{
  "annotations": {
    "list": []
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 1,
  "id": null,
  "links": [],
  "panels": [
    {
      "id": 1,
      "title": "Входы вне рабочего времени",
      "type": "table",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 0,
        "y": 0,
        "w": 12,
        "h": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "table",
          "rawSql": "SELECT ts, infobase, user, host, event_name, message FROM analytics_1c.reglog_events WHERE event_name ILIKE '%login%' AND toHour(ts) NOT BETWEEN 8 AND 20 AND $__timeFilter(ts) ORDER BY ts DESC LIMIT 50",
          "refId": "A"
        }
      ],
      "options": {
        "showHeader": true,
        "sortBy": [
          {
            "displayName": "ts",
            "desc": true
          }
        ]
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      }
    },
    {
      "id": 2,
      "title": "Критичные изменения объектов",
      "type": "table",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 12,
        "y": 0,
        "w": 12,
        "h": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "table",
          "rawSql": "SELECT ts, infobase, user, object_type, object_id, action, risk_tag FROM analytics_1c.audit_events WHERE risk_tag != '' AND $__timeFilter(ts) ORDER BY ts DESC LIMIT 50",
          "refId": "A"
        }
      ],
      "options": {
        "showHeader": true,
        "sortBy": [
          {
            "displayName": "ts",
            "desc": true
          }
        ]
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      }
    },
    {
      "id": 3,
      "title": "Топ пользователей по изменениям",
      "type": "table",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 0,
        "y": 8,
        "w": 12,
        "h": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "table",
          "rawSql": "SELECT user, count() AS changes_total FROM analytics_1c.audit_events WHERE $__timeFilter(ts) GROUP BY user ORDER BY changes_total DESC LIMIT 20",
          "refId": "A"
        }
      ],
      "options": {
        "showHeader": true,
        "sortBy": [
          {
            "displayName": "ts",
            "desc": true
          }
        ]
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      }
    },
    {
      "id": 4,
      "title": "Severity split",
      "type": "table",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 12,
        "y": 8,
        "w": 12,
        "h": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "table",
          "rawSql": "SELECT severity, count() AS detections_total FROM analytics_1c.detections WHERE $__timeFilter(ts) GROUP BY severity ORDER BY severity",
          "refId": "A"
        }
      ],
      "options": {
        "showHeader": true,
        "sortBy": [
          {
            "displayName": "ts",
            "desc": true
          }
        ]
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      }
    },
    {
      "id": 5,
      "title": "Audit actions over time",
      "type": "timeseries",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 0,
        "y": 16,
        "w": 24,
        "h": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "timeSeries",
          "rawSql": "SELECT toStartOfHour(ts) AS time, count() AS value FROM analytics_1c.audit_events WHERE $__timeFilter(ts) GROUP BY time ORDER BY time",
          "refId": "A"
        }
      ],
      "options": {
        "legend": {
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "multi"
        }
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          }
        },
        "overrides": []
      }
    }
  ],
  "refresh": "30s",
  "schemaVersion": 39,
  "style": "dark",
  "tags": [
    "1c",
    "audit",
    "clickhouse"
  ],
  "templating": {
    "list": [
      {
        "name": "infobase",
        "label": "Infobase",
        "type": "query",
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "clickhouse-1c"
        },
        "refresh": 1,
        "definition": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase",
        "query": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase",
        "multi": true,
        "includeAll": true,
        "sort": 1,
        "current": {
          "selected": false,
          "text": "All",
          "value": "$__all"
        }
      },
      {
        "name": "severity",
        "label": "Severity",
        "type": "query",
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "clickhouse-1c"
        },
        "refresh": 1,
        "definition": "SELECT arrayJoin(['low','medium','high','critical'])",
        "query": "SELECT arrayJoin(['low','medium','high','critical'])",
        "multi": true,
        "includeAll": true,
        "sort": 1,
        "current": {
          "selected": false,
          "text": "All",
          "value": "$__all"
        }
      },
      {
        "name": "host",
        "label": "Host",
        "type": "query",
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "clickhouse-1c"
        },
        "refresh": 1,
        "definition": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host",
        "query": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host",
        "multi": true,
        "includeAll": true,
        "sort": 1,
        "current": {
          "selected": false,
          "text": "All",
          "value": "$__all"
        }
      },
      {
        "name": "user",
        "label": "User",
        "type": "query",
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "clickhouse-1c"
        },
        "refresh": 1,
        "definition": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user",
        "query": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user",
        "multi": true,
        "includeAll": true,
        "sort": 1,
        "current": {
          "selected": false,
          "text": "All",
          "value": "$__all"
        }
      }
    ]
  },
  "time": {
    "from": "now-7d",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "browser",
  "title": "1C File - Audit Overview",
  "uid": "1c-file-audit",
  "version": 1,
  "weekStart": ""
}