVizHeight": 10,
         "namePlacement": "auto",
-        "valueMode": "color"
+        "valueMode": "color",
+        "noValue": "0"
       }
     },
     {
@@ -697,7 +698,8 @@
           "values": false
         },
         "showUnfilled": true,
-        "valueMode": "color"
+        "valueMode": "color",
+        "noValue": "0"
       }
     },
     {
@@ -757,7 +759,8 @@
           "values": false
         },
         "showUnfilled": true,
-        "valueMode": "color"
+        "valueMode": "color",
+        "noValue": "0"
       }
     },
     {
@@ -817,7 +820,8 @@
           "values": false
         },
         "showUnfilled": true,
-        "valueMode": "color"
+        "valueMode": "color",
+        "noValue": "0"
       }
     },
     {
@@ -882,8 +886,8 @@
           "text": "",
           "value": ""
         },
-        "description": "Первое слово для поиска",
-        "label": "Search Term 1",
+        "description": "Первое слово для фильтрации событий",
+        "label": "Поиск 1",
         "name": "search_term_1",
         "options": [
           {
@@ -901,8 +905,8 @@
           "text": "",
           "value": ""
         },
-        "description": "Второе слово для поиска",
-        "label": "Search Term 2",
+        "description": "Второе слово для фильтрации событий",
+        "label": "Поиск 2",
         "name": "search_term_2",
         "options": [
           {
@@ -923,7 +927,7 @@
   },
   "timepicker": {},
   "timezone": "browser",
-  "title": "pfSense Firewall Overview",
+  "title": "pfSense: обзор firewall",
   "uid": "pfsense-loki-dashboard",
   "version": 6,
   "weekStart": ""