From 41f7a869e57e8ad83ab7b23bbf0f825cf131ecde Mon Sep 17 00:00:00 2001 From: igor04091968 Date: Fri, 22 May 2026 00:36:54 +0300 Subject: [PATCH] feat(1c): make file dashboards live and provisioned --- clickhouse-1c/.gitignore | 2 + .../detections/insert_detections.sql | 39 +- clickhouse-1c/docker-compose.yml | 2 +- .../provisioning/dashboards/dashboards.yml | 12 + .../dashboards/files/1c-audit-overview.json | 333 ++++++++++ .../dashboards/files/1c-data-quality.json | 476 +++++++++++++++ .../dashboards/files/1c-detections.json | 290 +++++++++ .../files/1c-executive-summary.json | 570 ++++++++++++++++++ .../files/1c-investigation-timeline.json | 369 ++++++++++++ .../files/1c-operations-health.json | 337 +++++++++++ clickhouse-1c/sample/seed_demo.sql | 21 + 11 files changed, 2438 insertions(+), 13 deletions(-) create mode 100644 clickhouse-1c/.gitignore create mode 100644 clickhouse-1c/grafana/provisioning/dashboards/dashboards.yml create mode 100644 clickhouse-1c/grafana/provisioning/dashboards/files/1c-audit-overview.json create mode 100644 clickhouse-1c/grafana/provisioning/dashboards/files/1c-data-quality.json create mode 100644 clickhouse-1c/grafana/provisioning/dashboards/files/1c-detections.json create mode 100644 clickhouse-1c/grafana/provisioning/dashboards/files/1c-executive-summary.json create mode 100644 clickhouse-1c/grafana/provisioning/dashboards/files/1c-investigation-timeline.json create mode 100644 clickhouse-1c/grafana/provisioning/dashboards/files/1c-operations-health.json create mode 100644 clickhouse-1c/sample/seed_demo.sql diff --git a/clickhouse-1c/.gitignore b/clickhouse-1c/.gitignore new file mode 100644 index 0000000..789e73f --- /dev/null +++ b/clickhouse-1c/.gitignore @@ -0,0 +1,2 @@ +.env +.local/ diff --git a/clickhouse-1c/detections/insert_detections.sql b/clickhouse-1c/detections/insert_detections.sql index cbd2d82..3ba5c25 100644 --- a/clickhouse-1c/detections/insert_detections.sql +++ b/clickhouse-1c/detections/insert_detections.sql @@ -17,8 +17,8 @@ WHERE event_name ILIKE '%login%' INSERT INTO analytics_1c.detections SELECT - max(ts) AS ts, - concat('failed_login_burst:', infobase, ':', user, ':', toString(toUnixTimestamp(max(ts)))) AS detection_id, + event_ts AS ts, + concat('failed_login_burst:', infobase, ':', user, ':', toString(toUnixTimestamp(event_ts))) AS detection_id, infobase, 'failed_login_burst' AS rule_id, 'Всплеск ошибок входа' AS rule_title, @@ -28,16 +28,24 @@ SELECT 65 AS score, concat('У пользователя ', user, ' более 5 ошибок входа за 15 минут') AS summary, 'open' AS status -FROM analytics_1c.reglog_events -WHERE level IN ('error', 'warn') - AND (event_name ILIKE '%login%' OR message ILIKE '%парол%' OR message ILIKE '%auth%') -GROUP BY infobase, user, toStartOfFifteenMinutes(ts) -HAVING count() >= 5; +FROM ( + SELECT + infobase, + user, + toStartOfFifteenMinutes(ts) AS window_ts, + max(ts) AS event_ts, + count() AS attempts + FROM analytics_1c.reglog_events + WHERE level IN ('error', 'warn') + AND (event_name ILIKE '%login%' OR message ILIKE '%парол%' OR message ILIKE '%auth%') + GROUP BY infobase, user, window_ts + HAVING attempts >= 5 +); INSERT INTO analytics_1c.detections SELECT - max(ts) AS ts, - concat('disk_latency_high:', host, ':', toString(toUnixTimestamp(max(ts)))) AS detection_id, + event_ts AS ts, + concat('disk_latency_high:', host, ':', toString(toUnixTimestamp(event_ts))) AS detection_id, '' AS infobase, 'disk_latency_high' AS rule_id, 'Высокая задержка диска' AS rule_title, @@ -47,6 +55,13 @@ SELECT 65 AS score, concat('На хосте ', host, ' задержка диска превышает 50 мс') AS summary, 'open' AS status -FROM analytics_1c.host_events -GROUP BY host, toStartOfHour(ts) -HAVING avg(disk_latency_ms) > 50; +FROM ( + SELECT + host, + toStartOfHour(ts) AS hour_ts, + max(ts) AS event_ts, + avg(disk_latency_ms) AS avg_latency_ms + FROM analytics_1c.host_events + GROUP BY host, hour_ts + HAVING avg_latency_ms > 50 +); diff --git a/clickhouse-1c/docker-compose.yml b/clickhouse-1c/docker-compose.yml index 4bafdf9..042c61e 100644 --- a/clickhouse-1c/docker-compose.yml +++ b/clickhouse-1c/docker-compose.yml @@ -11,8 +11,8 @@ services: - "${CLICKHOUSE_PORT}:8123" - "${CLICKHOUSE_NATIVE_PORT}:9000" volumes: - - ./clickhouse/init:/docker-entrypoint-initdb.d:ro - clickhouse_1c_data:/var/lib/clickhouse + - ./clickhouse/init:/docker-entrypoint-initdb.d:ro grafana: image: grafana/grafana:11.2.2 diff --git a/clickhouse-1c/grafana/provisioning/dashboards/dashboards.yml b/clickhouse-1c/grafana/provisioning/dashboards/dashboards.yml new file mode 100644 index 0000000..56af97d --- /dev/null +++ b/clickhouse-1c/grafana/provisioning/dashboards/dashboards.yml @@ -0,0 +1,12 @@ +apiVersion: 1 + +providers: + - name: clickhouse-1c + orgId: 1 + folder: 1C File Analytics + type: file + disableDeletion: false + editable: true + updateIntervalSeconds: 30 + options: + path: /etc/grafana/provisioning/dashboards/files diff --git a/clickhouse-1c/grafana/provisioning/dashboards/files/1c-audit-overview.json b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-audit-overview.json new file mode 100644 index 0000000..0b86ff3 --- /dev/null +++ b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-audit-overview.json @@ -0,0 +1,333 @@ +{ + "annotations": { + "list": [] + }, + "editable": true, + "fiscalYearStartMonth": 0, + "graphTooltip": 1, + "id": null, + "links": [], + "panels": [ + { + "id": 1, + "title": "Входы вне рабочего времени", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 0, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, infobase, user, host, event_name, message FROM analytics_1c.reglog_events WHERE event_name ILIKE '%login%' AND toHour(ts) NOT BETWEEN 8 AND 20 AND $__timeFilter(ts) ORDER BY ts DESC LIMIT 50", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 2, + "title": "Критичные изменения объектов", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 0, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, infobase, user, object_type, object_id, action, risk_tag FROM analytics_1c.audit_events WHERE risk_tag != '' AND $__timeFilter(ts) ORDER BY ts DESC LIMIT 50", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 3, + "title": "Топ пользователей по изменениям", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 8, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT user, count() AS changes_total FROM analytics_1c.audit_events WHERE $__timeFilter(ts) GROUP BY user ORDER BY changes_total DESC LIMIT 20", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 4, + "title": "Severity split", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 8, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT severity, count() AS detections_total FROM analytics_1c.detections WHERE $__timeFilter(ts) GROUP BY severity ORDER BY severity", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 5, + "title": "Audit actions over time", + "type": "timeseries", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 16, + "w": 24, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "timeSeries", + "rawSql": "SELECT toStartOfHour(ts) AS time, count() AS value FROM analytics_1c.audit_events WHERE $__timeFilter(ts) GROUP BY time ORDER BY time", + "refId": "A" + } + ], + "options": { + "legend": { + "displayMode": "list", + "placement": "bottom" + }, + "tooltip": { + "mode": "multi" + } + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + } + }, + "overrides": [] + } + } + ], + "refresh": "30s", + "schemaVersion": 39, + "style": "dark", + "tags": [ + "1c", + "audit", + "clickhouse" + ], + "templating": { + "list": [ + { + "name": "infobase", + "label": "Infobase", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "query": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "severity", + "label": "Severity", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT arrayJoin(['low','medium','high','critical'])", + "query": "SELECT arrayJoin(['low','medium','high','critical'])", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "host", + "label": "Host", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "query": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "user", + "label": "User", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "query": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + } + ] + }, + "time": { + "from": "now-7d", + "to": "now" + }, + "timepicker": {}, + "timezone": "browser", + "title": "1C File - Audit Overview", + "uid": "1c-file-audit", + "version": 1, + "weekStart": "" +} \ No newline at end of file diff --git a/clickhouse-1c/grafana/provisioning/dashboards/files/1c-data-quality.json b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-data-quality.json new file mode 100644 index 0000000..7f78773 --- /dev/null +++ b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-data-quality.json @@ -0,0 +1,476 @@ +{ + "annotations": { + "list": [] + }, + "editable": true, + "fiscalYearStartMonth": 0, + "graphTooltip": 1, + "id": null, + "links": [], + "panels": [ + { + "id": 1, + "title": "Row counts", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 0, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT 'documents' AS dataset, count() AS rows_total FROM analytics_1c.documents UNION ALL SELECT 'postings', count() FROM analytics_1c.postings UNION ALL SELECT 'reglog_events', count() FROM analytics_1c.reglog_events UNION ALL SELECT 'audit_events', count() FROM analytics_1c.audit_events UNION ALL SELECT 'host_events', count() FROM analytics_1c.host_events UNION ALL SELECT 'detections', count() FROM analytics_1c.detections UNION ALL SELECT 'cases', count() FROM analytics_1c.cases", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 2, + "title": "Latest source files", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 0, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT source_file, max(ts) AS latest_ts FROM analytics_1c.documents GROUP BY source_file ORDER BY latest_ts DESC LIMIT 50", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 3, + "title": "Detections total", + "type": "stat", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 8, + "w": 6, + "h": 6 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT count() AS value FROM analytics_1c.detections", + "refId": "A" + } + ], + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "auto", + "orientation": "auto", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "orange", + "value": 1 + }, + { + "color": "red", + "value": 10 + } + ] + } + }, + "overrides": [] + } + }, + { + "id": 4, + "title": "Cases total", + "type": "stat", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 6, + "y": 8, + "w": 6, + "h": 6 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT count() AS value FROM analytics_1c.cases", + "refId": "A" + } + ], + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "auto", + "orientation": "auto", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "orange", + "value": 1 + }, + { + "color": "red", + "value": 10 + } + ] + } + }, + "overrides": [] + } + }, + { + "id": 5, + "title": "Timeline total", + "type": "stat", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 8, + "w": 6, + "h": 6 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT count() AS value FROM analytics_1c.entity_timeline", + "refId": "A" + } + ], + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "auto", + "orientation": "auto", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "orange", + "value": 1 + }, + { + "color": "red", + "value": 10 + } + ] + } + }, + "overrides": [] + } + }, + { + "id": 6, + "title": "Backup failures", + "type": "stat", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 18, + "y": 8, + "w": 6, + "h": 6 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT count() AS value FROM analytics_1c.host_events WHERE backup_ok = 0 AND $__timeFilter(ts)", + "refId": "A" + } + ], + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "auto", + "orientation": "auto", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "orange", + "value": 1 + }, + { + "color": "red", + "value": 10 + } + ] + } + }, + "overrides": [] + } + } + ], + "refresh": "30s", + "schemaVersion": 39, + "style": "dark", + "tags": [ + "1c", + "quality", + "clickhouse" + ], + "templating": { + "list": [ + { + "name": "infobase", + "label": "Infobase", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "query": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "severity", + "label": "Severity", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT arrayJoin(['low','medium','high','critical'])", + "query": "SELECT arrayJoin(['low','medium','high','critical'])", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "host", + "label": "Host", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "query": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "user", + "label": "User", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "query": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + } + ] + }, + "time": { + "from": "now-7d", + "to": "now" + }, + "timepicker": {}, + "timezone": "browser", + "title": "1C File - Data Quality", + "uid": "1c-file-data-quality", + "version": 1, + "weekStart": "" +} \ No newline at end of file diff --git a/clickhouse-1c/grafana/provisioning/dashboards/files/1c-detections.json b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-detections.json new file mode 100644 index 0000000..8742be3 --- /dev/null +++ b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-detections.json @@ -0,0 +1,290 @@ +{ + "annotations": { + "list": [] + }, + "editable": true, + "fiscalYearStartMonth": 0, + "graphTooltip": 1, + "id": null, + "links": [], + "panels": [ + { + "id": 1, + "title": "Open detections", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 0, + "w": 24, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, infobase, rule_title, entity_type, entity_id, severity, score, summary FROM analytics_1c.detections WHERE status = 'open' AND $__timeFilter(ts) ORDER BY ts DESC LIMIT 100", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 2, + "title": "Top rules", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 8, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT rule_title, severity, count() AS detections_total, sum(score) AS score_total FROM analytics_1c.detections WHERE $__timeFilter(ts) GROUP BY rule_title, severity ORDER BY detections_total DESC LIMIT 20", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 3, + "title": "Open cases", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 8, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT opened_at, case_id, infobase, title, severity, status FROM analytics_1c.cases ORDER BY opened_at DESC LIMIT 50", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 4, + "title": "Critical / High timeline", + "type": "timeseries", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 16, + "w": 24, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "timeSeries", + "rawSql": "SELECT toStartOfHour(ts) AS time, count() AS value FROM analytics_1c.detections WHERE severity IN ('high','critical') AND $__timeFilter(ts) GROUP BY time ORDER BY time", + "refId": "A" + } + ], + "options": { + "legend": { + "displayMode": "list", + "placement": "bottom" + }, + "tooltip": { + "mode": "multi" + } + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + } + }, + "overrides": [] + } + } + ], + "refresh": "30s", + "schemaVersion": 39, + "style": "dark", + "tags": [ + "1c", + "detections", + "clickhouse" + ], + "templating": { + "list": [ + { + "name": "infobase", + "label": "Infobase", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "query": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "severity", + "label": "Severity", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT arrayJoin(['low','medium','high','critical'])", + "query": "SELECT arrayJoin(['low','medium','high','critical'])", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "host", + "label": "Host", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "query": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "user", + "label": "User", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "query": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + } + ] + }, + "time": { + "from": "now-7d", + "to": "now" + }, + "timepicker": {}, + "timezone": "browser", + "title": "1C File - Detections", + "uid": "1c-file-detections", + "version": 1, + "weekStart": "" +} \ No newline at end of file diff --git a/clickhouse-1c/grafana/provisioning/dashboards/files/1c-executive-summary.json b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-executive-summary.json new file mode 100644 index 0000000..c89da78 --- /dev/null +++ b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-executive-summary.json @@ -0,0 +1,570 @@ +{ + "annotations": { + "list": [] + }, + "editable": true, + "fiscalYearStartMonth": 0, + "graphTooltip": 1, + "id": null, + "links": [], + "panels": [ + { + "id": 1, + "title": "Продажи за 7 дней", + "type": "stat", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 0, + "w": 6, + "h": 6 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT sum(amount) AS value FROM analytics_1c.documents WHERE doc_type = 'Реализация' AND $__timeFilter(ts)", + "refId": "A" + } + ], + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "auto", + "orientation": "auto", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "orange", + "value": 1 + }, + { + "color": "red", + "value": 10 + } + ] + } + }, + "overrides": [] + } + }, + { + "id": 2, + "title": "Просроченная дебиторка", + "type": "stat", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 6, + "y": 0, + "w": 6, + "h": 6 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT sum(amount) AS value FROM analytics_1c.documents WHERE status = 'overdue' AND $__timeFilter(ts)", + "refId": "A" + } + ], + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "auto", + "orientation": "auto", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "orange", + "value": 1 + }, + { + "color": "red", + "value": 10 + } + ] + } + }, + "overrides": [] + } + }, + { + "id": 3, + "title": "Открытые кейсы", + "type": "stat", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 0, + "w": 6, + "h": 6 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT count() AS value FROM analytics_1c.cases WHERE status != 'closed'", + "refId": "A" + } + ], + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "auto", + "orientation": "auto", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "orange", + "value": 1 + }, + { + "color": "red", + "value": 10 + } + ] + } + }, + "overrides": [] + } + }, + { + "id": 4, + "title": "Critical detections", + "type": "stat", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 18, + "y": 0, + "w": 6, + "h": 6 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT count() AS value FROM analytics_1c.detections WHERE severity = 'critical' AND $__timeFilter(ts)", + "refId": "A" + } + ], + "options": { + "colorMode": "value", + "graphMode": "none", + "justifyMode": "auto", + "orientation": "auto", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "orange", + "value": 1 + }, + { + "color": "red", + "value": 10 + } + ] + } + }, + "overrides": [] + } + }, + { + "id": 5, + "title": "Продажи по дням", + "type": "timeseries", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 6, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "timeSeries", + "rawSql": "SELECT toStartOfDay(ts) AS time, sum(amount) AS value FROM analytics_1c.documents WHERE doc_type = 'Реализация' AND $__timeFilter(ts) GROUP BY time ORDER BY time", + "refId": "A" + } + ], + "options": { + "legend": { + "displayMode": "list", + "placement": "bottom" + }, + "tooltip": { + "mode": "multi" + } + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + } + }, + "overrides": [] + } + }, + { + "id": 6, + "title": "Detections по времени", + "type": "timeseries", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 6, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "timeSeries", + "rawSql": "SELECT toStartOfHour(ts) AS time, count() AS value FROM analytics_1c.detections WHERE $__timeFilter(ts) GROUP BY time ORDER BY time", + "refId": "A" + } + ], + "options": { + "legend": { + "displayMode": "list", + "placement": "bottom" + }, + "tooltip": { + "mode": "multi" + } + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + } + }, + "overrides": [] + } + }, + { + "id": 7, + "title": "Топ риск-пользователей", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 14, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT entity_id AS user, sum(score) AS score_total, count() AS detections_total FROM analytics_1c.detections WHERE entity_type = 'user' AND $__timeFilter(ts) GROUP BY entity_id ORDER BY score_total DESC LIMIT 10", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 8, + "title": "Топ проблемных баз", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 14, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT infobase, count() AS detections_total, sum(score) AS score_total FROM analytics_1c.detections WHERE $__timeFilter(ts) GROUP BY infobase ORDER BY score_total DESC LIMIT 10", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + } + ], + "refresh": "30s", + "schemaVersion": 39, + "style": "dark", + "tags": [ + "1c", + "executive", + "clickhouse" + ], + "templating": { + "list": [ + { + "name": "infobase", + "label": "Infobase", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "query": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "severity", + "label": "Severity", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT arrayJoin(['low','medium','high','critical'])", + "query": "SELECT arrayJoin(['low','medium','high','critical'])", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "host", + "label": "Host", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "query": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "user", + "label": "User", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "query": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + } + ] + }, + "time": { + "from": "now-7d", + "to": "now" + }, + "timepicker": {}, + "timezone": "browser", + "title": "1C File - Executive Summary", + "uid": "1c-file-exec", + "version": 1, + "weekStart": "" +} \ No newline at end of file diff --git a/clickhouse-1c/grafana/provisioning/dashboards/files/1c-investigation-timeline.json b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-investigation-timeline.json new file mode 100644 index 0000000..3c9c7f4 --- /dev/null +++ b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-investigation-timeline.json @@ -0,0 +1,369 @@ +{ + "annotations": { + "list": [] + }, + "editable": true, + "fiscalYearStartMonth": 0, + "graphTooltip": 1, + "id": null, + "links": [], + "panels": [ + { + "id": 1, + "title": "Entity timeline", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 0, + "w": 24, + "h": 10 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, entity_type, entity_id, actor, source, event_type, severity, score, summary FROM analytics_1c.entity_timeline WHERE $__timeFilter(ts) AND entity_type = '${entity_type}' AND entity_id = '${entity_id}' ORDER BY ts DESC LIMIT 200", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 2, + "title": "Related detections", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 10, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, rule_title, severity, score, summary FROM analytics_1c.detections WHERE entity_type = '${entity_type}' AND entity_id = '${entity_id}' AND $__timeFilter(ts) ORDER BY ts DESC LIMIT 100", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 3, + "title": "Recent documents", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 10, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, infobase, doc_type, doc_number, author, amount, status FROM analytics_1c.documents WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 4, + "title": "Recent reglog", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 18, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, user, event_name, level, message FROM analytics_1c.reglog_events WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 5, + "title": "Recent audit", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 18, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, user, object_type, object_id, action, risk_tag FROM analytics_1c.audit_events WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + } + ], + "refresh": "30s", + "schemaVersion": 39, + "style": "dark", + "tags": [ + "1c", + "investigation", + "clickhouse" + ], + "templating": { + "list": [ + { + "name": "infobase", + "label": "Infobase", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "query": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "severity", + "label": "Severity", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT arrayJoin(['low','medium','high','critical'])", + "query": "SELECT arrayJoin(['low','medium','high','critical'])", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "host", + "label": "Host", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "query": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "user", + "label": "User", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "query": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "entity_type", + "label": "Entity type", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT arrayJoin(['user','document','host'])", + "query": "SELECT arrayJoin(['user','document','host'])", + "multi": false, + "includeAll": false, + "sort": 1, + "current": { + "selected": false, + "text": "", + "value": "" + } + }, + { + "name": "entity_id", + "label": "Entity id", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT entity_id FROM analytics_1c.entity_timeline ORDER BY entity_id", + "query": "SELECT DISTINCT entity_id FROM analytics_1c.entity_timeline ORDER BY entity_id", + "multi": false, + "includeAll": false, + "sort": 1, + "current": { + "selected": false, + "text": "", + "value": "" + } + } + ] + }, + "time": { + "from": "now-7d", + "to": "now" + }, + "timepicker": {}, + "timezone": "browser", + "title": "1C File - Investigation Timeline", + "uid": "1c-file-investigation", + "version": 1, + "weekStart": "" +} \ No newline at end of file diff --git a/clickhouse-1c/grafana/provisioning/dashboards/files/1c-operations-health.json b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-operations-health.json new file mode 100644 index 0000000..1e51732 --- /dev/null +++ b/clickhouse-1c/grafana/provisioning/dashboards/files/1c-operations-health.json @@ -0,0 +1,337 @@ +{ + "annotations": { + "list": [] + }, + "editable": true, + "fiscalYearStartMonth": 0, + "graphTooltip": 1, + "id": null, + "links": [], + "panels": [ + { + "id": 1, + "title": "CPU / RAM", + "type": "timeseries", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 0, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "timeSeries", + "rawSql": "SELECT ts AS time, cpu_pct AS cpu, ram_pct AS ram FROM analytics_1c.host_events WHERE $__timeFilter(ts) ORDER BY time", + "refId": "A" + } + ], + "options": { + "legend": { + "displayMode": "list", + "placement": "bottom" + }, + "tooltip": { + "mode": "multi" + } + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + } + }, + "overrides": [] + } + }, + { + "id": 2, + "title": "Disk latency", + "type": "timeseries", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 0, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "timeSeries", + "rawSql": "SELECT ts AS time, disk_latency_ms AS value FROM analytics_1c.host_events WHERE $__timeFilter(ts) ORDER BY time", + "refId": "A" + } + ], + "options": { + "legend": { + "displayMode": "list", + "placement": "bottom" + }, + "tooltip": { + "mode": "multi" + } + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + } + }, + "overrides": [] + } + }, + { + "id": 3, + "title": "Последнее состояние хоста", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 8, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT host, anyLast(cpu_pct) AS cpu_pct, anyLast(ram_pct) AS ram_pct, anyLast(disk_free_gb) AS disk_free_gb, anyLast(disk_latency_ms) AS disk_latency_ms, anyLast(backup_ok) AS backup_ok FROM analytics_1c.host_events GROUP BY host ORDER BY host", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 4, + "title": "Ошибки журнала регистрации", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 12, + "y": 8, + "w": 12, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, infobase, user, event_name, level, message FROM analytics_1c.reglog_events WHERE level IN ('error','warn') AND $__timeFilter(ts) ORDER BY ts DESC LIMIT 50", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + }, + { + "id": 5, + "title": "Длительные операции", + "type": "table", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "pluginVersion": "11.2.2", + "gridPos": { + "x": 0, + "y": 16, + "w": 24, + "h": 8 + }, + "targets": [ + { + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "editorType": "sql", + "format": 1, + "pluginVersion": "11.2.2", + "queryType": "table", + "rawSql": "SELECT ts, infobase, user, event_name, duration_ms, message FROM analytics_1c.reglog_events WHERE duration_ms > 3000 AND $__timeFilter(ts) ORDER BY duration_ms DESC LIMIT 50", + "refId": "A" + } + ], + "options": { + "showHeader": true, + "sortBy": [ + { + "displayName": "ts", + "desc": true + } + ] + }, + "fieldConfig": { + "defaults": {}, + "overrides": [] + } + } + ], + "refresh": "30s", + "schemaVersion": 39, + "style": "dark", + "tags": [ + "1c", + "ops", + "clickhouse" + ], + "templating": { + "list": [ + { + "name": "infobase", + "label": "Infobase", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "query": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "severity", + "label": "Severity", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT arrayJoin(['low','medium','high','critical'])", + "query": "SELECT arrayJoin(['low','medium','high','critical'])", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "host", + "label": "Host", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "query": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + }, + { + "name": "user", + "label": "User", + "type": "query", + "datasource": { + "type": "grafana-clickhouse-datasource", + "uid": "clickhouse-1c" + }, + "refresh": 1, + "definition": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "query": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user", + "multi": true, + "includeAll": true, + "sort": 1, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + } + } + ] + }, + "time": { + "from": "now-7d", + "to": "now" + }, + "timepicker": {}, + "timezone": "browser", + "title": "1C File - Operations Health", + "uid": "1c-file-ops", + "version": 1, + "weekStart": "" +} \ No newline at end of file diff --git a/clickhouse-1c/sample/seed_demo.sql b/clickhouse-1c/sample/seed_demo.sql new file mode 100644 index 0000000..1957314 --- /dev/null +++ b/clickhouse-1c/sample/seed_demo.sql @@ -0,0 +1,21 @@ +INSERT INTO analytics_1c.documents (ts, infobase, organization, department, doc_type, doc_id, doc_number, author, counterparty, operation_type, amount, status, posted, source_file) VALUES +('2026-05-21 08:10:00','ТРАНСГАЗ 2026','Трансгаз','Продажи','Реализация','DOC-1','000001','USER1','ООО Альфа','sale',125000.00,'posted',1,'demo-docs.jsonl'), +('2026-05-21 09:40:00','ТРАНСГАЗ 2026','Трансгаз','Продажи','Возврат','DOC-2','000002','USER1','ООО Альфа','return',12000.00,'posted',1,'demo-docs.jsonl'), +('2026-05-21 10:15:00','ФЕЛИЦТ ГРУПП 2026','Фелицт','Бухгалтерия','Корректировка','DOC-3','000003','USER4','ООО Бета','adjustment',54000.00,'overdue',0,'demo-docs.jsonl'); + +INSERT INTO analytics_1c.postings (ts, infobase, registrar, operation_type, account_dt, account_ct, amount, source_file) VALUES +('2026-05-21 08:11:00','ТРАНСГАЗ 2026','DOC-1','sale','62.01','90.01',125000.00,'demo-postings.jsonl'), +('2026-05-21 10:16:00','ФЕЛИЦТ ГРУПП 2026','DOC-3','adjustment','91.02','62.01',54000.00,'demo-postings.jsonl'); + +INSERT INTO analytics_1c.reglog_events (ts, infobase, user, host, app, event_name, level, duration_ms, message, source_file) VALUES +('2026-05-21 07:15:00','ТРАНСГАЗ 2026','USER1','SHARKON2025','1cv8c','Login','warn',0,'Вход вне рабочего времени','demo-reglog.jsonl'), +('2026-05-21 10:20:00','ФЕЛИЦТ ГРУПП 2026','USER4','SHARKON2025','1cv8c','PostingError','error',4200,'Ошибка проведения документа','demo-reglog.jsonl'), +('2026-05-21 10:25:00','ФЕЛИЦТ ГРУПП 2026','USER4','SHARKON2025','1cv8c','ExchangeFailure','error',6100,'Ошибка обмена с внешней системой','demo-reglog.jsonl'); + +INSERT INTO analytics_1c.audit_events (ts, infobase, user, object_type, object_id, action, before_hash, after_hash, risk_tag, source_file) VALUES +('2026-05-21 10:17:00','ФЕЛИЦТ ГРУПП 2026','USER4','document','DOC-3','repost','abc','def','repost','demo-audit.jsonl'), +('2026-05-21 10:18:00','ФЕЛИЦТ ГРУПП 2026','USER4','counterparty','CP-77','change','old','new','critical_ref','demo-audit.jsonl'); + +INSERT INTO analytics_1c.host_events (ts, host, cpu_pct, ram_pct, disk_free_gb, disk_latency_ms, smb_errors, rdp_sessions, backup_ok, source_file) VALUES +('2026-05-21 10:00:00','SHARKON2025',41.2,68.4,120.0,12.5,0,4,1,'demo-host.jsonl'), +('2026-05-21 11:00:00','SHARKON2025',57.8,72.0,118.0,61.0,2,4,0,'demo-host.jsonl');