{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": {
          "type": "grafana",
          "uid": "-- Grafana --"
        },
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "target": {
          "limit": 100,
          "matchAny": false,
          "tags": [],
          "type": "dashboard"
        },
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 1,
  "id": null,
  "links": [],
  "panels": [
    {
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 1,
      "options": {
        "content": "### Как читать этот экран\n- **Верхний блок** отвечает на вопрос: сколько было сработок и в каком состоянии разбор.\n- **Средний блок** показывает характер сработок: типы, серьёзность, пользователи и итоги разбора.\n- **Нижний блок** нужен для оперативной работы ИБ: динамика по дням, ошибки отправки коллекторов, последние кейсы и последние инциденты.\n- Если нужно быстро понять, есть ли проблема прямо сейчас, смотрите на **открытые кейсы**, **высокие/критичные**, **ошибки отправки** и **последние инциденты**.",
        "mode": "markdown"
      },
      "title": "ИБ: как смотреть этот дашборд",
      "transparent": true,
      "type": "text",
      "fieldConfig": {
        "defaults": {}
      }
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 5
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 4,
        "x": 0,
        "y": 3
      },
      "id": 2,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
          "refId": "A"
        }
      ],
      "title": "Сработок за 7 дней",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 3
              }
            ]
          },
          "displayName": "Сработок"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 4,
        "x": 4,
        "y": 3
      },
      "id": 3,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "import \"array\"\n\nhigh = from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n  |> group()\n  |> sum()\n  |> keep(columns: [\"_value\"])\n\nfallback = array.from(rows: [{_value: 0}])\n\nunion(tables: [fallback, high])\n  |> group()\n  |> sum()\n  |> set(key: \"_field\", value: \"Сработок\")\n  |> keep(columns: [\"_value\", \"_field\"])\n  |> yield(name: \"high_or_critical_count\")\n",
          "refId": "A"
        }
      ],
      "title": "Высокие и критичные за 7 дней",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 3
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 4,
        "x": 8,
        "y": 3
      },
      "id": 4,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"open\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
          "refId": "A"
        }
      ],
      "title": "Открытые кейсы",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 3
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 4,
        "x": 12,
        "y": 3
      },
      "id": 5,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"investigating\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
          "refId": "A"
        }
      ],
      "title": "В расследовании",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 5
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 4,
        "x": 16,
        "y": 3
      },
      "id": 6,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -24h)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_signal\" and r._field == \"count\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
          "refId": "A"
        }
      ],
      "title": "Сигналы за 24 часа",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 10
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 4,
        "x": 20,
        "y": 3
      },
      "id": 7,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -24h)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"send_failures\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
          "refId": "A"
        }
      ],
      "title": "Ошибки отправки за 24 часа",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "displayName": "${__field.labels.severity_ru}"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 0,
        "y": 7
      },
      "id": 8,
      "options": {
        "displayMode": "gradient",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "showUnfilled": true,
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> map(fn: (r) => ({ r with severity_ru: if r.severity == \"critical\" then \"Критичный\" else if r.severity == \"high\" then \"Высокий\" else if r.severity == \"medium\" then \"Средний\" else if r.severity == \"low\" then \"Низкий\" else if r.severity == \"info\" then \"Инфо\" else r.severity }))\n  |> group(columns:[\"severity_ru\"])\n  |> sum()\n  |> sort(columns:[\"_value\"], desc:true)",
          "refId": "A"
        }
      ],
      "title": "Сработки по серьёзности за 30 дней",
      "type": "bargauge"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "displayName": "${__field.labels.signal_type_ru}"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 6,
        "y": 7
      },
      "id": 9,
      "options": {
        "displayMode": "gradient",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "showUnfilled": true,
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_signal\" and r._field == \"count\")\n  |> map(fn: (r) => ({ r with signal_type_ru: if r.signal_type == \"self_test\" then \"Самопроверка\" else if r.signal_type == \"print_job\" then \"Печать\" else if r.signal_type == \"clipboard_copy\" then \"Буфер обмена\" else if r.signal_type == \"file_operation\" then \"Файловая операция\" else if r.signal_type == \"email_outbound\" then \"Исходящая почта\" else if r.signal_type == \"browser_domain\" then \"Сайт\" else if r.signal_type == \"unknown\" then \"Неизвестно\" else r.signal_type }))\n  |> group(columns:[\"signal_type_ru\"])\n  |> sum()\n  |> sort(columns:[\"_value\"], desc:true)",
          "refId": "A"
        }
      ],
      "title": "Сигналы по типу за 30 дней",
      "type": "bargauge"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "displayName": "${__field.labels.username}"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 12,
        "y": 7
      },
      "id": 10,
      "options": {
        "displayMode": "gradient",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "showUnfilled": true,
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and r.username != \"unknown\")\n  |> group(columns:[\"username\"])\n  |> sum()\n  |> sort(columns:[\"_value\"], desc:true)\n  |> limit(n:10)",
          "refId": "A"
        }
      ],
      "title": "Топ пользователей по инцидентам",
      "type": "bargauge"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "displayName": "${__field.labels.verdict_ru}"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 18,
        "y": 7
      },
      "id": 11,
      "options": {
        "displayMode": "gradient",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "showUnfilled": true,
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_review\" and r._field == \"count\")\n  |> map(fn: (r) => ({ r with verdict_ru: if r.verdict == \"false_positive\" then \"Ложное срабатывание\" else if r.verdict == \"incident\" then \"Инцидент\" else if r.verdict == \"allowed\" then \"Разрешено\" else if r.verdict == \"review_needed\" then \"Нужен разбор\" else if r.verdict == \"pending\" then \"Ожидает решения\" else r.verdict }))\n  |> group(columns:[\"verdict_ru\"])\n  |> sum()\n  |> sort(columns:[\"_value\"], desc:true)",
          "refId": "A"
        }
      ],
      "title": "Итоги разбора за 30 дней",
      "type": "bargauge"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "displayName": "${__field.labels.action_ru}"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 0,
        "y": 15
      },
      "id": 12,
      "options": {
        "displayMode": "gradient",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "showUnfilled": true,
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_rule\" and r._field == \"count\")\n  |> map(fn: (r) => ({ r with action_ru: if r.action == \"allow\" then \"Разрешить\" else if r.action == \"alert\" then \"Оповестить\" else if r.action == \"block\" then \"Блокировать\" else if r.action == \"review\" then \"На разбор\" else if r.action == \"notify\" then \"Уведомить\" else if r.action == \"log\" then \"Логировать\" else if r.action == \"deny\" then \"Запретить\" else r.action }))\n  |> group(columns:[\"action_ru\"])\n  |> sum()\n  |> sort(columns:[\"_value\"], desc:true)",
          "refId": "A"
        }
      ],
      "title": "Действия правил за 30 дней",
      "type": "bargauge"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "custom": {
            "drawStyle": "bars",
            "fillOpacity": 70,
            "lineWidth": 1,
            "showPoints": "never",
            "stacking": {
              "group": "A",
              "mode": "normal"
            }
          },
          "displayName": "${__field.labels.severity_ru}"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 6,
        "y": 15
      },
      "id": 13,
      "options": {
        "legend": {
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "multi"
        }
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> map(fn: (r) => ({ r with severity_ru: if r.severity == \"critical\" then \"Критичный\" else if r.severity == \"high\" then \"Высокий\" else if r.severity == \"medium\" then \"Средний\" else if r.severity == \"low\" then \"Низкий\" else if r.severity == \"info\" then \"Инфо\" else r.severity }))\n  |> group(columns:[\"severity_ru\"])\n  |> aggregateWindow(every: 1d, fn: sum, createEmpty: false)",
          "refId": "A"
        }
      ],
      "title": "Инциденты по дням",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "displayName": "${__field.labels.host}",
          "unit": "none"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 18,
        "y": 15
      },
      "id": 14,
      "options": {
        "legend": {
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "multi"
        }
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"send_failures\")\n  |> group(columns:[\"host\"])\n  |> aggregateWindow(every: 1h, fn: last, createEmpty: false)",
          "refId": "A"
        }
      ],
      "title": "Ошибки отправки endpoint-коллектора",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "displayName": "${__field.labels.host}",
          "unit": "none"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 0,
        "y": 23
      },
      "id": 15,
      "options": {
        "legend": {
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "multi"
        }
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"queue_depth\")\n  |> group(columns:[\"host\"])\n  |> aggregateWindow(every: 1h, fn: max, createEmpty: false)",
          "refId": "A"
        }
      ],
      "title": "Очередь endpoint-коллектора",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "displayName": "${__field.labels.host}",
          "unit": "none"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 6,
        "y": 23
      },
      "id": 16,
      "options": {
        "legend": {
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "multi"
        }
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_fileops_health\" and r._field == \"send_failures\")\n  |> group(columns:[\"host\"])\n  |> aggregateWindow(every: 1h, fn: last, createEmpty: false)",
          "refId": "A"
        }
      ],
      "title": "Ошибки отправки FileOps-коллектора",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "custom": {
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 23
      },
      "id": 17,
      "options": {
        "footer": {
          "show": false
        },
        "showHeader": true
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and (r._field == \"count\" or r._field == \"title\" or r._field == \"incident_id\" or r._field == \"has_forensics\"))\n  |> group(columns:[\"case_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"case_id\",\"host\",\"status\",\"severity\",\"assignee\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:20)\n  |> group()\n  |> drop(columns:[\"_start\",\"_stop\"])",
          "refId": "A"
        }
      ],
      "title": "Последние кейсы",
      "transformations": [
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "count": true
            },
            "indexByName": {
              "_time": 0,
              "host": 1,
              "case_id": 2,
              "status": 3,
              "severity": 4,
              "assignee": 5,
              "title": 6,
              "incident_id": 7,
              "has_forensics": 8
            },
            "renameByName": {
              "_time": "Обновлено",
              "host": "Хост",
              "case_id": "Кейс",
              "status": "Статус",
              "severity": "Уровень",
              "assignee": "Исполнитель",
              "title": "Заголовок",
              "incident_id": "ID инцидента",
              "has_forensics": "DFIR"
            }
          }
        }
      ],
      "type": "table"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "custom": {
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 10,
        "w": 24,
        "x": 0,
        "y": 31
      },
      "id": 18,
      "options": {
        "footer": {
          "show": false
        },
        "showHeader": true
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and (r._field == \"count\" or r._field == \"message\" or r._field == \"document_name\" or r._field == \"printer_name\" or r._field == \"incident_verdict\"))\n  |> group(columns:[\"event_id\",\"_field\"])\n  |> last()\n  |> pivot(rowKey:[\"_time\",\"host\",\"username\",\"signal_type\",\"severity\",\"action\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> sort(columns:[\"_time\"], desc:true)\n  |> limit(n:20)\n  |> group()\n  |> drop(columns:[\"_start\",\"_stop\"])",
          "refId": "A"
        }
      ],
      "title": "Последние инциденты",
      "transformations": [
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "count": true
            },
            "indexByName": {
              "_time": 0,
              "host": 1,
              "username": 2,
              "signal_type": 3,
              "severity": 4,
              "action": 5,
              "message": 6,
              "document_name": 7,
              "printer_name": 8,
              "incident_verdict": 9
            },
            "renameByName": {
              "_time": "Время",
              "host": "Хост",
              "username": "Пользователь",
              "signal_type": "Тип сигнала",
              "severity": "Уровень",
              "action": "Действие",
              "message": "Сообщение",
              "document_name": "Документ",
              "printer_name": "Принтер",
              "incident_verdict": "Вердикт"
            }
          }
        }
      ],
      "type": "table"
    }
  ],
  "refresh": "5m",
  "schemaVersion": 39,
  "style": "dark",
  "tags": [
    "detmir",
    "aw-rus",
    "dlp",
    "security"
  ],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-30d",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "browser",
  "title": "DetMir: DLP и ИБ обзор",
  "uid": "detmir-dlp-security",
  "version": 1,
  "weekStart": ""
}