{
  "uid": "awatch-dlp-overview",
  "title": "AW-rus: DLP обзор",
  "schemaVersion": 39,
  "version": 3,
  "refresh": "30s",
  "time": {
    "from": "now-30d",
    "to": "now"
  },
  "panels": [
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 5
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 0,
        "y": 0
      },
      "id": 1,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> group()\n  |> sum()\n  |> keep(columns:[\"_value\"])",
          "refId": "A"
        }
      ],
      "title": "Сработок за 7 дней",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 3
              }
            ]
          },
          "displayName": "Сработок"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 6,
        "y": 0
      },
      "id": 2,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "import \"array\"\n\nhigh = from(bucket: \"aw_metrics\")\n  |> range(start: -7d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n  |> group()\n  |> sum()\n  |> keep(columns: [\"_value\"])\n\nfallback = array.from(rows: [{_value: 0}])\n\nunion(tables: [fallback, high])\n  |> group()\n  |> sum()\n  |> set(key: \"_field\", value: \"Сработок\")\n  |> keep(columns: [\"_value\", \"_field\"])\n  |> yield(name: \"high_or_critical_count\")\n",
          "refId": "A"
        }
      ],
      "title": "Высокие и критичные за 7 дней",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 3
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 12,
        "y": 0
      },
      "id": 3,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"open\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
          "refId": "A"
        }
      ],
      "title": "Открытые кейсы",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green"
              },
              {
                "color": "orange",
                "value": 1
              },
              {
                "color": "red",
                "value": 3
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 18,
        "y": 0
      },
      "id": 4,
      "options": {
        "colorMode": "value",
        "graphMode": "none",
        "justifyMode": "center",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value",
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -180d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n  |> group(columns:[\"case_id\"])\n  |> last()\n  |> filter(fn: (r) => r.status == \"investigating\")\n  |> group()\n  |> count()\n  |> keep(columns:[\"_value\"])",
          "refId": "A"
        }
      ],
      "title": "В расследовании",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "custom": {
            "drawStyle": "bars",
            "fillOpacity": 80,
            "lineWidth": 1,
            "showPoints": "never"
          },
          "displayName": "${__field.labels.series}"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 4
      },
      "id": 5,
      "options": {
        "legend": {
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "multi"
        }
      },
      "targets": [
        {
          "query": "all = from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> aggregateWindow(every: 1d, fn: sum, createEmpty: false)\n  |> set(key: \"series\", value: \"Все сработки\")\n\nhigh = from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n  |> aggregateWindow(every: 1d, fn: sum, createEmpty: false)\n  |> set(key: \"series\", value: \"Высокие и критичные\")\n\nunion(tables: [all, high])\n  |> group(columns:[\"series\"])",
          "refId": "A"
        }
      ],
      "title": "Динамика риска по дням",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "influxdb_aw"
      },
      "fieldConfig": {
        "defaults": {
          "displayName": "${__field.labels.signal_type_ru}"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 4
      },
      "id": 6,
      "options": {
        "displayMode": "gradient",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "showUnfilled": true,
        "noValue": "0"
      },
      "targets": [
        {
          "query": "from(bucket: \"aw_metrics\")\n  |> range(start: -30d)\n  |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n  |> map(fn: (r) => ({ r with signal_type_ru: if r.signal_type == \"self_test\" then \"Самопроверка\" else if r.signal_type == \"print_job\" then \"Печать\" else if r.signal_type == \"clipboard_copy\" then \"Буфер обмена\" else if r.signal_type == \"file_operation\" then \"Файловая операция\" else if r.signal_type == \"email_outbound\" then \"Исходящая почта\" else if r.signal_type == \"browser_domain\" then \"Сайт\" else if r.signal_type == \"unknown\" then \"Неизвестно\" else r.signal_type }))\n  |> group(columns:[\"signal_type_ru\"])\n  |> sum()\n  |> sort(columns:[\"_value\"], desc:true)",
          "refId": "A"
        }
      ],
      "title": "По каким типам событий чаще всего срабатывает DLP",
      "type": "bargauge"
    }
  ]
}