330 lines
8.0 KiB
JSON
330 lines
8.0 KiB
JSON
{
|
|
"annotations": {
|
|
"list": []
|
|
},
|
|
"editable": true,
|
|
"fiscalYearStartMonth": 0,
|
|
"graphTooltip": 1,
|
|
"id": null,
|
|
"links": [],
|
|
"panels": [
|
|
{
|
|
"id": 1,
|
|
"title": "Entity timeline",
|
|
"type": "table",
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"pluginVersion": "11.2.2",
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 0,
|
|
"w": 24,
|
|
"h": 10
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 1,
|
|
"pluginVersion": "11.2.2",
|
|
"queryType": "table",
|
|
"rawSql": "SELECT ts, entity_type, entity_id, actor, source, event_type, severity, score, summary FROM analytics_1c.entity_timeline WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 200",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"displayName": "ts",
|
|
"desc": true
|
|
}
|
|
]
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {},
|
|
"overrides": []
|
|
}
|
|
},
|
|
{
|
|
"id": 2,
|
|
"title": "Related detections",
|
|
"type": "table",
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"pluginVersion": "11.2.2",
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 10,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 1,
|
|
"pluginVersion": "11.2.2",
|
|
"queryType": "table",
|
|
"rawSql": "SELECT ts, entity_type, entity_id, rule_title, severity, score, summary FROM analytics_1c.detections WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"displayName": "ts",
|
|
"desc": true
|
|
}
|
|
]
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {},
|
|
"overrides": []
|
|
}
|
|
},
|
|
{
|
|
"id": 3,
|
|
"title": "Recent documents",
|
|
"type": "table",
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"pluginVersion": "11.2.2",
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 10,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 1,
|
|
"pluginVersion": "11.2.2",
|
|
"queryType": "table",
|
|
"rawSql": "SELECT ts, infobase, doc_type, doc_number, author, amount, status FROM analytics_1c.documents WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"displayName": "ts",
|
|
"desc": true
|
|
}
|
|
]
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {},
|
|
"overrides": []
|
|
}
|
|
},
|
|
{
|
|
"id": 4,
|
|
"title": "Recent reglog",
|
|
"type": "table",
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"pluginVersion": "11.2.2",
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 18,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 1,
|
|
"pluginVersion": "11.2.2",
|
|
"queryType": "table",
|
|
"rawSql": "SELECT ts, user, event_name, level, message FROM analytics_1c.reglog_events WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"displayName": "ts",
|
|
"desc": true
|
|
}
|
|
]
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {},
|
|
"overrides": []
|
|
}
|
|
},
|
|
{
|
|
"id": 5,
|
|
"title": "Recent audit",
|
|
"type": "table",
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"pluginVersion": "11.2.2",
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 18,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 1,
|
|
"pluginVersion": "11.2.2",
|
|
"queryType": "table",
|
|
"rawSql": "SELECT ts, user, object_type, object_id, action, risk_tag FROM analytics_1c.audit_events WHERE $__timeFilter(ts) ORDER BY ts DESC LIMIT 100",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"displayName": "ts",
|
|
"desc": true
|
|
}
|
|
]
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {},
|
|
"overrides": []
|
|
}
|
|
}
|
|
],
|
|
"refresh": "30s",
|
|
"schemaVersion": 39,
|
|
"style": "dark",
|
|
"tags": [
|
|
"1c",
|
|
"investigation",
|
|
"clickhouse"
|
|
],
|
|
"templating": {
|
|
"list": [
|
|
{
|
|
"name": "infobase",
|
|
"label": "Infobase",
|
|
"type": "query",
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"refresh": 1,
|
|
"definition": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase",
|
|
"query": "SELECT DISTINCT infobase FROM analytics_1c.documents ORDER BY infobase",
|
|
"multi": true,
|
|
"includeAll": true,
|
|
"sort": 1,
|
|
"current": {
|
|
"selected": false,
|
|
"text": "All",
|
|
"value": "$__all"
|
|
}
|
|
},
|
|
{
|
|
"name": "severity",
|
|
"label": "Severity",
|
|
"type": "query",
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"refresh": 1,
|
|
"definition": "SELECT arrayJoin(['low','medium','high','critical'])",
|
|
"query": "SELECT arrayJoin(['low','medium','high','critical'])",
|
|
"multi": true,
|
|
"includeAll": true,
|
|
"sort": 1,
|
|
"current": {
|
|
"selected": false,
|
|
"text": "All",
|
|
"value": "$__all"
|
|
}
|
|
},
|
|
{
|
|
"name": "host",
|
|
"label": "Host",
|
|
"type": "query",
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"refresh": 1,
|
|
"definition": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host",
|
|
"query": "SELECT DISTINCT host FROM analytics_1c.host_events ORDER BY host",
|
|
"multi": true,
|
|
"includeAll": true,
|
|
"sort": 1,
|
|
"current": {
|
|
"selected": false,
|
|
"text": "All",
|
|
"value": "$__all"
|
|
}
|
|
},
|
|
{
|
|
"name": "user",
|
|
"label": "User",
|
|
"type": "query",
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "clickhouse-1c"
|
|
},
|
|
"refresh": 1,
|
|
"definition": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user",
|
|
"query": "SELECT DISTINCT user FROM analytics_1c.reglog_events ORDER BY user",
|
|
"multi": true,
|
|
"includeAll": true,
|
|
"sort": 1,
|
|
"current": {
|
|
"selected": false,
|
|
"text": "All",
|
|
"value": "$__all"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"time": {
|
|
"from": "now-7d",
|
|
"to": "now"
|
|
},
|
|
"timepicker": {},
|
|
"timezone": "browser",
|
|
"title": "1C File - Investigation Timeline",
|
|
"uid": "1c-file-investigation",
|
|
"version": 3,
|
|
"weekStart": ""
|
|
}
|