{
  "annotations": {
    "list": []
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 1,
  "id": null,
  "links": [],
  "panels": [
    {
      "id": 1,
      "title": "Entity timeline",
      "type": "table",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 0,
        "y": 0,
        "w": 24,
        "h": 10
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "table",
          "rawSql": "SELECT ts, entity_type, entity_id, actor, source, event_type, severity, score, summary FROM analytics_1c.entity_timeline WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 200",
          "refId": "A"
        }
      ],
      "options": {
        "showHeader": true,
        "sortBy": [
          {
            "displayName": "ts",
            "desc": true
          }
        ]
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      }
    },
    {
      "id": 2,
      "title": "Related detections",
      "type": "table",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 0,
        "y": 10,
        "w": 12,
        "h": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "table",
          "rawSql": "SELECT ts, entity_type, entity_id, rule_title, severity, score, summary FROM analytics_1c.detections WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100",
          "refId": "A"
        }
      ],
      "options": {
        "showHeader": true,
        "sortBy": [
          {
            "displayName": "ts",
            "desc": true
          }
        ]
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      }
    },
    {
      "id": 3,
      "title": "Recent documents",
      "type": "table",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 12,
        "y": 10,
        "w": 12,
        "h": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "table",
          "rawSql": "SELECT ts, infobase, doc_type, doc_number, author, amount, status FROM analytics_1c.documents WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100",
          "refId": "A"
        }
      ],
      "options": {
        "showHeader": true,
        "sortBy": [
          {
            "displayName": "ts",
            "desc": true
          }
        ]
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      }
    },
    {
      "id": 4,
      "title": "Recent reglog",
      "type": "table",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 0,
        "y": 18,
        "w": 12,
        "h": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "table",
          "rawSql": "SELECT ts, user, event_name, level, message FROM analytics_1c.reglog_events WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100",
          "refId": "A"
        }
      ],
      "options": {
        "showHeader": true,
        "sortBy": [
          {
            "displayName": "ts",
            "desc": true
          }
        ]
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      }
    },
    {
      "id": 5,
      "title": "Recent audit",
      "type": "table",
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "clickhouse-1c"
      },
      "pluginVersion": "11.2.2",
      "gridPos": {
        "x": 12,
        "y": 18,
        "w": 12,
        "h": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "clickhouse-1c"
          },
          "editorType": "sql",
          "format": 1,
          "pluginVersion": "11.2.2",
          "queryType": "table",
          "rawSql": "SELECT ts, user, object_type, object_id, action, risk_tag FROM analytics_1c.audit_events WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100",
          "refId": "A"
        }
      ],
      "options": {
        "showHeader": true,
        "sortBy": [
          {
            "displayName": "ts",
            "desc": true
          }
        ]
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      }
    }
  ],
  "refresh": "30s",
  "schemaVersion": 39,
  "style": "dark",
  "tags": [
    "1c",
    "investigation",
    "clickhouse"
  ],
  "templating": {
    "list": [
      {
        "name": "infobase",
        "label": "Infobase",
        "type": "query",
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "clickhouse-1c"
        },
        "refresh": 1,
        "definition": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase",
        "query": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase",
        "multi": true,
        "includeAll": true,
        "sort": 1,
        "current": {
          "selected": false,
          "text": "All",
          "value": "$__all"
        }
      },
      {
        "name": "severity",
        "label": "Severity",
        "type": "query",
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "clickhouse-1c"
        },
        "refresh": 1,
        "definition": "SELECT arrayJoin(['low','medium','high','critical'])",
        "query": "SELECT arrayJoin(['low','medium','high','critical'])",
        "multi": true,
        "includeAll": true,
        "sort": 1,
        "current": {
          "selected": false,
          "text": "All",
          "value": "$__all"
        }
      },
      {
        "name": "host",
        "label": "Host",
        "type": "query",
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "clickhouse-1c"
        },
        "refresh": 1,
        "definition": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host",
        "query": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host",
        "multi": true,
        "includeAll": true,
        "sort": 1,
        "current": {
          "selected": false,
          "text": "All",
          "value": "$__all"
        }
      },
      {
        "name": "user",
        "label": "User",
        "type": "query",
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "clickhouse-1c"
        },
        "refresh": 1,
        "definition": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user",
        "query": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user",
        "multi": true,
        "includeAll": true,
        "sort": 1,
        "current": {
          "selected": false,
          "text": "All",
          "value": "$__all"
        }
      }
    ]
  },
  "time": {
    "from": "now-7d",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "browser",
  "title": "1C File - Investigation Timeline",
  "uid": "1c-file-investigation",
  "version": 3,
  "weekStart": ""
}