Files
AWatch-rus/grafana/detmir-dlp-security-dashboard.json
T

927 lines
27 KiB
JSON

{
"annotations": {
"list": [
{
"builtIn": 1,
"datasource": {
"type": "grafana",
"uid": "-- Grafana --"
},
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"target": {
"limit": 100,
"matchAny": false,
"tags": [],
"type": "dashboard"
},
"type": "dashboard"
}
]
},
"editable": true,
"fiscalYearStartMonth": 0,
"graphTooltip": 1,
"id": null,
"links": [],
"panels": [
{
"gridPos": {
"h": 3,
"w": 24,
"x": 0,
"y": 0
},
"id": 1,
"options": {
"content": "### Как читать этот экран\n- **Верхний блок** отвечает на вопрос: сколько было сработок и в каком состоянии разбор.\n- **Средний блок** показывает характер сработок: типы, серьёзность, пользователи и итоги разбора.\n- **Нижний блок** нужен для оперативной работы ИБ: динамика по дням, ошибки отправки коллекторов, последние кейсы и последние инциденты.\n- Если нужно быстро понять, есть ли проблема прямо сейчас, смотрите на **открытые кейсы**, **высокие/критичные**, **ошибки отправки** и **последние инциденты**.",
"mode": "markdown"
},
"title": "ИБ: как смотреть этот дашборд",
"transparent": true,
"type": "text",
"fieldConfig": {
"defaults": {}
}
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green"
},
{
"color": "orange",
"value": 1
},
{
"color": "red",
"value": 5
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 4,
"x": 0,
"y": 3
},
"id": 2,
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "center",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"textMode": "value",
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -7d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n |> group()\n |> sum()\n |> keep(columns:[\"_value\"])",
"refId": "A"
}
],
"title": "Сработок за 7 дней",
"type": "stat"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green"
},
{
"color": "orange",
"value": 1
},
{
"color": "red",
"value": 3
}
]
},
"displayName": "Сработок"
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 4,
"x": 4,
"y": 3
},
"id": 3,
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "center",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"textMode": "value",
"noValue": "0"
},
"targets": [
{
"query": "import \"array\"\n\nhigh = from(bucket: \"aw_metrics\")\n |> range(start: -7d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and (r.severity == \"high\" or r.severity == \"critical\"))\n |> group()\n |> sum()\n |> keep(columns: [\"_value\"])\n\nfallback = array.from(rows: [{_value: 0}])\n\nunion(tables: [fallback, high])\n |> group()\n |> sum()\n |> set(key: \"_field\", value: \"Сработок\")\n |> keep(columns: [\"_value\", \"_field\"])\n |> yield(name: \"high_or_critical_count\")\n",
"refId": "A"
}
],
"title": "Высокие и критичные за 7 дней",
"type": "stat"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green"
},
{
"color": "orange",
"value": 1
},
{
"color": "red",
"value": 3
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 4,
"x": 8,
"y": 3
},
"id": 4,
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "center",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"textMode": "value",
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -180d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n |> group(columns:[\"case_id\"])\n |> last()\n |> filter(fn: (r) => r.status == \"open\")\n |> group()\n |> count()\n |> keep(columns:[\"_value\"])",
"refId": "A"
}
],
"title": "Открытые кейсы",
"type": "stat"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green"
},
{
"color": "orange",
"value": 1
},
{
"color": "red",
"value": 3
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 4,
"x": 12,
"y": 3
},
"id": 5,
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "center",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"textMode": "value",
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -180d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and r._field == \"count\")\n |> group(columns:[\"case_id\"])\n |> last()\n |> filter(fn: (r) => r.status == \"investigating\")\n |> group()\n |> count()\n |> keep(columns:[\"_value\"])",
"refId": "A"
}
],
"title": "В расследовании",
"type": "stat"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green"
},
{
"color": "orange",
"value": 1
},
{
"color": "red",
"value": 5
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 4,
"x": 16,
"y": 3
},
"id": 6,
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "center",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"textMode": "value",
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -24h)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_signal\" and r._field == \"count\")\n |> group()\n |> sum()\n |> keep(columns:[\"_value\"])",
"refId": "A"
}
],
"title": "Сигналы за 24 часа",
"type": "stat"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green"
},
{
"color": "orange",
"value": 1
},
{
"color": "red",
"value": 10
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 4,
"x": 20,
"y": 3
},
"id": 7,
"options": {
"colorMode": "value",
"graphMode": "none",
"justifyMode": "center",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"textMode": "value",
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -24h)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"send_failures\")\n |> group()\n |> sum()\n |> keep(columns:[\"_value\"])",
"refId": "A"
}
],
"title": "Ошибки отправки за 24 часа",
"type": "stat"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"displayName": "${__field.labels.severity_ru}"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 6,
"x": 0,
"y": 7
},
"id": 8,
"options": {
"displayMode": "gradient",
"orientation": "horizontal",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showUnfilled": true,
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -30d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n |> map(fn: (r) => ({ r with severity_ru: if r.severity == \"critical\" then \"Критичный\" else if r.severity == \"high\" then \"Высокий\" else if r.severity == \"medium\" then \"Средний\" else if r.severity == \"low\" then \"Низкий\" else if r.severity == \"info\" then \"Инфо\" else r.severity }))\n |> group(columns:[\"severity_ru\"])\n |> sum()\n |> sort(columns:[\"_value\"], desc:true)",
"refId": "A"
}
],
"title": "Сработки по серьёзности за 30 дней",
"type": "bargauge"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"displayName": "${__field.labels.signal_type_ru}"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 6,
"x": 6,
"y": 7
},
"id": 9,
"options": {
"displayMode": "gradient",
"orientation": "horizontal",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showUnfilled": true,
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -30d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_signal\" and r._field == \"count\")\n |> map(fn: (r) => ({ r with signal_type_ru: if r.signal_type == \"self_test\" then \"Самопроверка\" else if r.signal_type == \"print_job\" then \"Печать\" else if r.signal_type == \"clipboard_copy\" then \"Буфер обмена\" else if r.signal_type == \"file_operation\" then \"Файловая операция\" else if r.signal_type == \"email_outbound\" then \"Исходящая почта\" else if r.signal_type == \"browser_domain\" then \"Сайт\" else if r.signal_type == \"unknown\" then \"Неизвестно\" else r.signal_type }))\n |> group(columns:[\"signal_type_ru\"])\n |> sum()\n |> sort(columns:[\"_value\"], desc:true)",
"refId": "A"
}
],
"title": "Сигналы по типу за 30 дней",
"type": "bargauge"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"displayName": "${__field.labels.username}"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 6,
"x": 12,
"y": 7
},
"id": 10,
"options": {
"displayMode": "gradient",
"orientation": "horizontal",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showUnfilled": true,
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -30d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\" and r.username != \"unknown\")\n |> group(columns:[\"username\"])\n |> sum()\n |> sort(columns:[\"_value\"], desc:true)\n |> limit(n:10)",
"refId": "A"
}
],
"title": "Топ пользователей по инцидентам",
"type": "bargauge"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"displayName": "${__field.labels.verdict_ru}"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 6,
"x": 18,
"y": 7
},
"id": 11,
"options": {
"displayMode": "gradient",
"orientation": "horizontal",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showUnfilled": true,
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -30d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_review\" and r._field == \"count\")\n |> map(fn: (r) => ({ r with verdict_ru: if r.verdict == \"false_positive\" then \"Ложное срабатывание\" else if r.verdict == \"incident\" then \"Инцидент\" else if r.verdict == \"allowed\" then \"Разрешено\" else if r.verdict == \"review_needed\" then \"Нужен разбор\" else if r.verdict == \"pending\" then \"Ожидает решения\" else r.verdict }))\n |> group(columns:[\"verdict_ru\"])\n |> sum()\n |> sort(columns:[\"_value\"], desc:true)",
"refId": "A"
}
],
"title": "Итоги разбора за 30 дней",
"type": "bargauge"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"displayName": "${__field.labels.action_ru}"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 6,
"x": 0,
"y": 15
},
"id": 12,
"options": {
"displayMode": "gradient",
"orientation": "horizontal",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"showUnfilled": true,
"noValue": "0"
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -30d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_rule\" and r._field == \"count\")\n |> map(fn: (r) => ({ r with action_ru: if r.action == \"allow\" then \"Разрешить\" else if r.action == \"alert\" then \"Оповестить\" else if r.action == \"block\" then \"Блокировать\" else if r.action == \"review\" then \"На разбор\" else if r.action == \"notify\" then \"Уведомить\" else if r.action == \"log\" then \"Логировать\" else if r.action == \"deny\" then \"Запретить\" else r.action }))\n |> group(columns:[\"action_ru\"])\n |> sum()\n |> sort(columns:[\"_value\"], desc:true)",
"refId": "A"
}
],
"title": "Действия правил за 30 дней",
"type": "bargauge"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "bars",
"fillOpacity": 70,
"lineWidth": 1,
"showPoints": "never",
"stacking": {
"group": "A",
"mode": "normal"
}
},
"displayName": "${__field.labels.severity_ru}"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 6,
"y": 15
},
"id": 13,
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom"
},
"tooltip": {
"mode": "multi"
}
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -30d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and r._field == \"count\")\n |> map(fn: (r) => ({ r with severity_ru: if r.severity == \"critical\" then \"Критичный\" else if r.severity == \"high\" then \"Высокий\" else if r.severity == \"medium\" then \"Средний\" else if r.severity == \"low\" then \"Низкий\" else if r.severity == \"info\" then \"Инфо\" else r.severity }))\n |> group(columns:[\"severity_ru\"])\n |> aggregateWindow(every: 1d, fn: sum, createEmpty: false)",
"refId": "A"
}
],
"title": "Инциденты по дням",
"type": "timeseries"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"displayName": "${__field.labels.host}",
"unit": "none"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 6,
"x": 18,
"y": 15
},
"id": 14,
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom"
},
"tooltip": {
"mode": "multi"
}
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -7d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"send_failures\")\n |> group(columns:[\"host\"])\n |> aggregateWindow(every: 1h, fn: last, createEmpty: false)",
"refId": "A"
}
],
"title": "Ошибки отправки endpoint-коллектора",
"type": "timeseries"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"displayName": "${__field.labels.host}",
"unit": "none"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 6,
"x": 0,
"y": 23
},
"id": 15,
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom"
},
"tooltip": {
"mode": "multi"
}
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -7d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_endpoint_self_test\" and r._field == \"queue_depth\")\n |> group(columns:[\"host\"])\n |> aggregateWindow(every: 1h, fn: max, createEmpty: false)",
"refId": "A"
}
],
"title": "Очередь endpoint-коллектора",
"type": "timeseries"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"displayName": "${__field.labels.host}",
"unit": "none"
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 6,
"x": 6,
"y": 23
},
"id": 16,
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom"
},
"tooltip": {
"mode": "multi"
}
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -7d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_fileops_health\" and r._field == \"send_failures\")\n |> group(columns:[\"host\"])\n |> aggregateWindow(every: 1h, fn: last, createEmpty: false)",
"refId": "A"
}
],
"title": "Ошибки отправки FileOps-коллектора",
"type": "timeseries"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"custom": {
"cellOptions": {
"type": "auto"
},
"inspect": false
}
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 12,
"y": 23
},
"id": 17,
"options": {
"footer": {
"show": false
},
"showHeader": true
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -180d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_case\" and (r._field == \"count\" or r._field == \"title\" or r._field == \"incident_id\" or r._field == \"has_forensics\"))\n |> group(columns:[\"case_id\",\"_field\"])\n |> last()\n |> pivot(rowKey:[\"_time\",\"case_id\",\"host\",\"status\",\"severity\",\"assignee\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n |> sort(columns:[\"_time\"], desc:true)\n |> limit(n:20)\n |> group()\n |> drop(columns:[\"_start\",\"_stop\"])",
"refId": "A"
}
],
"title": "Последние кейсы",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {
"count": true
},
"indexByName": {
"_time": 0,
"host": 1,
"case_id": 2,
"status": 3,
"severity": 4,
"assignee": 5,
"title": 6,
"incident_id": 7,
"has_forensics": 8
},
"renameByName": {
"_time": "Обновлено",
"host": "Хост",
"case_id": "Кейс",
"status": "Статус",
"severity": "Уровень",
"assignee": "Исполнитель",
"title": "Заголовок",
"incident_id": "ID инцидента",
"has_forensics": "DFIR"
}
}
}
],
"type": "table"
},
{
"datasource": {
"type": "influxdb",
"uid": "influxdb_aw"
},
"fieldConfig": {
"defaults": {
"custom": {
"cellOptions": {
"type": "auto"
},
"inspect": false
}
},
"overrides": []
},
"gridPos": {
"h": 10,
"w": 24,
"x": 0,
"y": 31
},
"id": 18,
"options": {
"footer": {
"show": false
},
"showHeader": true
},
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -30d)\n |> filter(fn: (r) => r._measurement == \"aw_dlp_incident\" and (r._field == \"count\" or r._field == \"message\" or r._field == \"document_name\" or r._field == \"printer_name\" or r._field == \"incident_verdict\"))\n |> group(columns:[\"event_id\",\"_field\"])\n |> last()\n |> pivot(rowKey:[\"_time\",\"host\",\"username\",\"signal_type\",\"severity\",\"action\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n |> sort(columns:[\"_time\"], desc:true)\n |> limit(n:20)\n |> group()\n |> drop(columns:[\"_start\",\"_stop\"])",
"refId": "A"
}
],
"title": "Последние инциденты",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {
"count": true
},
"indexByName": {
"_time": 0,
"host": 1,
"username": 2,
"signal_type": 3,
"severity": 4,
"action": 5,
"message": 6,
"document_name": 7,
"printer_name": 8,
"incident_verdict": 9
},
"renameByName": {
"_time": "Время",
"host": "Хост",
"username": "Пользователь",
"signal_type": "Тип сигнала",
"severity": "Уровень",
"action": "Действие",
"message": "Сообщение",
"document_name": "Документ",
"printer_name": "Принтер",
"incident_verdict": "Вердикт"
}
}
}
],
"type": "table"
}
],
"refresh": "5m",
"schemaVersion": 39,
"style": "dark",
"tags": [
"detmir",
"aw-rus",
"dlp",
"security"
],
"templating": {
"list": []
},
"time": {
"from": "now-30d",
"to": "now"
},
"timepicker": {},
"timezone": "browser",
"title": "DetMir: DLP и ИБ обзор",
"uid": "detmir-dlp-security",
"version": 1,
"weekStart": ""
}