{
  "groups": [
    {
      "id": "windows-rdp",
      "name": "Windows RDP",
      "description": "Пользовательские Windows/RDP хосты с активностью, DLP и рабочим временем.",
      "patterns": [
        "^(SHARKON|WIN|RDP|TERM|TS-|WS-)"
      ],
      "links": [
        { "label": "Активность", "type": "activity" },
        { "label": "DLP", "type": "bucket", "bucket_prefix": "aw-dlp-endpoint-signals_" }
      ]
    },
    {
      "id": "virtual-infra",
      "name": "Virtual servers + Proxmox",
      "description": "Инфраструктурные VM и сетевые узлы. Здесь должны лежать Proxmox, pfSense, Debian и Ubuntu серверы.",
      "patterns": [
        "^(PFSENSE|PVE|PROXMOX|DEBIAN|UBUNTU|LINUX|VM-|SRV-|INFRA-)"
      ],
      "links": [
        { "label": "pfSense health", "type": "bucket", "bucket_prefix": "aw-pfsense-health_" },
        { "label": "pfSense gateways", "type": "bucket", "bucket_prefix": "aw-pfsense-gateways_" },
        { "label": "Все бакеты", "type": "buckets" }
      ]
    }
  ],
  "ungrouped_name": "Прочие хосты"
}